* [PATCH 6.19 001/844] rust_binder: Fix build failure if !CONFIG_COMPAT
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 002/844] mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms Sasha Levin
` (851 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xi Ruoyao, Miguel Ojeda, Alice Ryhl, Greg Kroah-Hartman
From: Xi Ruoyao <xry111@xry111.site>
commit 174e2a339bf731e080ced67c215ad609a677560b upstream.
The bindgen utility cannot handle "#define compat_ptr_ioctl NULL" in the
C header, so we need to handle this case on our own.
Simply skip this field in the initializer when !CONFIG_COMPAT as the
SAFETY comment above this initializer implies this is allowed.
Reported-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Closes: https://lore.kernel.org/all/CANiq72mrVzqXnAV=Hy2XBOonLHA6YQgH-ckZoc_h0VBvTGK8rA@mail.gmail.com/
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251209125029.1117897-1-xry111@xry111.site
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder/rust_binder_main.rs | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index c79a9e7422401..9a527268f5b45 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -314,6 +314,7 @@ unsafe impl<T> Sync for AssertSync<T> {}
owner: THIS_MODULE.as_ptr(),
poll: Some(rust_binder_poll),
unlocked_ioctl: Some(rust_binder_ioctl),
+ #[cfg(CONFIG_COMPAT)]
compat_ioctl: Some(bindings::compat_ptr_ioctl),
mmap: Some(rust_binder_mmap),
open: Some(rust_binder_open),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 002/844] mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 001/844] rust_binder: Fix build failure if !CONFIG_COMPAT Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 003/844] Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" Sasha Levin
` (850 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Matthew Schwartz, Greg Kroah-Hartman, Sasha Levin
From: Matthew Schwartz <matthew.schwartz@linux.dev>
[ Upstream commit aced969e9bf3701dc75cfca57c78c031b7875b9d ]
The existing 1ms delay in sd_power_on is insufficient and causes resume
errors around 4% of the time.
Increasing the delay to 5ms resolves this issue after testing 300
s2idle cycles.
Fixes: 1f311c94aabd ("mmc: rtsx: add 74 Clocks in power on flow")
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Link: https://patch.msgid.link/20260105060236.400366-3-matthew.schwartz@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/rtsx_pci_sdmmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index 4db3328f46dfb..b6cf1803c7d27 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -937,7 +937,7 @@ static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode)
if (err < 0)
return err;
- mdelay(1);
+ mdelay(5);
err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN);
if (err < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 003/844] Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 001/844] rust_binder: Fix build failure if !CONFIG_COMPAT Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 002/844] mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 004/844] perf test: Fix test case perf evlist tests for s390x Sasha Levin
` (849 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Matthew Schwartz, Ulf Hansson, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit ff112f1ecd10b72004eac05bae395e1c65f0c63c ]
This reverts commit aced969e9bf3701dc75cfca57c78c031b7875b9d.
It was determined that this was not the correct "fix", so should be
reverted.
Fixes: aced969e9bf3 ("mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms")
Cc: Matthew Schwartz <matthew.schwartz@linux.dev>
Cc: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/rtsx_pci_sdmmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index b6cf1803c7d27..4db3328f46dfb 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -937,7 +937,7 @@ static int sd_power_on(struct realtek_pci_sdmmc *host, unsigned char power_mode)
if (err < 0)
return err;
- mdelay(5);
+ mdelay(1);
err = rtsx_pci_write_register(pcr, CARD_OE, SD_OUTPUT_EN, SD_OUTPUT_EN);
if (err < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 004/844] perf test: Fix test case perf evlist tests for s390x
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (2 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 003/844] Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 005/844] perf test stat tests: Fix for virtualized machines Sasha Levin
` (848 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Richter, Ian Rogers, Alexander Gordeev, Heiko Carstens,
Jan Polensky, Namhyung Kim, Sumanth Korikkar, Vasily Gorbik,
Arnaldo Carvalho de Melo, Sasha Levin
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit b04d2b9199129f4f0c992a518c0fb78c2efc1064 ]
Perf test case 78: perf evlist tests fails on s390.
The failure is causes by grouping events cycles and instructions because
sampling does only support event cycles. Change the group to software
events to fix this.
Output before:
# ./perf test 78
78: perf evlist tests : FAILED!
#
Output after:
# ./perf test 78
78: perf evlist tests : Ok
#
Fixes: db452961de939225 ("perf tests evlist: Add basic evlist test")
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Tested-by: Ian Rogers <irogers@google.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Jan Polensky <japo@linux.ibm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/evlist.sh | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/shell/evlist.sh b/tools/perf/tests/shell/evlist.sh
index 140f099e75c1e..5632be3917109 100755
--- a/tools/perf/tests/shell/evlist.sh
+++ b/tools/perf/tests/shell/evlist.sh
@@ -38,13 +38,14 @@ test_evlist_simple() {
test_evlist_group() {
echo "Group evlist test"
- if ! perf record -e "{cycles,instructions}" -o "${perfdata}" true 2> /dev/null
+ if ! perf record -e "{cpu-clock,task-clock}" -o "${perfdata}" \
+ -- perf test -w noploop 2> /dev/null
then
echo "Group evlist [Skipped event group recording failed]"
return
fi
- if ! perf evlist -i "${perfdata}" -g | grep -q "{.*cycles.*,.*instructions.*}"
+ if ! perf evlist -i "${perfdata}" -g | grep -q "{.*cpu-clock.*,.*task-clock.*}"
then
echo "Group evlist [Failed to list event group]"
err=1
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 005/844] perf test stat tests: Fix for virtualized machines
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (3 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 004/844] perf test: Fix test case perf evlist tests for s390x Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 006/844] perf build: Raise minimum shellcheck version to 0.7.2 Sasha Levin
` (847 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Richter, Ian Rogers, James Clark, Alexander Gordeev,
Heiko Carstens, Jan Polensky, linux-s390, Namhyung Kim,
Sumanth Korikkar, Vasily Gorbik, Arnaldo Carvalho de Melo,
Sasha Levin
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit e272628902c1c96731e2d9f62a7fc77767686eb0 ]
On s390 'perf test's 'perf stat tests', subtest test_hybrid fails for
z/VM systems. The root cause is this statement:
$(perf stat -a -- sleep 0.1 2>&1 |\
grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* -c)
The 'perf stat' output on a s390 z/VM system is
# perf stat -a -- sleep 0.1 2>&1
Performance counter stats for 'system wide':
56 context-switches # 46.3 cs/sec cs_per_second
1,210.41 msec cpu-clock # 11.9 CPUs CPUs_utilized
12 cpu-migrations # 9.9 migrations/sec ...
81 page-faults # 66.9 faults/sec ...
0.100891009 seconds time elapsed
The grep command does not match any single line and exits with error
code 1.
As the bash script is executed with 'set -e', it aborts with the first
error code being non-zero.
Fix this and use 'wc -l' to count matching lines instead of 'grep ... -c'.
Output before:
# perf test 102
102: perf stat tests : FAILED!
#
Output after:
# perf test 102
102: perf stat tests : Ok
#
Fixes: bb6e7cb11d97ce19 ("perf tools: Add fallback for exclude_guest")
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Jan Polensky <japo@linux.ibm.com>
Cc: linux-s390@vger.kernel.org
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/stat.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
index 0b2f0f88ca166..792a0b79f6b86 100755
--- a/tools/perf/tests/shell/stat.sh
+++ b/tools/perf/tests/shell/stat.sh
@@ -233,7 +233,7 @@ test_hybrid() {
fi
# Run default Perf stat
- cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " -c)
+ cycles_events=$(perf stat -a -- sleep 0.1 2>&1 | grep -E "/cpu-cycles/[uH]*| cpu-cycles[:uH]* " | wc -l)
# The expectation is that default output will have a cycles events on each
# hybrid PMU. In situations with no cycles PMU events, like virtualized, this
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 006/844] perf build: Raise minimum shellcheck version to 0.7.2
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (4 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 005/844] perf test stat tests: Fix for virtualized machines Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 007/844] perf unwind-libdw: Fix invalid reference counts Sasha Levin
` (846 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicolas Schier, Namhyung Kim, Adrian Hunter, Alexander Shishkin,
Ian Rogers, Ingo Molnar, Jakub Brnak, James Clark, Jiri Olsa,
Mark Rutland, Michael Petlan, Nicolas Schier, Peter Zijlstra,
Philipp Hahn, Veronika Molnarova, Arnaldo Carvalho de Melo,
Sasha Levin
From: Nicolas Schier <n.schier@avm.de>
[ Upstream commit 383f8e26e2c483e25453f8c3d0839877708ac701 ]
Raise the minimum shellcheck version for perf builds to 0.7.2, so that
systems with shellcheck versions below 0.7.2 will automatically skip the
shell script checking, even if NO_SHELLCHECK is unset.
Since commit 241f21be7d0fdf3c ("perf test perftool_testsuite: Use
absolute paths"), shellcheck versions before 0.7.2 break the perf build
with several SC1090 [2] warnings due to its too strict dynamic source
handling [1], e.g.:
In tests/shell/base_probe/test_line_semantics.sh line 20:
. "$DIR_PATH/../common/init.sh"
^---------------------------^ SC1090: Can't follow non-constant source. Use a directive to specify location.
Fixes: 241f21be7d0fdf3c ("perf test perftool_testsuite: Use absolute paths")
Signed-off-by: Nicolas Schier <n.schier@avm.de>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jakub Brnak <jbrnak@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Nicolas Schier <nsc@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Philipp Hahn <p.hahn@avm.de>
Cc: Veronika Molnarova <vmolnaro@redhat.com>
Link: https://github.com/koalaman/shellcheck/issues/1998 # [1]
Link: https://www.shellcheck.net/wiki/SC1090
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/Makefile.perf | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index b3f481a626afa..e6895626c1872 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -251,11 +251,12 @@ else
endif
# shellcheck is using in tools/perf/tests/Build with option -a/--check-sourced (
-# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0). So make the
-# minimal shellcheck version as v0.6.0.
+# introduced in v0.4.7) and -S/--severity (introduced in v0.6.0) as well as
+# dynamic source inclusions (properly handled since v0.7.2).
+# So make the minimal shellcheck version as v0.7.2.
ifneq ($(SHELLCHECK),)
ifeq ($(shell expr $(shell $(SHELLCHECK) --version | grep version: | \
- sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 060), 1)
+ sed -e 's/.\+ \([0-9]\+\).\([0-9]\+\).\([0-9]\+\)/\1\2\3/g') \< 072), 1)
SHELLCHECK :=
else
SHELLCHECK := $(SHELLCHECK) -s bash -a -S warning
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 007/844] perf unwind-libdw: Fix invalid reference counts
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (5 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 006/844] perf build: Raise minimum shellcheck version to 0.7.2 Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 008/844] perf callchain: Fix srcline printing with inlines Sasha Levin
` (845 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, James Clark, Adrian Hunter, Alexander Shishkin,
Howard Chu, Ingo Molnar, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Stephen Brennan, Tony Jones, Arnaldo Carvalho de Melo,
Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit f815fc0c66e777c727689666cfb46b8d461c2f99 ]
The addition of addr_location__exit() causes use-after put on the maps
and map references in the unwind info. Add the gets and then add the
map_symbol__exit() calls.
Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Howard Chu <howardchu95@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
Cc: Tony Jones <tonyj@suse.de>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/unwind-libdw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index ae70fb56a0572..3ff427a49e4c5 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -136,8 +136,8 @@ static int entry(u64 ip, struct unwind_info *ui)
}
e->ip = ip;
- e->ms.maps = al.maps;
- e->ms.map = al.map;
+ e->ms.maps = maps__get(al.maps);
+ e->ms.map = map__get(al.map);
e->ms.sym = al.sym;
pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n",
@@ -325,6 +325,9 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
if (err)
pr_debug("unwind: failed with '%s'\n", dwfl_errmsg(-1));
+ for (i = 0; i < ui->idx; i++)
+ map_symbol__exit(&ui->entries[i].ms);
+
dwfl_end(ui->dwfl);
free(ui);
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 008/844] perf callchain: Fix srcline printing with inlines
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (6 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 007/844] perf unwind-libdw: Fix invalid reference counts Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 009/844] libsubcmd: Fix null intersection case in exclude_cmds() Sasha Levin
` (844 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, James Clark, Adrian Hunter, Alexander Shishkin,
Howard Chu, Ingo Molnar, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Stephen Brennan, Tony Jones, Arnaldo Carvalho de Melo,
Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit abec464767b5d26f0612250d511c18f420826ca1 ]
sample__fprintf_callchain() was using map__fprintf_srcline() which won't
report inline line numbers.
Fix by using the srcline from the callchain and falling back to the map
variant.
Fixes: 25da4fab5f66e659 ("perf evsel: Move fprintf methods to separate source file")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Howard Chu <howardchu95@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
Cc: Tony Jones <tonyj@suse.de>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/evsel_fprintf.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
index 10f1a03c28601..5521d00bff2c0 100644
--- a/tools/perf/util/evsel_fprintf.c
+++ b/tools/perf/util/evsel_fprintf.c
@@ -185,8 +185,12 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
if (print_dso && (!sym || !sym->inlined))
printed += map__fprintf_dsoname_dsoff(map, print_dsoff, addr, fp);
- if (print_srcline)
- printed += map__fprintf_srcline(map, addr, "\n ", fp);
+ if (print_srcline) {
+ if (node->srcline)
+ printed += fprintf(fp, "\n %s", node->srcline);
+ else
+ printed += map__fprintf_srcline(map, addr, "\n ", fp);
+ }
if (sym && sym->inlined)
printed += fprintf(fp, " (inlined)");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 009/844] libsubcmd: Fix null intersection case in exclude_cmds()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (7 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 008/844] perf callchain: Fix srcline printing with inlines Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 010/844] rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver Sasha Levin
` (843 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sri Jayaramappa, Guilherme Amadio, Ian Rogers, Joshua Hunt,
Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo,
Sasha Levin
From: Sri Jayaramappa <sjayaram@akamai.com>
[ Upstream commit b6ee9b6e206b288921c14c906eebf4b32fe0c0d8 ]
When there is no exclusion occurring from the cmds list - for example -
cmds contains ["read-vdso32"] and excludes contains ["archive"] - the
main loop completes with ci == cj == 0. In the original code the loop
processing the remaining elements in the list was conditional:
if (ci != cj) { ...}
So we end up in the assertion loop since ci < cmds->cnt and we
incorrectly try to assert the list elements to be NULL and fail with
the following error
help.c:104: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
Fix this by moving the if (ci != cj) check inside of a broader loop.
If ci != cj, left shift the list elements, as before, and then
unconditionally advance the ci and cj indicies which also covers the
ci == cj case.
Fixes: 1fdf938168c4d26f ("perf tools: Fix use-after-free in help_unknown_cmd()")
Reviewed-by: Guilherme Amadio <amadio@gentoo.org>
Signed-off-by: Sri Jayaramappa <sjayaram@akamai.com>
Tested-by: Guilherme Amadio <amadio@gentoo.org>
Tested-by: Ian Rogers <irogers@google.com>
Cc: Joshua Hunt <johunt@akamai.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20251202213632.2873731-1-sjayaram@akamai.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/subcmd/help.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
index ddaeb4eb3e249..db94aa685b73b 100644
--- a/tools/lib/subcmd/help.c
+++ b/tools/lib/subcmd/help.c
@@ -97,11 +97,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
ei++;
}
}
- if (ci != cj) {
- while (ci < cmds->cnt) {
- cmds->names[cj++] = cmds->names[ci];
- cmds->names[ci++] = NULL;
+ while (ci < cmds->cnt) {
+ if (ci != cj) {
+ cmds->names[cj] = cmds->names[ci];
+ cmds->names[ci] = NULL;
}
+ ci++;
+ cj++;
}
for (ci = cj; ci < cmds->cnt; ci++)
assert(cmds->names[ci] == NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 010/844] rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (8 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 009/844] libsubcmd: Fix null intersection case in exclude_cmds() Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 011/844] rtc: max31335: use correct CONFIG symbol in IS_REACHABLE() Sasha Levin
` (842 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Robinson, Shubhi Garg, Jon Hunter, Alexandre Belloni,
Sasha Levin
From: Peter Robinson <pbrobinson@gmail.com>
[ Upstream commit f9ecfd9bfedba9fd9d4b015b33b847571f7fdd42 ]
The NV VRS RTC driver currently is only supported on the
Tegra platform so add a dep for ARCH_TEGRA and compile test
so it doesn't show up universally across all arches/platforms.
Fixes: 9d6d6b06933c8 ("rtc: nvvrs: add NVIDIA VRS RTC device driver")
Cc: Shubhi Garg <shgarg@nvidia.com>
Cc: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20251222035651.433603-1-pbrobinson@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 50dc779f7f983..50ba48609d74e 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -418,6 +418,7 @@ config RTC_DRV_SPACEMIT_P1
config RTC_DRV_NVIDIA_VRS10
tristate "NVIDIA VRS10 RTC device"
+ depends on ARCH_TEGRA || COMPILE_TEST
help
If you say yes here you will get support for the battery backed RTC device
of NVIDIA VRS (Voltage Regulator Specification). The RTC is connected via
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 011/844] rtc: max31335: use correct CONFIG symbol in IS_REACHABLE()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (9 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 010/844] rtc: nvvrs: Add ARCH_TEGRA to the NV VRS RTC driver Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 012/844] perf symbol-elf: Fix leak of ELF files with GNU debugdata Sasha Levin
` (841 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Randy Dunlap, Nuno Sá, Alexandre Belloni, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit d5aca9a17f6de884febc56018f92d743b8ea1298 ]
IS_REACHABLE() is meant to be used with full symbol names from a kernel
.config file, not the shortened symbols used in Kconfig files, so
change HWMON to CONFIG_HWMON in 3 places.
Fixes: dedaf03b99d6 ("rtc: max31335: add driver support")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Link: https://patch.msgid.link/20260108045432.2705691-1-rdunlap@infradead.org
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-max31335.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/rtc/rtc-max31335.c b/drivers/rtc/rtc-max31335.c
index 23b7bf16b4cd5..952b455071d68 100644
--- a/drivers/rtc/rtc-max31335.c
+++ b/drivers/rtc/rtc-max31335.c
@@ -591,7 +591,7 @@ static struct nvmem_config max31335_nvmem_cfg = {
.size = MAX31335_RAM_SIZE,
};
-#if IS_REACHABLE(HWMON)
+#if IS_REACHABLE(CONFIG_HWMON)
static int max31335_read_temp(struct device *dev, enum hwmon_sensor_types type,
u32 attr, int channel, long *val)
{
@@ -672,7 +672,7 @@ static int max31335_clkout_register(struct device *dev)
static int max31335_probe(struct i2c_client *client)
{
struct max31335_data *max31335;
-#if IS_REACHABLE(HWMON)
+#if IS_REACHABLE(CONFIG_HWMON)
struct device *hwmon;
#endif
const struct chip_desc *match;
@@ -727,7 +727,7 @@ static int max31335_probe(struct i2c_client *client)
return dev_err_probe(&client->dev, ret,
"cannot register rtc nvmem\n");
-#if IS_REACHABLE(HWMON)
+#if IS_REACHABLE(CONFIG_HWMON)
if (max31335->chip->temp_reg) {
hwmon = devm_hwmon_device_register_with_info(&client->dev, client->name, max31335,
&max31335_chip_info, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 012/844] perf symbol-elf: Fix leak of ELF files with GNU debugdata
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (10 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 011/844] rtc: max31335: use correct CONFIG symbol in IS_REACHABLE() Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 013/844] perf tools: Get debug info of DSO properly Sasha Levin
` (840 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Aditya Bodkhe, Adrian Hunter, Albert Ou,
Alexandre Ghiti, Andi Kleen, Athira Rajeev, Chun-Tse Shao,
Dmitriy Vyukov, Dr. David Alan Gilbert, Guo Ren, Haibo Xu,
Howard Chu, Ingo Molnar, James Clark, Jiri Olsa, John Garry,
Krzysztof Łopatowski, Leo Yan, Mark Wielaard, Namhyung Kim,
Palmer Dabbelt, Paul Walmsley, Peter Zijlstra, Sergei Trofimovich,
Shimin Guo, Stephen Brennan, Thomas Falcon, Will Deacon,
Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 92d65d9c31621befe0a5f7c0bd43bd217613c6b6 ]
The processing of DSO_BINARY_TYPE__GNU_DEBUGDATA in symsrc__init happens
with an open ELF file but the error path only closes the associate fd.
Fix the goto so that the ELF file is also ended and memory released.
Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: Chun-Tse Shao <ctshao@google.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: Guo Ren <guoren@kernel.org>
Cc: Haibo Xu <haibo1.xu@intel.com>
Cc: Howard Chu <howardchu95@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Mark Wielaard <mark@klomp.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sergei Trofimovich <slyich@gmail.com>
Cc: Shimin Guo <shimin.guo@skydio.com>
Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index d1dcafa4b3b80..439f252937b89 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1173,7 +1173,7 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
Elf *embedded = read_gnu_debugdata(dso, elf, name, &new_fd);
if (!embedded)
- goto out_close;
+ goto out_elf_end;
elf_end(elf);
close(fd);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 013/844] perf tools: Get debug info of DSO properly
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (11 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 012/844] perf symbol-elf: Fix leak of ELF files with GNU debugdata Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 014/844] perf tests kallsyms: Fix missed map__put() Sasha Levin
` (839 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Namhyung Kim, Ian Rogers, Adrian Hunter, Ingo Molnar, James Clark,
Jiri Olsa, Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 069e603d8248dac98b1ef2909e2f1c4169b9da11 ]
The dso__debuginfo() just used the path name to open the file but it may
be outdated. It should check build-ID and use the file in the build-ID
cache if available rather than just using the path name.
Let's factor out dso__get_filename() to avoid code duplicate.
Fixes: 53a61a6ca279165d ("perf annotate: Add dso__debuginfo() helper")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/dso.c | 63 ++++++++++++++++++++++++++++++++-----------
tools/perf/util/dso.h | 11 ++------
2 files changed, 50 insertions(+), 24 deletions(-)
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index 344e689567ee1..dc202d4943721 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -111,7 +111,7 @@ bool dso__is_object_file(const struct dso *dso)
int dso__read_binary_type_filename(const struct dso *dso,
enum dso_binary_type type,
- char *root_dir, char *filename, size_t size)
+ const char *root_dir, char *filename, size_t size)
{
char build_id_hex[SBUILD_ID_SIZE];
int ret = 0;
@@ -563,20 +563,15 @@ char *dso__filename_with_chroot(const struct dso *dso, const char *filename)
return filename_with_chroot(nsinfo__pid(dso__nsinfo_const(dso)), filename);
}
-static int __open_dso(struct dso *dso, struct machine *machine)
- EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock)
+static char *dso__get_filename(struct dso *dso, const char *root_dir,
+ bool *decomp)
{
- int fd = -EINVAL;
- char *root_dir = (char *)"";
char *name = malloc(PATH_MAX);
- bool decomp = false;
- if (!name)
- return -ENOMEM;
+ *decomp = false;
- mutex_lock(dso__lock(dso));
- if (machine)
- root_dir = machine->root_dir;
+ if (name == NULL)
+ return NULL;
if (dso__read_binary_type_filename(dso, dso__binary_type(dso),
root_dir, name, PATH_MAX))
@@ -601,20 +596,38 @@ static int __open_dso(struct dso *dso, struct machine *machine)
size_t len = sizeof(newpath);
if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
- fd = -(*dso__load_errno(dso));
+ errno = *dso__load_errno(dso);
goto out;
}
- decomp = true;
+ *decomp = true;
strcpy(name, newpath);
}
+ return name;
+
+out:
+ free(name);
+ return NULL;
+}
- fd = do_open(name);
+static int __open_dso(struct dso *dso, struct machine *machine)
+ EXCLUSIVE_LOCKS_REQUIRED(_dso__data_open_lock)
+{
+ int fd = -EINVAL;
+ char *name;
+ bool decomp = false;
+
+ mutex_lock(dso__lock(dso));
+
+ name = dso__get_filename(dso, machine ? machine->root_dir : "", &decomp);
+ if (name)
+ fd = do_open(name);
+ else
+ fd = -errno;
if (decomp)
unlink(name);
-out:
mutex_unlock(dso__lock(dso));
free(name);
return fd;
@@ -1910,3 +1923,23 @@ const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename,
return __dso__read_symbol(dso, symfs_filename, start, len,
out_buf, out_buf_len, is_64bit);
}
+
+struct debuginfo *dso__debuginfo(struct dso *dso)
+{
+ char *name;
+ bool decomp = false;
+ struct debuginfo *dinfo = NULL;
+
+ mutex_lock(dso__lock(dso));
+
+ name = dso__get_filename(dso, "", &decomp);
+ if (name)
+ dinfo = debuginfo__new(name);
+
+ if (decomp)
+ unlink(name);
+
+ mutex_unlock(dso__lock(dso));
+ free(name);
+ return dinfo;
+}
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index f8ccb9816b89c..54e470dd07305 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -766,7 +766,7 @@ int dso__kernel_module_get_build_id(struct dso *dso, const char *root_dir);
char dso__symtab_origin(const struct dso *dso);
int dso__read_binary_type_filename(const struct dso *dso, enum dso_binary_type type,
- char *root_dir, char *filename, size_t size);
+ const char *root_dir, char *filename, size_t size);
bool is_kernel_module(const char *pathname, int cpumode);
bool dso__needs_decompress(struct dso *dso);
int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
@@ -915,14 +915,7 @@ u64 dso__findnew_global_type(struct dso *dso, u64 addr, u64 offset);
bool perf_pid_map_tid(const char *dso_name, int *tid);
bool is_perf_pid_map_name(const char *dso_name);
-/*
- * In the future, we may get debuginfo using build-ID (w/o path).
- * Add this helper is for the smooth conversion.
- */
-static inline struct debuginfo *dso__debuginfo(struct dso *dso)
-{
- return debuginfo__new(dso__long_name(dso));
-}
+struct debuginfo *dso__debuginfo(struct dso *dso);
const u8 *dso__read_symbol(struct dso *dso, const char *symfs_filename,
const struct map *map, const struct symbol *sym,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 014/844] perf tests kallsyms: Fix missed map__put()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (12 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 013/844] perf tools: Get debug info of DSO properly Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 015/844] perf cs-etm: Fix decoding for sparse CPU maps Sasha Levin
` (838 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, kernel test robot, James Clark, Ingo Molnar,
Jiri Olsa, Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo,
Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit a58807adbed5f532efb231e5490767f284f237c0 ]
Issue was caught by leak sanitizer and the test robot.
Fixes: 34e271ae55382fbd ("perf test: Add kallsyms split test")
Reported-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Closes: https://lore.kernel.org/oe-lkp/202512101502.f3819cd3-lkp@intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/kallsyms-split.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/tests/kallsyms-split.c b/tools/perf/tests/kallsyms-split.c
index bbbc66957e5d0..117ed3b70f630 100644
--- a/tools/perf/tests/kallsyms-split.c
+++ b/tools/perf/tests/kallsyms-split.c
@@ -148,6 +148,7 @@ static int test__kallsyms_split(struct test_suite *test __maybe_unused,
ret = TEST_OK;
out:
+ map__put(map);
remove_proc_dir(0);
machine__exit(&m);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 015/844] perf cs-etm: Fix decoding for sparse CPU maps
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (13 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 014/844] perf tests kallsyms: Fix missed map__put() Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 016/844] perf annotate: Fix args leak of map_symbol Sasha Levin
` (837 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: James Clark, Leo Yan, Adrian Hunter, Alexander Shishkin,
coresight, Ian Rogers, Ingo Molnar, Jiri Olsa, John Garry,
Mark Rutland, Mike Leach, Namhyung Kim, Peter Zijlstra,
Suzuki Poulouse, Thomas Falcon, Will Deacon,
Arnaldo Carvalho de Melo, Sasha Levin
From: James Clark <james.clark@linaro.org>
[ Upstream commit a70493e2bb0878885aa7a8178162550270693eb1 ]
The ETM decoder incorrectly assumed that auxtrace queue indices were
equivalent to CPU number. This assumption is used for inserting records
into the queue, and for fetching queues when given a CPU number. This
assumption held when Perf always opened a dummy event on every CPU, even
if the user provided a subset of CPUs on the commandline, resulting in
the indices aligning.
For example:
# event : name = cs_etm//u, , id = { 2451, 2452 }, type = 11 (cs_etm), size = 136, config = 0x4010, { sample_period, samp>
# event : name = dummy:u, , id = { 2453, 2454, 2455, 2456 }, type = 1 (PERF_TYPE_SOFTWARE), size = 136, config = 0x9 (PER>
0 0 0x200 [0xd0]: PERF_RECORD_ID_INDEX nr: 6
... id: 2451 idx: 2 cpu: 2 tid: -1
... id: 2452 idx: 3 cpu: 3 tid: -1
... id: 2453 idx: 0 cpu: 0 tid: -1
... id: 2454 idx: 1 cpu: 1 tid: -1
... id: 2455 idx: 2 cpu: 2 tid: -1
... id: 2456 idx: 3 cpu: 3 tid: -1
Since commit 811082e4b668 ("perf parse-events: Support user CPUs mixed
with threads/processes") the dummy event no longer behaves in this way,
making the ETM event indices start from 0 on the first CPU recorded
regardless of its ID:
# event : name = cs_etm//u, , id = { 771, 772 }, type = 11 (cs_etm), size = 144, config = 0x4010, { sample_period, sample>
# event : name = dummy:u, , id = { 773, 774 }, type = 1 (PERF_TYPE_SOFTWARE), size = 144, config = 0x9 (PERF_COUNT_SW_DUM>
0 0 0x200 [0x90]: PERF_RECORD_ID_INDEX nr: 4
... id: 771 idx: 0 cpu: 2 tid: -1
... id: 772 idx: 1 cpu: 3 tid: -1
... id: 773 idx: 0 cpu: 2 tid: -1
... id: 774 idx: 1 cpu: 3 tid: -1
This causes the following segfault when decoding:
$ perf record -e cs_etm//u -C 2,3 -- true
$ perf report
perf: Segmentation fault
-------- backtrace --------
#0 0xaaaabf9fd020 in ui__signal_backtrace setup.c:110
#1 0xffffab5c7930 in __kernel_rt_sigreturn [vdso][930]
#2 0xaaaabfb68d30 in cs_etm_decoder__reset cs-etm-decoder.c:85
#3 0xaaaabfb65930 in cs_etm__get_data_block cs-etm.c:2032
#4 0xaaaabfb666fc in cs_etm__run_per_cpu_timeless_decoder cs-etm.c:2551
#5 0xaaaabfb6692c in (cs_etm__process_timeless_queues cs-etm.c:2612
#6 0xaaaabfb63390 in cs_etm__flush_events cs-etm.c:921
#7 0xaaaabfb324c0 in auxtrace__flush_events auxtrace.c:2915
#8 0xaaaabfaac378 in __perf_session__process_events session.c:2285
#9 0xaaaabfaacc9c in perf_session__process_events session.c:2442
#10 0xaaaabf8d3d90 in __cmd_report builtin-report.c:1085
#11 0xaaaabf8d6944 in cmd_report builtin-report.c:1866
#12 0xaaaabf95ebfc in run_builtin perf.c:351
#13 0xaaaabf95eeb0 in handle_internal_command perf.c:404
#14 0xaaaabf95f068 in run_argv perf.c:451
#15 0xaaaabf95f390 in main perf.c:558
#16 0xffffaab97400 in __libc_start_call_main libc_start_call_main.h:74
#17 0xffffaab974d8 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
#18 0xaaaabf8aa8f0 in _start perf[7a8f0]
Fix it by inserting into the queues based on CPU number, rather than
using the index.
Fixes: 811082e4b668db96 ("perf parse-events: Support user CPUs mixed with threads/processes")
Signed-off-by: James Clark <james.clark@linaro.org>
Tested-by: Leo Yan <leo.yan@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: coresight@lists.linaro.org
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cs-etm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
index 25d56e0f1c078..12b55c2bc2ca4 100644
--- a/tools/perf/util/cs-etm.c
+++ b/tools/perf/util/cs-etm.c
@@ -3086,7 +3086,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
if (aux_offset >= auxtrace_event->offset &&
aux_offset + aux_size <= auxtrace_event->offset + auxtrace_event->size) {
- struct cs_etm_queue *etmq = etm->queues.queue_array[auxtrace_event->idx].priv;
+ struct cs_etm_queue *etmq = cs_etm__get_queue(etm, auxtrace_event->cpu);
/*
* If this AUX event was inside this buffer somewhere, create a new auxtrace event
@@ -3095,6 +3095,7 @@ static int cs_etm__queue_aux_fragment(struct perf_session *session, off_t file_o
auxtrace_fragment.auxtrace = *auxtrace_event;
auxtrace_fragment.auxtrace.size = aux_size;
auxtrace_fragment.auxtrace.offset = aux_offset;
+ auxtrace_fragment.auxtrace.idx = etmq->queue_nr;
file_offset += aux_offset - auxtrace_event->offset + auxtrace_event->header.size;
pr_debug3("CS ETM: Queue buffer size: %#"PRI_lx64" offset: %#"PRI_lx64
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 016/844] perf annotate: Fix args leak of map_symbol
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (14 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 015/844] perf cs-etm: Fix decoding for sparse CPU maps Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 017/844] perf maps: Fix reference count leak in maps__find_ams() Sasha Levin
` (836 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, James Clark, Aditya Bodkhe, Adrian Hunter, Albert Ou,
Alexander Shishkin, Alexandre Ghiti, Athira Rajeev, Bill Wendling,
Dr. David Alan Gilbert, Guo Ren, Howard Chu, Ingo Molnar,
Jiri Olsa, John Garry, Julia Lawall, Justin Stitt,
Krzysztof Łopatowski, Leo Yan, linux-arm-kernel, linux-csky,
linux-riscv, Namhyung Kim, Nathan Chancellor, Nick Desaulniers,
Palmer Dabbelt, Paul Walmsley, Peter Zijlstra, Sergei Trofimovich,
Shimin Guo, Suchit Karunakaran, Thomas Falcon, Tianyou Li,
Will Deacon, Zecheng Li, Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 00419892bac28bf148450d762bbff990a6bd5494 ]
map_symbol__exit() needs calling on an annotate_args.ms, however, rather
than introduce proper reference count handling to symbol__annotate()
just switch to passing the map_symbol pointer parameter around, making
the puts the caller's responsibility.
Fix a number of cases to ensure the map in a map_symbol has a
reference count increment and add the then necessary map_symbol_exits.
Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: Bill Wendling <morbo@google.com>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: Guo Ren <guoren@kernel.org>
Cc: Howard Chu <howardchu95@gmail.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Julia Lawall <Julia.Lawall@inria.fr>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-csky@vger.kernel.org
Cc: linux-riscv@lists.infradead.org
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sergei Trofimovich <slyich@gmail.com>
Cc: Shimin Guo <shimin.guo@skydio.com>
Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Cc: Tianyou Li <tianyou.li@intel.com>
Cc: Will Deacon <will@kernel.org>
Cc: Zecheng Li <zecheng@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arch/loongarch/annotate/instructions.c | 14 ++++----
tools/perf/arch/s390/annotate/instructions.c | 11 +++---
tools/perf/util/annotate.c | 2 +-
tools/perf/util/capstone.c | 14 ++++----
tools/perf/util/disasm.c | 36 ++++++++++---------
tools/perf/util/disasm.h | 2 +-
tools/perf/util/llvm.c | 6 ++--
7 files changed, 47 insertions(+), 38 deletions(-)
diff --git a/tools/perf/arch/loongarch/annotate/instructions.c b/tools/perf/arch/loongarch/annotate/instructions.c
index 70262d5f14442..1c3abb43c8d72 100644
--- a/tools/perf/arch/loongarch/annotate/instructions.c
+++ b/tools/perf/arch/loongarch/annotate/instructions.c
@@ -10,9 +10,7 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st
{
char *c, *endptr, *tok, *name;
struct map *map = ms->map;
- struct addr_map_symbol target = {
- .ms = { .map = map, },
- };
+ struct addr_map_symbol target;
c = strchr(ops->raw, '#');
if (c++ == NULL)
@@ -38,12 +36,16 @@ static int loongarch_call__parse(struct arch *arch, struct ins_operands *ops, st
if (ops->target.name == NULL)
return -1;
- target.addr = map__objdump_2mem(map, ops->target.addr);
+ target = (struct addr_map_symbol) {
+ .ms = { .map = map__get(map), },
+ .addr = map__objdump_2mem(map, ops->target.addr),
+ };
if (maps__find_ams(ms->maps, &target) == 0 &&
map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
ops->target.sym = target.ms.sym;
+ addr_map_symbol__exit(&target);
return 0;
}
@@ -58,7 +60,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st
struct map *map = ms->map;
struct symbol *sym = ms->sym;
struct addr_map_symbol target = {
- .ms = { .map = map, },
+ .ms = { .map = map__get(map), },
};
const char *c = strchr(ops->raw, '#');
u64 start, end;
@@ -90,7 +92,7 @@ static int loongarch_jump__parse(struct arch *arch, struct ins_operands *ops, st
} else {
ops->target.offset_avail = false;
}
-
+ addr_map_symbol__exit(&target);
return 0;
}
diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c
index c61193f1e0964..626e6d2cbc81a 100644
--- a/tools/perf/arch/s390/annotate/instructions.c
+++ b/tools/perf/arch/s390/annotate/instructions.c
@@ -6,9 +6,7 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
{
char *endptr, *tok, *name;
struct map *map = ms->map;
- struct addr_map_symbol target = {
- .ms = { .map = map, },
- };
+ struct addr_map_symbol target;
tok = strchr(ops->raw, ',');
if (!tok)
@@ -36,12 +34,17 @@ static int s390_call__parse(struct arch *arch, struct ins_operands *ops,
if (ops->target.name == NULL)
return -1;
- target.addr = map__objdump_2mem(map, ops->target.addr);
+
+ target = (struct addr_map_symbol) {
+ .ms = { .map = map__get(map), },
+ .addr = map__objdump_2mem(map, ops->target.addr),
+ };
if (maps__find_ams(ms->maps, &target) == 0 &&
map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
ops->target.sym = target.ms.sym;
+ addr_map_symbol__exit(&target);
return 0;
}
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index cc7764455faf6..791d60f97c23e 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1031,7 +1031,7 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel,
return 0;
args.arch = arch;
- args.ms = *ms;
+ args.ms = ms;
if (notes->src == NULL) {
notes->src = annotated_source__new();
diff --git a/tools/perf/util/capstone.c b/tools/perf/util/capstone.c
index be5fd44b1f9dc..2c7feab61b7bf 100644
--- a/tools/perf/util/capstone.c
+++ b/tools/perf/util/capstone.c
@@ -143,7 +143,7 @@ static void print_capstone_detail(cs_insn *insn, char *buf, size_t len,
struct annotate_args *args, u64 addr)
{
int i;
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct symbol *sym;
/* TODO: support more architectures */
@@ -222,7 +222,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
{
#ifdef HAVE_LIBCAPSTONE_SUPPORT
struct annotation *notes = symbol__annotation(sym);
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct dso *dso = map__dso(map);
u64 start = map__rip_2objdump(map, sym->start);
u64 offset;
@@ -256,7 +256,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
args->line = disasm_buf;
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
if (dl == NULL)
@@ -268,7 +268,7 @@ int symbol__disassemble_capstone(const char *filename __maybe_unused,
!strcmp(args->options->disassembler_style, "att"))
disassembler_style = true;
- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0)
+ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0)
goto err;
needs_cs_close = true;
@@ -345,7 +345,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
{
#ifdef HAVE_LIBCAPSTONE_SUPPORT
struct annotation *notes = symbol__annotation(sym);
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct dso *dso = map__dso(map);
struct nscookie nsc;
u64 start = map__rip_2objdump(map, sym->start);
@@ -382,7 +382,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
!strcmp(args->options->disassembler_style, "att"))
disassembler_style = true;
- if (capstone_init(maps__machine(args->ms.maps), &handle, is_64bit, disassembler_style) < 0)
+ if (capstone_init(maps__machine(args->ms->maps), &handle, is_64bit, disassembler_style) < 0)
goto err;
needs_cs_close = true;
@@ -408,7 +408,7 @@ int symbol__disassemble_capstone_powerpc(const char *filename __maybe_unused,
args->line = disasm_buf;
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
if (dl == NULL)
diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
index 50b9433f3f8e6..924429142631a 100644
--- a/tools/perf/util/disasm.c
+++ b/tools/perf/util/disasm.c
@@ -269,9 +269,7 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s
{
char *endptr, *tok, *name;
struct map *map = ms->map;
- struct addr_map_symbol target = {
- .ms = { .map = map, },
- };
+ struct addr_map_symbol target;
ops->target.addr = strtoull(ops->raw, &endptr, 16);
@@ -296,12 +294,16 @@ static int call__parse(struct arch *arch, struct ins_operands *ops, struct map_s
if (ops->target.name == NULL)
return -1;
find_target:
- target.addr = map__objdump_2mem(map, ops->target.addr);
+ target = (struct addr_map_symbol) {
+ .ms = { .map = map__get(map), },
+ .addr = map__objdump_2mem(map, ops->target.addr),
+ };
if (maps__find_ams(ms->maps, &target) == 0 &&
map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
ops->target.sym = target.ms.sym;
+ addr_map_symbol__exit(&target);
return 0;
indirect_call:
@@ -366,7 +368,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
struct map *map = ms->map;
struct symbol *sym = ms->sym;
struct addr_map_symbol target = {
- .ms = { .map = map, },
+ .ms = { .map = map__get(map), },
};
const char *c = strchr(ops->raw, ',');
u64 start, end;
@@ -440,7 +442,7 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
} else {
ops->target.offset_avail = false;
}
-
+ addr_map_symbol__exit(&target);
return 0;
}
@@ -1046,7 +1048,7 @@ static size_t disasm_line_size(int nr)
struct disasm_line *disasm_line__new(struct annotate_args *args)
{
struct disasm_line *dl = NULL;
- struct annotation *notes = symbol__annotation(args->ms.sym);
+ struct annotation *notes = symbol__annotation(args->ms->sym);
int nr = notes->src->nr_events;
dl = zalloc(disasm_line_size(nr));
@@ -1064,7 +1066,7 @@ struct disasm_line *disasm_line__new(struct annotate_args *args)
} else if (disasm_line__parse(dl->al.line, &dl->ins.name, &dl->ops.raw) < 0)
goto out_free_line;
- disasm_line__init_ins(dl, args->arch, &args->ms);
+ disasm_line__init_ins(dl, args->arch, args->ms);
}
return dl;
@@ -1119,7 +1121,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
struct annotate_args *args,
char *parsed_line, int *line_nr, char **fileloc)
{
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct annotation *notes = symbol__annotation(sym);
struct disasm_line *dl;
char *tmp;
@@ -1151,7 +1153,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
args->line = parsed_line;
args->line_nr = *line_nr;
args->fileloc = *fileloc;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
(*line_nr)++;
@@ -1169,12 +1171,14 @@ static int symbol__parse_objdump_line(struct symbol *sym,
if (dl->ins.ops && ins__is_call(&dl->ins) && !dl->ops.target.sym) {
struct addr_map_symbol target = {
.addr = dl->ops.target.addr,
- .ms = { .map = map, },
+ .ms = { .map = map__get(map), },
};
- if (!maps__find_ams(args->ms.maps, &target) &&
+ if (!maps__find_ams(args->ms->maps, &target) &&
target.ms.sym->start == target.al_addr)
dl->ops.target.sym = target.ms.sym;
+
+ addr_map_symbol__exit(&target);
}
annotation_line__add(&dl->al, ¬es->src->source);
@@ -1338,7 +1342,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym,
struct annotate_args *args)
{
struct annotation *notes = symbol__annotation(sym);
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct dso *dso = map__dso(map);
u64 start = map__rip_2objdump(map, sym->start);
u64 end = map__rip_2objdump(map, sym->end);
@@ -1375,7 +1379,7 @@ static int symbol__disassemble_raw(char *filename, struct symbol *sym,
args->line = disasm_buf;
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
if (dl == NULL)
@@ -1501,7 +1505,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym,
struct annotate_args *args)
{
struct annotation_options *opts = &annotate_opts;
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct dso *dso = map__dso(map);
char *command;
FILE *file;
@@ -1644,7 +1648,7 @@ static int symbol__disassemble_objdump(const char *filename, struct symbol *sym,
int symbol__disassemble(struct symbol *sym, struct annotate_args *args)
{
struct annotation_options *options = args->options;
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct dso *dso = map__dso(map);
char symfs_filename[PATH_MAX];
bool delete_extract = false;
diff --git a/tools/perf/util/disasm.h b/tools/perf/util/disasm.h
index d2cb555e4a3be..a3ea9d6762816 100644
--- a/tools/perf/util/disasm.h
+++ b/tools/perf/util/disasm.h
@@ -97,7 +97,7 @@ struct ins_ops {
struct annotate_args {
struct arch *arch;
- struct map_symbol ms;
+ struct map_symbol *ms;
struct annotation_options *options;
s64 offset;
char *line;
diff --git a/tools/perf/util/llvm.c b/tools/perf/util/llvm.c
index 2ebf1f5f65bf7..4ada9a10bd93f 100644
--- a/tools/perf/util/llvm.c
+++ b/tools/perf/util/llvm.c
@@ -118,7 +118,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
{
#ifdef HAVE_LIBLLVM_SUPPORT
struct annotation *notes = symbol__annotation(sym);
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct dso *dso = map__dso(map);
u64 start = map__rip_2objdump(map, sym->start);
/* Malloc-ed buffer containing instructions read from disk. */
@@ -184,7 +184,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
args->line = disasm_buf;
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
if (dl == NULL)
@@ -242,7 +242,7 @@ int symbol__disassemble_llvm(const char *filename, struct symbol *sym,
&line_storage_len);
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
llvm_addr2line(filename, pc, &args->fileloc,
(unsigned int *)&args->line_nr, false, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 017/844] perf maps: Fix reference count leak in maps__find_ams()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (15 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 016/844] perf annotate: Fix args leak of map_symbol Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 018/844] perf tests sched: Avoid error in cleanup on loaded machines Sasha Levin
` (835 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, James Clark, Aditya Bodkhe, Adrian Hunter, Albert Ou,
Alexander Shishkin, Alexandre Ghiti, Athira Rajeev, Bill Wendling,
Dr. David Alan Gilbert, Guo Ren, Howard Chu, Ingo Molnar,
Jiri Olsa, John Garry, Julia Lawall, Justin Stitt,
Krzysztof Łopatowski, Leo Yan, Namhyung Kim,
Nathan Chancellor, Nick Desaulniers, Palmer Dabbelt,
Paul Walmsley, Peter Zijlstra, Sergei Trofimovich, Shimin Guo,
Suchit Karunakaran, Thomas Falcon, Tianyou Li, Will Deacon,
Zecheng Li, Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 6fdd2676db55b503c52dd3f1359b5c57f774ab75 ]
ams and so ams->ms.map is an in argument, however, it is also
overwritten. As a map is reference counted, ensure a map__put() is done
before overwriting it.
Fixes: 42fd623b58dbcc48 ("perf maps: Get map before returning in maps__find")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Aditya Bodkhe <aditya.b1@linux.ibm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: Athira Rajeev <atrajeev@linux.ibm.com>
Cc: Bill Wendling <morbo@google.com>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: Guo Ren <guoren@kernel.org>
Cc: Howard Chu <howardchu95@gmail.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Julia Lawall <Julia.Lawall@inria.fr>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Krzysztof Łopatowski <krzysztof.m.lopatowski@gmail.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sergei Trofimovich <slyich@gmail.com>
Cc: Shimin Guo <shimin.guo@skydio.com>
Cc: Suchit Karunakaran <suchitkarunakaran@gmail.com>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Cc: Tianyou Li <tianyou.li@intel.com>
Cc: Will Deacon <will@kernel.org>
Cc: Zecheng Li <zecheng@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/maps.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c
index c321d4f4d8466..8885c95f02b3e 100644
--- a/tools/perf/util/maps.c
+++ b/tools/perf/util/maps.c
@@ -676,6 +676,7 @@ int maps__find_ams(struct maps *maps, struct addr_map_symbol *ams)
if (ams->addr < map__start(ams->ms.map) || ams->addr >= map__end(ams->ms.map)) {
if (maps == NULL)
return -1;
+ map__put(ams->ms.map);
ams->ms.map = maps__find(maps, ams->addr);
if (ams->ms.map == NULL)
return -1;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 018/844] perf tests sched: Avoid error in cleanup on loaded machines
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (16 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 017/844] perf maps: Fix reference count leak in maps__find_ams() Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 019/844] perf annotate: Fix memcpy size in arch__grow_instructions() Sasha Levin
` (834 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Arnaldo Carvalho de Melo, Adrian Hunter,
Alexander Shishkin, Ingo Molnar, James Clark, Jiri Olsa,
Namhyung Kim, Peter Zijlstra, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit c5e47e4d00fbc15f2390bb6ed8d9c21836363291 ]
The stop_noploops function will kill the noploop processes that are
running for 10 seconds.
On a loaded machine they may have already terminated meaning the kill
will return an error of no such process.
This doesn't matter and so ignore the error to avoid the test
terminating in the cleanup.
Fixes: 0e22c5ca44e68798 ("perf test: Add sched latency and script shell tests")
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/sched.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/sched.sh b/tools/perf/tests/shell/sched.sh
index b9b81eaf856e6..b9637069adb1f 100755
--- a/tools/perf/tests/shell/sched.sh
+++ b/tools/perf/tests/shell/sched.sh
@@ -53,7 +53,7 @@ start_noploops() {
}
cleanup_noploops() {
- kill "$PID1" "$PID2"
+ kill "$PID1" "$PID2" || true
}
test_sched_record() {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 019/844] perf annotate: Fix memcpy size in arch__grow_instructions()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (17 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 018/844] perf tests sched: Avoid error in cleanup on loaded machines Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 020/844] tools headers: Go back to include asm-generic/unistd.h for arm64 Sasha Levin
` (833 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Suchit Karunakaran, Ian Rogers, Adrian Hunter, Alexander Shishkin,
Ingo Molnar, James Clark, Jiri Olsa, Mark Rutland, Namhyung Kim,
Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin
From: Suchit Karunakaran <suchitkarunakaran@gmail.com>
[ Upstream commit f0d98c78f8bf73ce2a9b7793f66cda240fa9ab10 ]
The memcpy() in arch__grow_instructions() is copying the wrong number of
bytes when growing from a non-allocated table.
It should copy arch->nr_instructions * sizeof(struct ins) bytes, not
just arch->nr_instructions bytes.
This bug causes data corruption as only a partial copy of the
instruction table is made, leading to garbage data in most entries and
potential crashes
Fixes: 2a1ff812c40be982 ("perf annotate: Introduce alternative method of keeping instructions table")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/disasm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
index 924429142631a..88706b98b9064 100644
--- a/tools/perf/util/disasm.c
+++ b/tools/perf/util/disasm.c
@@ -81,7 +81,7 @@ static int arch__grow_instructions(struct arch *arch)
if (new_instructions == NULL)
return -1;
- memcpy(new_instructions, arch->instructions, arch->nr_instructions);
+ memcpy(new_instructions, arch->instructions, arch->nr_instructions * sizeof(struct ins));
goto out_update_instructions;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 020/844] tools headers: Go back to include asm-generic/unistd.h for arm64
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (18 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 019/844] perf annotate: Fix memcpy size in arch__grow_instructions() Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 021/844] perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to pointer Sasha Levin
` (832 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Leo Yan, James Clark, Adrian Hunter, Arnd Bergmann, Ian Rogers,
Jiri Olsa, Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 096b86ce08332fbcb0ec6ff6714c44899ec03970 ]
The header unistd.h is included under Arm64's uAPI folder (see
tools/arch/arm64/include/uapi/asm/), but it does not include its
dependent header unistd_64.h.
The intention is for unistd_64.h to be generated dynamically using
scripts/Makefile.asm-headers.
However, this dynamic approach causes problems because the header is not
available early enough, even though it is widely included throughout
tools.
Using the perf build as an example:
1) Feature detection: Perf first runs feature tests.
The BPF feature program test-bpf.c includes unistd.h. Since
unistd_64.h has not been generated yet, the program fails to build,
and the BPF feature ends up being disabled.
2) libperf build:
The libperf Makefile later generates unistd_64.h on the fly, so
libperf itself builds successfully.
3) Final perf build:
Although the perf binary can build successfully using the generated
header, we never get a chance to build BPF skeleton programs,
because BPF support was already disabled earlier.
Restore to include asm-generic/unistd.h for fixing the issue. This
aligns with most architectures (x86 is a special case that keeps
unistd_32.h/unistd_64.h for its particular syscall numbers) and ensures
the header is available from the start.
Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/arch/arm64/include/uapi/asm/unistd.h | 24 +++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/tools/arch/arm64/include/uapi/asm/unistd.h b/tools/arch/arm64/include/uapi/asm/unistd.h
index df36f23876e86..9306726337fe0 100644
--- a/tools/arch/arm64/include/uapi/asm/unistd.h
+++ b/tools/arch/arm64/include/uapi/asm/unistd.h
@@ -1,2 +1,24 @@
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-#include <asm/unistd_64.h>
+/*
+ * Copyright (C) 2012 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define __ARCH_WANT_RENAMEAT
+#define __ARCH_WANT_NEW_STAT
+#define __ARCH_WANT_SET_GET_RLIMIT
+#define __ARCH_WANT_TIME32_SYSCALLS
+#define __ARCH_WANT_MEMFD_SECRET
+
+#include <asm-generic/unistd.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 021/844] perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to pointer
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (19 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 020/844] tools headers: Go back to include asm-generic/unistd.h for arm64 Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 022/844] perf test: Fix test perf evlist for z/VM s390x Sasha Levin
` (831 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Arnaldo Carvalho de Melo, Ian Rogers, Sasha Levin
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit dda5f926a1006c735b00ed5c27291fce64236656 ]
Fix a few missing conversions to pointer in the usage of 'struct
annotate_args' 'ms' member in symbol__disassemble_bpf_libbfd().
Fixes: 00419892bac28bf1 ("perf annotate: Fix args leak of map_symbol")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/libbfd.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/libbfd.c b/tools/perf/util/libbfd.c
index 79f4528234a9d..63ea3fb53e77d 100644
--- a/tools/perf/util/libbfd.c
+++ b/tools/perf/util/libbfd.c
@@ -501,7 +501,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
struct bpf_prog_info_node *info_node;
int len = sym->end - sym->start;
disassembler_ftype disassemble;
- struct map *map = args->ms.map;
+ struct map *map = args->ms->map;
struct perf_bpil *info_linear;
struct disassemble_info info;
struct dso *dso = map__dso(map);
@@ -612,7 +612,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
args->line = strdup(srcline);
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
if (dl) {
annotation_line__add(&dl->al,
@@ -624,7 +624,7 @@ int symbol__disassemble_bpf_libbfd(struct symbol *sym __maybe_unused,
args->line = buf + prev_buf_size;
args->line_nr = 0;
args->fileloc = NULL;
- args->ms.sym = sym;
+ args->ms->sym = sym;
dl = disasm_line__new(args);
if (dl)
annotation_line__add(&dl->al, ¬es->src->source);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 022/844] perf test: Fix test perf evlist for z/VM s390x
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (20 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 021/844] perf annotate: Fix BUILD_NONDISTRO=1 missing args->ms conversions to pointer Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 023/844] perf vendor events amd: Fix Zen 5 MAB allocation events Sasha Levin
` (830 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Richter, Ian Rogers, Jan Polensky, Alexander Gordeev,
Heiko Carstens, Namhyung Kim, Sumanth Korikkar, Vasily Gorbik,
Arnaldo Carvalho de Melo, Sasha Levin
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit 008603bda19b29687edce533e4c09acff68c1077 ]
Perf test case 'perf evlist tests' fails on z/VM machines on s390.
The failure is causes by event cycles. This event is not available
on virtualized machines like z/VM on s390.
Change to software event cpu-clock to fix this.
Output before:
# ./perf test 78
79: perf evlist tests : FAILED!
#
Output after:
# ./perf test 78
79: perf evlist tests : Ok
#
Fixes: b04d2b9199129f4f ("perf test: Fix test case perf evlist tests for s390x")
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Tested-by: Jan Polensky <japo@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/tests/shell/evlist.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/shell/evlist.sh b/tools/perf/tests/shell/evlist.sh
index 5632be3917109..8a22f4171c07c 100755
--- a/tools/perf/tests/shell/evlist.sh
+++ b/tools/perf/tests/shell/evlist.sh
@@ -21,13 +21,13 @@ trap trap_cleanup EXIT TERM INT
test_evlist_simple() {
echo "Simple evlist test"
- if ! perf record -e cycles -o "${perfdata}" true 2> /dev/null
+ if ! perf record -e cpu-clock -o "${perfdata}" true 2> /dev/null
then
echo "Simple evlist [Failed record]"
err=1
return
fi
- if ! perf evlist -i "${perfdata}" | grep -q "cycles"
+ if ! perf evlist -i "${perfdata}" | grep -q "cpu-clock"
then
echo "Simple evlist [Failed to list event]"
err=1
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 023/844] perf vendor events amd: Fix Zen 5 MAB allocation events
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (21 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 022/844] perf test: Fix test perf evlist for z/VM s390x Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 024/844] perf jevents: Handle deleted JSONS in out of source builds Sasha Levin
` (829 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sandipan Das, Suyash Mahar, Ian Rogers, Adrian Hunter,
Alexander Shishkin, Ananth Narayan, Ingo Molnar, James Clark,
Jiri Olsa, Mark Rutland, Namhyung Kim, Peter Zijlstra,
Ravi Bangoria, Arnaldo Carvalho de Melo, Sasha Levin
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit 76b2cf07a6d2a836108f9c2486d76599f7adf6e8 ]
The unit masks for PMCx041 vary across different generations of Zen
processors.
Fix the Zen 5 events based on PMCx041 as they incorrectly use the same
unit masks as that of Zen 4.
Fixes: 45c072f2537ab07b ("perf vendor events amd: Add Zen 5 core events")
Reported-by: Suyash Mahar <smahar@meta.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ananth Narayan <ananth.narayan@amd.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/pmu-events/arch/x86/amdzen5/load-store.json | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
index ff6627a778057..06bbaea159259 100644
--- a/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
+++ b/tools/perf/pmu-events/arch/x86/amdzen5/load-store.json
@@ -70,19 +70,19 @@
"EventName": "ls_mab_alloc.load_store_allocations",
"EventCode": "0x41",
"BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for load-store allocations.",
- "UMask": "0x3f"
+ "UMask": "0x07"
},
{
"EventName": "ls_mab_alloc.hardware_prefetcher_allocations",
"EventCode": "0x41",
"BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for hardware prefetcher allocations.",
- "UMask": "0x40"
+ "UMask": "0x08"
},
{
"EventName": "ls_mab_alloc.all_allocations",
"EventCode": "0x41",
"BriefDescription": "Miss Address Buffer (MAB) entries allocated by a Load-Store (LS) pipe for all types of allocations.",
- "UMask": "0x7f"
+ "UMask": "0x0f"
},
{
"EventName": "ls_dmnd_fills_from_sys.local_l2",
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 024/844] perf jevents: Handle deleted JSONS in out of source builds
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (22 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 023/844] perf vendor events amd: Fix Zen 5 MAB allocation events Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 025/844] perf build: Remove NO_LIBCAP that controls nothing Sasha Levin
` (828 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: James Clark, Mark Brown, Adrian Hunter, Alexander Shishkin,
Ian Rogers, Ingo Molnar, Jiri Olsa, Mark Rutland, Namhyung Kim,
Peter Zijlstra, Arnaldo Carvalho de Melo, Sasha Levin
From: James Clark <james.clark@linaro.org>
[ Upstream commit 297c9d96e3085116c5cde18170dba716a1f2591e ]
Make the source folders a dependency for the generated folder root so
that whenever a file is deleted from the source it will force a new
fresh copy of all the JSON files and avoid stale deleted files.
JSON_DIRS_OUTPUT_ROOT needs to be a dependency of LEGACY_CACHE_JSON so
that the root folder doesn't get cleaned after the legacy JSON is
generated. But this is a no-op with in-source builds as
JSON_DIRS_OUTPUT_ROOT is unset.
JSON_DIRS is added as a dependency of PMU_EVENTS_C which also forces a
re-build for in source builds when JSON files are deleted. This could
have also resulted in stale builds, but never a broken one.
Closes: https://lore.kernel.org/linux-next/aW5XSAo88_LBPSYI@sirena.org.uk/
Fixes: 4bb55de4ff03db3e ("perf jevents: Support copying the source json files to OUTPUT")
Reported-by: Mark Brown <broonie@kernel.org>
Signed-off-by: James Clark <james.clark@linaro.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/pmu-events/Build | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
index a46ab7b612dfc..4f9ef624ba70d 100644
--- a/tools/perf/pmu-events/Build
+++ b/tools/perf/pmu-events/Build
@@ -1,5 +1,6 @@
pmu-events-y += pmu-events.o
JSON = $(shell find pmu-events/arch -name '*.json' -o -name '*.csv')
+JSON_DIRS = $(shell find pmu-events/arch -type d)
JDIR_TEST = pmu-events/arch/test
JSON_TEST = $(shell [ -d $(JDIR_TEST) ] && \
find $(JDIR_TEST) -name '*.json')
@@ -31,16 +32,23 @@ $(PMU_EVENTS_C): $(EMPTY_PMU_EVENTS_C)
else
# Copy checked-in json to OUTPUT for generation if it's an out of source build
ifneq ($(OUTPUT),)
-$(OUTPUT)pmu-events/arch/%: pmu-events/arch/%
+# Remove all output directories when any source directory timestamp changes
+# so there are no stale deleted files
+JSON_DIRS_ROOT = $(OUTPUT)pmu-events/arch/
+$(JSON_DIRS_ROOT): $(JSON_DIRS)
+ $(Q)$(call echo-cmd,gen)rm -rf $@
+ $(Q)mkdir -p $@
+
+$(OUTPUT)pmu-events/arch/%: pmu-events/arch/% $(JSON_DIRS_ROOT)
$(call rule_mkdir)
$(Q)$(call echo-cmd,gen)cp $< $@
endif
-$(LEGACY_CACHE_JSON): $(LEGACY_CACHE_PY)
+$(LEGACY_CACHE_JSON): $(LEGACY_CACHE_PY) $(JSON_DIRS_ROOT)
$(call rule_mkdir)
$(Q)$(call echo-cmd,gen)$(PYTHON) $(LEGACY_CACHE_PY) > $@
-GEN_JSON = $(patsubst %,$(OUTPUT)%,$(JSON)) $(LEGACY_CACHE_JSON)
+GEN_JSON = $(patsubst %,$(OUTPUT)%,$(JSON)) $(LEGACY_CACHE_JSON) $(JSON_DIRS)
$(METRIC_TEST_LOG): $(METRIC_TEST_PY) $(METRIC_PY)
$(call rule_mkdir)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 025/844] perf build: Remove NO_LIBCAP that controls nothing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (23 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 024/844] perf jevents: Handle deleted JSONS in out of source builds Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:18 ` [PATCH 6.19 026/844] libperf build: Always place libperf includes first Sasha Levin
` (827 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Adrian Hunter, Alexander Shishkin, Ingo Molnar,
James Clark, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 169343cc8ff2bd59758760d867bd26adae866a2b ]
Using libcap was removed in commit e25ebda78e230283 ("perf cap: Tidy up
and improve capability testing") and improve capability testing"),
however, some build documentation and a use of the NO_LIBCAP=1 were
lingering.
Remove these left over bits.
Fixes: e25ebda78e230283 ("perf cap: Tidy up and improve capability testing")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/Makefile.perf | 2 --
tools/perf/tests/make | 2 +-
2 files changed, 1 insertion(+), 3 deletions(-)
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index e6895626c1872..fbeb5c81c8072 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -86,8 +86,6 @@ include ../scripts/utilities.mak
#
# Define NO_LIBBPF if you do not want BPF support
#
-# Define NO_LIBCAP if you do not want process capabilities considered by perf
-#
# Define NO_SDT if you do not want to define SDT event in perf tools,
# note that it doesn't disable SDT scanning support.
#
diff --git a/tools/perf/tests/make b/tools/perf/tests/make
index 6641701e48285..c721cd1bcaa9a 100644
--- a/tools/perf/tests/make
+++ b/tools/perf/tests/make
@@ -122,7 +122,7 @@ make_minimal += NO_DEMANGLE=1 NO_LIBELF=1 NO_BACKTRACE=1
make_minimal += NO_LIBNUMA=1 NO_LIBBIONIC=1 NO_LIBDW=1
make_minimal += NO_LIBDW_DWARF_UNWIND=1 NO_LIBBPF=1
make_minimal += NO_SDT=1 NO_JVMTI=1 NO_LIBZSTD=1
-make_minimal += NO_LIBCAP=1 NO_CAPSTONE=1
+make_minimal += NO_CAPSTONE=1
# $(run) contains all available tests
run := make_pure
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 026/844] libperf build: Always place libperf includes first
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (24 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 025/844] perf build: Remove NO_LIBCAP that controls nothing Sasha Levin
@ 2026-02-28 17:18 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists Sasha Levin
` (826 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:18 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Adrian Hunter, Alexander Shishkin, Ingo Molnar,
James Clark, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 8c5b40678c63be6b85f1c2dc8c8b89d632faf988 ]
When building tools/perf the CFLAGS can contain a directory for the
installed headers.
As the headers may be being installed while building libperf.a this can
cause headers to be partially installed and found in the include path
while building an object file for libperf.a.
The installed header may reference other installed headers that are
missing given the partial nature of the install and then the build fails
with a missing header file.
Avoid this by ensuring the libperf source headers are always first in
the CFLAGS.
Fixes: 3143504918105156 ("libperf: Make libperf.a part of the perf build")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/perf/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/perf/Makefile b/tools/lib/perf/Makefile
index 7fbb50b74c00b..5c64122bf5374 100644
--- a/tools/lib/perf/Makefile
+++ b/tools/lib/perf/Makefile
@@ -51,9 +51,9 @@ INCLUDES = \
-I$(srctree)/tools/include/uapi
# Append required CFLAGS
+override CFLAGS := $(INCLUDES) $(CFLAGS)
override CFLAGS += -g -Werror -Wall
override CFLAGS += -fPIC
-override CFLAGS += $(INCLUDES)
override CFLAGS += -fvisibility=hidden
override CFLAGS += $(EXTRA_WARNINGS)
override CFLAGS += $(EXTRA_CFLAGS)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (25 preceding siblings ...)
2026-02-28 17:18 ` [PATCH 6.19 026/844] libperf build: Always place libperf includes first Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-03-09 7:40 ` Jiri Slaby
2026-02-28 17:19 ` [PATCH 6.19 028/844] perf test: Fix test case perftool-testsuite_report for s390 Sasha Levin
` (825 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Leo Yan, Adrian Hunter, Alexander Shishkin,
Ingo Molnar, James Clark, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
The failure to find a table of metrics with a CPUID shouldn't early
exit as the metric code will now also consider the default table.
When searching for a metric or metric group,
pmu_metrics_table__for_each_metric() considers all tables and so the
caller doesn't need to switch the table to do this.
Fixes: c7adeb0974f18da4 ("perf jevents: Add set of common metrics based on default ones")
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Leo Yan <leo.yan@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/metricgroup.c | 18 +++++-------------
1 file changed, 5 insertions(+), 13 deletions(-)
diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
index 25c75fdbfc525..a21f2d4969c5c 100644
--- a/tools/perf/util/metricgroup.c
+++ b/tools/perf/util/metricgroup.c
@@ -1563,8 +1563,6 @@ int metricgroup__parse_groups(struct evlist *perf_evlist,
{
const struct pmu_metrics_table *table = pmu_metrics_table__find();
- if (!table)
- return -EINVAL;
if (hardware_aware_grouping)
pr_debug("Use hardware aware grouping instead of traditional metric grouping method\n");
@@ -1602,22 +1600,16 @@ static int metricgroup__has_metric_or_groups_callback(const struct pmu_metric *p
bool metricgroup__has_metric_or_groups(const char *pmu, const char *metric_or_groups)
{
- const struct pmu_metrics_table *tables[2] = {
- pmu_metrics_table__find(),
- pmu_metrics_table__default(),
- };
+ const struct pmu_metrics_table *table = pmu_metrics_table__find();
struct metricgroup__has_metric_data data = {
.pmu = pmu,
.metric_or_groups = metric_or_groups,
};
- for (size_t i = 0; i < ARRAY_SIZE(tables); i++) {
- if (pmu_metrics_table__for_each_metric(tables[i],
- metricgroup__has_metric_or_groups_callback,
- &data))
- return true;
- }
- return false;
+ return pmu_metrics_table__for_each_metric(table,
+ metricgroup__has_metric_or_groups_callback,
+ &data)
+ ? true : false;
}
static int metricgroup__topdown_max_level_callback(const struct pmu_metric *pm,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists
2026-02-28 17:19 ` [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists Sasha Levin
@ 2026-03-09 7:40 ` Jiri Slaby
2026-03-09 13:40 ` Greg KH
0 siblings, 1 reply; 879+ messages in thread
From: Jiri Slaby @ 2026-03-09 7:40 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Ian Rogers, Leo Yan, Adrian Hunter, Alexander Shishkin,
Ingo Molnar, James Clark, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo
On 28. 02. 26, 18:19, Sasha Levin wrote:
> From: Ian Rogers <irogers@google.com>
>
> [ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
This breaks (userspace) perf:
$ ./perf stat -a -d -p 1 sleep 5
PID/TID switch overriding SYSTEM
Error:
No supported events found.
Any ideas?
> The failure to find a table of metrics with a CPUID shouldn't early
> exit as the metric code will now also consider the default table.
>
> When searching for a metric or metric group,
> pmu_metrics_table__for_each_metric() considers all tables and so the
> caller doesn't need to switch the table to do this.
>
> Fixes: c7adeb0974f18da4 ("perf jevents: Add set of common metrics based on default ones")
> Reviewed-by: Leo Yan <leo.yan@arm.com>
> Signed-off-by: Ian Rogers <irogers@google.com>
> Tested-by: Leo Yan <leo.yan@arm.com>
> Cc: Adrian Hunter <adrian.hunter@intel.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Ian Rogers <irogers@google.com>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: James Clark <james.clark@linaro.org>
> Cc: Jiri Olsa <jolsa@kernel.org>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> tools/perf/util/metricgroup.c | 18 +++++-------------
> 1 file changed, 5 insertions(+), 13 deletions(-)
>
> diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
> index 25c75fdbfc525..a21f2d4969c5c 100644
> --- a/tools/perf/util/metricgroup.c
> +++ b/tools/perf/util/metricgroup.c
> @@ -1563,8 +1563,6 @@ int metricgroup__parse_groups(struct evlist *perf_evlist,
> {
> const struct pmu_metrics_table *table = pmu_metrics_table__find();
>
> - if (!table)
> - return -EINVAL;
> if (hardware_aware_grouping)
> pr_debug("Use hardware aware grouping instead of traditional metric grouping method\n");
>
> @@ -1602,22 +1600,16 @@ static int metricgroup__has_metric_or_groups_callback(const struct pmu_metric *p
>
> bool metricgroup__has_metric_or_groups(const char *pmu, const char *metric_or_groups)
> {
> - const struct pmu_metrics_table *tables[2] = {
> - pmu_metrics_table__find(),
> - pmu_metrics_table__default(),
> - };
> + const struct pmu_metrics_table *table = pmu_metrics_table__find();
> struct metricgroup__has_metric_data data = {
> .pmu = pmu,
> .metric_or_groups = metric_or_groups,
> };
>
> - for (size_t i = 0; i < ARRAY_SIZE(tables); i++) {
> - if (pmu_metrics_table__for_each_metric(tables[i],
> - metricgroup__has_metric_or_groups_callback,
> - &data))
> - return true;
> - }
> - return false;
> + return pmu_metrics_table__for_each_metric(table,
> + metricgroup__has_metric_or_groups_callback,
> + &data)
> + ? true : false;
> }
>
> static int metricgroup__topdown_max_level_callback(const struct pmu_metric *pm,
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists
2026-03-09 7:40 ` Jiri Slaby
@ 2026-03-09 13:40 ` Greg KH
2026-03-09 14:53 ` Ian Rogers
0 siblings, 1 reply; 879+ messages in thread
From: Greg KH @ 2026-03-09 13:40 UTC (permalink / raw)
To: Jiri Slaby
Cc: Sasha Levin, linux-kernel, stable, Ian Rogers, Leo Yan,
Adrian Hunter, Alexander Shishkin, Ingo Molnar, James Clark,
Jiri Olsa, Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo
On Mon, Mar 09, 2026 at 08:40:33AM +0100, Jiri Slaby wrote:
> On 28. 02. 26, 18:19, Sasha Levin wrote:
> > From: Ian Rogers <irogers@google.com>
> >
> > [ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
>
> This breaks (userspace) perf:
> $ ./perf stat -a -d -p 1 sleep 5
> PID/TID switch overriding SYSTEM
> Error:
> No supported events found.
>
> Any ideas?
Is it also broken in 7.0-rc3? Or is this only a 6.19.y issue?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists
2026-03-09 13:40 ` Greg KH
@ 2026-03-09 14:53 ` Ian Rogers
2026-03-09 14:57 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Ian Rogers @ 2026-03-09 14:53 UTC (permalink / raw)
To: Greg KH
Cc: Jiri Slaby, Sasha Levin, linux-kernel, stable, Leo Yan,
Adrian Hunter, Alexander Shishkin, Ingo Molnar, James Clark,
Jiri Olsa, Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo
On Mon, Mar 9, 2026 at 6:40 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Mon, Mar 09, 2026 at 08:40:33AM +0100, Jiri Slaby wrote:
> > On 28. 02. 26, 18:19, Sasha Levin wrote:
> > > From: Ian Rogers <irogers@google.com>
> > >
> > > [ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
> >
> > This breaks (userspace) perf:
> > $ ./perf stat -a -d -p 1 sleep 5
> > PID/TID switch overriding SYSTEM
> > Error:
> > No supported events found.
> >
> > Any ideas?
>
> Is it also broken in 7.0-rc3? Or is this only a 6.19.y issue?
There was a fix:
https://web.git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/commit/tools/perf/util/metricgroup.c?h=perf-tools-next&id=c5a244bf17caf2de22f9e100832b75f72b31d3e6
was that applied to 6.19.y?
Thanks,
Ian
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists
2026-03-09 14:53 ` Ian Rogers
@ 2026-03-09 14:57 ` Sasha Levin
2026-03-10 8:06 ` Jiri Slaby
0 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-03-09 14:57 UTC (permalink / raw)
To: Ian Rogers
Cc: Greg KH, Jiri Slaby, linux-kernel, stable, Leo Yan, Adrian Hunter,
Alexander Shishkin, Ingo Molnar, James Clark, Jiri Olsa,
Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo
On Mon, Mar 09, 2026 at 07:53:10AM -0700, Ian Rogers wrote:
>On Mon, Mar 9, 2026 at 6:40 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>>
>> On Mon, Mar 09, 2026 at 08:40:33AM +0100, Jiri Slaby wrote:
>> > On 28. 02. 26, 18:19, Sasha Levin wrote:
>> > > From: Ian Rogers <irogers@google.com>
>> > >
>> > > [ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
>> >
>> > This breaks (userspace) perf:
>> > $ ./perf stat -a -d -p 1 sleep 5
>> > PID/TID switch overriding SYSTEM
>> > Error:
>> > No supported events found.
>> >
>> > Any ideas?
>>
>> Is it also broken in 7.0-rc3? Or is this only a 6.19.y issue?
>
>There was a fix:
>https://web.git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/commit/tools/perf/util/metricgroup.c?h=perf-tools-next&id=c5a244bf17caf2de22f9e100832b75f72b31d3e6
>was that applied to 6.19.y?
It's not even upstream yet :)
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists
2026-03-09 14:57 ` Sasha Levin
@ 2026-03-10 8:06 ` Jiri Slaby
0 siblings, 0 replies; 879+ messages in thread
From: Jiri Slaby @ 2026-03-10 8:06 UTC (permalink / raw)
To: Sasha Levin, Ian Rogers
Cc: Greg KH, linux-kernel, stable, Leo Yan, Adrian Hunter,
Alexander Shishkin, Ingo Molnar, James Clark, Jiri Olsa,
Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo
On 09. 03. 26, 15:57, Sasha Levin wrote:
> On Mon, Mar 09, 2026 at 07:53:10AM -0700, Ian Rogers wrote:
>> On Mon, Mar 9, 2026 at 6:40 AM Greg KH <gregkh@linuxfoundation.org>
>> wrote:
>>>
>>> On Mon, Mar 09, 2026 at 08:40:33AM +0100, Jiri Slaby wrote:
>>> > On 28. 02. 26, 18:19, Sasha Levin wrote:
>>> > > From: Ian Rogers <irogers@google.com>
>>> > >
>>> > > [ Upstream commit cee275edcdb1acfdc8270f80e96f30750b633220 ]
>>> >
>>> > This breaks (userspace) perf:
>>> > $ ./perf stat -a -d -p 1 sleep 5
>>> > PID/TID switch overriding SYSTEM
>>> > Error:
>>> > No supported events found.
>>> >
>>> > Any ideas?
>>>
>>> Is it also broken in 7.0-rc3? Or is this only a 6.19.y issue?
It's broken in linus/master too.
>> There was a fix:
>> https://web.git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-
>> next.git/commit/tools/perf/util/metricgroup.c?h=perf-tools-
>> next&id=c5a244bf17caf2de22f9e100832b75f72b31d3e6
>> was that applied to 6.19.y?
>
> It's not even upstream yet :)
Right. (And it fixes the issue.)
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread
* [PATCH 6.19 028/844] perf test: Fix test case perftool-testsuite_report for s390
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (26 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 027/844] perf metricgroup: Don't early exit if no CPUID table exists Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 029/844] objtool/rust: add one more `noreturn` Rust function Sasha Levin
` (824 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Richter, Jan Polensky, Alexander Gordeev, Heiko Carstens,
Ian Rogers, linux-s390, Namhyung Kim, Sumanth Korikkar,
Vasily Gorbik, Arnaldo Carvalho de Melo, Sasha Levin
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit 3d012b8614ee020666f3dd15af9f65dc487e3f5f ]
Test case perftool-testsuite_report fails on s390 for some time
now.
Root cause is a time out which is too tight for large s390 machines.
The time out value addr2line_timeout_ms is per default set to 1 second.
This is the maximum time the function read_addr2line_record() waits for
a reply from the forked off tool addr2line, which is started as a child
in interactive mode.
It reads stdin (an address in hexadecimal) and replies on stdout with
function name, file name and line number. This might take more than one
second.
However one second is not always enough and the reply from addr2line
tool is not received. Function read_addr2line_record() fails and emits
a warning, which is not expected by the test case. It fails.
Output before:
# perf test -F 133
-- [ PASS ] -- perf_report :: setup :: prepare the perf.data file
==================
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.087 MB \
/tmp/perftool-testsuite_report.FHz/perf_report/perf.data.1 \
(207 samples) ]
==================
-- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file
## [ PASS ] ## perf_report :: setup SUMMARY
-- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped
Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/
6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/
vmlinux: could not read first record"
Line did not match any pattern: "cmd__addr2line /usr/lib/debug/lib/modules/
6.19.0-20260205.rc8.git366.9845cf73f7db.300.fc43.s390x+next/
vmlinux: could not read first record"
-- [ FAIL ] -- perf_report :: test_basic :: basic execution
(output regexp parsing)
....
133: perftool-testsuite_report : FAILED!
Output after:
# ./perf test -F 133
-- [ PASS ] -- perf_report :: setup :: prepare the perf.data file
==================
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.087 MB \
/tmp/perftool-testsuite_report.Mlp/perf_report/perf.data.1
(188 samples) ]
==================
-- [ PASS ] -- perf_report :: setup :: prepare the perf.data.1 file
## [ PASS ] ## perf_report :: setup SUMMARY
-- [ SKIP ] -- perf_report :: test_basic :: help message :: testcase skipped
-- [ PASS ] -- perf_report :: test_basic :: basic execution
-- [ PASS ] -- perf_report :: test_basic :: number of samples
-- [ PASS ] -- perf_report :: test_basic :: header
-- [ PASS ] -- perf_report :: test_basic :: header timestamp
-- [ PASS ] -- perf_report :: test_basic :: show CPU utilization
-- [ PASS ] -- perf_report :: test_basic :: pid
-- [ PASS ] -- perf_report :: test_basic :: non-existing symbol
-- [ PASS ] -- perf_report :: test_basic :: symbol filter
-- [ PASS ] -- perf_report :: test_basic :: latency header
-- [ PASS ] -- perf_report :: test_basic :: default report for latency profile
-- [ PASS ] -- perf_report :: test_basic :: latency report for latency profile
-- [ PASS ] -- perf_report :: test_basic :: parallelism histogram
## [ PASS ] ## perf_report :: test_basic SUMMARY
133: perftool-testsuite_report : Ok
#
Fixes: 257046a36750a6db ("perf srcline: Fallback between addr2line implementations")
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Ian Rogers <irogers@google.com>
Cc: linux-s390@vger.kernel.org
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/addr2line.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/addr2line.c b/tools/perf/util/addr2line.c
index f2d94a3272d71..a8b39f4f202b6 100644
--- a/tools/perf/util/addr2line.c
+++ b/tools/perf/util/addr2line.c
@@ -18,8 +18,8 @@
#define MAX_INLINE_NEST 1024
-/* If addr2line doesn't return data for 1 second then timeout. */
-int addr2line_timeout_ms = 1 * 1000;
+/* If addr2line doesn't return data for 5 seconds then timeout. */
+int addr2line_timeout_ms = 5 * 1000;
static int filename_split(char *filename, unsigned int *line_nr)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 029/844] objtool/rust: add one more `noreturn` Rust function
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (27 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 028/844] perf test: Fix test case perftool-testsuite_report for s390 Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 030/844] perf stat: Ensure metrics are displayed even with failed events Sasha Levin
` (823 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miguel Ojeda, FUJITA Tomonori, Alice Ryhl, Sasha Levin
From: Miguel Ojeda <ojeda@kernel.org>
[ Upstream commit c431b00ca6afc5da3133636ecc34ee7edd38d6cc ]
`objtool` with Rust 1.84.0 reports:
rust/kernel.o: error: objtool: _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix14from_str_radix()
falls through to next function _RNvXNtNtCsaRPFapPOzLs_6kernel3str9parse_intaNtNtB2_7private12FromStrRadix16from_u64_negated()
This is very similar to commit c18f35e49049 ("objtool/rust: add one more
`noreturn` Rust function"), which added `from_ascii_radix_panic` for Rust
1.86.0, except that Rust 1.84.0 ends up needing `from_str_radix_panic`.
Thus add it to the list to fix the warning.
Cc: FUJITA Tomonori <fujita.tomonori@gmail.com>
Fixes: 51d9ee90ea90 ("rust: str: add radix prefixed integer parsing functions")
Reported-by: Alice Ryhl <aliceryhl@google.com>
Link: https://rust-for-linux.zulipchat.com/#narrow/channel/291565/topic/x/with/572427627
Tested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260206204336.38462-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/objtool/check.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 3fd98c5b6e1a8..37ec0d757e9b1 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -197,7 +197,8 @@ static bool is_rust_noreturn(const struct symbol *func)
* as well as changes to the source code itself between versions (since
* these come from the Rust standard library).
*/
- return str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
+ return str_ends_with(func->name, "_4core3num20from_str_radix_panic") ||
+ str_ends_with(func->name, "_4core3num22from_ascii_radix_panic") ||
str_ends_with(func->name, "_4core5sliceSp15copy_from_slice17len_mismatch_fail") ||
str_ends_with(func->name, "_4core6option13expect_failed") ||
str_ends_with(func->name, "_4core6option13unwrap_failed") ||
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 030/844] perf stat: Ensure metrics are displayed even with failed events
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (28 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 029/844] objtool/rust: add one more `noreturn` Rust function Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-03-02 7:09 ` Jiri Slaby
2026-02-28 17:19 ` [PATCH 6.19 031/844] perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel Sasha Levin
` (822 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chun-Tse Shao, Ian Rogers, Adrian Hunter, Alexander Shishkin,
Ingo Molnar, James Clark, Jiri Olsa, Kan Liang, Mark Rutland,
Namhyung Kim, Peter Zijlstra, Yang Li, Arnaldo Carvalho de Melo,
Sasha Levin
From: Chun-Tse Shao <ctshao@google.com>
[ Upstream commit bb5a920b9099127915706fdd23eb540c9a69c338 ]
Currently, `perf stat` skips or hides metrics when the underlying
hardware events cannot be counted (e.g., due to insufficient permissions
or unsupported events).
In `--metric-only` mode, this often results in missing columns or blank
spaces, making the output difficult to parse.
Modify the logic to ensure metrics are consistently displayed by
propagating NAN (Not a Number) through the expression evaluator.
Specifically:
1. Update `prepare_metric()` in stat-shadow.c to treat uncounted events
(where `run == 0`) as NAN. This leverages the existing math in expr.y
to propagate NAN through metric expressions.
2. Remove the early return in the display logic's `printout()` function
that was previously skipping metrics in `--metric-only` mode for
failed events.
l
3. Simplify `perf_stat__skip_metric_event()` to no longer depend on
event runtime.
Tested:
1. `perf all metrics test` did not crash while paranoid is 2.
2. Multiple combinations with `CPUs_utilized` while paranoid is 2.
$ ./perf stat -M CPUs_utilized -a -- sleep 1
Performance counter stats for 'system wide':
<not supported> msec cpu-clock:u # nan CPUs CPUs_utilized
1,006,356,120 duration_time
1.004375550 seconds time elapsed
$ ./perf stat -M CPUs_utilized -a -j -- sleep 1
{"counter-value" : "<not supported>", "unit" : "msec", "event" : "cpu-clock:u", "event-runtime" : 0, "pcnt-running" : 100.00, "metric-value" : "nan", "metric-unit" : "CPUs CPUs_utilized"}
{"counter-value" : "1006642462.000000", "unit" : "", "event" : "duration_time", "event-runtime" : 1, "pcnt-running" : 100.00}
$ ./perf stat -M CPUs_utilized -a --metric-only -- sleep 1
Performance counter stats for 'system wide':
CPUs CPUs_utilized
nan
1.004424652 seconds time elapsed
$ ./perf stat -M CPUs_utilized -a --metric-only -j -- sleep 1
{"CPUs CPUs_utilized" : "none"}
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Chun-Tse Shao <ctshao@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Stable-dep-of: 63b320aaac08 ("perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/stat-display.c | 59 +++++++++++++++-------------------
tools/perf/util/stat-shadow.c | 8 ++---
tools/perf/util/stat.h | 2 +-
3 files changed, 29 insertions(+), 40 deletions(-)
diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
index 6d02f84c5691a..f4bd579908b43 100644
--- a/tools/perf/util/stat-display.c
+++ b/tools/perf/util/stat-display.c
@@ -820,12 +820,6 @@ static void printout(struct perf_stat_config *config, struct outstate *os,
}
if (run == 0 || ena == 0 || counter->counts->scaled == -1) {
- if (config->metric_only) {
- pm(config, os, METRIC_THRESHOLD_UNKNOWN, /*format=*/NULL,
- /*unit=*/NULL, /*val=*/0);
- return;
- }
-
ok = false;
if (counter->supported) {
@@ -848,33 +842,32 @@ static void printout(struct perf_stat_config *config, struct outstate *os,
print_running(config, os, run, ena, /*before_metric=*/true);
}
- if (ok) {
- if (!config->metric_only && counter->default_metricgroup && !counter->default_show_events) {
- void *from = NULL;
-
- aggr_printout(config, os, os->evsel, os->id, os->aggr_nr);
- /* Print out all the metricgroup with the same metric event. */
- do {
- int num = 0;
-
- /* Print out the new line for the next new metricgroup. */
- if (from) {
- if (config->json_output)
- new_line_json(config, (void *)os);
- else
- __new_line_std_csv(config, os);
- }
-
- print_noise(config, os, counter, noise, /*before_metric=*/true);
- print_running(config, os, run, ena, /*before_metric=*/true);
- from = perf_stat__print_shadow_stats_metricgroup(config, counter, aggr_idx,
- &num, from, &out);
- } while (from != NULL);
- } else {
- perf_stat__print_shadow_stats(config, counter, aggr_idx, &out);
- }
+ if (!config->metric_only && counter->default_metricgroup &&
+ !counter->default_show_events) {
+ void *from = NULL;
+
+ aggr_printout(config, os, os->evsel, os->id, os->aggr_nr);
+ /* Print out all the metricgroup with the same metric event. */
+ do {
+ int num = 0;
+
+ /* Print out the new line for the next new metricgroup. */
+ if (from) {
+ if (config->json_output)
+ new_line_json(config, (void *)os);
+ else
+ __new_line_std_csv(config, os);
+ }
+
+ print_noise(config, os, counter, noise,
+ /*before_metric=*/true);
+ print_running(config, os, run, ena,
+ /*before_metric=*/true);
+ from = perf_stat__print_shadow_stats_metricgroup(
+ config, counter, aggr_idx, &num, from, &out);
+ } while (from != NULL);
} else {
- pm(config, os, METRIC_THRESHOLD_UNKNOWN, /*format=*/NULL, /*unit=*/NULL, /*val=*/0);
+ perf_stat__print_shadow_stats(config, counter, aggr_idx, &out);
}
if (!config->metric_only) {
@@ -987,7 +980,7 @@ static void print_counter_aggrdata(struct perf_stat_config *config,
ena = aggr->counts.ena;
run = aggr->counts.run;
- if (perf_stat__skip_metric_event(counter, ena, run))
+ if (perf_stat__skip_metric_event(counter))
return;
if (val == 0 && should_skip_zero_counter(config, counter, &id))
diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
index 9c83f7d96caa4..5d8d09e0e6ae5 100644
--- a/tools/perf/util/stat-shadow.c
+++ b/tools/perf/util/stat-shadow.c
@@ -83,7 +83,7 @@ static int prepare_metric(struct perf_stat_config *config,
}
/* Time events are always on CPU0, the first aggregation index. */
aggr = &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx];
- if (!aggr || !metric_events[i]->supported) {
+ if (!aggr || !metric_events[i]->supported || aggr->counts.run == 0) {
/*
* Not supported events will have a count of 0, which
* can be confusing in a metric. Explicitly set the
@@ -335,14 +335,10 @@ void perf_stat__print_shadow_stats(struct perf_stat_config *config,
* perf_stat__skip_metric_event - Skip the evsel in the Default metricgroup,
* if it's not running or not the metric event.
*/
-bool perf_stat__skip_metric_event(struct evsel *evsel,
- u64 ena, u64 run)
+bool perf_stat__skip_metric_event(struct evsel *evsel)
{
if (!evsel->default_metricgroup)
return false;
- if (!ena || !run)
- return true;
-
return !metricgroup__lookup(&evsel->evlist->metric_events, evsel, false);
}
diff --git a/tools/perf/util/stat.h b/tools/perf/util/stat.h
index f986911c9296e..4bced233d2fc0 100644
--- a/tools/perf/util/stat.h
+++ b/tools/perf/util/stat.h
@@ -163,7 +163,7 @@ void perf_stat__print_shadow_stats(struct perf_stat_config *config,
struct evsel *evsel,
int aggr_idx,
struct perf_stat_output_ctx *out);
-bool perf_stat__skip_metric_event(struct evsel *evsel, u64 ena, u64 run);
+bool perf_stat__skip_metric_event(struct evsel *evsel);
void *perf_stat__print_shadow_stats_metricgroup(struct perf_stat_config *config,
struct evsel *evsel,
int aggr_idx,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 030/844] perf stat: Ensure metrics are displayed even with failed events
2026-02-28 17:19 ` [PATCH 6.19 030/844] perf stat: Ensure metrics are displayed even with failed events Sasha Levin
@ 2026-03-02 7:09 ` Jiri Slaby
2026-03-02 13:59 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Jiri Slaby @ 2026-03-02 7:09 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Chun-Tse Shao, Ian Rogers, Adrian Hunter, Alexander Shishkin,
Ingo Molnar, James Clark, Jiri Olsa, Kan Liang, Mark Rutland,
Namhyung Kim, Peter Zijlstra, Yang Li, Arnaldo Carvalho de Melo
On 28. 02. 26, 18:19, Sasha Levin wrote:
> From: Chun-Tse Shao <ctshao@google.com>
>
> [ Upstream commit bb5a920b9099127915706fdd23eb540c9a69c338 ]
And finally, this one needs the below to fix the test:
ff9aeb6bd14d perf test parse-metric: Ensure aggregate counts appear to
have run
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 030/844] perf stat: Ensure metrics are displayed even with failed events
2026-03-02 7:09 ` Jiri Slaby
@ 2026-03-02 13:59 ` Sasha Levin
0 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-03-02 13:59 UTC (permalink / raw)
To: Jiri Slaby
Cc: linux-kernel, stable, Chun-Tse Shao, Ian Rogers, Adrian Hunter,
Alexander Shishkin, Ingo Molnar, James Clark, Jiri Olsa,
Kan Liang, Mark Rutland, Namhyung Kim, Peter Zijlstra, Yang Li,
Arnaldo Carvalho de Melo
On Mon, Mar 02, 2026 at 08:09:11AM +0100, Jiri Slaby wrote:
>On 28. 02. 26, 18:19, Sasha Levin wrote:
>>From: Chun-Tse Shao <ctshao@google.com>
>>
>>[ Upstream commit bb5a920b9099127915706fdd23eb540c9a69c338 ]
>
>And finally, this one needs the below to fix the test:
>ff9aeb6bd14d perf test parse-metric: Ensure aggregate counts appear to
>have run
Queued up, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* [PATCH 6.19 031/844] perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (29 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 030/844] perf stat: Ensure metrics are displayed even with failed events Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 032/844] io_uring: add IORING_OP_URING_CMD128 to opcode checks Sasha Levin
` (821 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Andres Freund, Adrian Hunter, Alexander Shishkin,
Andi Kleen, Dapeng Mi, Dr. David Alan Gilbert, Ingo Molnar,
James Clark, Jiri Olsa, Namhyung Kim, Peter Zijlstra,
Thomas Falcon, Thomas Richter, Yang Li, Arnaldo Carvalho de Melo,
Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 63b320aaac08ba267268ec21a195ce3c82dcb8ab ]
The aggr value is setup to always be non-null creating a redundant
guard for reading from it. Switch to using the perf_stat_evsel (ps)
and narrow the scope of aggr so that it is known valid when used.
Fixes: 3d65f6445fd93e3e ("perf stat-shadow: Read tool events directly")
Reported-by: Andres Freund <andres@anarazel.de>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Falcon <thomas.falcon@intel.com>
Cc: Thomas Richter <tmricht@linux.ibm.com>
Cc: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/stat-shadow.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
index 5d8d09e0e6ae5..59d2cd4f2188d 100644
--- a/tools/perf/util/stat-shadow.c
+++ b/tools/perf/util/stat-shadow.c
@@ -57,7 +57,6 @@ static int prepare_metric(struct perf_stat_config *config,
bool is_tool_time =
tool_pmu__is_time_event(config, metric_events[i], &tool_aggr_idx);
struct perf_stat_evsel *ps = metric_events[i]->stats;
- struct perf_stat_aggr *aggr;
char *n;
double val;
@@ -82,8 +81,7 @@ static int prepare_metric(struct perf_stat_config *config,
}
}
/* Time events are always on CPU0, the first aggregation index. */
- aggr = &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx];
- if (!aggr || !metric_events[i]->supported || aggr->counts.run == 0) {
+ if (!ps || !metric_events[i]->supported) {
/*
* Not supported events will have a count of 0, which
* can be confusing in a metric. Explicitly set the
@@ -93,11 +91,21 @@ static int prepare_metric(struct perf_stat_config *config,
val = NAN;
source_count = 0;
} else {
- val = aggr->counts.val;
- if (is_tool_time)
- val *= 1e-9; /* Convert time event nanoseconds to seconds. */
- if (!source_count)
- source_count = evsel__source_count(metric_events[i]);
+ struct perf_stat_aggr *aggr =
+ &ps->aggr[is_tool_time ? tool_aggr_idx : aggr_idx];
+
+ if (aggr->counts.run == 0) {
+ val = NAN;
+ source_count = 0;
+ } else {
+ val = aggr->counts.val;
+ if (is_tool_time) {
+ /* Convert time event nanoseconds to seconds. */
+ val *= 1e-9;
+ }
+ if (!source_count)
+ source_count = evsel__source_count(metric_events[i]);
+ }
}
n = strdup(evsel__metric_id(metric_events[i]));
if (!n)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 032/844] io_uring: add IORING_OP_URING_CMD128 to opcode checks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (30 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 031/844] perf stat-shadow: In prepare_metric fix guard on reading NULL perf_stat_evsel Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 033/844] rtc: interface: Alarm race handling should not discard preceding error Sasha Levin
` (820 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Caleb Sander Mateos, Anuj Gupta, Kanchan Joshi, Jens Axboe,
Sasha Levin
From: Caleb Sander Mateos <csander@purestorage.com>
[ Upstream commit 42a6bd57ee9f930a72c26f863c72f666d6ed9ea5 ]
io_should_commit(), io_uring_classic_poll(), and io_do_iopoll() compare
struct io_kiocb's opcode against IORING_OP_URING_CMD to implement
special treatment for uring_cmds. The recently added opcode
IORING_OP_URING_CMD128 is meant to be equivalent to IORING_OP_URING_CMD,
so treat it the same way in these functions.
Fixes: 1cba30bf9fdd ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.h | 6 ++++++
io_uring/kbuf.c | 2 +-
io_uring/rw.c | 4 ++--
3 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index a790c16854d32..0f096f44d34bf 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -595,6 +595,12 @@ static inline bool io_file_can_poll(struct io_kiocb *req)
return false;
}
+static inline bool io_is_uring_cmd(const struct io_kiocb *req)
+{
+ return req->opcode == IORING_OP_URING_CMD ||
+ req->opcode == IORING_OP_URING_CMD128;
+}
+
static inline ktime_t io_get_time(struct io_ring_ctx *ctx)
{
if (ctx->clockid == CLOCK_MONOTONIC)
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 67d4fe576473a..dae5b4ab3819c 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -171,7 +171,7 @@ static bool io_should_commit(struct io_kiocb *req, unsigned int issue_flags)
return true;
/* uring_cmd commits kbuf upfront, no need to auto-commit */
- if (!io_file_can_poll(req) && req->opcode != IORING_OP_URING_CMD)
+ if (!io_file_can_poll(req) && !io_is_uring_cmd(req))
return true;
return false;
}
diff --git a/io_uring/rw.c b/io_uring/rw.c
index 28555bc85ba0f..01367ac09531a 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -1253,7 +1253,7 @@ static int io_uring_classic_poll(struct io_kiocb *req, struct io_comp_batch *iob
{
struct file *file = req->file;
- if (req->opcode == IORING_OP_URING_CMD) {
+ if (io_is_uring_cmd(req)) {
struct io_uring_cmd *ioucmd;
ioucmd = io_kiocb_to_cmd(req, struct io_uring_cmd);
@@ -1376,7 +1376,7 @@ int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
break;
nr_events++;
req->cqe.flags = io_put_kbuf(req, req->cqe.res, NULL);
- if (req->opcode != IORING_OP_URING_CMD)
+ if (!io_is_uring_cmd(req))
io_req_rw_cleanup(req, 0);
}
if (unlikely(!nr_events))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 033/844] rtc: interface: Alarm race handling should not discard preceding error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (31 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 032/844] io_uring: add IORING_OP_URING_CMD128 to opcode checks Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 034/844] statmount: permission check should return EPERM Sasha Levin
` (819 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Anthony Pighin (Nokia), Esben Haabendal, Nick Bowler,
Alexandre Belloni, Sasha Levin
From: "Anthony Pighin (Nokia)" <anthony.pighin@nokia.com>
[ Upstream commit 81be22cd4ace020045cc6d31255c6f7c071eb7c0 ]
Commit 795cda8338ea ("rtc: interface: Fix long-standing race when setting
alarm") should not discard any errors from the preceding validations.
Prior to that commit, if the alarm feature was disabled, or the
set_alarm failed, a meaningful error code would be returned to the
caller for further action.
After, more often than not, the __rtc_read_time will cause a success
return code instead, misleading the caller.
An example of this is when timer_enqueue is called for a rtc-abx080x
device. Since that driver does not clear the alarm feature bit, but
instead relies on the set_alarm operation to return invalid, the discard
of the return code causes very different behaviour; i.e.
hwclock: select() to /dev/rtc0 to wait for clock tick timed out
Fixes: 795cda8338ea ("rtc: interface: Fix long-standing race when setting alarm")
Signed-off-by: Anthony Pighin (Nokia) <anthony.pighin@nokia.com>
Reviewed-by: Esben Haabendal <esben@geanix.com>
Tested-by: Nick Bowler <nbowler@draconx.ca>
Link: https://patch.msgid.link/BN0PR08MB6951415A751F236375A2945683D1A@BN0PR08MB6951.namprd08.prod.outlook.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/interface.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index b8b298efd9a9c..1906f4884a834 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -457,7 +457,7 @@ static int __rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
* are in, we can return -ETIME to signal that the timer has already
* expired, which is true in both cases.
*/
- if ((scheduled - now) <= 1) {
+ if (!err && (scheduled - now) <= 1) {
err = __rtc_read_time(rtc, &tm);
if (err)
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 034/844] statmount: permission check should return EPERM
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (32 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 033/844] rtc: interface: Alarm race handling should not discard preceding error Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 035/844] hfsplus: fix volume corruption issue for generic/480 Sasha Levin
` (818 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bhavik Sachdev, Miklos Szeredi, Christian Brauner, Sasha Levin
From: Bhavik Sachdev <b.sachdev1904@gmail.com>
[ Upstream commit fccbe38a5d06dbe44bcd89196fe1d2c2272a1f4a ]
Currently, statmount() returns ENOENT when caller is not CAP_SYS_ADMIN
in the user namespace owner of target mount namespace. This should be
EPERM instead.
Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Bhavik Sachdev <b.sachdev1904@gmail.com>
Link: https://patch.msgid.link/20251129091455.757724-2-b.sachdev1904@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index c58674a20cad5..f6879f282daec 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5780,7 +5780,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
!ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
- return -ENOENT;
+ return -EPERM;
ks = kmalloc(sizeof(*ks), GFP_KERNEL_ACCOUNT);
if (!ks)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 035/844] hfsplus: fix volume corruption issue for generic/480
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (33 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 034/844] statmount: permission check should return EPERM Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 036/844] audit: add fchmodat2() to change attributes class Sasha Levin
` (817 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Viacheslav Dubeyko, John Paul Adrian Glaubitz, Yangtao Li,
linux-fsdevel, Sasha Levin
From: Viacheslav Dubeyko <slava@dubeyko.com>
[ Upstream commit bea4429eb30190c59b5ac7c8ff6c90176c7c110f ]
The xfstests' test-case generic/480 leaves HFS+ volume
in corrupted state:
sudo ./check generic/480
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.17.0-rc1+ #4 SMP PREEMPT_DYNAMIC Wed Oct 1 15:02:44 PDT 2025
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/480 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
(see XFSTESTS-2/xfstests-dev/results//generic/480.full for details)
Ran: generic/480
Failures: generic/480
Failed 1 of 1 tests
sudo fsck.hfsplus -d /dev/loop51
** /dev/loop51
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking non-journaled HFS Plus Volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking multi-linked files.
CheckHardLinks: found 1 pre-Leopard file inodes.
Incorrect number of file hard links
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
invalid VHB nextCatalogID
Volume header needs minor repair
(2, 0)
Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000
CBTStat = 0x0000 CatStat = 0x00000002
** Repairing volume.
Incorrect flags for file hard link (id = 19)
(It should be 0x22 instead of 0x2)
Incorrect flags for file inode (id = 18)
(It should be 0x22 instead of 0x2)
first link ID=0 is < 16 for fileinode=18
Error getting first link ID for inode = 18 (result=2)
Invalid first link in hard link chain (id = 18)
(It should be 19 instead of 0)
Indirect node 18 needs link count adjustment
(It should be 1 instead of 2)
** Rechecking volume.
** Checking non-journaled HFS Plus Volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking multi-linked files.
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled was repaired successfully.
The generic/480 test executes such steps on final phase:
"Now remove of the links of our file and create
a new file with the same name and in the same
parent directory, and finally fsync this new file."
unlink $SCRATCH_MNT/testdir/bar
touch $SCRATCH_MNT/testdir/bar
$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/testdir/bar
"Simulate a power failure and mount the filesystem
to check that replaying the fsync log/journal
succeeds, that is the mount operation does not fail."
_flakey_drop_and_remount
The key issue in HFS+ logic is that hfsplus_link(),
hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
and hfsplus_mknod() methods don't call
hfsplus_cat_write_inode() for the case of modified
inode objects. As a result, even if hfsplus_file_fsync()
is trying to flush the dirty Catalog File, but because of
not calling hfsplus_cat_write_inode() not all modified
inodes save the new state into Catalog File's records.
Finally, simulation of power failure results in inconsistent
state of Catalog File and FSCK tool reports about
volume corruption.
This patch adds calling of hfsplus_cat_write_inode()
method for modified inodes in hfsplus_link(),
hfsplus_unlink(), hfsplus_rmdir(), hfsplus_symlink(),
and hfsplus_mknod() methods. Also, it adds debug output
in several methods.
sudo ./check generic/480
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/480 16s ... 16s
Ran: generic/480
Passed all 1 tests
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/20251205000054.3670326-1-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/dir.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
fs/hfsplus/inode.c | 5 +++++
2 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index cadf0b5f93422..ca5f74a140ec1 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -313,6 +313,9 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
if (!S_ISREG(inode->i_mode))
return -EPERM;
+ hfs_dbg("src_dir->i_ino %lu, dst_dir->i_ino %lu, inode->i_ino %lu\n",
+ src_dir->i_ino, dst_dir->i_ino, inode->i_ino);
+
mutex_lock(&sbi->vh_mutex);
if (inode->i_ino == (u32)(unsigned long)src_dentry->d_fsdata) {
for (;;) {
@@ -332,7 +335,7 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
cnid = sbi->next_cnid++;
src_dentry->d_fsdata = (void *)(unsigned long)cnid;
res = hfsplus_create_cat(cnid, src_dir,
- &src_dentry->d_name, inode);
+ &src_dentry->d_name, inode);
if (res)
/* panic? */
goto out;
@@ -350,6 +353,21 @@ static int hfsplus_link(struct dentry *src_dentry, struct inode *dst_dir,
mark_inode_dirty(inode);
sbi->file_count++;
hfsplus_mark_mdb_dirty(dst_dir->i_sb);
+
+ res = hfsplus_cat_write_inode(src_dir);
+ if (res)
+ goto out;
+
+ res = hfsplus_cat_write_inode(dst_dir);
+ if (res)
+ goto out;
+
+ res = hfsplus_cat_write_inode(sbi->hidden_dir);
+ if (res)
+ goto out;
+
+ res = hfsplus_cat_write_inode(inode);
+
out:
mutex_unlock(&sbi->vh_mutex);
return res;
@@ -367,6 +385,9 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
if (HFSPLUS_IS_RSRC(inode))
return -EPERM;
+ hfs_dbg("dir->i_ino %lu, inode->i_ino %lu\n",
+ dir->i_ino, inode->i_ino);
+
mutex_lock(&sbi->vh_mutex);
cnid = (u32)(unsigned long)dentry->d_fsdata;
if (inode->i_ino == cnid &&
@@ -408,6 +429,15 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
inode_set_ctime_current(inode);
mark_inode_dirty(inode);
out:
+ if (!res) {
+ res = hfsplus_cat_write_inode(dir);
+ if (!res) {
+ res = hfsplus_cat_write_inode(sbi->hidden_dir);
+ if (!res)
+ res = hfsplus_cat_write_inode(inode);
+ }
+ }
+
mutex_unlock(&sbi->vh_mutex);
return res;
}
@@ -429,6 +459,8 @@ static int hfsplus_rmdir(struct inode *dir, struct dentry *dentry)
inode_set_ctime_current(inode);
hfsplus_delete_inode(inode);
mark_inode_dirty(inode);
+
+ res = hfsplus_cat_write_inode(dir);
out:
mutex_unlock(&sbi->vh_mutex);
return res;
@@ -465,6 +497,12 @@ static int hfsplus_symlink(struct mnt_idmap *idmap, struct inode *dir,
hfsplus_instantiate(dentry, inode, inode->i_ino);
mark_inode_dirty(inode);
+
+ res = hfsplus_cat_write_inode(dir);
+ if (res)
+ goto out;
+
+ res = hfsplus_cat_write_inode(inode);
goto out;
out_err:
@@ -506,6 +544,12 @@ static int hfsplus_mknod(struct mnt_idmap *idmap, struct inode *dir,
hfsplus_instantiate(dentry, inode, inode->i_ino);
mark_inode_dirty(inode);
+
+ res = hfsplus_cat_write_inode(dir);
+ if (res)
+ goto out;
+
+ res = hfsplus_cat_write_inode(inode);
goto out;
failed_mknod:
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index 7ae6745ca7ae1..c762bf909d1aa 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -328,6 +328,9 @@ int hfsplus_file_fsync(struct file *file, loff_t start, loff_t end,
struct hfsplus_vh *vhdr = sbi->s_vhdr;
int error = 0, error2;
+ hfs_dbg("inode->i_ino %lu, start %llu, end %llu\n",
+ inode->i_ino, start, end);
+
error = file_write_and_wait_range(file, start, end);
if (error)
return error;
@@ -616,6 +619,8 @@ int hfsplus_cat_write_inode(struct inode *inode)
hfsplus_cat_entry entry;
int res = 0;
+ hfs_dbg("inode->i_ino %lu\n", inode->i_ino);
+
if (HFSPLUS_IS_RSRC(inode))
main_inode = HFSPLUS_I(inode)->rsrc_inode;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 036/844] audit: add fchmodat2() to change attributes class
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (34 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 035/844] hfsplus: fix volume corruption issue for generic/480 Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 037/844] hfsplus: fix volume corruption issue for generic/498 Sasha Levin
` (816 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jeffrey Bencteux, Paul Moore, Sasha Levin
From: Jeffrey Bencteux <jeff@bencteux.fr>
[ Upstream commit 4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc ]
fchmodat2(), introduced in version 6.6 is currently not in the change
attribute class of audit. Calling fchmodat2() to change a file
attribute in the same fashion than chmod() or fchmodat() will bypass
audit rules such as:
-w /tmp/test -p rwa -k test_rwa
The current patch adds fchmodat2() to the change attributes class.
Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/asm-generic/audit_change_attr.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/include/asm-generic/audit_change_attr.h b/include/asm-generic/audit_change_attr.h
index cc840537885fb..ddd90bbe40dfc 100644
--- a/include/asm-generic/audit_change_attr.h
+++ b/include/asm-generic/audit_change_attr.h
@@ -26,6 +26,9 @@ __NR_fremovexattr,
__NR_fchownat,
__NR_fchmodat,
#endif
+#ifdef __NR_fchmodat2
+__NR_fchmodat2,
+#endif
#ifdef __NR_chown32
__NR_chown32,
__NR_fchown32,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 037/844] hfsplus: fix volume corruption issue for generic/498
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (35 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 036/844] audit: add fchmodat2() to change attributes class Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 038/844] fs/buffer: add alert in try_to_free_buffers() for folios without buffers Sasha Levin
` (815 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Viacheslav Dubeyko, John Paul Adrian Glaubitz, Yangtao Li,
linux-fsdevel, Sasha Levin
From: Viacheslav Dubeyko <slava@dubeyko.com>
[ Upstream commit 9a8c4ad44721da4c48e1ff240ac76286c82837fe ]
The xfstests' test-case generic/498 leaves HFS+ volume
in corrupted state:
sudo ./check generic/498
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #18 SMP PREEMPT_DYNAMIC Thu Dec 4 12:24:45 PST 2025
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/498 _check_generic_filesystem: filesystem on /dev/loop51 is inconsistent
(see XFSTESTS-2/xfstests-dev/results//generic/498.full for details)
Ran: generic/498
Failures: generic/498
Failed 1 of 1 tests
sudo fsck.hfsplus -d /dev/loop51
** /dev/loop51
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking non-journaled HFS Plus Volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
Invalid leaf record count
(It should be 16 instead of 2)
** Checking multi-linked files.
CheckHardLinks: found 1 pre-Leopard file inodes.
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000
CBTStat = 0x8000 CatStat = 0x00000000
** Repairing volume.
** Rechecking volume.
** Checking non-journaled HFS Plus Volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking multi-linked files.
CheckHardLinks: found 1 pre-Leopard file inodes.
** Checking catalog hierarchy.
** Checking extended attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled was repaired successfully.
The generic/498 test executes such steps on final phase:
mkdir $SCRATCH_MNT/A
mkdir $SCRATCH_MNT/B
mkdir $SCRATCH_MNT/A/C
touch $SCRATCH_MNT/B/foo
$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/B/foo
ln $SCRATCH_MNT/B/foo $SCRATCH_MNT/A/C/foo
$XFS_IO_PROG -c "fsync" $SCRATCH_MNT/A
"Simulate a power failure and mount the filesystem
to check that what we explicitly fsync'ed exists."
_flakey_drop_and_remount
The FSCK tool complains about "Invalid leaf record count".
HFS+ b-tree header contains leaf_count field is updated
by hfs_brec_insert() and hfs_brec_remove(). The hfs_brec_insert()
is involved into hard link creation process. However,
modified in-core leaf_count field is stored into HFS+
b-tree header by hfs_btree_write() method. But,
unfortunately, hfs_btree_write() hasn't been called
by hfsplus_cat_write_inode() and hfsplus_file_fsync()
stores not fully consistent state of the Catalog File's
b-tree.
This patch adds calling hfs_btree_write() method in
the hfsplus_cat_write_inode() with the goal of
storing consistent state of Catalog File's b-tree.
Finally, it makes FSCK tool happy.
sudo ./check generic/498
FSTYP -- hfsplus
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.18.0-rc1+ #22 SMP PREEMPT_DYNAMIC Sat Dec 6 17:01:31 PST 2025
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch
generic/498 33s ... 31s
Ran: generic/498
Passed all 1 tests
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/20251207035821.3863657-1-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/inode.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index c762bf909d1aa..6153e5cc6eb65 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -615,6 +615,7 @@ int hfsplus_cat_read_inode(struct inode *inode, struct hfs_find_data *fd)
int hfsplus_cat_write_inode(struct inode *inode)
{
struct inode *main_inode = inode;
+ struct hfs_btree *tree = HFSPLUS_SB(inode->i_sb)->cat_tree;
struct hfs_find_data fd;
hfsplus_cat_entry entry;
int res = 0;
@@ -627,7 +628,7 @@ int hfsplus_cat_write_inode(struct inode *inode)
if (!main_inode->i_nlink)
return 0;
- if (hfs_find_init(HFSPLUS_SB(main_inode->i_sb)->cat_tree, &fd))
+ if (hfs_find_init(tree, &fd))
/* panic? */
return -EIO;
@@ -692,6 +693,15 @@ int hfsplus_cat_write_inode(struct inode *inode)
set_bit(HFSPLUS_I_CAT_DIRTY, &HFSPLUS_I(inode)->flags);
out:
hfs_find_exit(&fd);
+
+ if (!res) {
+ res = hfs_btree_write(tree);
+ if (res) {
+ pr_err("b-tree write err: %d, ino %lu\n",
+ res, inode->i_ino);
+ }
+ }
+
return res;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 038/844] fs/buffer: add alert in try_to_free_buffers() for folios without buffers
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (36 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 037/844] hfsplus: fix volume corruption issue for generic/498 Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 039/844] kselftest/kublk: include message in _Static_assert for C11 compatibility Sasha Levin
` (814 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Deepakkumar Karn, Jan Kara, Christian Brauner, Sasha Levin
From: Deepakkumar Karn <dkarn@redhat.com>
[ Upstream commit b68f91ef3b3fe82ad78c417de71b675699a8467c ]
try_to_free_buffers() can be called on folios with no buffers attached
when filemap_release_folio() is invoked on a folio belonging to a mapping
with AS_RELEASE_ALWAYS set but no release_folio operation defined.
In such cases, folio_needs_release() returns true because of the
AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
causes try_to_free_buffers() to call drop_buffers() on a folio with no
buffers, leading to a null pointer dereference.
Adding a check in try_to_free_buffers() to return early if the folio has no
buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
This provides defensive hardening.
Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
Link: https://patch.msgid.link/20251211131211.308021-1-dkarn@redhat.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/buffer.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/buffer.c b/fs/buffer.c
index 838c0c5710229..28e4d53f17173 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2948,6 +2948,10 @@ bool try_to_free_buffers(struct folio *folio)
if (folio_test_writeback(folio))
return false;
+ /* Misconfigured folio check */
+ if (WARN_ON_ONCE(!folio_buffers(folio)))
+ return true;
+
if (mapping == NULL) { /* can this still happen? */
ret = drop_buffers(folio, &buffers_to_free);
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 039/844] kselftest/kublk: include message in _Static_assert for C11 compatibility
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (37 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 038/844] fs/buffer: add alert in try_to_free_buffers() for folios without buffers Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 040/844] hfs: Replace BUG_ON with error handling for CNID count checks Sasha Levin
` (813 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Clint George, Ming Lei, Shuah Khan, Sasha Levin
From: Clint George <clintbgeorge@gmail.com>
[ Upstream commit 3e6ad272bb8b3199bad952e7b077102af2d8df03 ]
Add descriptive message in the _Static_assert to comply with the C11
standard requirement to prevent compiler from throwing out error. The
compiler throws an error when _Static_assert is used without a message as
that is a C23 extension.
[] Testing:
The diff between before and after of running the kselftest test of the
module shows no regression on system with x86 architecture
[] Error log:
~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk$ make LLVM=1 W=1
CC kublk
In file included from kublk.c:6:
./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
| ^
| , ""
1 error generated.
In file included from null.c:3:
./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
| ^
| , ""
1 error generated.
In file included from file_backed.c:3:
./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
| ^
| , ""
1 error generated.
In file included from common.c:3:
./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
| ^
| , ""
1 error generated.
In file included from stripe.c:3:
./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
| ^
| , ""
1 error generated.
In file included from fault_inject.c:11:
./kublk.h:220:43: error: '_Static_assert' with no message is a C23 extension [-Werror,-Wc23-extensions]
220 | _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
| ^
| , ""
1 error generated.
make: *** [../lib.mk:225: ~/Desktop/kernel-dev/linux-v1/tools/testing/selftests/ublk/kublk] Error 1
Link: https://lore.kernel.org/r/20251215085022.7642-1-clintbgeorge@gmail.com
Signed-off-by: Clint George <clintbgeorge@gmail.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ublk/kublk.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ublk/kublk.h b/tools/testing/selftests/ublk/kublk.h
index 8a83b90ec603a..cae2e30f0cdd5 100644
--- a/tools/testing/selftests/ublk/kublk.h
+++ b/tools/testing/selftests/ublk/kublk.h
@@ -223,7 +223,7 @@ static inline __u64 build_user_data(unsigned tag, unsigned op,
unsigned tgt_data, unsigned q_id, unsigned is_target_io)
{
/* we only have 7 bits to encode q_id */
- _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7);
+ _Static_assert(UBLK_MAX_QUEUES_SHIFT <= 7, "UBLK_MAX_QUEUES_SHIFT must be <= 7");
assert(!(tag >> 16) && !(op >> 8) && !(tgt_data >> 16) && !(q_id >> 7));
return tag | (op << 16) | (tgt_data << 24) |
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 040/844] hfs: Replace BUG_ON with error handling for CNID count checks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (38 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 039/844] kselftest/kublk: include message in _Static_assert for C11 compatibility Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 041/844] audit: add missing syscalls to read class Sasha Levin
` (812 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jori Koolstra, syzbot+17cc9bb6d8d69b4139f0, Viacheslav Dubeyko,
Sasha Levin
From: Jori Koolstra <jkoolstra@xs4all.nl>
[ Upstream commit b226804532a875c10276168dc55ce752944096bd ]
In a06ec283e125 next_id, folder_count, and file_count in the super block
info were expanded to 64 bits, and BUG_ONs were added to detect
overflow. This triggered an error reported by syzbot: if the MDB is
corrupted, the BUG_ON is triggered. This patch replaces this mechanism
with proper error handling and resolves the syzbot reported bug.
Singed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Reported-by: syzbot+17cc9bb6d8d69b4139f0@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=17cc9bb6d8d69b4139f0
Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20251220191006.2465256-1-jkoolstra@xs4all.nl
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfs/dir.c | 15 +++++++++++----
fs/hfs/hfs_fs.h | 1 +
fs/hfs/inode.c | 30 ++++++++++++++++++++++++------
fs/hfs/mdb.c | 31 +++++++++++++++++++++++++++----
fs/hfs/super.c | 3 +++
5 files changed, 66 insertions(+), 14 deletions(-)
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index 86a6b317b474a..0c615c078650c 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -196,8 +196,8 @@ static int hfs_create(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, mode);
- if (!inode)
- return -ENOMEM;
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -226,8 +226,8 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
int res;
inode = hfs_new_inode(dir, &dentry->d_name, S_IFDIR | mode);
- if (!inode)
- return ERR_PTR(-ENOMEM);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
res = hfs_cat_create(inode->i_ino, dir, &dentry->d_name, inode);
if (res) {
@@ -254,11 +254,18 @@ static struct dentry *hfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
*/
static int hfs_remove(struct inode *dir, struct dentry *dentry)
{
+ struct super_block *sb = dir->i_sb;
struct inode *inode = d_inode(dentry);
int res;
if (S_ISDIR(inode->i_mode) && inode->i_size != 2)
return -ENOTEMPTY;
+
+ if (unlikely(!is_hfs_cnid_counts_valid(sb))) {
+ pr_err("cannot remove file/folder\n");
+ return -ERANGE;
+ }
+
res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name);
if (res)
return res;
diff --git a/fs/hfs/hfs_fs.h b/fs/hfs/hfs_fs.h
index e94dbc04a1e43..ac0e83f77a0f1 100644
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -199,6 +199,7 @@ extern void hfs_delete_inode(struct inode *inode);
extern const struct xattr_handler * const hfs_xattr_handlers[];
/* mdb.c */
+extern bool is_hfs_cnid_counts_valid(struct super_block *sb);
extern int hfs_mdb_get(struct super_block *sb);
extern void hfs_mdb_commit(struct super_block *sb);
extern void hfs_mdb_close(struct super_block *sb);
diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index 524db1389737d..878535db64d67 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -187,16 +187,23 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
s64 next_id;
s64 file_count;
s64 folder_count;
+ int err = -ENOMEM;
if (!inode)
- return NULL;
+ goto out_err;
+
+ err = -ERANGE;
mutex_init(&HFS_I(inode)->extents_lock);
INIT_LIST_HEAD(&HFS_I(inode)->open_dir_list);
spin_lock_init(&HFS_I(inode)->open_dir_lock);
hfs_cat_build_key(sb, (btree_key *)&HFS_I(inode)->cat_key, dir->i_ino, name);
next_id = atomic64_inc_return(&HFS_SB(sb)->next_id);
- BUG_ON(next_id > U32_MAX);
+ if (next_id > U32_MAX) {
+ atomic64_dec(&HFS_SB(sb)->next_id);
+ pr_err("cannot create new inode: next CNID exceeds limit\n");
+ goto out_discard;
+ }
inode->i_ino = (u32)next_id;
inode->i_mode = mode;
inode->i_uid = current_fsuid();
@@ -210,7 +217,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
if (S_ISDIR(mode)) {
inode->i_size = 2;
folder_count = atomic64_inc_return(&HFS_SB(sb)->folder_count);
- BUG_ON(folder_count > U32_MAX);
+ if (folder_count> U32_MAX) {
+ atomic64_dec(&HFS_SB(sb)->folder_count);
+ pr_err("cannot create new inode: folder count exceeds limit\n");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_dirs++;
inode->i_op = &hfs_dir_inode_operations;
@@ -220,7 +231,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
} else if (S_ISREG(mode)) {
HFS_I(inode)->clump_blocks = HFS_SB(sb)->clumpablks;
file_count = atomic64_inc_return(&HFS_SB(sb)->file_count);
- BUG_ON(file_count > U32_MAX);
+ if (file_count > U32_MAX) {
+ atomic64_dec(&HFS_SB(sb)->file_count);
+ pr_err("cannot create new inode: file count exceeds limit\n");
+ goto out_discard;
+ }
if (dir->i_ino == HFS_ROOT_CNID)
HFS_SB(sb)->root_files++;
inode->i_op = &hfs_file_inode_operations;
@@ -244,6 +259,11 @@ struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name, umode_t
hfs_mark_mdb_dirty(sb);
return inode;
+
+ out_discard:
+ iput(inode);
+ out_err:
+ return ERR_PTR(err);
}
void hfs_delete_inode(struct inode *inode)
@@ -252,7 +272,6 @@ void hfs_delete_inode(struct inode *inode)
hfs_dbg("ino %lu\n", inode->i_ino);
if (S_ISDIR(inode->i_mode)) {
- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
atomic64_dec(&HFS_SB(sb)->folder_count);
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
HFS_SB(sb)->root_dirs--;
@@ -261,7 +280,6 @@ void hfs_delete_inode(struct inode *inode)
return;
}
- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
atomic64_dec(&HFS_SB(sb)->file_count);
if (HFS_I(inode)->cat_key.ParID == cpu_to_be32(HFS_ROOT_CNID))
HFS_SB(sb)->root_files--;
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index f28cd24dee842..a97cea35ca2e1 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -64,6 +64,27 @@ static int hfs_get_last_session(struct super_block *sb,
return 0;
}
+bool is_hfs_cnid_counts_valid(struct super_block *sb)
+{
+ struct hfs_sb_info *sbi = HFS_SB(sb);
+ bool corrupted = false;
+
+ if (unlikely(atomic64_read(&sbi->next_id) > U32_MAX)) {
+ pr_warn("next CNID exceeds limit\n");
+ corrupted = true;
+ }
+ if (unlikely(atomic64_read(&sbi->file_count) > U32_MAX)) {
+ pr_warn("file count exceeds limit\n");
+ corrupted = true;
+ }
+ if (unlikely(atomic64_read(&sbi->folder_count) > U32_MAX)) {
+ pr_warn("folder count exceeds limit\n");
+ corrupted = true;
+ }
+
+ return !corrupted;
+}
+
/*
* hfs_mdb_get()
*
@@ -159,6 +180,11 @@ int hfs_mdb_get(struct super_block *sb)
atomic64_set(&HFS_SB(sb)->file_count, be32_to_cpu(mdb->drFilCnt));
atomic64_set(&HFS_SB(sb)->folder_count, be32_to_cpu(mdb->drDirCnt));
+ if (!is_hfs_cnid_counts_valid(sb)) {
+ pr_warn("filesystem possibly corrupted, running fsck.hfs is recommended. Mounting read-only.\n");
+ sb->s_flags |= SB_RDONLY;
+ }
+
/* TRY to get the alternate (backup) MDB. */
sect = part_start + part_size - 2;
bh = sb_bread512(sb, sect, mdb2);
@@ -212,7 +238,7 @@ int hfs_mdb_get(struct super_block *sb)
attrib = mdb->drAtrb;
if (!(attrib & cpu_to_be16(HFS_SB_ATTRIB_UNMNT))) {
- pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only.\n");
+ pr_warn("filesystem was not cleanly unmounted, running fsck.hfs is recommended. Mounting read-only.\n");
sb->s_flags |= SB_RDONLY;
}
if ((attrib & cpu_to_be16(HFS_SB_ATTRIB_SLOCK))) {
@@ -270,15 +296,12 @@ void hfs_mdb_commit(struct super_block *sb)
/* These parameters may have been modified, so write them back */
mdb->drLsMod = hfs_mtime();
mdb->drFreeBks = cpu_to_be16(HFS_SB(sb)->free_ablocks);
- BUG_ON(atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX);
mdb->drNxtCNID =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->next_id));
mdb->drNmFls = cpu_to_be16(HFS_SB(sb)->root_files);
mdb->drNmRtDirs = cpu_to_be16(HFS_SB(sb)->root_dirs);
- BUG_ON(atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX);
mdb->drFilCnt =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->file_count));
- BUG_ON(atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX);
mdb->drDirCnt =
cpu_to_be32((u32)atomic64_read(&HFS_SB(sb)->folder_count));
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index df289cbdd4e85..97546d6b41f47 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -34,6 +34,7 @@ MODULE_LICENSE("GPL");
static int hfs_sync_fs(struct super_block *sb, int wait)
{
+ is_hfs_cnid_counts_valid(sb);
hfs_mdb_commit(sb);
return 0;
}
@@ -65,6 +66,8 @@ static void flush_mdb(struct work_struct *work)
sbi->work_queued = 0;
spin_unlock(&sbi->work_lock);
+ is_hfs_cnid_counts_valid(sb);
+
hfs_mdb_commit(sb);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 041/844] audit: add missing syscalls to read class
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (39 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 040/844] hfs: Replace BUG_ON with error handling for CNID count checks Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 042/844] hfsplus: pretend special inodes as regular files Sasha Levin
` (811 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jeffrey Bencteux, Paul Moore, Sasha Levin
From: Jeffrey Bencteux <jeff@bencteux.fr>
[ Upstream commit bcb90a2834c7393c26df9609b889a3097b7700cd ]
The "at" variant of getxattr() and listxattr() are missing from the
audit read class. Calling getxattrat() or listxattrat() on a file to
read its extended attributes will bypass audit rules such as:
-w /tmp/test -p rwa -k test_rwa
The current patch adds missing syscalls to the audit read class.
Signed-off-by: Jeffrey Bencteux <jeff@bencteux.fr>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/asm-generic/audit_read.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/include/asm-generic/audit_read.h b/include/asm-generic/audit_read.h
index 7bb7b5a83ae2e..fb9991f53fb6f 100644
--- a/include/asm-generic/audit_read.h
+++ b/include/asm-generic/audit_read.h
@@ -4,9 +4,15 @@ __NR_readlink,
#endif
__NR_quotactl,
__NR_listxattr,
+#ifdef __NR_listxattrat
+__NR_listxattrat,
+#endif
__NR_llistxattr,
__NR_flistxattr,
__NR_getxattr,
+#ifdef __NR_getxattrat
+__NR_getxattrat,
+#endif
__NR_lgetxattr,
__NR_fgetxattr,
#ifdef __NR_readlinkat
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 042/844] hfsplus: pretend special inodes as regular files
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (40 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 041/844] audit: add missing syscalls to read class Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 043/844] i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() Sasha Levin
` (810 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tetsuo Handa, syzbot, Viacheslav Dubeyko, Sasha Levin
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit ed8889ca21b6ab37bc1435c4009ce37a79acb9e6 ]
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/d0a07b1b-8b73-4002-8e29-e2bd56871262@I-love.SAKURA.ne.jp
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/super.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index aaffa9e060a0a..7f327b777ece8 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -53,6 +53,12 @@ static int hfsplus_system_read_inode(struct inode *inode)
return -EIO;
}
+ /*
+ * Assign a dummy file type, for may_open() requires that
+ * an inode has a valid file type.
+ */
+ inode->i_mode = S_IFREG;
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 043/844] i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (41 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 042/844] hfsplus: pretend special inodes as regular files Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 044/844] i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability ID is 0 Sasha Levin
` (809 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Frank Li, kernel test robot, Alexandre Belloni, Sasha Levin
From: Frank Li <Frank.Li@nxp.com>
[ Upstream commit 3c9ffb4db787428a5851d5865823ab23842d5103 ]
Initialize the 'dev' pointer to NULL in svc_i3c_master_ibi_isr() and add
a NULL check in the error path.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/r/202512131016.YCKIsDXM-lkp@intel.com/
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251215200852.3079073-1-Frank.Li@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/svc-i3c-master.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index a62f22ff8b576..857504d36e186 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -533,8 +533,8 @@ static int svc_i3c_master_handle_ibi_won(struct svc_i3c_master *master, u32 msta
static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
{
struct svc_i3c_i2c_dev_data *data;
+ struct i3c_dev_desc *dev = NULL;
unsigned int ibitype, ibiaddr;
- struct i3c_dev_desc *dev;
u32 status, val;
int ret;
@@ -627,7 +627,7 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
* for the slave to interrupt again.
*/
if (svc_i3c_master_error(master)) {
- if (master->ibi.tbq_slot) {
+ if (master->ibi.tbq_slot && dev) {
data = i3c_dev_get_master_data(dev);
i3c_generic_ibi_recycle_slot(data->ibi_pool,
master->ibi.tbq_slot);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 044/844] i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability ID is 0
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (42 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 043/844] i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 045/844] i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init Sasha Levin
` (808 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Adrian Hunter, Frank Li, Alexandre Belloni, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 0818e4aa8fdeeed5973e0a8faeddc9da599fc897 ]
Extended Capability ID value 0 is special. It signifies the end of the
list. Stop reading Extended Capabilities if capability ID is 0.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260106164416.67074-3-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
index 7714f00ea9cc0..533a495e14c86 100644
--- a/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
+++ b/drivers/i3c/master/mipi-i3c-hci/ext_caps.c
@@ -272,7 +272,7 @@ int i3c_hci_parse_ext_caps(struct i3c_hci *hci)
cap_length = FIELD_GET(CAP_HEADER_LENGTH, cap_header);
dev_dbg(&hci->master.dev, "id=0x%02x length=%d",
cap_id, cap_length);
- if (!cap_length)
+ if (!cap_id || !cap_length)
break;
if (curr_cap + cap_length * 4 >= end) {
dev_err(&hci->master.dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 045/844] i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (43 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 044/844] i3c: mipi-i3c-hci: Stop reading Extended Capabilities if capability ID is 0 Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 046/844] dlm: fix recovery pending middle conversion Sasha Levin
` (807 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Adrian Hunter, Frank Li, Alexandre Belloni, Sasha Levin
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit 78f63ae4a82db173f93adca462e63d11ba06b126 ]
The MIPI I3C HCI specification does not define reset values for
RING_OPERATION1 fields, and some controllers (e.g., Intel) do not clear
them during a software reset. Ensure the ring pointers are explicitly
set to zero during bus initialization to avoid inconsistent state.
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260113072702.16268-2-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/mipi-i3c-hci/dma.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c
index c401a9425cdc5..951abfea5a6fd 100644
--- a/drivers/i3c/master/mipi-i3c-hci/dma.c
+++ b/drivers/i3c/master/mipi-i3c-hci/dma.c
@@ -342,6 +342,14 @@ static int hci_dma_init(struct i3c_hci *hci)
rh_reg_write(INTR_SIGNAL_ENABLE, regval);
ring_ready:
+ /*
+ * The MIPI I3C HCI specification does not document reset values for
+ * RING_OPERATION1 fields and some controllers (e.g. Intel controllers)
+ * do not reset the values, so ensure the ring pointers are set to zero
+ * here.
+ */
+ rh_reg_write(RING_OPERATION1, 0);
+
rh_reg_write(RING_CONTROL, RING_CTRL_ENABLE |
RING_CTRL_RUN_STOP);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 046/844] dlm: fix recovery pending middle conversion
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (44 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 045/844] i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 047/844] minix: Add required sanity checking to minix_check_superblock() Sasha Levin
` (806 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Alexander Aring, David Teigland, Sasha Levin
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit 1416bd508c78bdfdb9ae0b4511369e5581f348ea ]
During a workload involving conversions between lock modes PR and CW,
lock recovery can create a "conversion deadlock" state between locks
that have been recovered. When this occurs, kernel warning messages
are logged, e.g.
"dlm: WARN: pending deadlock 1e node 0 2 1bf21"
"dlm: receive_rcom_lock_args 2e middle convert gr 3 rq 2 remote 2 1e"
After this occurs, the deadlocked conversions both appear on the convert
queue of the resource being locked, and the conversion requests do not
complete.
Outside of recovery, conversions that would produce a deadlock are
resolved immediately, and return -EDEADLK. The locks are not placed
on the convert queue in the deadlocked state.
To fix this problem, an lkb under conversion between PR/CW is rebuilt
during recovery on a new master's granted queue, with the currently
granted mode, rather than being rebuilt on the new master's convert
queue, with the currently granted mode and the newly requested mode.
The in-progress convert is then resent to the new master after
recovery, so the conversion deadlock will be processed outside of
the recovery context and handled as described above.
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lock.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index be938fdf17d96..c01a291db401b 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -5014,25 +5014,8 @@ void dlm_receive_buffer(const union dlm_packet *p, int nodeid)
static void recover_convert_waiter(struct dlm_ls *ls, struct dlm_lkb *lkb,
struct dlm_message *ms_local)
{
- if (middle_conversion(lkb)) {
- log_rinfo(ls, "%s %x middle convert in progress", __func__,
- lkb->lkb_id);
-
- /* We sent this lock to the new master. The new master will
- * tell us when it's granted. We no longer need a reply, so
- * use a fake reply to put the lkb into the right state.
- */
- hold_lkb(lkb);
- memset(ms_local, 0, sizeof(struct dlm_message));
- ms_local->m_type = cpu_to_le32(DLM_MSG_CONVERT_REPLY);
- ms_local->m_result = cpu_to_le32(to_dlm_errno(-EINPROGRESS));
- ms_local->m_header.h_nodeid = cpu_to_le32(lkb->lkb_nodeid);
- _receive_convert_reply(lkb, ms_local, true);
- unhold_lkb(lkb);
-
- } else if (lkb->lkb_rqmode >= lkb->lkb_grmode) {
+ if (middle_conversion(lkb) || lkb->lkb_rqmode >= lkb->lkb_grmode)
set_bit(DLM_IFL_RESEND_BIT, &lkb->lkb_iflags);
- }
/* lkb->lkb_rqmode < lkb->lkb_grmode shouldn't happen since down
conversions are async; there's no reply from the remote master */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 047/844] minix: Add required sanity checking to minix_check_superblock()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (45 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 046/844] dlm: fix recovery pending middle conversion Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 048/844] dlm: validate length in dlm_search_rsb_tree Sasha Levin
` (805 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jori Koolstra, Jan Kara, syzbot+5ad0824204c7bf9b67f2,
Christian Brauner, Sasha Levin
From: Jori Koolstra <jkoolstra@xs4all.nl>
[ Upstream commit 8c97a6ddc95690a938ded44b4e3202f03f15078c ]
The fs/minix implementation of the minix filesystem does not currently
support any other value for s_log_zone_size than 0. This is also the
only value supported in util-linux; see mkfs.minix.c line 511. In
addition, this patch adds some sanity checking for the other minix
superblock fields, and moves the minix_blocks_needed() checks for the
zmap and imap also to minix_check_super_block().
This also closes a related syzbot bug report.
Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Link: https://patch.msgid.link/20251208153947.108343-1-jkoolstra@xs4all.nl
Reviewed-by: Jan Kara <jack@suse.cz>
Reported-by: syzbot+5ad0824204c7bf9b67f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5ad0824204c7bf9b67f2
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/minix/inode.c | 50 ++++++++++++++++++++++++++++--------------------
1 file changed, 29 insertions(+), 21 deletions(-)
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 51ea9bdc813f7..c8c6b2135abe7 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -170,10 +170,38 @@ static int minix_reconfigure(struct fs_context *fc)
static bool minix_check_superblock(struct super_block *sb)
{
struct minix_sb_info *sbi = minix_sb(sb);
+ unsigned long block;
- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+ if (sbi->s_log_zone_size != 0) {
+ printk("minix-fs error: zone size must equal block size. "
+ "s_log_zone_size > 0 is not supported.\n");
+ return false;
+ }
+
+ if (sbi->s_ninodes < 1 || sbi->s_firstdatazone <= 4 ||
+ sbi->s_firstdatazone >= sbi->s_nzones)
return false;
+ /* Apparently minix can create filesystems that allocate more blocks for
+ * the bitmaps than needed. We simply ignore that, but verify it didn't
+ * create one with not enough blocks and bail out if so.
+ */
+ block = minix_blocks_needed(sbi->s_ninodes, sb->s_blocksize);
+ if (sbi->s_imap_blocks < block) {
+ printk("MINIX-fs: file system does not have enough "
+ "imap blocks allocated. Refusing to mount.\n");
+ return false;
+ }
+
+ block = minix_blocks_needed(
+ (sbi->s_nzones - sbi->s_firstdatazone + 1),
+ sb->s_blocksize);
+ if (sbi->s_zmap_blocks < block) {
+ printk("MINIX-fs: file system does not have enough "
+ "zmap blocks allocated. Refusing to mount.\n");
+ return false;
+ }
+
/*
* s_max_size must not exceed the block mapping limitation. This check
* is only needed for V1 filesystems, since V2/V3 support an extra level
@@ -293,26 +321,6 @@ static int minix_fill_super(struct super_block *s, struct fs_context *fc)
minix_set_bit(0,sbi->s_imap[0]->b_data);
minix_set_bit(0,sbi->s_zmap[0]->b_data);
- /* Apparently minix can create filesystems that allocate more blocks for
- * the bitmaps than needed. We simply ignore that, but verify it didn't
- * create one with not enough blocks and bail out if so.
- */
- block = minix_blocks_needed(sbi->s_ninodes, s->s_blocksize);
- if (sbi->s_imap_blocks < block) {
- printk("MINIX-fs: file system does not have enough "
- "imap blocks allocated. Refusing to mount.\n");
- goto out_no_bitmap;
- }
-
- block = minix_blocks_needed(
- (sbi->s_nzones - sbi->s_firstdatazone + 1),
- s->s_blocksize);
- if (sbi->s_zmap_blocks < block) {
- printk("MINIX-fs: file system does not have enough "
- "zmap blocks allocated. Refusing to mount.\n");
- goto out_no_bitmap;
- }
-
/* set up enough so that it can read an inode */
s->s_op = &minix_sops;
s->s_time_min = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 048/844] dlm: validate length in dlm_search_rsb_tree
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (46 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 047/844] minix: Add required sanity checking to minix_check_superblock() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 049/844] btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() Sasha Levin
` (804 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ezrak1e, Alexander Aring, David Teigland, Sasha Levin
From: Ezrak1e <ezrakiez@gmail.com>
[ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ]
The len parameter in dlm_dump_rsb_name() is not validated and comes
from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can
cause out-of-bounds write in dlm_search_rsb_tree().
Add length validation to prevent potential buffer overflow.
Signed-off-by: Ezrak1e <ezrakiez@gmail.com>
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dlm/lock.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index c01a291db401b..a393ecaf3442a 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -626,7 +626,8 @@ int dlm_search_rsb_tree(struct rhashtable *rhash, const void *name, int len,
struct dlm_rsb **r_ret)
{
char key[DLM_RESNAME_MAXLEN] = {};
-
+ if (len > DLM_RESNAME_MAXLEN)
+ return -EINVAL;
memcpy(key, name, len);
*r_ret = rhashtable_lookup_fast(rhash, &key, dlm_rhash_rsb_params);
if (*r_ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 049/844] btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (47 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 048/844] dlm: validate length in dlm_search_rsb_tree Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 050/844] btrfs: fallback to buffered IO if the data profile has duplication Sasha Levin
` (803 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Filipe Manana, Boris Burkov, Qu Wenruo, David Sterba, Sasha Levin
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit c7d1d4ff56744074e005771aff193b927392d51f ]
There is no need to BUG(), we can just return an error and log an error
message.
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e4cae34620d19..1bf081243efb2 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1761,32 +1761,36 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
struct btrfs_delayed_extent_op *extent_op,
bool insert_reserved)
{
+ struct btrfs_fs_info *fs_info = trans->fs_info;
int ret = 0;
if (TRANS_ABORTED(trans)) {
if (insert_reserved) {
btrfs_pin_extent(trans, node->bytenr, node->num_bytes);
- free_head_ref_squota_rsv(trans->fs_info, href);
+ free_head_ref_squota_rsv(fs_info, href);
}
return 0;
}
if (node->type == BTRFS_TREE_BLOCK_REF_KEY ||
- node->type == BTRFS_SHARED_BLOCK_REF_KEY)
+ node->type == BTRFS_SHARED_BLOCK_REF_KEY) {
ret = run_delayed_tree_ref(trans, href, node, extent_op,
insert_reserved);
- else if (node->type == BTRFS_EXTENT_DATA_REF_KEY ||
- node->type == BTRFS_SHARED_DATA_REF_KEY)
+ } else if (node->type == BTRFS_EXTENT_DATA_REF_KEY ||
+ node->type == BTRFS_SHARED_DATA_REF_KEY) {
ret = run_delayed_data_ref(trans, href, node, extent_op,
insert_reserved);
- else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY)
+ } else if (node->type == BTRFS_EXTENT_OWNER_REF_KEY) {
ret = 0;
- else
- BUG();
+ } else {
+ ret = -EUCLEAN;
+ btrfs_err(fs_info, "unexpected delayed ref node type: %u", node->type);
+ }
+
if (ret && insert_reserved)
btrfs_pin_extent(trans, node->bytenr, node->num_bytes);
if (ret < 0)
- btrfs_err(trans->fs_info,
+ btrfs_err(fs_info,
"failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d",
node->bytenr, node->num_bytes, node->type,
node->action, node->ref_mod, ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 050/844] btrfs: fallback to buffered IO if the data profile has duplication
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (48 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 049/844] btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 051/844] btrfs: handle user interrupt properly in btrfs_trim_fs() Sasha Levin
` (802 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Qu Wenruo, David Sterba, Sasha Levin
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 7c2830f00c3e086292c1ee9f27b61efaf8e76c9a ]
[BACKGROUND]
Inspired by a recent kernel bug report, which is related to direct IO
buffer modification during writeback, that leads to contents mismatch of
different RAID1 mirrors.
[CAUSE AND PROBLEMS]
The root cause is exactly the same explained in commit 968f19c5b1b7
("btrfs: always fallback to buffered write if the inode requires
checksum"), that we can not trust direct IO buffer which can be modified
halfway during writeback.
Unlike data checksum verification, if this happened on inodes without
data checksum but has the data has extra mirrors, it will lead to
stealth data mismatch on different mirrors.
This will be way harder to detect without data checksum.
Furthermore for RAID56, we can even have data without checksum and data
with checksum mixed inside the same full stripe.
In that case if the direct IO buffer got changed halfway for the
nodatasum part, the data with checksum immediately lost its ability to
recover, e.g.:
" " = Good old data or parity calculated using good old data
"X" = Data modified during writeback
0 32K 64K
Data 1 | | Has csum
Data 2 |XXXXXXXXXXXXXXXX | No csum
Parity | |
In above case, the parity is calculated using data 1 (has csum, from
page cache, won't change during writeback), and old data 2 (has no csum,
direct IO write).
After parity is calculated, but before submission to the storage, direct
IO buffer of data 2 is modified, causing the range [0, 32K) of data 2
has a different content.
Now all data is submitted to the storage, and the fs got fully synced.
Then the device of data 1 is lost, has to be rebuilt from data 2 and
parity. But since the data 2 has some modified data, and the parity is
calculated using old data, the recovered data is no the same for data 1,
causing data checksum mismatch.
[FIX]
Fix the problem by checking the data allocation profile.
If our data allocation profile is either RAID0 or SINGLE, we can allow
true zero-copy direct IO and the end user is fully responsible for any
race.
However this is not going to fix all situations, as it's still possible
to race with balance where the fs got a new data profile after the data
allocation profile check.
But this fix should still greatly reduce the window of the original bug.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=99171
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/direct-io.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/fs/btrfs/direct-io.c b/fs/btrfs/direct-io.c
index 07e19e88ba4b3..5443d69efe956 100644
--- a/fs/btrfs/direct-io.c
+++ b/fs/btrfs/direct-io.c
@@ -814,6 +814,8 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
ssize_t ret;
unsigned int ilock_flags = 0;
struct iomap_dio *dio;
+ const u64 data_profile = btrfs_data_alloc_profile(fs_info) &
+ BTRFS_BLOCK_GROUP_PROFILE_MASK;
if (iocb->ki_flags & IOCB_NOWAIT)
ilock_flags |= BTRFS_ILOCK_TRY;
@@ -827,6 +829,16 @@ ssize_t btrfs_direct_write(struct kiocb *iocb, struct iov_iter *from)
if (iocb->ki_pos + iov_iter_count(from) <= i_size_read(inode) && IS_NOSEC(inode))
ilock_flags |= BTRFS_ILOCK_SHARED;
+ /*
+ * If our data profile has duplication (either extra mirrors or RAID56),
+ * we can not trust the direct IO buffer, the content may change during
+ * writeback and cause different contents written to different mirrors.
+ *
+ * Thus only RAID0 and SINGLE can go true zero-copy direct IO.
+ */
+ if (data_profile != BTRFS_BLOCK_GROUP_RAID0 && data_profile != 0)
+ goto buffered;
+
relock:
ret = btrfs_inode_lock(BTRFS_I(inode), ilock_flags);
if (ret < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 051/844] btrfs: handle user interrupt properly in btrfs_trim_fs()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (49 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 050/844] btrfs: fallback to buffered IO if the data profile has duplication Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 052/844] netfs: when subreq is marked for retry, do not check if it faced an error Sasha Levin
` (801 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: jinbaohong, Qu Wenruo, Robbie Ko, Filipe Manana, David Sterba,
Sasha Levin
From: jinbaohong <jinbaohong@synology.com>
[ Upstream commit bfb670b9183b0e4ba660aff2e396ec1cc01d0761 ]
When a fatal signal is pending or the process is freezing,
btrfs_trim_block_group() and btrfs_trim_free_extents() return -ERESTARTSYS.
Currently this is treated as a regular error: the loops continue to the
next iteration and count it as a block group or device failure.
Instead, break out of the loops immediately and return -ERESTARTSYS to
userspace without counting it as a failure. Also skip the device loop
entirely if the block group loop was interrupted.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: jinbaohong <jinbaohong@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 1bf081243efb2..8bdb609f58a7e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -6555,6 +6555,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
range->minlen);
trimmed += group_trimmed;
+ if (ret == -ERESTARTSYS || ret == -EINTR) {
+ btrfs_put_block_group(cache);
+ break;
+ }
if (ret) {
bg_failed++;
bg_ret = ret;
@@ -6568,6 +6572,9 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
"failed to trim %llu block group(s), last error %d",
bg_failed, bg_ret);
+ if (ret == -ERESTARTSYS || ret == -EINTR)
+ return ret;
+
mutex_lock(&fs_devices->device_list_mutex);
list_for_each_entry(device, &fs_devices->devices, dev_list) {
if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
@@ -6576,6 +6583,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
ret = btrfs_trim_free_extents(device, &group_trimmed);
trimmed += group_trimmed;
+ if (ret == -ERESTARTSYS || ret == -EINTR)
+ break;
if (ret) {
dev_failed++;
dev_ret = ret;
@@ -6589,6 +6598,8 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
"failed to trim %llu device(s), last error %d",
dev_failed, dev_ret);
range->len = trimmed;
+ if (ret == -ERESTARTSYS || ret == -EINTR)
+ return ret;
if (bg_ret)
return bg_ret;
return dev_ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 052/844] netfs: when subreq is marked for retry, do not check if it faced an error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (50 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 051/844] btrfs: handle user interrupt properly in btrfs_trim_fs() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 053/844] smb: client: add proper locking around ses->iface_last_update Sasha Levin
` (800 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shyam Prasad N, David Howells, Steve French, Sasha Levin
From: Shyam Prasad N <sprasad@microsoft.com>
[ Upstream commit 82e8885bd7633a36ee9050e6d7f348a4155eed5f ]
The *_subreq_terminated functions today only process the NEED_RETRY
flag when the subreq was successful or failed with EAGAIN error.
However, there could be other retriable errors for network filesystems.
Avoid this by processing the NEED_RETRY irrespective of the error
code faced by the subreq. If it was specifically marked for retry,
the error code must not matter.
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/netfs/read_collect.c | 10 ++++++++++
fs/netfs/read_retry.c | 4 ++--
fs/netfs/write_collect.c | 8 ++++----
fs/netfs/write_issue.c | 1 +
4 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
index 7a0ffa675fb17..137f0e28a44c5 100644
--- a/fs/netfs/read_collect.c
+++ b/fs/netfs/read_collect.c
@@ -546,6 +546,15 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)
}
}
+ /* If need retry is set, error should not matter unless we hit too many
+ * retries. Pause the generation of new subreqs
+ */
+ if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
+ trace_netfs_rreq(rreq, netfs_rreq_trace_set_pause);
+ set_bit(NETFS_RREQ_PAUSE, &rreq->flags);
+ goto skip_error_checks;
+ }
+
if (unlikely(subreq->error < 0)) {
trace_netfs_failure(rreq, subreq, subreq->error, netfs_fail_read);
if (subreq->source == NETFS_READ_FROM_CACHE) {
@@ -559,6 +568,7 @@ void netfs_read_subreq_terminated(struct netfs_io_subrequest *subreq)
set_bit(NETFS_RREQ_PAUSE, &rreq->flags);
}
+skip_error_checks:
trace_netfs_sreq(subreq, netfs_sreq_trace_terminated);
netfs_subreq_clear_in_progress(subreq);
netfs_put_subrequest(subreq, netfs_sreq_trace_put_terminated);
diff --git a/fs/netfs/read_retry.c b/fs/netfs/read_retry.c
index b99e84a8170af..7793ba5e3e8fc 100644
--- a/fs/netfs/read_retry.c
+++ b/fs/netfs/read_retry.c
@@ -12,6 +12,7 @@
static void netfs_reissue_read(struct netfs_io_request *rreq,
struct netfs_io_subrequest *subreq)
{
+ subreq->error = 0;
__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
netfs_stat(&netfs_n_rh_retry_read_subreq);
@@ -242,8 +243,7 @@ static void netfs_retry_read_subrequests(struct netfs_io_request *rreq)
subreq = list_next_entry(subreq, rreq_link);
abandon:
list_for_each_entry_from(subreq, &stream->subrequests, rreq_link) {
- if (!subreq->error &&
- !test_bit(NETFS_SREQ_FAILED, &subreq->flags) &&
+ if (!test_bit(NETFS_SREQ_FAILED, &subreq->flags) &&
!test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags))
continue;
subreq->error = -ENOMEM;
diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c
index cbf3d9194c7bf..61eab34ea67ef 100644
--- a/fs/netfs/write_collect.c
+++ b/fs/netfs/write_collect.c
@@ -492,11 +492,11 @@ void netfs_write_subrequest_terminated(void *_op, ssize_t transferred_or_error)
if (IS_ERR_VALUE(transferred_or_error)) {
subreq->error = transferred_or_error;
- if (subreq->error == -EAGAIN)
- set_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags);
- else
+ /* if need retry is set, error should not matter */
+ if (!test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
set_bit(NETFS_SREQ_FAILED, &subreq->flags);
- trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write);
+ trace_netfs_failure(wreq, subreq, transferred_or_error, netfs_fail_write);
+ }
switch (subreq->source) {
case NETFS_WRITE_TO_CACHE:
diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index dd8743bc8d7fe..34894da5a23ec 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -250,6 +250,7 @@ void netfs_reissue_write(struct netfs_io_stream *stream,
iov_iter_truncate(&subreq->io_iter, size);
subreq->retry_count++;
+ subreq->error = 0;
__clear_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags);
__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
netfs_stat(&netfs_n_wh_retry_write_subreq);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 053/844] smb: client: add proper locking around ses->iface_last_update
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (51 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 052/844] netfs: when subreq is marked for retry, do not check if it faced an error Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 054/844] gfs2: fiemap page fault fix Sasha Levin
` (799 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Henrique Carvalho, Steve French, Sasha Levin
From: Henrique Carvalho <henrique.carvalho@suse.com>
[ Upstream commit e97dcac3dc0bd37e4b56aaa6874b572a3a461102 ]
There is a missing ses->iface_lock in cifs_setup_session,
around ses->iface_last_update.
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/connect.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index ce620503e9f70..60c76375f0f50 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -4270,7 +4270,9 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
ses->ses_status = SES_IN_SETUP;
/* force iface_list refresh */
+ spin_lock(&ses->iface_lock);
ses->iface_last_update = 0;
+ spin_unlock(&ses->iface_lock);
}
spin_unlock(&ses->ses_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 054/844] gfs2: fiemap page fault fix
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (52 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 053/844] smb: client: add proper locking around ses->iface_last_update Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 055/844] smb: client: prevent races in ->query_interfaces() Sasha Levin
` (798 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Andreas Gruenbacher, Sasha Levin
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2 ]
In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
glock. This can lead to recursive glock taking if the fiemap buffer is
memory mapped to the same inode and accessing it triggers a page fault.
Fix by disabling page faults for iomap_fiemap() and faulting in the
buffer by hand if necessary.
Fixes xfstest generic/742.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/inode.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index b6ed069b34872..4d65e4a752626 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -2192,6 +2192,14 @@ static int gfs2_getattr(struct mnt_idmap *idmap,
return 0;
}
+static bool fault_in_fiemap(struct fiemap_extent_info *fi)
+{
+ struct fiemap_extent __user *dest = fi->fi_extents_start;
+ size_t size = sizeof(*dest) * fi->fi_extents_max;
+
+ return fault_in_safe_writeable((char __user *)dest, size) == 0;
+}
+
static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
u64 start, u64 len)
{
@@ -2201,14 +2209,22 @@ static int gfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
inode_lock_shared(inode);
+retry:
ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, 0, &gh);
if (ret)
goto out;
+ pagefault_disable();
ret = iomap_fiemap(inode, fieinfo, start, len, &gfs2_iomap_ops);
+ pagefault_enable();
gfs2_glock_dq_uninit(&gh);
+ if (ret == -EFAULT && fault_in_fiemap(fieinfo)) {
+ fieinfo->fi_extents_mapped = 0;
+ goto retry;
+ }
+
out:
inode_unlock_shared(inode);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 055/844] smb: client: prevent races in ->query_interfaces()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (53 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 054/844] gfs2: fiemap page fault fix Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 056/844] tools/cpupower: Fix inverted APERF capability check Sasha Levin
` (797 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Henrique Carvalho, Steve French, Sasha Levin
From: Henrique Carvalho <henrique.carvalho@suse.com>
[ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ]
It was possible for two query interface works to be concurrently trying
to update the interfaces.
Prevent this by checking and updating iface_last_update under
iface_lock.
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index c1aaf77e187b6..edfd6a4e87e8b 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -637,13 +637,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
p = buf;
spin_lock(&ses->iface_lock);
- /* do not query too frequently, this time with lock held */
- if (ses->iface_last_update &&
- time_before(jiffies, ses->iface_last_update +
- (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
- spin_unlock(&ses->iface_lock);
- return 0;
- }
/*
* Go through iface_list and mark them as inactive
@@ -666,7 +659,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
"Empty network interface list returned by server %s\n",
ses->server->hostname);
rc = -EOPNOTSUPP;
- ses->iface_last_update = jiffies;
goto out;
}
@@ -795,8 +787,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ sizeof(p->Next) && p->Next))
cifs_dbg(VFS, "%s: incomplete interface info\n", __func__);
- ses->iface_last_update = jiffies;
-
out:
/*
* Go through the list again and put the inactive entries
@@ -825,10 +815,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_
struct TCP_Server_Info *pserver;
/* do not query too frequently */
+ spin_lock(&ses->iface_lock);
if (ses->iface_last_update &&
time_before(jiffies, ses->iface_last_update +
- (SMB_INTERFACE_POLL_INTERVAL * HZ)))
+ (SMB_INTERFACE_POLL_INTERVAL * HZ))) {
+ spin_unlock(&ses->iface_lock);
return 0;
+ }
+
+ ses->iface_last_update = jiffies;
+
+ spin_unlock(&ses->iface_lock);
rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
FSCTL_QUERY_NETWORK_INTERFACE_INFO,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 056/844] tools/cpupower: Fix inverted APERF capability check
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (54 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 055/844] smb: client: prevent races in ->query_interfaces() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 057/844] s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS Sasha Levin
` (796 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kaushlendra Kumar, Shuah Khan, Sasha Levin
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 24858a84163c8d04827166b3bcaed80612bb62fc ]
The capability check was inverted, causing the function to return
error when APERF support is available and proceed when it is not.
Negate the condition to return error only when APERF capability
is absent.
Link: https://lore.kernel.org/r/20251126091613.567480-1-kaushlendra.kumar@intel.com
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/cpupower/utils/cpufreq-info.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
index 7d3732f5f2f6f..5fe01e516817e 100644
--- a/tools/power/cpupower/utils/cpufreq-info.c
+++ b/tools/power/cpupower/utils/cpufreq-info.c
@@ -270,7 +270,7 @@ static int get_freq_hardware(unsigned int cpu, unsigned int human)
{
unsigned long freq;
- if (cpupower_cpu_info.caps & CPUPOWER_CAP_APERF)
+ if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
return -EINVAL;
freq = cpufreq_get_freq_hardware(cpu);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 057/844] s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (55 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 056/844] tools/cpupower: Fix inverted APERF capability check Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 058/844] tools/power cpupower: Reset errno before strtoull() Sasha Levin
` (795 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Heiko Carstens, Sasha Levin
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit 5ba35a6c13fff0929c34aba6b7602dacbe68686c ]
Add -Wno-default-const-init-unsafe to boot KBUILD_CFLAGS, similar to
scripts/Makefile.extrawarn, since clang generates warnings for the dummy
variable in typecheck():
CC arch/s390/boot/version.o
arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
221 | return psw_bits(regs->psw).pstate;
| ^
arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
98 | typecheck(psw_t, __psw); \
| ^
include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/boot/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
index 490167faba7a4..a1e719a79d38c 100644
--- a/arch/s390/boot/Makefile
+++ b/arch/s390/boot/Makefile
@@ -21,6 +21,7 @@ KBUILD_AFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_AFLAGS_DECOMPRESSOR))
KBUILD_CFLAGS := $(filter-out $(CC_FLAGS_MARCH),$(KBUILD_CFLAGS_DECOMPRESSOR))
KBUILD_AFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS
KBUILD_CFLAGS += $(CC_FLAGS_MARCH_MINIMUM) -D__DISABLE_EXPORTS
+KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 058/844] tools/power cpupower: Reset errno before strtoull()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (56 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 057/844] s390/boot: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 059/844] s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS Sasha Levin
` (794 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kaushlendra Kumar, Shuah Khan, Sasha Levin
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit f9bd3762cf1bd0c2465f2e6121b340883471d1bf ]
cpuidle_state_get_one_value() never cleared errno before calling
strtoull(), so a prior ERANGE caused every cpuidle counter read to
return zero. Reset errno to 0 before the conversion so each sysfs read
is evaluated independently.
Link: https://lore.kernel.org/r/20251201121745.3776703-1-kaushlendra.kumar@intel.com
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/cpupower/lib/cpuidle.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index f2c1139adf716..bd857ee7541a7 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -150,6 +150,7 @@ unsigned long long cpuidle_state_get_one_value(unsigned int cpu,
if (len == 0)
return 0;
+ errno = 0;
value = strtoull(linebuf, &endp, 0);
if (endp == linebuf || errno == ERANGE)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 059/844] s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (57 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 058/844] tools/power cpupower: Reset errno before strtoull() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 060/844] perf/arm-cmn: Support CMN-600AE Sasha Levin
` (793 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Heiko Carstens, Sasha Levin
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit b4780fe4ddf04b51127a33d705f4a2e224df00fa ]
Add -Wno-default-const-init-unsafe to purgatory KBUILD_CFLAGS, similar
to scripts/Makefile.extrawarn, since clang generates warnings for the
dummy variable in typecheck():
CC arch/s390/purgatory/purgatory.o
arch/s390/include/asm/ptrace.h:221:9: warning: default initialization of an object of type 'typeof (regs->psw)' (aka 'const psw_t') leaves the object uninitialized [-Wdefault-const-init-var-unsafe]
221 | return psw_bits(regs->psw).pstate;
| ^
arch/s390/include/asm/ptrace.h:98:2: note: expanded from macro 'psw_bits'
98 | typecheck(psw_t, __psw); \
| ^
include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/purgatory/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
index 0c196a5b194af..61d240a37633d 100644
--- a/arch/s390/purgatory/Makefile
+++ b/arch/s390/purgatory/Makefile
@@ -23,6 +23,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS
KBUILD_CFLAGS += $(CLANG_FLAGS)
KBUILD_CFLAGS += $(if $(CONFIG_CC_IS_CLANG),-Wno-microsoft-anon-tag)
KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
+KBUILD_CFLAGS += $(call cc-option, -Wno-default-const-init-unsafe)
KBUILD_AFLAGS := $(filter-out -DCC_USING_EXPOLINE,$(KBUILD_AFLAGS))
KBUILD_AFLAGS += -D__DISABLE_EXPORTS
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 060/844] perf/arm-cmn: Support CMN-600AE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (58 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 059/844] s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 061/844] arm64: Add support for TSV110 Spectre-BHB mitigation Sasha Levin
` (792 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Robin Murphy, Ilkka Koskinen, Michal Simek, Will Deacon,
Sasha Levin
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit 12a94953c37e834c3eabb839ce057094946fe67a ]
The functional safety features of CMN-600AE have little to no impact on
the PMU relative to the base CMN-600 design, so for simplicity we can
reasonably just treat it as the same thing. The only obvious difference
is that the revision numbers aren't aligned, so we may hide some aliases
for events which do actually exist, but those can still be specified via
the underlying "type,eventid" format so it's not too big a deal.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
Tested-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/arm-cmn.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
index 23245352a3fc0..651edd73bfcb1 100644
--- a/drivers/perf/arm-cmn.c
+++ b/drivers/perf/arm-cmn.c
@@ -210,6 +210,7 @@ enum cmn_model {
enum cmn_part {
PART_CMN600 = 0x434,
PART_CMN650 = 0x436,
+ PART_CMN600AE = 0x438,
PART_CMN700 = 0x43c,
PART_CI700 = 0x43a,
PART_CMN_S3 = 0x43e,
@@ -2266,6 +2267,9 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
reg = readq_relaxed(cfg_region + CMN_CFGM_PERIPH_ID_01);
part = FIELD_GET(CMN_CFGM_PID0_PART_0, reg);
part |= FIELD_GET(CMN_CFGM_PID1_PART_1, reg) << 8;
+ /* 600AE is close enough that it's not really worth more complexity */
+ if (part == PART_CMN600AE)
+ part = PART_CMN600;
if (cmn->part && cmn->part != part)
dev_warn(cmn->dev,
"Firmware binding mismatch: expected part number 0x%x, found 0x%x\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 061/844] arm64: Add support for TSV110 Spectre-BHB mitigation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (59 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 060/844] perf/arm-cmn: Support CMN-600AE Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 062/844] rnbd-srv: Zero the rsp buffer before using it Sasha Levin
` (791 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jinqian Yang, Zenghui Yu, Will Deacon, Sasha Levin
From: Jinqian Yang <yangjinqian1@huawei.com>
[ Upstream commit e3baa5d4b361276efeb87b20d8beced451a7dbd5 ]
The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
Buffer) attack, which can be exploited to leak information through
branch prediction side channels. This commit adds the MIDR of TSV110
to the list for software mitigation.
Signed-off-by: Jinqian Yang <yangjinqian1@huawei.com>
Reviewed-by: Zenghui Yu <zenghui.yu@linux.dev>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/proton-pack.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c
index 80a580e019c50..b3801f532b10b 100644
--- a/arch/arm64/kernel/proton-pack.c
+++ b/arch/arm64/kernel/proton-pack.c
@@ -887,6 +887,7 @@ static u8 spectre_bhb_loop_affected(void)
MIDR_ALL_VERSIONS(MIDR_CORTEX_X2),
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
{},
};
static const struct midr_range spectre_bhb_k24_list[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 062/844] rnbd-srv: Zero the rsp buffer before using it
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (60 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 061/844] arm64: Add support for TSV110 Spectre-BHB mitigation Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 063/844] x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set Sasha Levin
` (790 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Md Haris Iqbal, Jack Wang, Grzegorz Prajsner, Jens Axboe,
Sasha Levin
From: Md Haris Iqbal <haris.iqbal@ionos.com>
[ Upstream commit 69d26698e4fd44935510553809007151b2fe4db5 ]
Before using the data buffer to send back the response message, zero it
completely. This prevents any stray bytes to be picked up by the client
side when there the message is exchanged between different protocol
versions.
Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/rnbd/rnbd-srv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
index 9b3fdc202e152..7eeb321d61402 100644
--- a/drivers/block/rnbd/rnbd-srv.c
+++ b/drivers/block/rnbd/rnbd-srv.c
@@ -551,6 +551,8 @@ static void rnbd_srv_fill_msg_open_rsp(struct rnbd_msg_open_rsp *rsp,
{
struct block_device *bdev = file_bdev(sess_dev->bdev_file);
+ memset(rsp, 0, sizeof(*rsp));
+
rsp->hdr.type = cpu_to_le16(RNBD_MSG_OPEN_RSP);
rsp->device_id = cpu_to_le32(sess_dev->device_id);
rsp->nsectors = cpu_to_le64(bdev_nr_sectors(bdev));
@@ -657,6 +659,7 @@ static void process_msg_sess_info(struct rnbd_srv_session *srv_sess,
trace_process_msg_sess_info(srv_sess, sess_info_msg);
+ memset(rsp, 0, sizeof(*rsp));
rsp->hdr.type = cpu_to_le16(RNBD_MSG_SESS_INFO_RSP);
rsp->ver = srv_sess->ver;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 063/844] x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (61 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 062/844] rnbd-srv: Zero the rsp buffer before using it Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 064/844] ntfs: ->d_compare() must not block Sasha Levin
` (789 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hou Wenlong, Juergen Gross, Sasha Levin
From: Hou Wenlong <houwenlong.hwl@antgroup.com>
[ Upstream commit db9aded979b491a24871e1621cd4e8822dbca859 ]
The PVH entry is available for 32-bit KVM guests, and 32-bit KVM guests
do not depend on CONFIG_X86_PAE. However, mk_early_pgtbl_32() builds
different pagetables depending on whether CONFIG_X86_PAE is set.
Therefore, enabling PAE mode for 32-bit KVM guests without
CONFIG_X86_PAE being set would result in a boot failure during CR3
loading.
Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <d09ce9a134eb9cbc16928a5b316969f8ba606b81.1768017442.git.houwenlong.hwl@antgroup.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/platform/pvh/head.S | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
index 344030c1a81d4..53ee2d53fcf8e 100644
--- a/arch/x86/platform/pvh/head.S
+++ b/arch/x86/platform/pvh/head.S
@@ -91,10 +91,12 @@ SYM_CODE_START(pvh_start_xen)
leal rva(early_stack_end)(%ebp), %esp
+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
/* Enable PAE mode. */
mov %cr4, %eax
orl $X86_CR4_PAE, %eax
mov %eax, %cr4
+#endif
#ifdef CONFIG_X86_64
/* Enable Long mode. */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 064/844] ntfs: ->d_compare() must not block
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (62 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 063/844] x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 065/844] EFI/CPER: don't dump the entire memory region Sasha Levin
` (788 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Al Viro, Sasha Levin
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce ]
... so don't use __getname() there. Switch it (and ntfs_d_hash(), while
we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash()
almost certainly can do with smaller allocations, but let ntfs folks
deal with that - keep the allocation size as-is for now.
Stop abusing names_cachep in ntfs, period - various uses of that thing
in there have nothing to do with pathnames; just use k[mz]alloc() and
be done with that. For now let's keep sizes as-in, but AFAICS none of
the users actually want PATH_MAX.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/dir.c | 5 ++---
fs/ntfs3/fsntfs.c | 4 ++--
fs/ntfs3/inode.c | 13 ++++++-------
fs/ntfs3/namei.c | 17 ++++++++---------
fs/ntfs3/xattr.c | 5 ++---
5 files changed, 20 insertions(+), 24 deletions(-)
diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index b98e95d6b4d99..cf038d713f507 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -423,8 +423,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
if (!dir_emit_dots(file, ctx))
return 0;
- /* Allocate PATH_MAX bytes. */
- name = __getname();
+ name = kmalloc(PATH_MAX, GFP_KERNEL);
if (!name)
return -ENOMEM;
@@ -502,7 +501,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
out:
- __putname(name);
+ kfree(name);
put_indx_node(node);
if (err == 1) {
diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index 5f138f7158357..bd67ba7b50153 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -2627,7 +2627,7 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len)
u32 uni_bytes;
struct ntfs_inode *ni = sbi->volume.ni;
/* Allocate PATH_MAX bytes. */
- struct cpu_str *uni = __getname();
+ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL);
if (!uni)
return -ENOMEM;
@@ -2671,6 +2671,6 @@ int ntfs_set_label(struct ntfs_sb_info *sbi, u8 *label, int len)
err = _ni_write_inode(&ni->vfs_inode, 0);
out:
- __putname(uni);
+ kfree(uni);
return err;
}
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index ec8e954f4426c..bf6ef525d9562 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -1280,7 +1280,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
fa |= FILE_ATTRIBUTE_READONLY;
/* Allocate PATH_MAX bytes. */
- new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
+ new_de = kzalloc(PATH_MAX, GFP_KERNEL);
if (!new_de) {
err = -ENOMEM;
goto out1;
@@ -1701,7 +1701,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
ntfs_mark_rec_free(sbi, ino, false);
out2:
- __putname(new_de);
+ kfree(new_de);
kfree(rp);
out1:
@@ -1722,7 +1722,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
struct NTFS_DE *de;
/* Allocate PATH_MAX bytes. */
- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
+ de = kzalloc(PATH_MAX, GFP_KERNEL);
if (!de)
return -ENOMEM;
@@ -1736,7 +1736,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de);
out:
- __putname(de);
+ kfree(de);
return err;
}
@@ -1759,8 +1759,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
if (ntfs_is_meta_file(sbi, ni->mi.rno))
return -EINVAL;
- /* Allocate PATH_MAX bytes. */
- de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
+ de = kzalloc(PATH_MAX, GFP_KERNEL);
if (!de)
return -ENOMEM;
@@ -1796,7 +1795,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
out:
ni_unlock(ni);
- __putname(de);
+ kfree(de);
return err;
}
diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
index 3b24ca02de614..b2af8f695e60f 100644
--- a/fs/ntfs3/namei.c
+++ b/fs/ntfs3/namei.c
@@ -68,7 +68,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
u32 flags)
{
struct ntfs_inode *ni = ntfs_i(dir);
- struct cpu_str *uni = __getname();
+ struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL);
struct inode *inode;
int err;
@@ -85,7 +85,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
inode = dir_search_u(dir, uni, NULL);
ni_unlock(ni);
}
- __putname(uni);
+ kfree(uni);
}
/*
@@ -303,8 +303,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,
return err;
}
- /* Allocate PATH_MAX bytes. */
- de = __getname();
+ de = kmalloc(PATH_MAX, GFP_KERNEL);
if (!de)
return -ENOMEM;
@@ -349,7 +348,7 @@ static int ntfs_rename(struct mnt_idmap *idmap, struct inode *dir,
ni_unlock(ni);
ni_unlock(dir_ni);
out:
- __putname(de);
+ kfree(de);
return err;
}
@@ -407,7 +406,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
/*
* Try slow way with current upcase table
*/
- uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT);
+ uni = kmalloc(PATH_MAX, GFP_NOWAIT);
if (!uni)
return -ENOMEM;
@@ -429,7 +428,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
err = 0;
out:
- kmem_cache_free(names_cachep, uni);
+ kfree(uni);
return err;
}
@@ -468,7 +467,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1,
* Try slow way with current upcase table
*/
sbi = dentry->d_sb->s_fs_info;
- uni1 = __getname();
+ uni1 = kmalloc(PATH_MAX, GFP_NOWAIT);
if (!uni1)
return -ENOMEM;
@@ -498,7 +497,7 @@ static int ntfs_d_compare(const struct dentry *dentry, unsigned int len1,
ret = !ntfs_cmp_names_cpu(uni1, uni2, sbi->upcase, false) ? 0 : 1;
out:
- __putname(uni1);
+ kfree(uni1);
return ret;
}
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index c93df55e98d07..f3bb2c41c000f 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -556,8 +556,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
if (unlikely(is_bad_ni(ni)))
return ERR_PTR(-EINVAL);
- /* Allocate PATH_MAX bytes. */
- buf = __getname();
+ buf = kmalloc(PATH_MAX, GFP_KERNEL);
if (!buf)
return ERR_PTR(-ENOMEM);
@@ -588,7 +587,7 @@ struct posix_acl *ntfs_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
if (!IS_ERR(acl))
set_cached_acl(inode, type, acl);
- __putname(buf);
+ kfree(buf);
return acl;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 065/844] EFI/CPER: don't dump the entire memory region
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (63 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 064/844] ntfs: ->d_compare() must not block Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 066/844] APEI/GHES: ensure that won't go past CPER allocated record Sasha Levin
` (787 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mauro Carvalho Chehab, Jonathan Cameron, Ard Biesheuvel,
Hanjun Guo, Rafael J. Wysocki, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit 55cc6fe5716f678f06bcb95140882dfa684464ec ]
The current logic at cper_print_fw_err() doesn't check if the
error record length is big enough to handle offset. On a bad firmware,
if the ofset is above the actual record, length -= offset will
underflow, making it dump the entire memory.
The end result can be:
- the logic taking a lot of time dumping large regions of memory;
- data disclosure due to the memory dumps;
- an OOPS, if it tries to dump an unmapped memory region.
Fix it by checking if the section length is too small before doing
a hex dump.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/1752b5ba63a3e2f148ddee813b36c996cc617e86.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/cper.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index bd99802cb0cad..09a4f0168df80 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -560,6 +560,11 @@ static void cper_print_fw_err(const char *pfx,
} else {
offset = sizeof(*fw_err);
}
+ if (offset > length) {
+ printk("%s""error section length is too small: offset=%d, length=%d\n",
+ pfx, offset, length);
+ return;
+ }
buf += offset;
length -= offset;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 066/844] APEI/GHES: ensure that won't go past CPER allocated record
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (64 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 065/844] EFI/CPER: don't dump the entire memory region Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 067/844] APEI/GHES: ARM processor Error: don't go past allocated memory Sasha Levin
` (786 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mauro Carvalho Chehab, Jonathan Cameron, Ard Biesheuvel,
Hanjun Guo, Rafael J. Wysocki, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit fa2408a24f8f0db14d9cfc613ef162dc267d7ad4 ]
The logic at ghes_new() prevents allocating too large records, by
checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
Yet, the allocation is done with the actual number of pages from the
CPER bios table location, which can be smaller.
Yet, a bad firmware could send data with a different size, which might
be bigger than the allocated memory, causing an OOPS:
Unable to handle kernel paging request at virtual address fff00000f9b40000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
[fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
Workqueue: kacpi_notify acpi_os_execute_deferred
pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : hex_dump_to_buffer+0x30c/0x4a0
lr : hex_dump_to_buffer+0x328/0x4a0
sp : ffff800080e13880
x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
Call trace:
hex_dump_to_buffer+0x30c/0x4a0 (P)
print_hex_dump+0xac/0x170
cper_estatus_print_section+0x90c/0x968
cper_estatus_print+0xf0/0x158
__ghes_print_estatus+0xa0/0x148
ghes_proc+0x1bc/0x220
ghes_notify_hed+0x5c/0xb8
notifier_call_chain+0x78/0x148
blocking_notifier_call_chain+0x4c/0x80
acpi_hed_notify+0x28/0x40
acpi_ev_notify_dispatch+0x50/0x80
acpi_os_execute_deferred+0x24/0x48
process_one_work+0x15c/0x3b0
worker_thread+0x2d0/0x400
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
---[ end trace 0000000000000000 ]---
Prevent that by taking the actual allocated are into account when
checking for CPER length.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 6 +++++-
include/acpi/ghes.h | 1 +
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 0dc767392a6c6..a37c8fb574832 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -29,6 +29,7 @@
#include <linux/cper.h>
#include <linux/cleanup.h>
#include <linux/platform_device.h>
+#include <linux/minmax.h>
#include <linux/mutex.h>
#include <linux/ratelimit.h>
#include <linux/vmalloc.h>
@@ -294,6 +295,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
error_block_length = GHES_ESTATUS_MAX_SIZE;
}
ghes->estatus = kmalloc(error_block_length, GFP_KERNEL);
+ ghes->estatus_length = error_block_length;
if (!ghes->estatus) {
rc = -ENOMEM;
goto err_unmap_status_addr;
@@ -365,13 +367,15 @@ static int __ghes_check_estatus(struct ghes *ghes,
struct acpi_hest_generic_status *estatus)
{
u32 len = cper_estatus_len(estatus);
+ u32 max_len = min(ghes->generic->error_block_length,
+ ghes->estatus_length);
if (len < sizeof(*estatus)) {
pr_warn_ratelimited(FW_WARN GHES_PFX "Truncated error status block!\n");
return -EIO;
}
- if (len > ghes->generic->error_block_length) {
+ if (!len || len > max_len) {
pr_warn_ratelimited(FW_WARN GHES_PFX "Invalid error status block length!\n");
return -EIO;
}
diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
index ebd21b05fe6ed..93db60da5934e 100644
--- a/include/acpi/ghes.h
+++ b/include/acpi/ghes.h
@@ -21,6 +21,7 @@ struct ghes {
struct acpi_hest_generic_v2 *generic_v2;
};
struct acpi_hest_generic_status *estatus;
+ unsigned int estatus_length;
unsigned long flags;
union {
struct list_head list;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 067/844] APEI/GHES: ARM processor Error: don't go past allocated memory
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (65 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 066/844] APEI/GHES: ensure that won't go past CPER allocated record Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 068/844] EFI/CPER: don't go past the ARM processor CPER record buffer Sasha Levin
` (785 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mauro Carvalho Chehab, Jonathan Cameron, Ard Biesheuvel,
Hanjun Guo, Rafael J. Wysocki, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit 87880af2d24e62a84ed19943dbdd524f097172f2 ]
If the BIOS generates a very small ARM Processor Error, or
an incomplete one, the current logic will fail to deferrence
err->section_length
and
ctx_info->size
Add checks to avoid that. With such changes, such GHESv2
records won't cause OOPSes like this:
[ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP
[ 1.495449] Modules linked in:
[ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT
[ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
[ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred
[ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 1.497199] pc : log_arm_hw_error+0x5c/0x200
[ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220
0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75).
70 err_info = (struct cper_arm_err_info *)(err + 1);
71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
72 ctx_err = (u8 *)ctx_info;
73
74 for (n = 0; n < err->context_info_num; n++) {
75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
77 ctx_len += sz;
78 }
79
and similar ones while trying to access section_length on an
error dump with too small size.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 32 ++++++++++++++++++++++++++++----
drivers/ras/ras.c | 6 +++++-
2 files changed, 33 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index a37c8fb574832..77ea7a5b761f1 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -556,21 +556,45 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
{
struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
int flags = sync ? MF_ACTION_REQUIRED : 0;
+ int length = gdata->error_data_length;
char error_type[120];
bool queued = false;
int sec_sev, i;
char *p;
sec_sev = ghes_severity(gdata->error_severity);
- log_arm_hw_error(err, sec_sev);
+ if (length >= sizeof(*err)) {
+ log_arm_hw_error(err, sec_sev);
+ } else {
+ pr_warn(FW_BUG "arm error length: %d\n", length);
+ pr_warn(FW_BUG "length is too small\n");
+ pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
+ return false;
+ }
+
if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE)
return false;
p = (char *)(err + 1);
+ length -= sizeof(err);
+
for (i = 0; i < err->err_info_num; i++) {
- struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p;
- bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
- bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
+ struct cper_arm_err_info *err_info;
+ bool is_cache, has_pa;
+
+ /* Ensure we have enough data for the error info header */
+ if (length < sizeof(*err_info))
+ break;
+
+ err_info = (struct cper_arm_err_info *)p;
+
+ /* Validate the claimed length before using it */
+ length -= err_info->length;
+ if (length < 0)
+ break;
+
+ is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
+ has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
/*
* The field (err_info->error_info & BIT(26)) is fixed to set to
diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index 2a5b5a9fdcb36..03df3db623346 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -72,7 +72,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
ctx_err = (u8 *)ctx_info;
for (n = 0; n < err->context_info_num; n++) {
- sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
+ sz = sizeof(struct cper_arm_ctx_info);
+
+ if (sz + (long)ctx_info - (long)err >= err->section_length)
+ sz += ctx_info->size;
+
ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
ctx_len += sz;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 068/844] EFI/CPER: don't go past the ARM processor CPER record buffer
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (66 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 067/844] APEI/GHES: ARM processor Error: don't go past allocated memory Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 069/844] ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() Sasha Levin
` (784 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mauro Carvalho Chehab, Jonathan Cameron, Ard Biesheuvel,
Hanjun Guo, Rafael J. Wysocki, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit eae21beecb95a3b69ee5c38a659f774e171d730e ]
There's a logic inside GHES/CPER to detect if the section_length
is too small, but it doesn't detect if it is too big.
Currently, if the firmware receives an ARM processor CPER record
stating that a section length is big, kernel will blindly trust
section_length, producing a very long dump. For instance, a 67
bytes record with ERR_INFO_NUM set 46198 and section length
set to 854918320 would dump a lot of data going a way past the
firmware memory-mapped area.
Fix it by adding a logic to prevent it to go past the buffer
if ERR_INFO_NUM is too big, making it report instead:
[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
[Hardware Error]: event severity: recoverable
[Hardware Error]: Error 0, type: recoverable
[Hardware Error]: section_type: ARM processor error
[Hardware Error]: MIDR: 0xff304b2f8476870a
[Hardware Error]: section length: 854918320, CPER size: 67
[Hardware Error]: section length is too big
[Hardware Error]: firmware-generated error record is incorrect
[Hardware Error]: ERR_INFO_NUM is 46198
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject and changelog tweaks ]
Link: https://patch.msgid.link/41cd9f6b3ace3cdff7a5e864890849e4b1c58b63.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/cper-arm.c | 12 ++++++++----
drivers/firmware/efi/cper.c | 3 ++-
include/linux/cper.h | 3 ++-
3 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
index 76542a53e2027..b21cb1232d820 100644
--- a/drivers/firmware/efi/cper-arm.c
+++ b/drivers/firmware/efi/cper-arm.c
@@ -226,7 +226,8 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
}
void cper_print_proc_arm(const char *pfx,
- const struct cper_sec_proc_arm *proc)
+ const struct cper_sec_proc_arm *proc,
+ u32 length)
{
int i, len, max_ctx_type;
struct cper_arm_err_info *err_info;
@@ -238,9 +239,12 @@ void cper_print_proc_arm(const char *pfx,
len = proc->section_length - (sizeof(*proc) +
proc->err_info_num * (sizeof(*err_info)));
- if (len < 0) {
- printk("%ssection length: %d\n", pfx, proc->section_length);
- printk("%ssection length is too small\n", pfx);
+
+ if (len < 0 || proc->section_length > length) {
+ printk("%ssection length: %d, CPER size: %d\n",
+ pfx, proc->section_length, length);
+ printk("%ssection length is too %s\n", pfx,
+ (len < 0) ? "small" : "big");
printk("%sfirmware-generated error record is incorrect\n", pfx);
printk("%sERR_INFO_NUM is %d\n", pfx, proc->err_info_num);
return;
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index 09a4f0168df80..06b4fdb59917a 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -664,7 +664,8 @@ cper_estatus_print_section(const char *pfx, struct acpi_hest_generic_data *gdata
printk("%ssection_type: ARM processor error\n", newpfx);
if (gdata->error_data_length >= sizeof(*arm_err))
- cper_print_proc_arm(newpfx, arm_err);
+ cper_print_proc_arm(newpfx, arm_err,
+ gdata->error_data_length);
else
goto err_section_too_small;
#endif
diff --git a/include/linux/cper.h b/include/linux/cper.h
index 5b1236d8c65bb..440b35e459e53 100644
--- a/include/linux/cper.h
+++ b/include/linux/cper.h
@@ -595,7 +595,8 @@ void cper_mem_err_pack(const struct cper_sec_mem_err *,
const char *cper_mem_err_unpack(struct trace_seq *,
struct cper_mem_err_compact *);
void cper_print_proc_arm(const char *pfx,
- const struct cper_sec_proc_arm *proc);
+ const struct cper_sec_proc_arm *proc,
+ u32 length);
void cper_print_proc_ia(const char *pfx,
const struct cper_sec_proc_ia *proc);
int cper_mem_err_location(struct cper_mem_err_compact *mem, char *msg);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 069/844] ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (67 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 068/844] EFI/CPER: don't go past the ARM processor CPER record buffer Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 070/844] ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] Sasha Levin
` (783 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tuo Li, Rafael J. Wysocki, Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit f132e089fe89cadc2098991f0a3cb05c3f824ac6 ]
In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
device and then reassigned an ISA device:
dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
If the first lookup succeeds but the second fails, dev becomes NULL. This
leads to a potential null-pointer dereference when dev_dbg() is called:
if (errata.piix4.bmisx)
dev_dbg(&dev->dev, ...);
To prevent this, use two temporary pointers and retrieve each device
independently, avoiding overwriting dev with a possible NULL value.
Signed-off-by: Tuo Li <islituo@gmail.com>
[ rjw: Subject adjustment, added an empty code line ]
Link: https://patch.msgid.link/20260111163214.202262-1-islituo@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_processor.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 7ec1dc04fd11b..85096ce7b658b 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -50,6 +50,7 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
{
u8 value1 = 0;
u8 value2 = 0;
+ struct pci_dev *ide_dev = NULL, *isa_dev = NULL;
if (!dev)
@@ -107,12 +108,12 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
* each IDE controller's DMA status to make sure we catch all
* DMA activity.
*/
- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ ide_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
PCI_DEVICE_ID_INTEL_82371AB,
PCI_ANY_ID, PCI_ANY_ID, NULL);
- if (dev) {
- errata.piix4.bmisx = pci_resource_start(dev, 4);
- pci_dev_put(dev);
+ if (ide_dev) {
+ errata.piix4.bmisx = pci_resource_start(ide_dev, 4);
+ pci_dev_put(ide_dev);
}
/*
@@ -124,24 +125,25 @@ static int acpi_processor_errata_piix4(struct pci_dev *dev)
* disable C3 support if this is enabled, as some legacy
* devices won't operate well if fast DMA is disabled.
*/
- dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
+ isa_dev = pci_get_subsys(PCI_VENDOR_ID_INTEL,
PCI_DEVICE_ID_INTEL_82371AB_0,
PCI_ANY_ID, PCI_ANY_ID, NULL);
- if (dev) {
- pci_read_config_byte(dev, 0x76, &value1);
- pci_read_config_byte(dev, 0x77, &value2);
+ if (isa_dev) {
+ pci_read_config_byte(isa_dev, 0x76, &value1);
+ pci_read_config_byte(isa_dev, 0x77, &value2);
if ((value1 & 0x80) || (value2 & 0x80))
errata.piix4.fdma = 1;
- pci_dev_put(dev);
+ pci_dev_put(isa_dev);
}
break;
}
- if (errata.piix4.bmisx)
- dev_dbg(&dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
- if (errata.piix4.fdma)
- dev_dbg(&dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
+ if (ide_dev)
+ dev_dbg(&ide_dev->dev, "Bus master activity detection (BM-IDE) erratum enabled\n");
+
+ if (isa_dev)
+ dev_dbg(&isa_dev->dev, "Type-F DMA livelock erratum (C3 disabled)\n");
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 070/844] ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (68 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 069/844] ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 071/844] ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP Sasha Levin
` (782 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ai Chao, Rafael J. Wysocki, Sasha Levin
From: Ai Chao <aichao@kylinos.cn>
[ Upstream commit ba6ded26dffe511b862a98a25955955e7154bfa8 ]
Like the JWIPC JVC9100 has its serial IRQ (10 and 11) described
as ActiveLow in the DSDT, which the kernel overrides to EdgeHigh which
breaks the serial.
irq 10, level, active-low, shared, skip-override
irq 11, level, active-low, shared, skip-override
Add the JVC9100 to the irq1_level_low_skip_override[] quirk table to fix
this.
Signed-off-by: Ai Chao <aichao@kylinos.cn>
Link: https://patch.msgid.link/20260113072719.4154485-1-aichao@kylinos.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index d16906f46484d..bc8050d8a6f51 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -532,6 +532,12 @@ static const struct dmi_system_id irq1_level_low_skip_override[] = {
DMI_MATCH(DMI_BOARD_NAME, "16T90SP"),
},
},
+ {
+ /* JWIPC JVC9100 */
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "JVC9100"),
+ },
+ },
{ }
};
@@ -706,6 +712,8 @@ struct irq_override_cmp {
static const struct irq_override_cmp override_table[] = {
{ irq1_level_low_skip_override, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
+ { irq1_level_low_skip_override, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
+ { irq1_level_low_skip_override, 11, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 1, false },
{ irq1_edge_low_force_override, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 071/844] ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (69 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 070/844] ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 072/844] powercap: intel_rapl: Add PL4 support for Ice Lake Sasha Levin
` (781 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Armin Wolf, Rafael J. Wysocki, Sasha Levin
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 026ad376a6a48538b576f3589331daa94daae6f0 ]
The ACPI specification states that when executing AML_FATAL_OP,
the OS should log the fatal error event and shutdown in a timely
fashion.
Windows complies with this requirement by immediatly entering a
Bso_d, effectively aborting the execution of the AML bytecode in
question.
ACPICA however might continue with the AML bytecode execution
should acpi_os_signal() simply return AE_OK. This will cause issues
because ACPI BIOS implementations might assume that the Fatal()
operator does not return.
Fix this by aborting the AML bytecode execution in such a case
by returning AE_ERROR. Also turn struct acpi_signal_fatal_info into a
local variable because of its small size (12 bytes) and to ensure
that acpi_os_signal() always receives valid information about the
fatal ACPI BIOS error.
Link: https://github.com/acpica/acpica/commit/d516c7758ba6
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3325491.5fSG56mABF@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/exoparg3.c | 46 +++++++++++++---------------------
1 file changed, 18 insertions(+), 28 deletions(-)
diff --git a/drivers/acpi/acpica/exoparg3.c b/drivers/acpi/acpica/exoparg3.c
index bf08110ed6d25..c8c8c4e49563e 100644
--- a/drivers/acpi/acpica/exoparg3.c
+++ b/drivers/acpi/acpica/exoparg3.c
@@ -10,6 +10,7 @@
#include <acpi/acpi.h>
#include "accommon.h"
#include "acinterp.h"
+#include <acpi/acoutput.h>
#include "acparser.h"
#include "amlcode.h"
@@ -51,8 +52,7 @@ ACPI_MODULE_NAME("exoparg3")
acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
{
union acpi_operand_object **operand = &walk_state->operands[0];
- struct acpi_signal_fatal_info *fatal;
- acpi_status status = AE_OK;
+ struct acpi_signal_fatal_info fatal;
ACPI_FUNCTION_TRACE_STR(ex_opcode_3A_0T_0R,
acpi_ps_get_opcode_name(walk_state->opcode));
@@ -60,28 +60,23 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
switch (walk_state->opcode) {
case AML_FATAL_OP: /* Fatal (fatal_type fatal_code fatal_arg) */
- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
- "FatalOp: Type %X Code %X Arg %X "
- "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n",
- (u32)operand[0]->integer.value,
- (u32)operand[1]->integer.value,
- (u32)operand[2]->integer.value));
-
- fatal = ACPI_ALLOCATE(sizeof(struct acpi_signal_fatal_info));
- if (fatal) {
- fatal->type = (u32) operand[0]->integer.value;
- fatal->code = (u32) operand[1]->integer.value;
- fatal->argument = (u32) operand[2]->integer.value;
- }
+ fatal.type = (u32)operand[0]->integer.value;
+ fatal.code = (u32)operand[1]->integer.value;
+ fatal.argument = (u32)operand[2]->integer.value;
- /* Always signal the OS! */
+ ACPI_BIOS_ERROR((AE_INFO,
+ "Fatal ACPI BIOS error (Type 0x%X Code 0x%X Arg 0x%X)\n",
+ fatal.type, fatal.code, fatal.argument));
- status = acpi_os_signal(ACPI_SIGNAL_FATAL, fatal);
+ /* Always signal the OS! */
- /* Might return while OS is shutting down, just continue */
+ acpi_os_signal(ACPI_SIGNAL_FATAL, &fatal);
- ACPI_FREE(fatal);
- goto cleanup;
+ /*
+ * Might return while OS is shutting down, so abort the AML execution
+ * by returning an error.
+ */
+ return_ACPI_STATUS(AE_ERROR);
case AML_EXTERNAL_OP:
/*
@@ -93,21 +88,16 @@ acpi_status acpi_ex_opcode_3A_0T_0R(struct acpi_walk_state *walk_state)
* wrong if an external opcode ever gets here.
*/
ACPI_ERROR((AE_INFO, "Executed External Op"));
- status = AE_OK;
- goto cleanup;
+
+ return_ACPI_STATUS(AE_OK);
default:
ACPI_ERROR((AE_INFO, "Unknown AML opcode 0x%X",
walk_state->opcode));
- status = AE_AML_BAD_OPCODE;
- goto cleanup;
+ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
}
-
-cleanup:
-
- return_ACPI_STATUS(status);
}
/*******************************************************************************
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 072/844] powercap: intel_rapl: Add PL4 support for Ice Lake
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (70 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 071/844] ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 073/844] io_uring/timeout: annotate data race in io_flush_timeouts() Sasha Levin
` (780 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Daniel Tang, Rafael J. Wysocki, Sasha Levin
From: Daniel Tang <danielzgtg.opensource@gmail.com>
[ Upstream commit 54b3cd55a515c7c0fcfa0c1f0b10d62c11d64bcc ]
Microsoft Surface Pro 7 firmware throttles the processor upon
boot/resume. Userspace needs to be able to restore the correct value.
Link: https://github.com/linux-surface/linux-surface/issues/706
Signed-off-by: Daniel Tang <danielzgtg.opensource@gmail.com>
Link: https://patch.msgid.link/6088605.ChMirdbgyp@daniel-desktop3
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/powercap/intel_rapl_msr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/powercap/intel_rapl_msr.c b/drivers/powercap/intel_rapl_msr.c
index 152893dca5653..3d5e7f56d68a1 100644
--- a/drivers/powercap/intel_rapl_msr.c
+++ b/drivers/powercap/intel_rapl_msr.c
@@ -160,6 +160,7 @@ static int rapl_msr_write_raw(int cpu, struct reg_action *ra)
/* List of verified CPUs. */
static const struct x86_cpu_id pl4_support_ids[] = {
+ X86_MATCH_VFM(INTEL_ICELAKE_L, NULL),
X86_MATCH_VFM(INTEL_TIGERLAKE_L, NULL),
X86_MATCH_VFM(INTEL_ALDERLAKE, NULL),
X86_MATCH_VFM(INTEL_ALDERLAKE_L, NULL),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 073/844] io_uring/timeout: annotate data race in io_flush_timeouts()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (71 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 072/844] powercap: intel_rapl: Add PL4 support for Ice Lake Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 074/844] alpha: fix user-space corruption during memory compaction Sasha Levin
` (779 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jens Axboe, syzbot+6c48db7d94402407301e, Sasha Levin
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit 42b12cb5fd4554679bac06bbdd05dc8b643bcc42 ]
syzbot correctly reports this as a KCSAN race, as ctx->cached_cq_tail
should be read under ->uring_lock. This isn't immediately feasible in
io_flush_timeouts(), but as long as we read a stable value, that should
be good enough. If two io-wq threads compete on this value, then they
will both end up calling io_flush_timeouts() and at least one of them
will see the correct value.
Reported-by: syzbot+6c48db7d94402407301e@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/timeout.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index d8fbbaf31cf35..84dda24f3eb24 100644
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -130,7 +130,7 @@ __cold void io_flush_timeouts(struct io_ring_ctx *ctx)
u32 seq;
raw_spin_lock_irq(&ctx->timeout_lock);
- seq = ctx->cached_cq_tail - atomic_read(&ctx->cq_timeouts);
+ seq = READ_ONCE(ctx->cached_cq_tail) - atomic_read(&ctx->cq_timeouts);
list_for_each_entry_safe(timeout, tmp, &ctx->timeout_list, list) {
struct io_kiocb *req = cmd_to_io_kiocb(timeout);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 074/844] alpha: fix user-space corruption during memory compaction
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (72 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 073/844] io_uring/timeout: annotate data race in io_flush_timeouts() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 075/844] md-cluster: fix NULL pointer dereference in process_metadata_update Sasha Levin
` (778 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Magnus Lindholm, Ivan Kokshaysky, Matoro Mahri, Michael Cree,
Sasha Levin
From: Magnus Lindholm <linmag7@gmail.com>
[ Upstream commit dd5712f3379cfe760267cdd28ff957d9ab4e51c7 ]
Alpha systems can suffer sporadic user-space crashes and heap
corruption when memory compaction is enabled.
Symptoms include SIGSEGV, glibc allocator failures (e.g. "unaligned
tcache chunk"), and compiler internal errors. The failures disappear
when compaction is disabled or when using global TLB invalidation.
The root cause is insufficient TLB shootdown during page migration.
Alpha relies on ASN-based MM context rollover for instruction cache
coherency, but this alone is not sufficient to prevent stale data or
instruction translations from surviving migration.
Fix this by introducing a migration-specific helper that combines:
- MM context invalidation (ASN rollover),
- immediate per-CPU TLB invalidation (TBI),
- synchronous cross-CPU shootdown when required.
The helper is used only by migration/compaction paths to avoid changing
global TLB semantics.
Additionally, update flush_tlb_other(), pte_clear(), to use
READ_ONCE()/WRITE_ONCE() for correct SMP memory ordering.
This fixes observed crashes on both UP and SMP Alpha systems.
Reviewed-by: Ivan Kokshaysky <ink@unseen.parts>
Tested-by: Matoro Mahri <matoro_mailinglist_kernel@matoro.tk>
Tested-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260102173603.18247-2-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/include/asm/pgtable.h | 33 ++++++++-
arch/alpha/include/asm/tlbflush.h | 4 +-
arch/alpha/mm/Makefile | 2 +-
arch/alpha/mm/tlbflush.c | 112 ++++++++++++++++++++++++++++++
4 files changed, 148 insertions(+), 3 deletions(-)
create mode 100644 arch/alpha/mm/tlbflush.c
diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
index 90e7a95391022..c9508ec37efc4 100644
--- a/arch/alpha/include/asm/pgtable.h
+++ b/arch/alpha/include/asm/pgtable.h
@@ -17,6 +17,7 @@
#include <asm/processor.h> /* For TASK_SIZE */
#include <asm/machvec.h>
#include <asm/setup.h>
+#include <linux/page_table_check.h>
struct mm_struct;
struct vm_area_struct;
@@ -183,6 +184,9 @@ extern inline void pud_set(pud_t * pudp, pmd_t * pmdp)
{ pud_val(*pudp) = _PAGE_TABLE | ((((unsigned long) pmdp) - PAGE_OFFSET) << (32-PAGE_SHIFT)); }
+extern void migrate_flush_tlb_page(struct vm_area_struct *vma,
+ unsigned long addr);
+
extern inline unsigned long
pmd_page_vaddr(pmd_t pmd)
{
@@ -202,7 +206,7 @@ extern inline int pte_none(pte_t pte) { return !pte_val(pte); }
extern inline int pte_present(pte_t pte) { return pte_val(pte) & _PAGE_VALID; }
extern inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
{
- pte_val(*ptep) = 0;
+ WRITE_ONCE(pte_val(*ptep), 0);
}
extern inline int pmd_none(pmd_t pmd) { return !pmd_val(pmd); }
@@ -264,6 +268,33 @@ extern inline pte_t * pte_offset_kernel(pmd_t * dir, unsigned long address)
extern pgd_t swapper_pg_dir[1024];
+#ifdef CONFIG_COMPACTION
+#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
+
+static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
+ unsigned long address,
+ pte_t *ptep)
+{
+ pte_t pte = READ_ONCE(*ptep);
+
+ pte_clear(mm, address, ptep);
+ return pte;
+}
+
+#define __HAVE_ARCH_PTEP_CLEAR_FLUSH
+
+static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
+ unsigned long addr, pte_t *ptep)
+{
+ struct mm_struct *mm = vma->vm_mm;
+ pte_t pte = ptep_get_and_clear(mm, addr, ptep);
+
+ page_table_check_pte_clear(mm, pte);
+ migrate_flush_tlb_page(vma, addr);
+ return pte;
+}
+
+#endif
/*
* The Alpha doesn't have any external MMU info: the kernel page
* tables contain all the necessary information.
diff --git a/arch/alpha/include/asm/tlbflush.h b/arch/alpha/include/asm/tlbflush.h
index ba4b359d6c395..0c8529997f54e 100644
--- a/arch/alpha/include/asm/tlbflush.h
+++ b/arch/alpha/include/asm/tlbflush.h
@@ -58,7 +58,9 @@ flush_tlb_other(struct mm_struct *mm)
unsigned long *mmc = &mm->context[smp_processor_id()];
/* Check it's not zero first to avoid cacheline ping pong
when possible. */
- if (*mmc) *mmc = 0;
+
+ if (READ_ONCE(*mmc))
+ WRITE_ONCE(*mmc, 0);
}
#ifndef CONFIG_SMP
diff --git a/arch/alpha/mm/Makefile b/arch/alpha/mm/Makefile
index 101dbd06b4ceb..2d05664058f64 100644
--- a/arch/alpha/mm/Makefile
+++ b/arch/alpha/mm/Makefile
@@ -3,4 +3,4 @@
# Makefile for the linux alpha-specific parts of the memory manager.
#
-obj-y := init.o fault.o
+obj-y := init.o fault.o tlbflush.o
diff --git a/arch/alpha/mm/tlbflush.c b/arch/alpha/mm/tlbflush.c
new file mode 100644
index 0000000000000..ccbc317b9a348
--- /dev/null
+++ b/arch/alpha/mm/tlbflush.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Alpha TLB shootdown helpers
+ *
+ * Copyright (C) 2025 Magnus Lindholm <linmag7@gmail.com>
+ *
+ * Alpha-specific TLB flush helpers that cannot be expressed purely
+ * as inline functions.
+ *
+ * These helpers provide combined MM context handling (ASN rollover)
+ * and immediate TLB invalidation for page migration and memory
+ * compaction paths, where lazy shootdowns are insufficient.
+ */
+
+#include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/sched.h>
+#include <asm/tlbflush.h>
+#include <asm/pal.h>
+#include <asm/mmu_context.h>
+
+#define asn_locked() (cpu_data[smp_processor_id()].asn_lock)
+
+/*
+ * Migration/compaction helper: combine mm context (ASN) handling with an
+ * immediate per-page TLB invalidate and (for exec) an instruction barrier.
+ *
+ * This mirrors the SMP combined IPI handler semantics, but runs locally on UP.
+ */
+#ifndef CONFIG_SMP
+void migrate_flush_tlb_page(struct vm_area_struct *vma,
+ unsigned long addr)
+{
+ struct mm_struct *mm = vma->vm_mm;
+ int tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2;
+
+ /*
+ * First do the mm-context side:
+ * If we're currently running this mm, reload a fresh context ASN.
+ * Otherwise, mark context invalid.
+ *
+ * On UP, this is mostly about matching the SMP semantics and ensuring
+ * exec/i-cache tagging assumptions hold when compaction migrates pages.
+ */
+ if (mm == current->active_mm)
+ flush_tlb_current(mm);
+ else
+ flush_tlb_other(mm);
+
+ /*
+ * Then do the immediate translation kill for this VA.
+ * For exec mappings, order instruction fetch after invalidation.
+ */
+ tbi(tbi_type, addr);
+}
+
+#else
+struct tlb_mm_and_addr {
+ struct mm_struct *mm;
+ unsigned long addr;
+ int tbi_type; /* 2 = DTB, 3 = ITB+DTB */
+};
+
+static void ipi_flush_mm_and_page(void *x)
+{
+ struct tlb_mm_and_addr *d = x;
+
+ /* Part 1: mm context side (Alpha uses ASN/context as a key mechanism). */
+ if (d->mm == current->active_mm && !asn_locked())
+ __load_new_mm_context(d->mm);
+ else
+ flush_tlb_other(d->mm);
+
+ /* Part 2: immediate per-VA invalidation on this CPU. */
+ tbi(d->tbi_type, d->addr);
+}
+
+void migrate_flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
+{
+ struct mm_struct *mm = vma->vm_mm;
+ struct tlb_mm_and_addr d = {
+ .mm = mm,
+ .addr = addr,
+ .tbi_type = (vma->vm_flags & VM_EXEC) ? 3 : 2,
+ };
+
+ /*
+ * One synchronous rendezvous: every CPU runs ipi_flush_mm_and_page().
+ * This is the "combined" version of flush_tlb_mm + per-page invalidate.
+ */
+ preempt_disable();
+ on_each_cpu(ipi_flush_mm_and_page, &d, 1);
+
+ /*
+ * mimic flush_tlb_mm()'s mm_users<=1 optimization.
+ */
+ if (atomic_read(&mm->mm_users) <= 1) {
+
+ int cpu, this_cpu;
+ this_cpu = smp_processor_id();
+
+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
+ if (!cpu_online(cpu) || cpu == this_cpu)
+ continue;
+ if (READ_ONCE(mm->context[cpu]))
+ WRITE_ONCE(mm->context[cpu], 0);
+ }
+ }
+ preempt_enable();
+}
+
+#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 075/844] md-cluster: fix NULL pointer dereference in process_metadata_update
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (73 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 074/844] alpha: fix user-space corruption during memory compaction Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 076/844] md raid: fix hang when stopping arrays with metadata through dm-raid Sasha Levin
` (777 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jiasheng Jiang, Yu Kuai, Sasha Levin
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ]
The function process_metadata_update() blindly dereferences the 'thread'
pointer (acquired via rcu_dereference_protected) within the wait_event()
macro.
While the code comment states "daemon thread must exist", there is a valid
race condition window during the MD array startup sequence (md_run):
1. bitmap_load() is called, which invokes md_cluster_ops->join().
2. join() starts the "cluster_recv" thread (recv_daemon).
3. At this point, recv_daemon is active and processing messages.
4. However, mddev->thread (the main MD thread) is not initialized until
later in md_run().
If a METADATA_UPDATED message is received from a remote node during this
specific window, process_metadata_update() will be called while
mddev->thread is still NULL, leading to a kernel panic.
To fix this, we must validate the 'thread' pointer. If it is NULL, we
release the held lock (no_new_dev_lockres) and return early, safely
ignoring the update request as the array is not yet fully ready to
process it.
Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-cluster.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 11f1e91d387d8..896279988dfd5 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -549,8 +549,13 @@ static void process_metadata_update(struct mddev *mddev, struct cluster_msg *msg
dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_CR);
- /* daemaon thread must exist */
thread = rcu_dereference_protected(mddev->thread, true);
+ if (!thread) {
+ pr_warn("md-cluster: Received metadata update but MD thread is not ready\n");
+ dlm_unlock_sync(cinfo->no_new_dev_lockres);
+ return;
+ }
+
wait_event(thread->wqueue,
(got_lock = mddev_trylock(mddev)) ||
test_bit(MD_CLUSTER_HOLDING_MUTEX_FOR_RECVD, &cinfo->state));
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 076/844] md raid: fix hang when stopping arrays with metadata through dm-raid
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (74 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 075/844] md-cluster: fix NULL pointer dereference in process_metadata_update Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 077/844] rust: cpufreq: always inline functions using build_assert with arguments Sasha Levin
` (776 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Heinz Mauelshagen, Yu Kuai, Sasha Levin
From: Heinz Mauelshagen <heinzm@redhat.com>
[ Upstream commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 ]
When using device-mapper's dm-raid target, stopping a RAID array can cause
the system to hang under specific conditions.
This occurs when:
- A dm-raid managed device tree is suspended from top to bottom
(the top-level RAID device is suspended first, followed by its
underlying metadata and data devices)
- The top-level RAID device is then removed
Removing the top-level device triggers a hang in the following sequence:
the dm-raid destructor calls md_stop(), which tries to flush the
write-intent bitmap by writing to the metadata sub-devices. However, these
devices are already suspended, making them unable to complete the write-intent
operations and causing an indefinite block.
Fix:
- Prevent bitmap flushing when md_stop() is called from dm-raid
destructor context
and avoid a quiescing/unquescing cycle which could also cause I/O
- Still allow write-intent bitmap flushing when called from dm-raid
suspend context
This ensures that RAID array teardown can complete successfully even when the
underlying devices are in a suspended state.
This second patch uses md_is_rdwr() to distinguish between suspend and
destructor paths as elaborated on above.
Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com
Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6d73f6e196a9f..ac71640ff3a81 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6848,13 +6848,15 @@ static void __md_stop_writes(struct mddev *mddev)
{
timer_delete_sync(&mddev->safemode_timer);
- if (mddev->pers && mddev->pers->quiesce) {
- mddev->pers->quiesce(mddev, 1);
- mddev->pers->quiesce(mddev, 0);
- }
+ if (md_is_rdwr(mddev) || !mddev_is_dm(mddev)) {
+ if (mddev->pers && mddev->pers->quiesce) {
+ mddev->pers->quiesce(mddev, 1);
+ mddev->pers->quiesce(mddev, 0);
+ }
- if (md_bitmap_enabled(mddev, true))
- mddev->bitmap_ops->flush(mddev);
+ if (md_bitmap_enabled(mddev, true))
+ mddev->bitmap_ops->flush(mddev);
+ }
if (md_is_rdwr(mddev) &&
((!mddev->in_sync && !mddev_is_clustered(mddev)) ||
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 077/844] rust: cpufreq: always inline functions using build_assert with arguments
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (75 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 076/844] md raid: fix hang when stopping arrays with metadata through dm-raid Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 078/844] cpufreq: dt-platdev: Block the driver from probing on more QC platforms Sasha Levin
` (775 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexandre Courbot, Daniel Almeida, Viresh Kumar, Sasha Levin
From: Alexandre Courbot <acourbot@nvidia.com>
[ Upstream commit 8c8b12a55614ea05953e8d695e700e6e1322a05d ]
`build_assert` relies on the compiler to optimize out its error path.
Functions using it with its arguments must thus always be inlined,
otherwise the error path of `build_assert` might not be optimized out,
triggering a build error.
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/cpufreq.rs | 2 ++
1 file changed, 2 insertions(+)
diff --git a/rust/kernel/cpufreq.rs b/rust/kernel/cpufreq.rs
index f968fbd228905..0879a79485f8e 100644
--- a/rust/kernel/cpufreq.rs
+++ b/rust/kernel/cpufreq.rs
@@ -1015,6 +1015,8 @@ impl<T: Driver> Registration<T> {
..pin_init::zeroed()
};
+ // Always inline to optimize out error path of `build_assert`.
+ #[inline(always)]
const fn copy_name(name: &'static CStr) -> [c_char; CPUFREQ_NAME_LEN] {
let src = name.to_bytes_with_nul();
let mut dst = [0; CPUFREQ_NAME_LEN];
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 078/844] cpufreq: dt-platdev: Block the driver from probing on more QC platforms
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (76 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 077/844] rust: cpufreq: always inline functions using build_assert with arguments Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 079/844] s390/perf: Disable register readout on sampling events Sasha Levin
` (774 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Konrad Dybcio, Viresh Kumar, Sasha Levin
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 7b781899072c5701ef9538c365757ee9ab9c00bd ]
Add a number of QC platforms to the blocklist, they all use either the
qcom-cpufreq-hw driver.
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq-dt-platdev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index b06a43143d23c..2fecab989dacc 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -169,8 +169,11 @@ static const struct of_device_id blocklist[] __initconst = {
{ .compatible = "qcom,sdm845", },
{ .compatible = "qcom,sdx75", },
{ .compatible = "qcom,sm6115", },
+ { .compatible = "qcom,sm6125", },
+ { .compatible = "qcom,sm6150", },
{ .compatible = "qcom,sm6350", },
{ .compatible = "qcom,sm6375", },
+ { .compatible = "qcom,sm7125", },
{ .compatible = "qcom,sm7225", },
{ .compatible = "qcom,sm7325", },
{ .compatible = "qcom,sm8150", },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 079/844] s390/perf: Disable register readout on sampling events
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (77 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 078/844] cpufreq: dt-platdev: Block the driver from probing on more QC platforms Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 080/844] arm64: mte: Set TCMA1 whenever MTE is present in the kernel Sasha Levin
` (773 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Richter, Jan Polensky, Heiko Carstens, Sasha Levin
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit b2c04fc1239062b39ddfdd8731ee1a10810dfb74 ]
Running commands
# ./perf record -IR0,R1 -a sleep 1
extracts and displays register value of general purpose register r1 and r0.
However the value displayed of any register is random and does not
reflect the register value recorded at the time of the sample interrupt.
The sampling device driver on s390 creates a very large buffer
for the hardware to store the samples. Only when that large buffer
gets full an interrupt is generated and many hundreds of sample
entries are processed and copied to the kernel ring buffer and
eventually get copied to the perf tool. It is during the copy
to the kernel ring buffer that each sample is processed (on s390)
and at that time the register values are extracted.
This is not the original goal, the register values should be read
when the samples are created not when the samples are copied to the
kernel ring buffer.
Prevent this event from being installed in the first place and
return -EOPNOTSUPP. This is already the case for PERF_SAMPLE_REGS_USER.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/perf_cpum_sf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index 459af23a47a5e..e8bd19ac82c7d 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -841,7 +841,7 @@ static bool is_callchain_event(struct perf_event *event)
u64 sample_type = event->attr.sample_type;
return sample_type & (PERF_SAMPLE_CALLCHAIN | PERF_SAMPLE_REGS_USER |
- PERF_SAMPLE_STACK_USER);
+ PERF_SAMPLE_REGS_INTR | PERF_SAMPLE_STACK_USER);
}
static int cpumsf_pmu_event_init(struct perf_event *event)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 080/844] arm64: mte: Set TCMA1 whenever MTE is present in the kernel
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (78 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 079/844] s390/perf: Disable register readout on sampling events Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 081/844] perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD Sasha Levin
` (772 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Carl Worth, Taehyun Noh, Catalin Marinas, Will Deacon,
Sasha Levin
From: Carl Worth <carl@os.amperecomputing.com>
[ Upstream commit a4e5927115f30a301f9939ed43e6a21a343e06ad ]
Set the TCMA1 bit so that access to TTBR1 addresses with 0xf in their
tag bits will be treated as tag unchecked.
This is important to avoid unwanted tag checking on some
systems. Specifically, SCTLR_EL1.TCF can be set to indicate that no
tag check faults are desired. But the architecture doesn't guarantee
that in this case the system won't still perform tag checks.
Use TCMA1 to ensure that undesired tag checks are not performed. This
bit was already set in the KASAN case. Adding it to the non-KASAN case
prevents tag checking since all TTBR1 address will have a value of 0xf
in their tag bits.
This patch has been measured on an Ampere system to improve the following:
* Eliminate over 98% of kernel-side tag checks during "perf bench
futex hash", as measured with "perf stat".
* Eliminate all MTE overhead (was previously a 25% performance
penalty) from the Phoronix pts/memcached benchmark (1:10 Set:Get
ration with 96 cores).
Reported-by: Taehyun Noh <taehyun@utexas.edu>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Carl Worth <carl@os.amperecomputing.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/proc.S | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 5d907ce3b6d3f..22866b49be372 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -48,14 +48,14 @@
#define TCR_KASAN_SW_FLAGS 0
#endif
-#ifdef CONFIG_KASAN_HW_TAGS
-#define TCR_MTE_FLAGS TCR_EL1_TCMA1 | TCR_EL1_TBI1 | TCR_EL1_TBID1
-#elif defined(CONFIG_ARM64_MTE)
+#ifdef CONFIG_ARM64_MTE
/*
* The mte_zero_clear_page_tags() implementation uses DC GZVA, which relies on
- * TBI being enabled at EL1.
+ * TBI being enabled at EL1. TCMA1 is needed to treat accesses with the
+ * match-all tag (0xF) as Tag Unchecked, irrespective of the SCTLR_EL1.TCF
+ * setting.
*/
-#define TCR_MTE_FLAGS TCR_EL1_TBI1 | TCR_EL1_TBID1
+#define TCR_MTE_FLAGS TCR_EL1_TCMA1 | TCR_EL1_TBI1 | TCR_EL1_TBID1
#else
#define TCR_MTE_FLAGS 0
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 081/844] perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (79 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 080/844] arm64: mte: Set TCMA1 whenever MTE is present in the kernel Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 082/844] ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) Sasha Levin
` (771 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Andrzej Siewior, Jonathan Cameron, Will Deacon,
Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit ab26d9c85554c4ff1d95ca8341522880ed9219d6 ]
Passing IRQF_ONESHOT ensures that the interrupt source is masked until
the secondary (threaded) handler is done. If only a primary handler is
used then the flag makes no sense because the interrupt can not fire
(again) while its handler is running.
The flag also disallows force-threading of the primary handler and the
irq-core will warn about this.
The intention here was probably not allowing forced-threading.
Replace IRQF_ONESHOT with IRQF_NO_THREAD.
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/cxl_pmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
index d094030220bf2..68a54d97d2a8a 100644
--- a/drivers/perf/cxl_pmu.c
+++ b/drivers/perf/cxl_pmu.c
@@ -877,7 +877,7 @@ static int cxl_pmu_probe(struct device *dev)
if (!irq_name)
return -ENOMEM;
- rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_ONESHOT,
+ rc = devm_request_irq(dev, irq, cxl_pmu_irq, IRQF_SHARED | IRQF_NO_THREAD,
irq_name, info);
if (rc)
return rc;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 082/844] ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (80 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 081/844] perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 083/844] ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Sasha Levin
` (770 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jakob Riemenschneider, Antheas Kapenekakis, Rafael J. Wysocki,
Sasha Levin
From: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
[ Upstream commit 229ecbaac6b31f89c554b77eb407377a5eade7d4 ]
Windows 11, version 22H2 introduced a new function index (Function 9) to
the Microsoft LPS0 _DSM, titled "Turn On Display Notification".
According to Microsoft documentation, this function signals to the system
firmware that the OS intends to turn on the display when exiting Modern
Standby. This allows the firmware to release Power Limits (PLx) earlier.
Crucially, this patch fixes a functional issue observed on the Lenovo Yoga
Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to
resume after suspend. Investigation linked shows the EC on this device
turns off these components during sleep but requires the Function 9
notification to wake them up again.
This patch defines the new function index (ACPI_MS_TURN_ON_DISPLAY) and
invokes it in acpi_s2idle_restore_early_lps0(). The execution order is
updated to match the logic of an "intent" signal:
1. LPS0 Exit (Function 6)
2. Turn On Display Intent (Function 9)
3. Modern Standby Exit (Function 8)
4. Screen On (Function 4)
Invoking Function 9 before the Modern Standby Exit ensures the firmware
has time to restore power rails and functionality (like fans) before the
software fully exits the sleep state.
Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications#turn-on-display-notification-function-9
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220505
Suggested-by: Antheas Kapenekakis <antheas@antheas.dev>
Signed-off-by: Jakob Riemenschneider <riemenschneiderjakob@gmail.com>
Link: https://patch.msgid.link/20260127200121.1292216-1-riemenschneiderjakob@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/x86/s2idle.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c
index cc3c83e4cc23b..2189330ffc6d3 100644
--- a/drivers/acpi/x86/s2idle.c
+++ b/drivers/acpi/x86/s2idle.c
@@ -49,6 +49,7 @@ static const struct acpi_device_id lps0_device_ids[] = {
#define ACPI_LPS0_EXIT 6
#define ACPI_LPS0_MS_ENTRY 7
#define ACPI_LPS0_MS_EXIT 8
+#define ACPI_MS_TURN_ON_DISPLAY 9
/* AMD */
#define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721"
@@ -356,6 +357,8 @@ static const char *acpi_sleep_dsm_state_to_str(unsigned int state)
return "lps0 ms entry";
case ACPI_LPS0_MS_EXIT:
return "lps0 ms exit";
+ case ACPI_MS_TURN_ON_DISPLAY:
+ return "lps0 ms turn on display";
}
} else {
switch (state) {
@@ -617,6 +620,9 @@ static void acpi_s2idle_restore_early_lps0(void)
if (lps0_dsm_func_mask_microsoft > 0) {
acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT,
lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
+ /* Intent to turn on display */
+ acpi_sleep_run_lps0_dsm(ACPI_MS_TURN_ON_DISPLAY,
+ lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
/* Modern Standby exit */
acpi_sleep_run_lps0_dsm(ACPI_LPS0_MS_EXIT,
lps0_dsm_func_mask_microsoft, lps0_dsm_guid_microsoft);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 083/844] ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (81 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 082/844] ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 084/844] ACPI: battery: fix incorrect charging status when current is zero Sasha Levin
` (769 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Yicong Yang, Rafael J. Wysocki, Sasha Levin
From: Yicong Yang <yang.yicong@picoheart.com>
[ Upstream commit 7cf28b3797a81b616bb7eb3e90cf131afc452919 ]
The device object rescan in acpi_scan_clear_dep_fn() is scheduled on a
system workqueue which is not guaranteed to be finished before entering
userspace. This may cause some key devices to be missing when userspace
init task tries to find them. Two issues observed on RISCV platforms:
- Kernel panic due to userspace init cannot have an opened
console.
The console device scanning is queued by acpi_scan_clear_dep_queue()
and not finished by the time userspace init process running, thus by
the time userspace init runs, no console is present.
- Entering rescue shell due to the lack of root devices (PCIe nvme in
our case).
Same reason as above, the PCIe host bridge scanning is queued on
a system workqueue and finished after init process runs.
The reason is because both devices (console, PCIe host bridge) depend on
riscv-aplic irqchip to serve their interrupts (console's wired interrupt
and PCI's INTx interrupts). In order to keep the dependency, these
devices are scanned and created after initializing riscv-aplic. The
riscv-aplic is initialized in device_initcall() and a device scan work
is queued via acpi_scan_clear_dep_queue(), which is close to the time
userspace init process is run. Since system_dfl_wq is used in
acpi_scan_clear_dep_queue() with no synchronization, the issues will
happen if userspace init runs before these devices are ready.
The solution is to wait for the queued work to complete before entering
userspace init. One possible way would be to use a dedicated workqueue
instead of system_dfl_wq, and explicitly flush it somewhere in the
initcall stage before entering userspace. Another way is to use
async_schedule_dev_nocall() for scanning these devices. It's designed
for asynchronous initialization and will work in the same way as before
because it's using a dedicated unbound workqueue as well, but the kernel
init code calls async_synchronize_full() right before entering userspace
init which will wait for the work to complete.
Compared to a dedicated workqueue, the second approach is simpler
because the async schedule framework takes care of all of the details.
The ACPI code only needs to focus on its job. A dedicated workqueue for
this could also be redundant because some platforms don't need
acpi_scan_clear_dep_queue() for their device scanning.
Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
[ rjw: Subject adjustment, changelog edits ]
Link: https://patch.msgid.link/20260128132848.93638-1-yang.yicong@picoheart.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/scan.c | 41 +++++++++++++++--------------------------
1 file changed, 15 insertions(+), 26 deletions(-)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 416d87f9bd107..b78f6be2f9468 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -5,6 +5,7 @@
#define pr_fmt(fmt) "ACPI: " fmt
+#include <linux/async.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>
@@ -2360,46 +2361,34 @@ static int acpi_dev_get_next_consumer_dev_cb(struct acpi_dep_data *dep, void *da
return 0;
}
-struct acpi_scan_clear_dep_work {
- struct work_struct work;
- struct acpi_device *adev;
-};
-
-static void acpi_scan_clear_dep_fn(struct work_struct *work)
+static void acpi_scan_clear_dep_fn(void *dev, async_cookie_t cookie)
{
- struct acpi_scan_clear_dep_work *cdw;
-
- cdw = container_of(work, struct acpi_scan_clear_dep_work, work);
+ struct acpi_device *adev = to_acpi_device(dev);
acpi_scan_lock_acquire();
- acpi_bus_attach(cdw->adev, (void *)true);
+ acpi_bus_attach(adev, (void *)true);
acpi_scan_lock_release();
- acpi_dev_put(cdw->adev);
- kfree(cdw);
+ acpi_dev_put(adev);
}
static bool acpi_scan_clear_dep_queue(struct acpi_device *adev)
{
- struct acpi_scan_clear_dep_work *cdw;
-
if (adev->dep_unmet)
return false;
- cdw = kmalloc(sizeof(*cdw), GFP_KERNEL);
- if (!cdw)
- return false;
-
- cdw->adev = adev;
- INIT_WORK(&cdw->work, acpi_scan_clear_dep_fn);
/*
- * Since the work function may block on the lock until the entire
- * initial enumeration of devices is complete, put it into the unbound
- * workqueue.
+ * Async schedule the deferred acpi_scan_clear_dep_fn() since:
+ * - acpi_bus_attach() needs to hold acpi_scan_lock which cannot
+ * be acquired under acpi_dep_list_lock (held here)
+ * - the deferred work at boot stage is ensured to be finished
+ * before userspace init task by the async_synchronize_full()
+ * barrier
+ *
+ * Use _nocall variant since it'll return on failure instead of
+ * run the function synchronously.
*/
- queue_work(system_dfl_wq, &cdw->work);
-
- return true;
+ return async_schedule_dev_nocall(acpi_scan_clear_dep_fn, &adev->dev);
}
static void acpi_scan_delete_dep_data(struct acpi_dep_data *dep)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 084/844] ACPI: battery: fix incorrect charging status when current is zero
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (82 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 083/844] ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 085/844] xenbus: Use .freeze/.thaw to handle xenbus devices Sasha Levin
` (768 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ata İlhan Köktürk, Rafael J. Wysocki, Sasha Levin
From: Ata İlhan Köktürk <atailhan2006@gmail.com>
[ Upstream commit bb1256e0ddc7e9e406164319769b9f8d8389f056 ]
On some laptops, such as the Huawei Matebook series, the embedded
controller continues to report "Charging" status even when the
charge threshold is reached and no current is being drawn.
This incorrect reporting prevents the system from switching to battery
power profiles, leading to significantly higher power (e.g., 18W instead
of 7W during browsing) and missed remaining battery time estimation.
Validate the "Charging" state by checking if rate_now is zero. If the
hardware reports charging but the current is zero, report "Not Charging"
to user space.
Signed-off-by: Ata İlhan Köktürk <atailhan2006@gmail.com>
[ rjw: Whitespace fix, braces added to an inner if (), new comment rewrite ]
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260129144856.43058-1-atailhan2006@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/battery.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 34181fa52e937..4b28ef79e6ac8 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -211,7 +211,14 @@ static int acpi_battery_get_property(struct power_supply *psy,
if (battery->state & ACPI_BATTERY_STATE_DISCHARGING)
val->intval = acpi_battery_handle_discharging(battery);
else if (battery->state & ACPI_BATTERY_STATE_CHARGING)
- val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ /* Validate the status by checking the current. */
+ if (battery->rate_now != ACPI_BATTERY_VALUE_UNKNOWN &&
+ battery->rate_now == 0) {
+ /* On charge but no current (0W/0mA). */
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ } else {
+ val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ }
else if (battery->state & ACPI_BATTERY_STATE_CHARGE_LIMITING)
val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
else if (acpi_battery_is_charged(battery))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 085/844] xenbus: Use .freeze/.thaw to handle xenbus devices
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (83 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 084/844] ACPI: battery: fix incorrect charging status when current is zero Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:19 ` [PATCH 6.19 086/844] blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() Sasha Levin
` (767 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jason Andryuk, Juergen Gross, Sasha Levin
From: Jason Andryuk <jason.andryuk@amd.com>
[ Upstream commit e08dd1ee49838750a514e83c0aa60cd12ba6ecbb ]
The goal is to fix s2idle and S3 for Xen PV devices. A domain resuming
from s3 or s2idle disconnects its PV devices during resume. The
backends are not expecting this and do not reconnect.
b3e96c0c7562 ("xen: use freeze/restore/thaw PM events for suspend/
resume/chkpt") changed xen_suspend()/do_suspend() from
PMSG_SUSPEND/PMSG_RESUME to PMSG_FREEZE/PMSG_THAW/PMSG_RESTORE, but the
suspend/resume callbacks remained.
.freeze/restore are used with hiberation where Linux restarts in a new
place in the future. .suspend/resume are useful for runtime power
management for the duration of a boot.
The current behavior of the callbacks works for an xl save/restore or
live migration where the domain is restored/migrated to a new location
and connecting to a not-already-connected backend.
Change xenbus_pm_ops to use .freeze/thaw/restore and drop the
.suspend/resume hook. This matches the use in drivers/xen/manage.c for
save/restore and live migration. With .suspend/resume empty, PV devices
are left connected during s2idle and s3, so PV devices are not changed
and work after resume.
Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
Acked-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20251119224731.61497-2-jason.andryuk@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/xen/xenbus/xenbus_probe_frontend.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
index 6d1819269cbe5..199917b6f77ca 100644
--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
@@ -148,11 +148,9 @@ static void xenbus_frontend_dev_shutdown(struct device *_dev)
}
static const struct dev_pm_ops xenbus_pm_ops = {
- .suspend = xenbus_dev_suspend,
- .resume = xenbus_frontend_dev_resume,
.freeze = xenbus_dev_suspend,
.thaw = xenbus_dev_cancel,
- .restore = xenbus_dev_resume,
+ .restore = xenbus_frontend_dev_resume,
};
static struct xen_bus_type xenbus_frontend = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 086/844] blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (84 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 085/844] xenbus: Use .freeze/.thaw to handle xenbus devices Sasha Levin
@ 2026-02-28 17:19 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 087/844] blk-mq-sched: unify elevators checking for async requests Sasha Levin
` (766 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yu Kuai, Nilay Shroff, Ming Lei, Hannes Reinecke, Jens Axboe,
Sasha Levin
From: Yu Kuai <yukuai@fnnas.com>
[ Upstream commit 9d20fd6ce1ba9733cd5ac96fcab32faa9fc404dd ]
In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
creating debugfs entries for hctxs. Hence add debugfs_mutex there,
it's safe because queue is not frozen.
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-debugfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 4896525b1c054..553d93b88e194 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -686,8 +686,10 @@ void blk_mq_debugfs_register_hctxs(struct request_queue *q)
struct blk_mq_hw_ctx *hctx;
unsigned long i;
+ mutex_lock(&q->debugfs_mutex);
queue_for_each_hw_ctx(q, hctx, i)
blk_mq_debugfs_register_hctx(q, hctx);
+ mutex_unlock(&q->debugfs_mutex);
}
void blk_mq_debugfs_unregister_hctxs(struct request_queue *q)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 087/844] blk-mq-sched: unify elevators checking for async requests
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (85 preceding siblings ...)
2026-02-28 17:19 ` [PATCH 6.19 086/844] blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 088/844] block: decouple secure erase size limit from discard size limit Sasha Levin
` (765 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yu Kuai, Nilay Shroff, Hannes Reinecke, Jens Axboe, Sasha Levin
From: Yu Kuai <yukuai@fnnas.com>
[ Upstream commit 1db61b0afdd7e8aa9289c423fdff002603b520b5 ]
bfq and mq-deadline consider sync writes as async requests and only
reserve tags for sync reads by async_depth, however, kyber doesn't
consider sync writes as async requests for now.
Consider the case there are lots of dirty pages, and user use fsync to
flush dirty pages. In this case sched_tags can be exhausted by sync writes
and sync reads can stuck waiting for tag. Hence let kyber follow what
mq-deadline and bfq did, and unify async requests checking for all
elevators.
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/bfq-iosched.c | 2 +-
block/blk-mq-sched.h | 5 +++++
block/kyber-iosched.c | 2 +-
block/mq-deadline.c | 2 +-
4 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 6e54b1d3d8bc2..9e9d081e86bb2 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -697,7 +697,7 @@ static void bfq_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
unsigned int limit, act_idx;
/* Sync reads have full depth available */
- if (op_is_sync(opf) && !op_is_write(opf))
+ if (blk_mq_is_sync_read(opf))
limit = data->q->nr_requests;
else
limit = bfqd->async_depths[!!bfqd->wr_busy_queues][op_is_sync(opf)];
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index 02c40a72e9598..5678e15bd33c4 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -137,4 +137,9 @@ static inline void blk_mq_set_min_shallow_depth(struct request_queue *q,
depth);
}
+static inline bool blk_mq_is_sync_read(blk_opf_t opf)
+{
+ return op_is_sync(opf) && !op_is_write(opf);
+}
+
#endif
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index c1b36ffd19ceb..2b3f5b8959af0 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -556,7 +556,7 @@ static void kyber_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
* We use the scheduler tags as per-hardware queue queueing tokens.
* Async requests can be limited at this stage.
*/
- if (!op_is_sync(opf)) {
+ if (!blk_mq_is_sync_read(opf)) {
struct kyber_queue_data *kqd = data->q->elevator->elevator_data;
data->shallow_depth = kqd->async_depth;
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 3e3719093aec7..29d00221fbea6 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -495,7 +495,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
struct deadline_data *dd = data->q->elevator->elevator_data;
/* Do not throttle synchronous reads. */
- if (op_is_sync(opf) && !op_is_write(opf))
+ if (blk_mq_is_sync_read(opf))
return;
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 088/844] block: decouple secure erase size limit from discard size limit
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (86 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 087/844] blk-mq-sched: unify elevators checking for async requests Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 089/844] sparc: Synchronize user stack on fork and clone Sasha Levin
` (764 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luke Wang, Ulf Hansson, Jens Axboe, Sasha Levin
From: Luke Wang <ziniu.wang_1@nxp.com>
[ Upstream commit ee81212f74a57c5d2b56cf504f40d528dac6faaf ]
Secure erase should use max_secure_erase_sectors instead of being limited
by max_discard_sectors. Separate the handling of REQ_OP_SECURE_ERASE from
REQ_OP_DISCARD to allow each operation to use its own size limit.
Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-merge.c | 21 +++++++++++++++++----
block/blk.h | 6 +++++-
2 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/block/blk-merge.c b/block/blk-merge.c
index d3115d7469df0..bf8faadb0bd46 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -158,8 +158,9 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
return bio;
}
-struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
- unsigned *nsegs)
+static struct bio *__bio_split_discard(struct bio *bio,
+ const struct queue_limits *lim, unsigned *nsegs,
+ unsigned int max_sectors)
{
unsigned int max_discard_sectors, granularity;
sector_t tmp;
@@ -169,8 +170,7 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
granularity = max(lim->discard_granularity >> 9, 1U);
- max_discard_sectors =
- min(lim->max_discard_sectors, bio_allowed_max_sectors(lim));
+ max_discard_sectors = min(max_sectors, bio_allowed_max_sectors(lim));
max_discard_sectors -= max_discard_sectors % granularity;
if (unlikely(!max_discard_sectors))
return bio;
@@ -194,6 +194,19 @@ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
return bio_submit_split(bio, split_sectors);
}
+struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+ unsigned *nsegs)
+{
+ unsigned int max_sectors;
+
+ if (bio_op(bio) == REQ_OP_SECURE_ERASE)
+ max_sectors = lim->max_secure_erase_sectors;
+ else
+ max_sectors = lim->max_discard_sectors;
+
+ return __bio_split_discard(bio, lim, nsegs, max_sectors);
+}
+
static inline unsigned int blk_boundary_sectors(const struct queue_limits *lim,
bool is_atomic)
{
diff --git a/block/blk.h b/block/blk.h
index e4c433f62dfc7..4cd5a91346d8a 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -208,10 +208,14 @@ static inline unsigned int blk_queue_get_max_sectors(struct request *rq)
struct request_queue *q = rq->q;
enum req_op op = req_op(rq);
- if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE))
+ if (unlikely(op == REQ_OP_DISCARD))
return min(q->limits.max_discard_sectors,
UINT_MAX >> SECTOR_SHIFT);
+ if (unlikely(op == REQ_OP_SECURE_ERASE))
+ return min(q->limits.max_secure_erase_sectors,
+ UINT_MAX >> SECTOR_SHIFT);
+
if (unlikely(op == REQ_OP_WRITE_ZEROES))
return q->limits.max_write_zeroes_sectors;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 089/844] sparc: Synchronize user stack on fork and clone
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (87 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 088/844] block: decouple secure erase size limit from discard size limit Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 090/844] sparc: don't reference obsolete termio struct for TC* constants Sasha Levin
` (763 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Andreas Larsson, Ludwig Rydberg, John Paul Adrian Glaubitz,
Sasha Levin
From: Andreas Larsson <andreas@gaisler.com>
[ Upstream commit e38eba3b77878ada327a572a41596a3b0b44e522 ]
Flush all uncommitted user windows before calling the generic syscall
handlers for clone, fork, and vfork.
Prior to entering the arch common handlers sparc_{clone|fork|vfork}, the
arch-specific syscall wrappers for these syscalls will attempt to flush
all windows (including user windows).
In the window overflow trap handlers on both SPARC{32|64},
if the window can't be stored (i.e due to MMU related faults) the routine
backups the user window and increments a thread counter (wsaved).
By adding a synchronization point after the flush attempt, when fault
handling is enabled, any uncommitted user windows will be flushed.
Link: https://sourceware.org/bugzilla/show_bug.cgi?id=31394
Closes: https://lore.kernel.org/sparclinux/fe5cc47167430007560501aabb28ba154985b661.camel@physik.fu-berlin.de/
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Link: https://lore.kernel.org/r/20260119144753.27945-2-ludwig.rydberg@gaisler.com
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/kernel/process.c | 38 +++++++++++++++++++++++--------------
1 file changed, 24 insertions(+), 14 deletions(-)
diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
index 0442ab00518d3..7d69877511fac 100644
--- a/arch/sparc/kernel/process.c
+++ b/arch/sparc/kernel/process.c
@@ -17,14 +17,18 @@
asmlinkage long sparc_fork(struct pt_regs *regs)
{
- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+ unsigned long orig_i1;
long ret;
struct kernel_clone_args args = {
.exit_signal = SIGCHLD,
- /* Reuse the parent's stack for the child. */
- .stack = regs->u_regs[UREG_FP],
};
+ synchronize_user_stack();
+
+ orig_i1 = regs->u_regs[UREG_I1];
+ /* Reuse the parent's stack for the child. */
+ args.stack = regs->u_regs[UREG_FP];
+
ret = kernel_clone(&args);
/* If we get an error and potentially restart the system
@@ -40,16 +44,19 @@ asmlinkage long sparc_fork(struct pt_regs *regs)
asmlinkage long sparc_vfork(struct pt_regs *regs)
{
- unsigned long orig_i1 = regs->u_regs[UREG_I1];
+ unsigned long orig_i1;
long ret;
-
struct kernel_clone_args args = {
.flags = CLONE_VFORK | CLONE_VM,
.exit_signal = SIGCHLD,
- /* Reuse the parent's stack for the child. */
- .stack = regs->u_regs[UREG_FP],
};
+ synchronize_user_stack();
+
+ orig_i1 = regs->u_regs[UREG_I1];
+ /* Reuse the parent's stack for the child. */
+ args.stack = regs->u_regs[UREG_FP];
+
ret = kernel_clone(&args);
/* If we get an error and potentially restart the system
@@ -65,15 +72,18 @@ asmlinkage long sparc_vfork(struct pt_regs *regs)
asmlinkage long sparc_clone(struct pt_regs *regs)
{
- unsigned long orig_i1 = regs->u_regs[UREG_I1];
- unsigned int flags = lower_32_bits(regs->u_regs[UREG_I0]);
+ unsigned long orig_i1;
+ unsigned int flags;
long ret;
+ struct kernel_clone_args args = {0};
- struct kernel_clone_args args = {
- .flags = (flags & ~CSIGNAL),
- .exit_signal = (flags & CSIGNAL),
- .tls = regs->u_regs[UREG_I3],
- };
+ synchronize_user_stack();
+
+ orig_i1 = regs->u_regs[UREG_I1];
+ flags = lower_32_bits(regs->u_regs[UREG_I0]);
+ args.flags = (flags & ~CSIGNAL);
+ args.exit_signal = (flags & CSIGNAL);
+ args.tls = regs->u_regs[UREG_I3];
#ifdef CONFIG_COMPAT
if (test_thread_flag(TIF_32BIT)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 090/844] sparc: don't reference obsolete termio struct for TC* constants
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (88 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 089/844] sparc: Synchronize user stack on fork and clone Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 091/844] bpf: verifier improvement in 32bit shift sign extension pattern Sasha Levin
` (762 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sam James, Andreas Larsson, Sasha Levin
From: Sam James <sam@gentoo.org>
[ Upstream commit be0bccffcde3308150d2a90e55fc10e249098909 ]
Similar in nature to commit ab107276607a ("powerpc: Fix struct termio related ioctl macros").
glibc-2.42 drops the legacy termio struct, but the ioctls.h header still
defines some TC* constants in terms of termio (via sizeof). Hardcode the
values instead.
This fixes building Python for example, which falls over like:
./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
Link: https://bugs.gentoo.org/961769
Link: https://bugs.gentoo.org/962600
Signed-off-by: Sam James <sam@gentoo.org>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/include/uapi/asm/ioctls.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
index 7fd2f5873c9e7..a8bbdf9877a41 100644
--- a/arch/sparc/include/uapi/asm/ioctls.h
+++ b/arch/sparc/include/uapi/asm/ioctls.h
@@ -5,10 +5,10 @@
#include <asm/ioctl.h>
/* Big T */
-#define TCGETA _IOR('T', 1, struct termio)
-#define TCSETA _IOW('T', 2, struct termio)
-#define TCSETAW _IOW('T', 3, struct termio)
-#define TCSETAF _IOW('T', 4, struct termio)
+#define TCGETA 0x40125401 /* _IOR('T', 1, struct termio) */
+#define TCSETA 0x80125402 /* _IOW('T', 2, struct termio) */
+#define TCSETAW 0x80125403 /* _IOW('T', 3, struct termio) */
+#define TCSETAF 0x80125404 /* _IOW('T', 4, struct termio) */
#define TCSBRK _IO('T', 5)
#define TCXONC _IO('T', 6)
#define TCFLSH _IO('T', 7)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 091/844] bpf: verifier improvement in 32bit shift sign extension pattern
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (89 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 090/844] sparc: don't reference obsolete termio struct for TC* constants Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 092/844] irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on exit Sasha Levin
` (761 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Cupertino Miranda, Andrew Pinski, Eduard Zingerman, David Faust,
Jose Marchesi, Elena Zannoni, Alexei Starovoitov, Sasha Levin
From: Cupertino Miranda <cupertino.miranda@oracle.com>
[ Upstream commit d18dec4b8990048ce75f0ece32bb96b3fbd3f422 ]
This patch improves the verifier to correctly compute bounds for
sign extension compiler pattern composed of left shift by 32bits
followed by a sign right shift by 32bits. Pattern in the verifier was
limitted to positive value bounds and would reset bound computation for
negative values. New code allows both positive and negative values for
sign extension without compromising bound computation and verifier to
pass.
This change is required by GCC which generate such pattern, and was
detected in the context of systemd, as described in the following GCC
bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119731
Three new tests were added in verifier_subreg.c.
Signed-off-by: Cupertino Miranda <cupertino.miranda@oracle.com>
Signed-off-by: Andrew Pinski <andrew.pinski@oss.qualcomm.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Cc: David Faust <david.faust@oracle.com>
Cc: Jose Marchesi <jose.marchesi@oracle.com>
Cc: Elena Zannoni <elena.zannoni@oracle.com>
Link: https://lore.kernel.org/r/20251202180220.11128-2-cupertino.miranda@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fe01edfcc34c6..7069e9f527eaa 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15305,21 +15305,17 @@ static void __scalar64_min_max_lsh(struct bpf_reg_state *dst_reg,
u64 umin_val, u64 umax_val)
{
/* Special case <<32 because it is a common compiler pattern to sign
- * extend subreg by doing <<32 s>>32. In this case if 32bit bounds are
- * positive we know this shift will also be positive so we can track
- * bounds correctly. Otherwise we lose all sign bit information except
- * what we can pick up from var_off. Perhaps we can generalize this
- * later to shifts of any length.
+ * extend subreg by doing <<32 s>>32. smin/smax assignments are correct
+ * because s32 bounds don't flip sign when shifting to the left by
+ * 32bits.
*/
- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_max_value >= 0)
+ if (umin_val == 32 && umax_val == 32) {
dst_reg->smax_value = (s64)dst_reg->s32_max_value << 32;
- else
- dst_reg->smax_value = S64_MAX;
-
- if (umin_val == 32 && umax_val == 32 && dst_reg->s32_min_value >= 0)
dst_reg->smin_value = (s64)dst_reg->s32_min_value << 32;
- else
+ } else {
+ dst_reg->smax_value = S64_MAX;
dst_reg->smin_value = S64_MIN;
+ }
/* If we might shift our top bit out, then we know nothing */
if (dst_reg->umax_value > 1ULL << (63 - umax_val)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 092/844] irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on exit
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (90 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 091/844] bpf: verifier improvement in 32bit shift sign extension pattern Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 093/844] perf/x86/msr: Add Airmont NP Sasha Levin
` (760 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nick Hu, Thomas Gleixner, Yong-Xuan Wang, Cyan Yang, Anup Patel,
Nutty Liu, Sasha Levin
From: Nick Hu <nick.hu@sifive.com>
[ Upstream commit f48b4bd0915bf61ac12b8c65c7939ebd03bc8abf ]
The IMSIC might be reset when the system enters a low power state, but on
exit nothing restores the registers, which prevents interrupt delivery.
Solve this by registering a CPU power management notifier, which restores
the IMSIC on exit.
Signed-off-by: Nick Hu <nick.hu@sifive.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Cyan Yang <cyan.yang@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Link: https://patch.msgid.link/20251202-preserve-aplic-imsic-v3-1-1844fbf1fe92@sifive.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-riscv-imsic-early.c | 39 ++++++++++++++++++++-----
1 file changed, 31 insertions(+), 8 deletions(-)
diff --git a/drivers/irqchip/irq-riscv-imsic-early.c b/drivers/irqchip/irq-riscv-imsic-early.c
index 6bac67cc0b6d9..ba903fa689bd5 100644
--- a/drivers/irqchip/irq-riscv-imsic-early.c
+++ b/drivers/irqchip/irq-riscv-imsic-early.c
@@ -7,6 +7,7 @@
#define pr_fmt(fmt) "riscv-imsic: " fmt
#include <linux/acpi.h>
#include <linux/cpu.h>
+#include <linux/cpu_pm.h>
#include <linux/export.h>
#include <linux/interrupt.h>
#include <linux/init.h>
@@ -123,14 +124,8 @@ static void imsic_handle_irq(struct irq_desc *desc)
chained_irq_exit(chip, desc);
}
-static int imsic_starting_cpu(unsigned int cpu)
+static void imsic_hw_states_init(void)
{
- /* Mark per-CPU IMSIC state as online */
- imsic_state_online();
-
- /* Enable per-CPU parent interrupt */
- enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq));
-
/* Setup IPIs */
imsic_ipi_starting_cpu();
@@ -142,6 +137,18 @@ static int imsic_starting_cpu(unsigned int cpu)
/* Enable local interrupt delivery */
imsic_local_delivery(true);
+}
+
+static int imsic_starting_cpu(unsigned int cpu)
+{
+ /* Mark per-CPU IMSIC state as online */
+ imsic_state_online();
+
+ /* Enable per-CPU parent interrupt */
+ enable_percpu_irq(imsic_parent_irq, irq_get_trigger_type(imsic_parent_irq));
+
+ /* Initialize the IMSIC registers to enable the interrupt delivery */
+ imsic_hw_states_init();
return 0;
}
@@ -157,6 +164,22 @@ static int imsic_dying_cpu(unsigned int cpu)
return 0;
}
+static int imsic_pm_notifier(struct notifier_block *self, unsigned long cmd, void *v)
+{
+ switch (cmd) {
+ case CPU_PM_EXIT:
+ /* Initialize the IMSIC registers to enable the interrupt delivery */
+ imsic_hw_states_init();
+ break;
+ }
+
+ return NOTIFY_OK;
+}
+
+static struct notifier_block imsic_pm_notifier_block = {
+ .notifier_call = imsic_pm_notifier,
+};
+
static int __init imsic_early_probe(struct fwnode_handle *fwnode)
{
struct irq_domain *domain;
@@ -194,7 +217,7 @@ static int __init imsic_early_probe(struct fwnode_handle *fwnode)
cpuhp_setup_state(CPUHP_AP_IRQ_RISCV_IMSIC_STARTING, "irqchip/riscv/imsic:starting",
imsic_starting_cpu, imsic_dying_cpu);
- return 0;
+ return cpu_pm_register_notifier(&imsic_pm_notifier_block);
}
static int __init imsic_early_dt_init(struct device_node *node, struct device_node *parent)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 093/844] perf/x86/msr: Add Airmont NP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (91 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 092/844] irqchip/riscv-imsic: Add a CPU pm notifier to restore the IMSIC on exit Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 094/844] perf/x86/cstate: " Sasha Levin
` (759 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Martin Schiller, Peter Zijlstra (Intel), Dapeng Mi, Sasha Levin
From: Martin Schiller <ms@dev.tdt.de>
[ Upstream commit 63dbadcafc1f4d1da796a8e2c0aea1e561f79ece ]
Like Airmont, the Airmont NP (aka Intel / MaxLinear Lightning Mountain)
supports SMI_COUNT MSR.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251124074846.9653-2-ms@dev.tdt.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/msr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
index 7f5007a4752a1..8052596b85036 100644
--- a/arch/x86/events/msr.c
+++ b/arch/x86/events/msr.c
@@ -78,6 +78,7 @@ static bool test_intel(int idx, void *data)
case INTEL_ATOM_SILVERMONT:
case INTEL_ATOM_SILVERMONT_D:
case INTEL_ATOM_AIRMONT:
+ case INTEL_ATOM_AIRMONT_NP:
case INTEL_ATOM_GOLDMONT:
case INTEL_ATOM_GOLDMONT_D:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 094/844] perf/x86/cstate: Add Airmont NP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (92 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 093/844] perf/x86/msr: Add Airmont NP Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 095/844] perf/x86/intel: " Sasha Levin
` (758 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Martin Schiller, Peter Zijlstra (Intel), Dapeng Mi, Sasha Levin
From: Martin Schiller <ms@dev.tdt.de>
[ Upstream commit 3006911f284d769b0f66c12b39da130325ef1440 ]
From the perspective of Intel cstate residency counters, the Airmont NP
(aka Lightning Mountain) is identical to the Airmont.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251124074846.9653-4-ms@dev.tdt.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/cstate.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index fa67fda6e45b4..c1e318bdaa397 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -599,6 +599,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
X86_MATCH_VFM(INTEL_ATOM_SILVERMONT, &slm_cstates),
X86_MATCH_VFM(INTEL_ATOM_SILVERMONT_D, &slm_cstates),
X86_MATCH_VFM(INTEL_ATOM_AIRMONT, &slm_cstates),
+ X86_MATCH_VFM(INTEL_ATOM_AIRMONT_NP, &slm_cstates),
X86_MATCH_VFM(INTEL_BROADWELL, &snb_cstates),
X86_MATCH_VFM(INTEL_BROADWELL_D, &snb_cstates),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 095/844] perf/x86/intel: Add Airmont NP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (93 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 094/844] perf/x86/cstate: " Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 096/844] gendwarfksyms: Fix build on 32-bit hosts Sasha Levin
` (757 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Martin Schiller, Peter Zijlstra (Intel), Dapeng Mi, Sasha Levin
From: Martin Schiller <ms@dev.tdt.de>
[ Upstream commit a08340fd291671c54d379d285b2325490ce90ddd ]
The Intel / MaxLinear Airmont NP (aka Lightning Mountain) supports the
same architectual and non-architecural events as Airmont.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251124074846.9653-3-ms@dev.tdt.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index bdf3f0d0fe216..d85df652334fb 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -7405,6 +7405,7 @@ __init int intel_pmu_init(void)
case INTEL_ATOM_SILVERMONT_D:
case INTEL_ATOM_SILVERMONT_MID:
case INTEL_ATOM_AIRMONT:
+ case INTEL_ATOM_AIRMONT_NP:
case INTEL_ATOM_SILVERMONT_MID2:
memcpy(hw_cache_event_ids, slm_hw_cache_event_ids,
sizeof(hw_cache_event_ids));
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 096/844] gendwarfksyms: Fix build on 32-bit hosts
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (94 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 095/844] perf/x86/intel: " Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 097/844] bpf: crypto: Use the correct destructor kfunc type Sasha Levin
` (756 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sami Tolvanen, Michal Suchánek, Sasha Levin
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit ddc54f912a551f6eb0bbcfc3880f45fe27a252cb ]
We have interchangeably used unsigned long for some of the types
defined in elfutils, assuming they're always 64-bit. This obviously
fails when building gendwarfksyms on 32-bit hosts. Fix the types.
Reported-by: Michal Suchánek <msuchanek@suse.de>
Closes: https://lore.kernel.org/linux-modules/aRcxzPxtJblVSh1y@kitsune.suse.cz/
Tested-by: Michal Suchánek <msuchanek@suse.de>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/gendwarfksyms/dwarf.c | 4 +++-
scripts/gendwarfksyms/symbols.c | 5 +++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/scripts/gendwarfksyms/dwarf.c b/scripts/gendwarfksyms/dwarf.c
index 3538a7d9cb070..e76d732f5f602 100644
--- a/scripts/gendwarfksyms/dwarf.c
+++ b/scripts/gendwarfksyms/dwarf.c
@@ -750,6 +750,7 @@ static void process_enumerator_type(struct state *state, struct die *cache,
Dwarf_Die *die)
{
bool overridden = false;
+ unsigned long override;
Dwarf_Word value;
if (stable) {
@@ -761,7 +762,8 @@ static void process_enumerator_type(struct state *state, struct die *cache,
return;
overridden = kabi_get_enumerator_value(
- state->expand.current_fqn, cache->fqn, &value);
+ state->expand.current_fqn, cache->fqn, &override);
+ value = override;
}
process_list_comma(state, cache);
diff --git a/scripts/gendwarfksyms/symbols.c b/scripts/gendwarfksyms/symbols.c
index ecddcb5ffcdfb..42cd27c9cec4f 100644
--- a/scripts/gendwarfksyms/symbols.c
+++ b/scripts/gendwarfksyms/symbols.c
@@ -3,6 +3,7 @@
* Copyright (C) 2024 Google LLC
*/
+#include <inttypes.h>
#include "gendwarfksyms.h"
#define SYMBOL_HASH_BITS 12
@@ -242,7 +243,7 @@ static void elf_for_each_global(int fd, elf_symbol_callback_t func, void *arg)
error("elf_getdata failed: %s", elf_errmsg(-1));
if (shdr->sh_entsize != sym_size)
- error("expected sh_entsize (%lu) to be %zu",
+ error("expected sh_entsize (%" PRIu64 ") to be %zu",
shdr->sh_entsize, sym_size);
nsyms = shdr->sh_size / shdr->sh_entsize;
@@ -292,7 +293,7 @@ static void set_symbol_addr(struct symbol *sym, void *arg)
hash_add(symbol_addrs, &sym->addr_hash,
symbol_addr_hash(&sym->addr));
- debug("%s -> { %u, %lx }", sym->name, sym->addr.section,
+ debug("%s -> { %u, %" PRIx64 " }", sym->name, sym->addr.section,
sym->addr.address);
} else if (sym->addr.section != addr->section ||
sym->addr.address != addr->address) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 097/844] bpf: crypto: Use the correct destructor kfunc type
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (95 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 096/844] gendwarfksyms: Fix build on 32-bit hosts Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 098/844] bpf: net_sched: " Sasha Levin
` (755 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sami Tolvanen, Yonghong Song, Viktor Malik, Alexei Starovoitov,
Sasha Levin
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit b40a5d724f29fc2eed23ff353808a9aae616b48a ]
With CONFIG_CFI enabled, the kernel strictly enforces that indirect
function calls use a function pointer type that matches the target
function. I ran into the following type mismatch when running BPF
self-tests:
CFI failure at bpf_obj_free_fields+0x190/0x238 (target:
bpf_crypto_ctx_release+0x0/0x94; expected type: 0xa488ebfc)
Internal error: Oops - CFI: 00000000f2008228 [#1] SMP
...
As bpf_crypto_ctx_release() is also used in BPF programs and using
a void pointer as the argument would make the verifier unhappy, add
a simple stub function with the correct type and register it as the
destructor kfunc instead.
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Tested-by: Viktor Malik <vmalik@redhat.com>
Link: https://lore.kernel.org/r/20260110082548.113748-7-samitolvanen@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/crypto.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/crypto.c b/kernel/bpf/crypto.c
index 83c4d9943084b..1d024fe7248ac 100644
--- a/kernel/bpf/crypto.c
+++ b/kernel/bpf/crypto.c
@@ -261,6 +261,12 @@ __bpf_kfunc void bpf_crypto_ctx_release(struct bpf_crypto_ctx *ctx)
call_rcu(&ctx->rcu, crypto_free_cb);
}
+__bpf_kfunc void bpf_crypto_ctx_release_dtor(void *ctx)
+{
+ bpf_crypto_ctx_release(ctx);
+}
+CFI_NOSEAL(bpf_crypto_ctx_release_dtor);
+
static int bpf_crypto_crypt(const struct bpf_crypto_ctx *ctx,
const struct bpf_dynptr_kern *src,
const struct bpf_dynptr_kern *dst,
@@ -368,7 +374,7 @@ static const struct btf_kfunc_id_set crypt_kfunc_set = {
BTF_ID_LIST(bpf_crypto_dtor_ids)
BTF_ID(struct, bpf_crypto_ctx)
-BTF_ID(func, bpf_crypto_ctx_release)
+BTF_ID(func, bpf_crypto_ctx_release_dtor)
static int __init crypto_kfunc_init(void)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 098/844] bpf: net_sched: Use the correct destructor kfunc type
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (96 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 097/844] bpf: crypto: Use the correct destructor kfunc type Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 099/844] bpf: Recognize special arithmetic shift in the verifier Sasha Levin
` (754 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sami Tolvanen, Yonghong Song, Alexei Starovoitov, Sasha Levin
From: Sami Tolvanen <samitolvanen@google.com>
[ Upstream commit c99d97b46631c4bea0c14b7581b7a59214601e63 ]
With CONFIG_CFI enabled, the kernel strictly enforces that indirect
function calls use a function pointer type that matches the
target function. As bpf_kfree_skb() signature differs from the
btf_dtor_kfunc_t pointer type used for the destructor calls in
bpf_obj_free_fields(), add a stub function with the correct type to
fix the type mismatch.
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260110082548.113748-8-samitolvanen@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/bpf_qdisc.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c
index adcb618a2bfca..e9bea9890777d 100644
--- a/net/sched/bpf_qdisc.c
+++ b/net/sched/bpf_qdisc.c
@@ -202,6 +202,12 @@ __bpf_kfunc void bpf_kfree_skb(struct sk_buff *skb)
kfree_skb(skb);
}
+__bpf_kfunc void bpf_kfree_skb_dtor(void *skb)
+{
+ bpf_kfree_skb(skb);
+}
+CFI_NOSEAL(bpf_kfree_skb_dtor);
+
/* bpf_qdisc_skb_drop - Drop an skb by adding it to a deferred free list.
* @skb: The skb whose reference to be released and dropped.
* @to_free_list: The list of skbs to be dropped.
@@ -449,7 +455,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = {
.owner = THIS_MODULE,
};
-BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb)
+BTF_ID_LIST_SINGLE(bpf_sk_buff_dtor_ids, func, bpf_kfree_skb_dtor)
static int __init bpf_qdisc_kfunc_init(void)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 099/844] bpf: Recognize special arithmetic shift in the verifier
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (97 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 098/844] bpf: net_sched: " Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 100/844] genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask Sasha Levin
` (753 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexei Starovoitov, Hao Sun, Puranjay Mohan, Sasha Levin
From: Alexei Starovoitov <ast@kernel.org>
[ Upstream commit bffacdb80b93b7b5e96b26fad64cc490a6c7d6c7 ]
cilium bpf_wiregard.bpf.c when compiled with -O1 fails to load
with the following verifier log:
192: (79) r2 = *(u64 *)(r10 -304) ; R2=pkt(r=40) R10=fp0 fp-304=pkt(r=40)
...
227: (85) call bpf_skb_store_bytes#9 ; R0=scalar()
228: (bc) w2 = w0 ; R0=scalar() R2=scalar(smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
...
232: (66) if w2 s> 0xffffffff goto pc+125 ; R2=scalar(smin=umin=umin32=0x80000000,smax=umax=umax32=0xffffff7a,smax32=-134,var_off=(0x80000000; 0x7fffff7a))
...
238: (79) r4 = *(u64 *)(r10 -304) ; R4=scalar() R10=fp0 fp-304=scalar()
239: (56) if w2 != 0xffffff78 goto pc+210 ; R2=0xffffff78 // -136
...
258: (71) r1 = *(u8 *)(r4 +0)
R4 invalid mem access 'scalar'
The error might confuse most bpf authors, since fp-304 slot had 'pkt'
pointer at insn 192 and became 'scalar' at 238. That happened because
bpf_skb_store_bytes() clears all packet pointers including those in
the stack. On the first glance it might look like a bug in the source
code, since ctx->data pointer should have been reloaded after the call
to bpf_skb_store_bytes().
The relevant part of cilium source code looks like this:
// bpf/lib/nodeport.h
int dsr_set_ipip6()
{
if (ctx_adjust_hroom(...))
return DROP_INVALID; // -134
if (ctx_store_bytes(...))
return DROP_WRITE_ERROR; // -141
return 0;
}
bool dsr_fail_needs_reply(int code)
{
if (code == DROP_FRAG_NEEDED) // -136
return true;
return false;
}
tail_nodeport_ipv6_dsr()
{
ret = dsr_set_ipip6(...);
if (!IS_ERR(ret)) {
...
} else {
if (dsr_fail_needs_reply(ret))
return dsr_reply_icmp6(...);
}
}
The code doesn't have arithmetic shift by 31 and it reloads ctx->data
every time it needs to access it. So it's not a bug in the source code.
The reason is DAGCombiner::foldSelectCCToShiftAnd() LLVM transformation:
// If this is a select where the false operand is zero and the compare is a
// check of the sign bit, see if we can perform the "gzip trick":
// select_cc setlt X, 0, A, 0 -> and (sra X, size(X)-1), A
// select_cc setgt X, 0, A, 0 -> and (not (sra X, size(X)-1)), A
The conditional branch in dsr_set_ipip6() and its return values
are optimized into BPF_ARSH plus BPF_AND:
227: (85) call bpf_skb_store_bytes#9
228: (bc) w2 = w0
229: (c4) w2 s>>= 31 ; R2=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=0,var_off=(0x0; 0xffffffff))
230: (54) w2 &= -134 ; R2=scalar(smin=0,smax=umax=umax32=0xffffff7a,smax32=0x7fffff7a,var_off=(0x0; 0xffffff7a))
after insn 230 the register w2 can only be 0 or -134,
but the verifier approximates it, since there is no way to
represent two scalars in bpf_reg_state.
After fallthough at insn 232 the w2 can only be -134,
hence the branch at insn
239: (56) if w2 != -136 goto pc+210
should be always taken, and trapping insn 258 should never execute.
LLVM generated correct code, but the verifier follows impossible
path and rejects valid program. To fix this issue recognize this
special LLVM optimization and fork the verifier state.
So after insn 229: (c4) w2 s>>= 31
the verifier has two states to explore:
one with w2 = 0 and another with w2 = 0xffffffff
which makes the verifier accept bpf_wiregard.c
A similar pattern exists were OR operation is used in place of the AND
operation, the verifier detects that pattern as well by forking the
state before the OR operation with a scalar in range [-1,0].
Note there are 20+ such patterns in bpf_wiregard.o compiled
with -O1 and -O2, but they're rarely seen in other production
bpf programs, so push_stack() approach is not a concern.
Reported-by: Hao Sun <sunhao.th@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Co-developed-by: Puranjay Mohan <puranjay@kernel.org>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20260112201424.816836-2-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7069e9f527eaa..1999b8d244f64 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15499,6 +15499,35 @@ static bool is_safe_to_compute_dst_reg_range(struct bpf_insn *insn,
}
}
+static int maybe_fork_scalars(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ struct bpf_reg_state *dst_reg)
+{
+ struct bpf_verifier_state *branch;
+ struct bpf_reg_state *regs;
+ bool alu32;
+
+ if (dst_reg->smin_value == -1 && dst_reg->smax_value == 0)
+ alu32 = false;
+ else if (dst_reg->s32_min_value == -1 && dst_reg->s32_max_value == 0)
+ alu32 = true;
+ else
+ return 0;
+
+ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+ if (IS_ERR(branch))
+ return PTR_ERR(branch);
+
+ regs = branch->frame[branch->curframe]->regs;
+ if (alu32) {
+ __mark_reg32_known(®s[insn->dst_reg], 0);
+ __mark_reg32_known(dst_reg, -1ull);
+ } else {
+ __mark_reg_known(®s[insn->dst_reg], 0);
+ __mark_reg_known(dst_reg, -1ull);
+ }
+ return 0;
+}
+
/* WARNING: This function does calculations on 64-bit values, but the actual
* execution may occur on 32-bit values. Therefore, things like bitshifts
* need extra checks in the 32-bit case.
@@ -15561,11 +15590,21 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
scalar_min_max_mul(dst_reg, &src_reg);
break;
case BPF_AND:
+ if (tnum_is_const(src_reg.var_off)) {
+ ret = maybe_fork_scalars(env, insn, dst_reg);
+ if (ret)
+ return ret;
+ }
dst_reg->var_off = tnum_and(dst_reg->var_off, src_reg.var_off);
scalar32_min_max_and(dst_reg, &src_reg);
scalar_min_max_and(dst_reg, &src_reg);
break;
case BPF_OR:
+ if (tnum_is_const(src_reg.var_off)) {
+ ret = maybe_fork_scalars(env, insn, dst_reg);
+ if (ret)
+ return ret;
+ }
dst_reg->var_off = tnum_or(dst_reg->var_off, src_reg.var_off);
scalar32_min_max_or(dst_reg, &src_reg);
scalar_min_max_or(dst_reg, &src_reg);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 100/844] genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (98 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 099/844] bpf: Recognize special arithmetic shift in the verifier Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 101/844] bpf: Properly mark live registers for indirect jumps Sasha Levin
` (752 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Imran Khan, Thomas Gleixner, Sasha Levin
From: Imran Khan <imran.f.khan@oracle.com>
[ Upstream commit dd9f6d30c64001ca4dde973ac04d8d155e856743 ]
During CPU offlining the interrupts affined to that CPU are moved to other
online CPUs, which might break the original affinity mask if the outgoing
CPU was the last online CPU in that mask. This change is not propagated to
irq_desc::affinity_notify(), which leaves users of the affinity notifier
mechanism with stale information.
Avoid this by scheduling affinity change notification work for interrupts
that were affined to the CPU being offlined, if the new target CPU is not
part of the original affinity mask.
Since irq_set_affinity_locked() uses the same logic to schedule affinity
change notification work, split out this logic into a dedicated function
and use that at both places.
[ tglx: Removed the EXPORT(), removed the !SMP stub, moved the prototype,
added a lockdep assert instead of a comment, fixed up coding style
and name space. Polished and clarified the change log ]
Signed-off-by: Imran Khan <imran.f.khan@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260113143727.1041265-1-imran.f.khan@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/irq/cpuhotplug.c | 6 ++++--
kernel/irq/internals.h | 2 +-
kernel/irq/manage.c | 26 ++++++++++++++++++--------
3 files changed, 23 insertions(+), 11 deletions(-)
diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
index 755346ea98196..cd5689e383b00 100644
--- a/kernel/irq/cpuhotplug.c
+++ b/kernel/irq/cpuhotplug.c
@@ -177,9 +177,11 @@ void irq_migrate_all_off_this_cpu(void)
bool affinity_broken;
desc = irq_to_desc(irq);
- scoped_guard(raw_spinlock, &desc->lock)
+ scoped_guard(raw_spinlock, &desc->lock) {
affinity_broken = migrate_one_irq(desc);
-
+ if (affinity_broken && desc->affinity_notify)
+ irq_affinity_schedule_notify_work(desc);
+ }
if (affinity_broken) {
pr_debug_ratelimited("IRQ %u: no longer affine to CPU%u\n",
irq, smp_processor_id());
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 0164ca48da59e..5568ed3a8b852 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -135,6 +135,7 @@ extern bool irq_can_set_affinity_usr(unsigned int irq);
extern int irq_do_set_affinity(struct irq_data *data,
const struct cpumask *dest, bool force);
+extern void irq_affinity_schedule_notify_work(struct irq_desc *desc);
#ifdef CONFIG_SMP
extern int irq_setup_affinity(struct irq_desc *desc);
@@ -142,7 +143,6 @@ extern int irq_setup_affinity(struct irq_desc *desc);
static inline int irq_setup_affinity(struct irq_desc *desc) { return 0; }
#endif
-
#define for_each_action_of_desc(desc, act) \
for (act = desc->action; act; act = act->next)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 349ae7979da0e..4873b0f73df96 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -347,6 +347,21 @@ static bool irq_set_affinity_deactivated(struct irq_data *data,
return true;
}
+/**
+ * irq_affinity_schedule_notify_work - Schedule work to notify about affinity change
+ * @desc: Interrupt descriptor whose affinity changed
+ */
+void irq_affinity_schedule_notify_work(struct irq_desc *desc)
+{
+ lockdep_assert_held(&desc->lock);
+
+ kref_get(&desc->affinity_notify->kref);
+ if (!schedule_work(&desc->affinity_notify->work)) {
+ /* Work was already scheduled, drop our extra ref */
+ kref_put(&desc->affinity_notify->kref, desc->affinity_notify->release);
+ }
+}
+
int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
bool force)
{
@@ -367,14 +382,9 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
irq_copy_pending(desc, mask);
}
- if (desc->affinity_notify) {
- kref_get(&desc->affinity_notify->kref);
- if (!schedule_work(&desc->affinity_notify->work)) {
- /* Work was already scheduled, drop our extra ref */
- kref_put(&desc->affinity_notify->kref,
- desc->affinity_notify->release);
- }
- }
+ if (desc->affinity_notify)
+ irq_affinity_schedule_notify_work(desc);
+
irqd_set(data, IRQD_AFFINITY_SET);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 101/844] bpf: Properly mark live registers for indirect jumps
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (99 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 100/844] genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 102/844] perf/core: Fix slow perf_event_task_exit() with LBR callstacks Sasha Levin
` (751 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Anton Protopopov, Alexei Starovoitov, Sasha Levin
From: Anton Protopopov <a.s.protopopov@gmail.com>
[ Upstream commit d1aab1ca576c90192ba961094d51b0be6355a4d6 ]
For a `gotox rX` instruction the rX register should be marked as used
in the compute_insn_live_regs() function. Fix this.
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
Link: https://lore.kernel.org/r/20260114162544.83253-2-a.s.protopopov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1999b8d244f64..783d984d7884d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -24852,6 +24852,12 @@ static void compute_insn_live_regs(struct bpf_verifier_env *env,
case BPF_JMP32:
switch (code) {
case BPF_JA:
+ def = 0;
+ if (BPF_SRC(insn->code) == BPF_X)
+ use = dst;
+ else
+ use = 0;
+ break;
case BPF_JCOND:
def = 0;
use = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 102/844] perf/core: Fix slow perf_event_task_exit() with LBR callstacks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (100 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 101/844] bpf: Properly mark live registers for indirect jumps Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 103/844] arm64/ftrace,bpf: Fix partial regs after bpf_prog_run Sasha Levin
` (750 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Namhyung Kim, Rosalie Fang, Peter Zijlstra, Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 4960626f956d63dce57f099016c2ecbe637a8229 ]
I got a report that a task is stuck in perf_event_exit_task() waiting
for global_ctx_data_rwsem. On large systems with lots threads, it'd
have performance issues when it grabs the lock to iterate all threads
in the system to allocate the context data.
And it'd block task exit path which is problematic especially under
memory pressure.
perf_event_open
perf_event_alloc
attach_perf_ctx_data
attach_global_ctx_data
percpu_down_write (global_ctx_data_rwsem)
for_each_process_thread
alloc_task_ctx_data
do_exit
perf_event_exit_task
percpu_down_read (global_ctx_data_rwsem)
It should not hold the global_ctx_data_rwsem on the exit path. Let's
skip allocation for exiting tasks and free the data carefully.
Reported-by: Rosalie Fang <rosaliefang@google.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260112165157.1919624-1-namhyung@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/core.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 8cca800946248..69c56cad88a89 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5280,9 +5280,20 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
return -ENOMEM;
for (;;) {
- if (try_cmpxchg((struct perf_ctx_data **)&task->perf_ctx_data, &old, cd)) {
+ if (try_cmpxchg(&task->perf_ctx_data, &old, cd)) {
if (old)
perf_free_ctx_data_rcu(old);
+ /*
+ * Above try_cmpxchg() pairs with try_cmpxchg() from
+ * detach_task_ctx_data() such that
+ * if we race with perf_event_exit_task(), we must
+ * observe PF_EXITING.
+ */
+ if (task->flags & PF_EXITING) {
+ /* detach_task_ctx_data() may free it already */
+ if (try_cmpxchg(&task->perf_ctx_data, &cd, NULL))
+ perf_free_ctx_data_rcu(cd);
+ }
return 0;
}
@@ -5328,6 +5339,8 @@ attach_global_ctx_data(struct kmem_cache *ctx_cache)
/* Allocate everything */
scoped_guard (rcu) {
for_each_process_thread(g, p) {
+ if (p->flags & PF_EXITING)
+ continue;
cd = rcu_dereference(p->perf_ctx_data);
if (cd && !cd->global) {
cd->global = 1;
@@ -14294,8 +14307,11 @@ void perf_event_exit_task(struct task_struct *task)
/*
* Detach the perf_ctx_data for the system-wide event.
+ *
+ * Done without holding global_ctx_data_rwsem; typically
+ * attach_global_ctx_data() will skip over this task, but otherwise
+ * attach_task_ctx_data() will observe PF_EXITING.
*/
- guard(percpu_read)(&global_ctx_data_rwsem);
detach_task_ctx_data(task);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 103/844] arm64/ftrace,bpf: Fix partial regs after bpf_prog_run
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (101 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 102/844] perf/core: Fix slow perf_event_task_exit() with LBR callstacks Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 104/844] clocksource/drivers/sh_tmu: Always leave device running after probe Sasha Levin
` (749 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jiri Olsa, Mahe Tardy, Andrii Nakryiko, Steven Rostedt (Google),
Will Deacon, Sasha Levin
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit 276f3b6daf6024ae2742afd161e7418a5584a660 ]
Mahe reported issue with bpf_override_return helper not working when
executed from kprobe.multi bpf program on arm.
The problem is that on arm we use alternate storage for pt_regs object
that is passed to bpf_prog_run and if any register is changed (which
is the case of bpf_override_return) it's not propagated back to actual
pt_regs object.
Fixing this by introducing and calling ftrace_partial_regs_update function
to propagate the values of changed registers (ip and stack).
Reported-by: Mahe Tardy <mahe.tardy@gmail.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/bpf/20260112121157.854473-1-jolsa@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ftrace_regs.h | 25 +++++++++++++++++++++++++
kernel/trace/bpf_trace.c | 1 +
2 files changed, 26 insertions(+)
diff --git a/include/linux/ftrace_regs.h b/include/linux/ftrace_regs.h
index 15627ceea9bcc..386fa48c4a957 100644
--- a/include/linux/ftrace_regs.h
+++ b/include/linux/ftrace_regs.h
@@ -33,6 +33,31 @@ struct ftrace_regs;
#define ftrace_regs_get_frame_pointer(fregs) \
frame_pointer(&arch_ftrace_regs(fregs)->regs)
+static __always_inline void
+ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs) { }
+
+#else
+
+/*
+ * ftrace_partial_regs_update - update the original ftrace_regs from regs
+ * @fregs: The ftrace_regs to update from @regs
+ * @regs: The partial regs from ftrace_partial_regs() that was updated
+ *
+ * Some architectures have the partial regs living in the ftrace_regs
+ * structure, whereas other architectures need to make a different copy
+ * of the @regs. If a partial @regs is retrieved by ftrace_partial_regs() and
+ * if the code using @regs updates a field (like the instruction pointer or
+ * stack pointer) it may need to propagate that change to the original @fregs
+ * it retrieved the partial @regs from. Use this function to guarantee that
+ * update happens.
+ */
+static __always_inline void
+ftrace_partial_regs_update(struct ftrace_regs *fregs, struct pt_regs *regs)
+{
+ ftrace_regs_set_instruction_pointer(fregs, instruction_pointer(regs));
+ ftrace_regs_set_return_value(fregs, regs_return_value(regs));
+}
+
#endif /* HAVE_ARCH_FTRACE_REGS */
/* This can be overridden by the architectures */
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 59c2394981c72..325579c7da260 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2564,6 +2564,7 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
err = bpf_prog_run(link->link.prog, regs);
bpf_reset_run_ctx(old_run_ctx);
+ ftrace_partial_regs_update(fregs, bpf_kprobe_multi_pt_regs_ptr());
rcu_read_unlock();
out:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 104/844] clocksource/drivers/sh_tmu: Always leave device running after probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (102 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 103/844] arm64/ftrace,bpf: Fix partial regs after bpf_prog_run Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 105/844] clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF Sasha Levin
` (748 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Söderlund, Daniel Lezcano, Geert Uytterhoeven,
Sasha Levin
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit b1278972b08e480990e2789bdc6a7c918bc349be ]
The TMU device can be used as both a clocksource and a clockevent
provider. The driver tries to be smart and power itself on and off, as
well as enabling and disabling its clock when it's not in operation.
This behavior is slightly altered if the TMU is used as an early
platform device in which case the device is left powered on after probe,
but the clock is still enabled and disabled at runtime.
This has worked for a long time, but recent improvements in PREEMPT_RT
and PROVE_LOCKING have highlighted an issue. As the TMU registers itself
as a clockevent provider, clockevents_register_device(), it needs to use
raw spinlocks internally as this is the context of which the clockevent
framework interacts with the TMU driver. However in the context of
holding a raw spinlock the TMU driver can't really manage its power
state or clock with calls to pm_runtime_*() and clk_*() as these calls
end up in other platform drivers using regular spinlocks to control
power and clocks.
This mix of spinlock contexts trips a lockdep warning.
=============================
[ BUG: Invalid wait context ]
6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted
-----------------------------
swapper/0/0 is trying to lock:
ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88
other info that might help us debug this:
context-{5:5}
1 lock held by swapper/0/0:
ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0
#0: ffff8000817ec298
ccree e6601000.crypto: ARM ccree device initialized
(tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8
stack backtrace:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT
Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
Call trace:
show_stack+0x14/0x1c (C)
dump_stack_lvl+0x6c/0x90
dump_stack+0x14/0x1c
__lock_acquire+0x904/0x1584
lock_acquire+0x220/0x34c
_raw_spin_lock_irqsave+0x58/0x80
__pm_runtime_resume+0x38/0x88
sh_tmu_clock_event_set_oneshot+0x84/0xd4
clockevents_switch_state+0xfc/0x13c
tick_broadcast_set_event+0x30/0xa4
__tick_broadcast_oneshot_control+0x1e0/0x3a8
tick_broadcast_oneshot_control+0x30/0x40
cpuidle_enter_state+0x40c/0x680
cpuidle_enter+0x30/0x40
do_idle+0x1f4/0x280
cpu_startup_entry+0x34/0x40
kernel_init+0x0/0x130
do_one_initcall+0x0/0x230
__primary_switched+0x88/0x90
For non-PREEMPT_RT builds this is not really an issue, but for
PREEMPT_RT builds where normal spinlocks can sleep this might be an
issue. Be cautious and always leave the power and clock running after
probe.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251202221341.1856773-1-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/sh_tmu.c | 18 ------------------
1 file changed, 18 deletions(-)
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index beffff81c00f3..3fc6ed9b56300 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -143,16 +143,6 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_channel *ch, int start)
static int __sh_tmu_enable(struct sh_tmu_channel *ch)
{
- int ret;
-
- /* enable clock */
- ret = clk_enable(ch->tmu->clk);
- if (ret) {
- dev_err(&ch->tmu->pdev->dev, "ch%u: cannot enable clock\n",
- ch->index);
- return ret;
- }
-
/* make sure channel is disabled */
sh_tmu_start_stop_ch(ch, 0);
@@ -174,7 +164,6 @@ static int sh_tmu_enable(struct sh_tmu_channel *ch)
if (ch->enable_count++ > 0)
return 0;
- pm_runtime_get_sync(&ch->tmu->pdev->dev);
dev_pm_syscore_device(&ch->tmu->pdev->dev, true);
return __sh_tmu_enable(ch);
@@ -187,9 +176,6 @@ static void __sh_tmu_disable(struct sh_tmu_channel *ch)
/* disable interrupts in TMU block */
sh_tmu_write(ch, TCR, TCR_TPSC_CLK4);
-
- /* stop clock */
- clk_disable(ch->tmu->clk);
}
static void sh_tmu_disable(struct sh_tmu_channel *ch)
@@ -203,7 +189,6 @@ static void sh_tmu_disable(struct sh_tmu_channel *ch)
__sh_tmu_disable(ch);
dev_pm_syscore_device(&ch->tmu->pdev->dev, false);
- pm_runtime_put(&ch->tmu->pdev->dev);
}
static void sh_tmu_set_next(struct sh_tmu_channel *ch, unsigned long delta,
@@ -552,7 +537,6 @@ static int sh_tmu_setup(struct sh_tmu_device *tmu, struct platform_device *pdev)
goto err_clk_unprepare;
tmu->rate = clk_get_rate(tmu->clk) / 4;
- clk_disable(tmu->clk);
/* Map the memory resource. */
ret = sh_tmu_map_memory(tmu);
@@ -626,8 +610,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
out:
if (tmu->has_clockevent || tmu->has_clocksource)
pm_runtime_irq_safe(&pdev->dev);
- else
- pm_runtime_idle(&pdev->dev);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 105/844] clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (103 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 104/844] clocksource/drivers/sh_tmu: Always leave device running after probe Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 106/844] PCI/MSI: Unmap MSI-X region on error Sasha Levin
` (747 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bartosz Golaszewski, Daniel Lezcano, Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit 2246464821e2820572e6feefca2029f17629cc50 ]
This driver accesses the of_aliases global variable declared in
linux/of.h and defined in drivers/base/of.c. It requires OF support or
will cause a link failure. Add the missing Kconfig dependency.
Closes: https://lore.kernel.org/oe-kbuild-all/202601152233.og6LdeUo-lkp@intel.com/
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://patch.msgid.link/20260116111723.10585-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index aa59e5b133510..fd91127065454 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -254,6 +254,7 @@ config KEYSTONE_TIMER
config INTEGRATOR_AP_TIMER
bool "Integrator-AP timer driver" if COMPILE_TEST
+ depends on OF
select CLKSRC_MMIO
help
Enables support for the Integrator-AP timer.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 106/844] PCI/MSI: Unmap MSI-X region on error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (104 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 105/844] clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 107/844] bpftool: Fix dependencies for static build Sasha Levin
` (746 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Thomas Gleixner, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202 ]
msix_capability_init() fails to unmap the MSI-X region if
msix_setup_interrupts() fails.
Add the missing iounmap() for that error path.
[ tglx: Massaged change log ]
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260125144452.2103812-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/msi/msi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index 34d664139f48f..e010ecd9f90dd 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -737,7 +737,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
ret = msix_setup_interrupts(dev, entries, nvec, affd);
if (ret)
- goto out_disable;
+ goto out_unmap;
/* Disable INTX */
pci_intx_for_msi(dev, 0);
@@ -758,6 +758,8 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
pcibios_free_irq(dev);
return 0;
+out_unmap:
+ iounmap(dev->msix_base);
out_disable:
dev->msix_enabled = 0;
pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 107/844] bpftool: Fix dependencies for static build
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (105 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 106/844] PCI/MSI: Unmap MSI-X region on error Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 108/844] crypto: hisilicon/qm - move the barrier before writing to the mailbox register Sasha Levin
` (745 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ihor Solodrai, Andrii Nakryiko, Sasha Levin
From: Ihor Solodrai <ihor.solodrai@linux.dev>
[ Upstream commit 08a7491843224f8b96518fbe70d9e48163046054 ]
When building selftests/bpf with EXTRA_LDFLAGS=-static the follwoing
error happens:
LINK /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool
/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-dso_dlfcn.o): in function `dlfcn_globallookup':
[...]
/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block':
(.text+0xc64): undefined reference to `uncompress'
/usr/bin/x86_64-linux-gnu-ld.bfd: /usr/lib/gcc/x86_64-linux-gnu/15/../../../x86_64-linux-gnu/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_compress_block':
(.text+0xce4): undefined reference to `compress'
collect2: error: ld returned 1 exit status
make[1]: *** [Makefile:252: /ws/linux/tools/testing/selftests/bpf/tools/build/bpftool/bootstrap/bpftool] Error 1
make: *** [Makefile:327: /ws/linux/tools/testing/selftests/bpf/tools/sbin/bpftool] Error 2
make: *** Waiting for unfinished jobs....
This is caused by wrong order of dependencies in the Makefile. Fix it.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260128211255.376933-1-ihor.solodrai@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile
index 5442073a2e428..519ea5cb8ab1c 100644
--- a/tools/bpf/bpftool/Makefile
+++ b/tools/bpf/bpftool/Makefile
@@ -130,8 +130,8 @@ include $(FEATURES_DUMP)
endif
endif
-LIBS = $(LIBBPF) -lelf -lz -lcrypto
-LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz -lcrypto
+LIBS = $(LIBBPF) -lelf -lcrypto -lz
+LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lcrypto -lz
ifeq ($(feature-libelf-zstd),1)
LIBS += -lzstd
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 108/844] crypto: hisilicon/qm - move the barrier before writing to the mailbox register
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (106 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 107/844] bpftool: Fix dependencies for static build Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 109/844] mailbox: bcm-ferxrm-mailbox: Use default primary handler Sasha Levin
` (744 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chenghai Huang, Herbert Xu, Sasha Levin
From: Chenghai Huang <huangchenghai2@huawei.com>
[ Upstream commit ebf35d8f9368816c930f5d70783a72716fab5e19 ]
Before sending the data via the mailbox to the hardware, to ensure
that the data accessed by the hardware is the most up-to-date,
a write barrier should be added before writing to the mailbox register.
The current memory barrier is placed after writing to the register,
the barrier order should be modified to be before writing to the register.
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/qm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index b8e59f99f7007..cf58d0d01b199 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -609,9 +609,13 @@ static void qm_mb_write(struct hisi_qm *qm, const void *src)
}
#if IS_ENABLED(CONFIG_ARM64)
+ /*
+ * The dmb oshst instruction ensures that the data in the
+ * mailbox is written before it is sent to the hardware.
+ */
asm volatile("ldp %0, %1, %3\n"
- "stp %0, %1, %2\n"
"dmb oshst\n"
+ "stp %0, %1, %2\n"
: "=&r" (tmp0),
"=&r" (tmp1),
"+Q" (*((char __iomem *)fun_base))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 109/844] mailbox: bcm-ferxrm-mailbox: Use default primary handler
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (107 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 108/844] crypto: hisilicon/qm - move the barrier before writing to the mailbox register Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 110/844] char: tpm: cr50: Remove IRQF_ONESHOT Sasha Levin
` (743 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Andrzej Siewior, Thomas Gleixner, Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 03843d95a4a4e0ba22ad4fcda65ccf21822b104c ]
request_threaded_irq() is invoked with a primary and a secondary handler
and no flags are passed. The primary handler is the same as
irq_default_primary_handler() so there is no need to have an identical
copy.
The lack of the IRQF_ONESHOT flag can be dangerous because the interrupt
source is not masked while the threaded handler is active. This means,
especially on LEVEL typed interrupt lines, the interrupt can fire again
before the threaded handler had a chance to run.
Use the default primary interrupt handler by specifying NULL and set
IRQF_ONESHOT so the interrupt source is masked until the secondary handler
is done.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260128095540.863589-5-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/bcm-flexrm-mailbox.c | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
index 41f79e51d9e5a..4255fefc3a5a0 100644
--- a/drivers/mailbox/bcm-flexrm-mailbox.c
+++ b/drivers/mailbox/bcm-flexrm-mailbox.c
@@ -1173,14 +1173,6 @@ static int flexrm_debugfs_stats_show(struct seq_file *file, void *offset)
/* ====== FlexRM interrupt handler ===== */
-static irqreturn_t flexrm_irq_event(int irq, void *dev_id)
-{
- /* We only have MSI for completions so just wakeup IRQ thread */
- /* Ring related errors will be informed via completion descriptors */
-
- return IRQ_WAKE_THREAD;
-}
-
static irqreturn_t flexrm_irq_thread(int irq, void *dev_id)
{
flexrm_process_completions(dev_id);
@@ -1271,10 +1263,8 @@ static int flexrm_startup(struct mbox_chan *chan)
ret = -ENODEV;
goto fail_free_cmpl_memory;
}
- ret = request_threaded_irq(ring->irq,
- flexrm_irq_event,
- flexrm_irq_thread,
- 0, dev_name(ring->mbox->dev), ring);
+ ret = request_threaded_irq(ring->irq, NULL, flexrm_irq_thread,
+ IRQF_ONESHOT, dev_name(ring->mbox->dev), ring);
if (ret) {
dev_err(ring->mbox->dev,
"failed to request ring%d IRQ\n", ring->num);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 110/844] char: tpm: cr50: Remove IRQF_ONESHOT
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (108 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 109/844] mailbox: bcm-ferxrm-mailbox: Use default primary handler Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 111/844] sched/debug: Fix updating of ppos on server write ops Sasha Levin
` (742 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Andrzej Siewior, Thomas Gleixner, Jarkko Sakkinen,
Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 1affd29ffbd50125a5492c6be1dbb1f04be18d4f ]
Passing IRQF_ONESHOT ensures that the interrupt source is masked until
the secondary (threaded) handler is done. If only a primary handler is
used then the flag makes no sense because the interrupt can not fire
(again) while its handler is running.
The flag also prevents force-threading of the primary handler and the
irq-core will warn about this.
Remove IRQF_ONESHOT from irqflags.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://patch.msgid.link/20260128095540.863589-10-bigeasy@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tpm/tpm_tis_i2c_cr50.c | 3 +--
drivers/char/tpm/tpm_tis_spi_cr50.c | 2 +-
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c
index fc6891a0b6936..b48cacacc0664 100644
--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c
+++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c
@@ -749,8 +749,7 @@ static int tpm_cr50_i2c_probe(struct i2c_client *client)
if (client->irq > 0) {
rc = devm_request_irq(dev, client->irq, tpm_cr50_i2c_int_handler,
- IRQF_TRIGGER_FALLING | IRQF_ONESHOT |
- IRQF_NO_AUTOEN,
+ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
dev->driver->name, chip);
if (rc < 0) {
dev_err(dev, "Failed to probe IRQ %d\n", client->irq);
diff --git a/drivers/char/tpm/tpm_tis_spi_cr50.c b/drivers/char/tpm/tpm_tis_spi_cr50.c
index f4937280e9406..32920b4cecfb4 100644
--- a/drivers/char/tpm/tpm_tis_spi_cr50.c
+++ b/drivers/char/tpm/tpm_tis_spi_cr50.c
@@ -287,7 +287,7 @@ int cr50_spi_probe(struct spi_device *spi)
if (spi->irq > 0) {
ret = devm_request_irq(&spi->dev, spi->irq,
cr50_spi_irq_handler,
- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ IRQF_TRIGGER_RISING,
"cr50_spi", cr50_phy);
if (ret < 0) {
if (ret == -EPROBE_DEFER)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 111/844] sched/debug: Fix updating of ppos on server write ops
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (109 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 110/844] char: tpm: cr50: Remove IRQF_ONESHOT Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 112/844] pstore: ram_core: fix incorrect success return when vmap() fails Sasha Levin
` (741 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Joel Fernandes, Peter Zijlstra (Intel), Juri Lelli, Andrea Righi,
Tejun Heo, Christian Loehle, Sasha Levin
From: Joel Fernandes <joelagnelf@nvidia.com>
[ Upstream commit 6080fb211672aec6ce8f2f5a2e0b4eae736f2027 ]
Updating "ppos" on error conditions does not make much sense. The pattern
is to return the error code directly without modifying the position, or
modify the position on success and return the number of bytes written.
Since on success, the return value of apply is 0, there is no point in
modifying ppos either. Fix it by removing all this and just returning
error code or number of bytes written on success.
Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Acked-by: Tejun Heo <tj@kernel.org>
Tested-by: Christian Loehle <christian.loehle@arm.com>
Link: https://patch.msgid.link/20260126100050.3854740-3-arighi@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/debug.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 41caa22e0680a..93f009e1076d8 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -345,8 +345,8 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
long cpu = (long) ((struct seq_file *) filp->private_data)->private;
struct rq *rq = cpu_rq(cpu);
u64 runtime, period;
+ int retval = 0;
size_t err;
- int retval;
u64 value;
err = kstrtoull_from_user(ubuf, cnt, 10, &value);
@@ -380,8 +380,6 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
dl_server_stop(&rq->fair_server);
retval = dl_server_apply_params(&rq->fair_server, runtime, period, 0);
- if (retval)
- cnt = retval;
if (!runtime)
printk_deferred("Fair server disabled in CPU %d, system may crash due to starvation.\n",
@@ -389,6 +387,9 @@ static ssize_t sched_fair_server_write(struct file *filp, const char __user *ubu
if (rq->cfs.h_nr_queued)
dl_server_start(&rq->fair_server);
+
+ if (retval < 0)
+ return retval;
}
*ppos += cnt;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 112/844] pstore: ram_core: fix incorrect success return when vmap() fails
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (110 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 111/844] sched/debug: Fix updating of ppos on server write ops Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 113/844] firmware: arm_ffa: Unmap Rx/Tx buffers on init failure Sasha Levin
` (740 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ruipeng Qi, Kees Cook, Sasha Levin
From: Ruipeng Qi <ruipengqi3@gmail.com>
[ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ]
In persistent_ram_vmap(), vmap() may return NULL on failure.
If offset is non-zero, adding offset_in_page(start) causes the function
to return a non-NULL pointer even though the mapping failed.
persistent_ram_buffer_map() therefore incorrectly returns success.
Subsequent access to prz->buffer may dereference an invalid address
and cause crashes.
Add proper NULL checking for vmap() failures.
Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/pstore/ram_core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index c9eaacdec37e4..7b6d6378a3b87 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -457,6 +457,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot);
kfree(pages);
+ /*
+ * vmap() may fail and return NULL. Do not add the offset in this
+ * case, otherwise a NULL mapping would appear successful.
+ */
+ if (!vaddr)
+ return NULL;
+
/*
* Since vmap() uses page granularity, we must add the offset
* into the page here, to get the byte granularity address
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 113/844] firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (111 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 112/844] pstore: ram_core: fix incorrect success return when vmap() fails Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 114/844] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" Sasha Levin
` (739 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Sudeep Holla, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 9fda364cb78c8b9e1abe4029f877300c94655742 ]
ffa_init() maps the Rx/Tx buffers via ffa_rxtx_map() but on the
partition setup failure path it never unmaps them.
Add the missing ffa_rxtx_unmap() call in the error path so that
the Rx/Tx buffers are properly released before freeing the backing
pages.
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Message-Id: <20251210031656.56194-1-lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/arm_ffa/driver.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
index c501c3104b3a4..11a702e7f641c 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
@@ -2093,6 +2093,7 @@ static int __init ffa_init(void)
pr_err("failed to setup partitions\n");
ffa_notifications_cleanup();
+ ffa_rxtx_unmap(drv_info->vm_id);
free_pages:
if (drv_info->tx_buffer)
free_pages_exact(drv_info->tx_buffer, rxtx_bufsz);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 114/844] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (112 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 113/844] firmware: arm_ffa: Unmap Rx/Tx buffers on init failure Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 115/844] EDAC/igen6: Add more Intel Panther Lake-H SoCs support Sasha Levin
` (738 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tomas Melin, Michal Simek, Sasha Levin
From: Tomas Melin <tomas.melin@vaisala.com>
[ Upstream commit c197179990124f991fca220d97fac56779a02c6d ]
This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.
OP-TEE logic in U-Boot automatically injects a reserved-memory
node along with optee firmware node to kernel device tree.
The injection logic is dependent on that there is no manually
defined optee node. Having the node in zynqmp.dtsi effectively
breaks OP-TEE's insertion of the reserved-memory node, causing
memory access violations during runtime.
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/20251125-revert-zynqmp-optee-v1-1-d2ce4c0fcaf6@vaisala.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 5 -----
1 file changed, 5 deletions(-)
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index 938b014ca9231..b55c6b2e8e0e1 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -192,11 +192,6 @@ psci {
};
firmware {
- optee: optee {
- compatible = "linaro,optee-tz";
- method = "smc";
- };
-
zynqmp_firmware: zynqmp-firmware {
compatible = "xlnx,zynqmp-firmware";
#power-domain-cells = <1>;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 115/844] EDAC/igen6: Add more Intel Panther Lake-H SoCs support
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (113 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 114/844] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 116/844] EDAC/igen6: Add two Intel Amston Lake " Sasha Levin
` (737 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Lili Li, Tony Luck, Qiuxu Zhuo, Sasha Levin
From: Lili Li <lili.li@intel.com>
[ Upstream commit 4c36e6106997b6ad8f4a279b4bdbca3ed6f53c6c ]
Add more Intel Panther Lake-H SoC compute die IDs for EDAC support.
Signed-off-by: Lili Li <lili.li@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Link: https://patch.msgid.link/20251124131537.3633983-1-qiuxu.zhuo@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/igen6_edac.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
index 553c31a2d9226..839b6dd3629e9 100644
--- a/drivers/edac/igen6_edac.c
+++ b/drivers/edac/igen6_edac.c
@@ -274,6 +274,16 @@ static struct work_struct ecclog_work;
#define DID_PTL_H_SKU1 0xb000
#define DID_PTL_H_SKU2 0xb001
#define DID_PTL_H_SKU3 0xb002
+#define DID_PTL_H_SKU4 0xb003
+#define DID_PTL_H_SKU5 0xb004
+#define DID_PTL_H_SKU6 0xb005
+#define DID_PTL_H_SKU7 0xb008
+#define DID_PTL_H_SKU8 0xb011
+#define DID_PTL_H_SKU9 0xb014
+#define DID_PTL_H_SKU10 0xb015
+#define DID_PTL_H_SKU11 0xb028
+#define DID_PTL_H_SKU12 0xb029
+#define DID_PTL_H_SKU13 0xb02a
/* Compute die IDs for Wildcat Lake with IBECC */
#define DID_WCL_SKU1 0xfd00
@@ -636,6 +646,16 @@ static struct pci_device_id igen6_pci_tbl[] = {
{ PCI_VDEVICE(INTEL, DID_PTL_H_SKU1), (kernel_ulong_t)&mtl_p_cfg },
{ PCI_VDEVICE(INTEL, DID_PTL_H_SKU2), (kernel_ulong_t)&mtl_p_cfg },
{ PCI_VDEVICE(INTEL, DID_PTL_H_SKU3), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU4), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU5), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU6), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU7), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU8), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU9), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU10), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU11), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU12), (kernel_ulong_t)&mtl_p_cfg },
+ { PCI_VDEVICE(INTEL, DID_PTL_H_SKU13), (kernel_ulong_t)&mtl_p_cfg },
{ PCI_VDEVICE(INTEL, DID_WCL_SKU1), (kernel_ulong_t)&wcl_cfg },
{ },
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 116/844] EDAC/igen6: Add two Intel Amston Lake SoCs support
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (114 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 115/844] EDAC/igen6: Add more Intel Panther Lake-H SoCs support Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 117/844] arm64: tegra: smaug: Add usb-role-switch support Sasha Levin
` (736 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Qiuxu Zhuo, Tony Luck, Jianfeng Gao, Sasha Levin
From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
[ Upstream commit 41ca2155d62b0b0d217f59e1bce18362d0c2446f ]
Intel Amston Lake SoCs with IBECC (In-Band ECC) capability share the same
IBECC registers as Alder Lake-N SoCs. Add two new compute die IDs for
Amston Lake SoC products to enable EDAC support.
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Tested-by: Jianfeng Gao <jianfeng.gao@intel.com>
Link: https://patch.msgid.link/20251124065457.3630949-2-qiuxu.zhuo@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/igen6_edac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
index 839b6dd3629e9..f2c9270c1893c 100644
--- a/drivers/edac/igen6_edac.c
+++ b/drivers/edac/igen6_edac.c
@@ -246,6 +246,8 @@ static struct work_struct ecclog_work;
/* Compute did IDs for Amston Lake with IBECC */
#define DID_ASL_SKU1 0x464a
+#define DID_ASL_SKU2 0x4646
+#define DID_ASL_SKU3 0x4652
/* Compute die IDs for Raptor Lake-P with IBECC */
#define DID_RPL_P_SKU1 0xa706
@@ -628,6 +630,8 @@ static struct pci_device_id igen6_pci_tbl[] = {
{ PCI_VDEVICE(INTEL, DID_ADL_N_SKU12), (kernel_ulong_t)&adl_n_cfg },
{ PCI_VDEVICE(INTEL, DID_AZB_SKU1), (kernel_ulong_t)&adl_n_cfg },
{ PCI_VDEVICE(INTEL, DID_ASL_SKU1), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_ASL_SKU2), (kernel_ulong_t)&adl_n_cfg },
+ { PCI_VDEVICE(INTEL, DID_ASL_SKU3), (kernel_ulong_t)&adl_n_cfg },
{ PCI_VDEVICE(INTEL, DID_RPL_P_SKU1), (kernel_ulong_t)&rpl_p_cfg },
{ PCI_VDEVICE(INTEL, DID_RPL_P_SKU2), (kernel_ulong_t)&rpl_p_cfg },
{ PCI_VDEVICE(INTEL, DID_RPL_P_SKU3), (kernel_ulong_t)&rpl_p_cfg },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 117/844] arm64: tegra: smaug: Add usb-role-switch support
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (115 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 116/844] EDAC/igen6: Add two Intel Amston Lake " Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 118/844] soc: imx8m: Fix error handling for clk_prepare_enable() Sasha Levin
` (735 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Diogo Ivo, Thierry Reding, Sasha Levin
From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
[ Upstream commit dfa93788dd8b2f9c59adf45ecf592082b1847b7b ]
The USB2 port on Smaug is configured for OTG operation but lacked the
required 'usb-role-switch' property, leading to a failed probe and a
non-functioning USB port. Add the property along with setting the default
role to host.
Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
index 5aa6afd56cbc6..dfbd1c72388c1 100644
--- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
+++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts
@@ -1809,6 +1809,8 @@ usb2-0 {
status = "okay";
vbus-supply = <&usbc_vbus>;
mode = "otg";
+ usb-role-switch;
+ role-switch-default-mode = "host";
};
usb3-0 {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 118/844] soc: imx8m: Fix error handling for clk_prepare_enable()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (116 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 117/844] arm64: tegra: smaug: Add usb-role-switch support Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 119/844] soc/tegra: pmc: Fix unsafe generic_handle_irq() call Sasha Levin
` (734 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peng Fan, kernel test robot, Dan Carpenter, Marco Felsch,
Daniel Baluta, Shawn Guo, Sasha Levin
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit f6ef3d9ff81240e9bcc030f2da132eb0f8a761d7 ]
imx8m_soc_prepare() directly returns the result of clk_prepare_enable(),
which skips proper cleanup if the clock enable fails. Check the return
value of clk_prepare_enable() and release resources if failure.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202601111406.ZVV3YaiU-lkp@intel.com/
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/imx/soc-imx8m.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
index 04a1b60f2f2b5..8e2322999f099 100644
--- a/drivers/soc/imx/soc-imx8m.c
+++ b/drivers/soc/imx/soc-imx8m.c
@@ -148,7 +148,11 @@ static int imx8m_soc_prepare(struct platform_device *pdev, const char *ocotp_com
goto err_clk;
}
- return clk_prepare_enable(drvdata->clk);
+ ret = clk_prepare_enable(drvdata->clk);
+ if (ret)
+ goto err_clk;
+
+ return 0;
err_clk:
iounmap(drvdata->ocotp_base);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 119/844] soc/tegra: pmc: Fix unsafe generic_handle_irq() call
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (117 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 118/844] soc: imx8m: Fix error handling for clk_prepare_enable() Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 120/844] x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor Sasha Levin
` (733 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Prathamesh Shete, Petlozu Pravareshwar, Jon Hunter,
Thierry Reding, Sasha Levin
From: Prathamesh Shete <pshete@nvidia.com>
[ Upstream commit e6d96073af681780820c94079b978474a8a44413 ]
Currently, when resuming from system suspend on Tegra platforms,
the following warning is observed:
WARNING: CPU: 0 PID: 14459 at kernel/irq/irqdesc.c:666
Call trace:
handle_irq_desc+0x20/0x58 (P)
tegra186_pmc_wake_syscore_resume+0xe4/0x15c
syscore_resume+0x3c/0xb8
suspend_devices_and_enter+0x510/0x540
pm_suspend+0x16c/0x1d8
The warning occurs because generic_handle_irq() is being called from
a non-interrupt context which is considered as unsafe.
Fix this warning by deferring generic_handle_irq() call to an IRQ work
which gets executed in hard IRQ context where generic_handle_irq()
can be called safely.
When PREEMPT_RT kernels are used, regular IRQ work (initialized with
init_irq_work) is deferred to run in per-CPU kthreads in preemptible
context rather than hard IRQ context. Hence, use the IRQ_WORK_INIT_HARD
variant so that with PREEMPT_RT kernels, the IRQ work is processed in
hardirq context instead of being deferred to a thread which is required
for calling generic_handle_irq().
On non-PREEMPT_RT kernels, both init_irq_work() and IRQ_WORK_INIT_HARD()
execute in IRQ context, so this change has no functional impact for
standard kernel configurations.
Signed-off-by: Petlozu Pravareshwar <petlozup@nvidia.com>
Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
[treding@nvidia.com: miscellaneous cleanups]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/tegra/pmc.c | 104 ++++++++++++++++++++++++++++------------
1 file changed, 74 insertions(+), 30 deletions(-)
diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
index f3760a3b3026d..407fa840814c3 100644
--- a/drivers/soc/tegra/pmc.c
+++ b/drivers/soc/tegra/pmc.c
@@ -28,6 +28,7 @@
#include <linux/iopoll.h>
#include <linux/irqdomain.h>
#include <linux/irq.h>
+#include <linux/irq_work.h>
#include <linux/kernel.h>
#include <linux/of_address.h>
#include <linux/of_clk.h>
@@ -468,6 +469,10 @@ struct tegra_pmc {
unsigned long *wake_sw_status_map;
unsigned long *wake_cntrl_level_map;
struct syscore syscore;
+
+ /* Pending wake IRQ processing */
+ struct irq_work wake_work;
+ u32 *wake_status;
};
static struct tegra_pmc *pmc = &(struct tegra_pmc) {
@@ -1905,6 +1910,50 @@ static int tegra_pmc_parse_dt(struct tegra_pmc *pmc, struct device_node *np)
return 0;
}
+/* translate sc7 wake sources back into IRQs to catch edge triggered wakeups */
+static void tegra186_pmc_wake_handler(struct irq_work *work)
+{
+ struct tegra_pmc *pmc = container_of(work, struct tegra_pmc, wake_work);
+ unsigned int i, wake;
+
+ for (i = 0; i < pmc->soc->max_wake_vectors; i++) {
+ unsigned long status = pmc->wake_status[i];
+
+ for_each_set_bit(wake, &status, 32) {
+ irq_hw_number_t hwirq = wake + (i * 32);
+ struct irq_desc *desc;
+ unsigned int irq;
+
+ irq = irq_find_mapping(pmc->domain, hwirq);
+ if (!irq) {
+ dev_warn(pmc->dev,
+ "No IRQ found for WAKE#%lu!\n",
+ hwirq);
+ continue;
+ }
+
+ dev_dbg(pmc->dev,
+ "Resume caused by WAKE#%lu mapped to IRQ#%u\n",
+ hwirq, irq);
+
+ desc = irq_to_desc(irq);
+ if (!desc) {
+ dev_warn(pmc->dev,
+ "No descriptor found for IRQ#%u\n",
+ irq);
+ continue;
+ }
+
+ if (!desc->action || !desc->action->name)
+ continue;
+
+ generic_handle_irq(irq);
+ }
+
+ pmc->wake_status[i] = 0;
+ }
+}
+
static int tegra_pmc_init(struct tegra_pmc *pmc)
{
if (pmc->soc->max_wake_events > 0) {
@@ -1923,6 +1972,18 @@ static int tegra_pmc_init(struct tegra_pmc *pmc)
pmc->wake_cntrl_level_map = bitmap_zalloc(pmc->soc->max_wake_events, GFP_KERNEL);
if (!pmc->wake_cntrl_level_map)
return -ENOMEM;
+
+ pmc->wake_status = kcalloc(pmc->soc->max_wake_vectors, sizeof(u32), GFP_KERNEL);
+ if (!pmc->wake_status)
+ return -ENOMEM;
+
+ /*
+ * Initialize IRQ work for processing wake IRQs. Must use
+ * HARD_IRQ variant to run in hard IRQ context on PREEMPT_RT
+ * because we call generic_handle_irq() which requires hard
+ * IRQ context.
+ */
+ pmc->wake_work = IRQ_WORK_INIT_HARD(tegra186_pmc_wake_handler);
}
if (pmc->soc->init)
@@ -3129,47 +3190,30 @@ static void wke_clear_wake_status(struct tegra_pmc *pmc)
}
}
-/* translate sc7 wake sources back into IRQs to catch edge triggered wakeups */
-static void tegra186_pmc_process_wake_events(struct tegra_pmc *pmc, unsigned int index,
- unsigned long status)
-{
- unsigned int wake;
-
- dev_dbg(pmc->dev, "Wake[%d:%d] status=%#lx\n", (index * 32) + 31, index * 32, status);
-
- for_each_set_bit(wake, &status, 32) {
- irq_hw_number_t hwirq = wake + 32 * index;
- struct irq_desc *desc;
- unsigned int irq;
-
- irq = irq_find_mapping(pmc->domain, hwirq);
-
- desc = irq_to_desc(irq);
- if (!desc || !desc->action || !desc->action->name) {
- dev_dbg(pmc->dev, "Resume caused by WAKE%ld, IRQ %d\n", hwirq, irq);
- continue;
- }
-
- dev_dbg(pmc->dev, "Resume caused by WAKE%ld, %s\n", hwirq, desc->action->name);
- generic_handle_irq(irq);
- }
-}
-
static void tegra186_pmc_wake_syscore_resume(void *data)
{
- u32 status, mask;
unsigned int i;
+ u32 mask;
for (i = 0; i < pmc->soc->max_wake_vectors; i++) {
mask = readl(pmc->wake + WAKE_AOWAKE_TIER2_ROUTING(i));
- status = readl(pmc->wake + WAKE_AOWAKE_STATUS_R(i)) & mask;
-
- tegra186_pmc_process_wake_events(pmc, i, status);
+ pmc->wake_status[i] = readl(pmc->wake + WAKE_AOWAKE_STATUS_R(i)) & mask;
}
+
+ /* Schedule IRQ work to process wake IRQs (if any) */
+ irq_work_queue(&pmc->wake_work);
}
static int tegra186_pmc_wake_syscore_suspend(void *data)
{
+ unsigned int i;
+
+ /* Check if there are unhandled wake IRQs */
+ for (i = 0; i < pmc->soc->max_wake_vectors; i++)
+ if (pmc->wake_status[i])
+ dev_warn(pmc->dev,
+ "Unhandled wake IRQs pending vector[%u]: 0x%x\n",
+ i, pmc->wake_status[i]);
wke_read_sw_wake_status(pmc);
/* flip the wakeup trigger for dual-edge triggered pads
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 120/844] x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (118 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 119/844] soc/tegra: pmc: Fix unsafe generic_handle_irq() call Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 121/844] parisc: Prevent interrupts during reboot Sasha Levin
` (732 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Borislav Petkov (AMD), kernel test robot, Julia Lawall,
Tom Lendacky, Sasha Levin
From: "Borislav Petkov (AMD)" <bp@alien8.de>
[ Upstream commit af05e558988ed004a20fc4de7d0f80cfbba663f0 ]
Use the proper helper instead of an open-coded variant.
Closes: https://lore.kernel.org/r/202512202235.WHPQkLZu-lkp@intel.com
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@inria.fr>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://patch.msgid.link/20260112114147.GBaWTd-8HSy_Xp4S3X@fat_crate.local
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/coco/sev/core.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c
index 9ae3b11754e65..c8ddb9febe3d9 100644
--- a/arch/x86/coco/sev/core.c
+++ b/arch/x86/coco/sev/core.c
@@ -2008,8 +2008,7 @@ void snp_msg_free(struct snp_msg_desc *mdesc)
free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg));
iounmap((__force void __iomem *)mdesc->secrets);
- memset(mdesc, 0, sizeof(*mdesc));
- kfree(mdesc);
+ kfree_sensitive(mdesc);
}
EXPORT_SYMBOL_GPL(snp_msg_free);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 121/844] parisc: Prevent interrupts during reboot
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (119 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 120/844] x86/sev: Use kfree_sensitive() when freeing a SNP message descriptor Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 122/844] drm/xe/ggtt: Use scope-based runtime pm Sasha Levin
` (731 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Helge Deller, Sasha Levin
From: Helge Deller <deller@gmx.de>
[ Upstream commit 35ac5a728c878594f2ea6c43b57652a16be3c968 ]
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/parisc/kernel/process.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index e64ab5d2a40d6..703644e5bfc4a 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -85,6 +85,9 @@ void machine_restart(char *cmd)
#endif
/* set up a new led state on systems shipped with a LED State panel */
pdc_chassis_send_status(PDC_CHASSIS_DIRECT_SHUTDOWN);
+
+ /* prevent interrupts during reboot */
+ set_eiem(0);
/* "Normal" system reset */
pdc_do_reset();
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 122/844] drm/xe/ggtt: Use scope-based runtime pm
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (120 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 121/844] parisc: Prevent interrupts during reboot Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 123/844] drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL Sasha Levin
` (730 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Matt Roper, Gustavo Sousa, Sasha Levin
From: Matt Roper <matthew.d.roper@intel.com>
[ Upstream commit 8a579f4b2476fd1df07e2bca9fedc82a39a56a65 ]
Switch the GGTT code to scope-based runtime PM for consistency with
other parts of the driver.
Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
Link: https://patch.msgid.link/20251118164338.3572146-51-matthew.d.roper@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_ggtt.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c
index 793d7324a395d..9e6b4e9835424 100644
--- a/drivers/gpu/drm/xe/xe_ggtt.c
+++ b/drivers/gpu/drm/xe/xe_ggtt.c
@@ -396,9 +396,8 @@ static void ggtt_node_remove_work_func(struct work_struct *work)
delayed_removal_work);
struct xe_device *xe = tile_to_xe(node->ggtt->tile);
- xe_pm_runtime_get(xe);
+ guard(xe_pm_runtime)(xe);
ggtt_node_remove(node);
- xe_pm_runtime_put(xe);
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 123/844] drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (121 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 122/844] drm/xe/ggtt: Use scope-based runtime pm Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 124/844] drm/xe/vm: Skip ufence association for CPU address mirror VMA during MAP Sasha Levin
` (729 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Matthew Brost, Tejas Upadhyay, Sasha Levin
From: Matthew Brost <matthew.brost@intel.com>
[ Upstream commit 6028f59620927aee2e15a424004012ae05c50684 ]
xe_vma_userptr_pin_pages can return -EBUSY but -EBUSY has special
meaning in VM bind IOCTLs that user fence is pending that is attached to
the VMA. Convert -EBUSY to -ENOMEM in this case as -EBUSY in practice
means we are low or out of memory.
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
Link: https://patch.msgid.link/20251122012502.382587-2-matthew.brost@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 095bb197e8b05..9781209dd26ed 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -2451,8 +2451,17 @@ static struct xe_vma *new_vma(struct xe_vm *vm, struct drm_gpuva_op_map *op,
if (IS_ERR(vma))
return vma;
- if (xe_vma_is_userptr(vma))
+ if (xe_vma_is_userptr(vma)) {
err = xe_vma_userptr_pin_pages(to_userptr_vma(vma));
+ /*
+ * -EBUSY has dedicated meaning that a user fence
+ * attached to the VMA is busy, in practice
+ * xe_vma_userptr_pin_pages can only fail with -EBUSY if
+ * we are low on memory so convert this to -ENOMEM.
+ */
+ if (err == -EBUSY)
+ err = -ENOMEM;
+ }
}
if (err) {
prep_vma_destroy(vm, vma, false);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 124/844] drm/xe/vm: Skip ufence association for CPU address mirror VMA during MAP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (122 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 123/844] drm/xe: Covert return of -EBUSY to -ENOMEM in VM bind IOCTL Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 125/844] drm/panthor: Always wait after sending a command to an AS Sasha Levin
` (728 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Himal Prasad Ghimiray, Matthew Brost, Thomas Hellström,
Sasha Levin
From: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
[ Upstream commit 7f08cc5b3cc3bf6416f8b55bff906f67ed75637d ]
The MAP operation for a CPU address mirror VMA does not require ufence
association because such mappings are not GPU-synchronized and do not
participate in GPU job completion signaling.
Remove the unnecessary ufence addition for this case to avoid -EBUSY
failure in check_ufence of unbind ops.
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20251125075628.1182481-6-himal.prasad.ghimiray@intel.com
Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_vm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 9781209dd26ed..612fc5b2539cd 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -3223,7 +3223,8 @@ static void op_add_ufence(struct xe_vm *vm, struct xe_vma_op *op,
{
switch (op->base.op) {
case DRM_GPUVA_OP_MAP:
- vma_add_ufence(op->map.vma, ufence);
+ if (!xe_vma_is_cpu_addr_mirror(op->map.vma))
+ vma_add_ufence(op->map.vma, ufence);
break;
case DRM_GPUVA_OP_REMAP:
if (op->remap.prev)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 125/844] drm/panthor: Always wait after sending a command to an AS
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (123 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 124/844] drm/xe/vm: Skip ufence association for CPU address mirror VMA during MAP Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 126/844] drm/xe/xe3_lpg: Apply Wa_16028005424 Sasha Levin
` (727 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Boris Brezillon, Steven Price, Sasha Levin
From: Boris Brezillon <boris.brezillon@collabora.com>
[ Upstream commit d2c6fde56d451ca48a5e03428535ce3dbc8fc910 ]
There's currently no situation where we want to issue a command to an
AS and not wait for this command to complete. The wait is either
explicitly done (LOCK, UNLOCK) or it's missing (UPDATE). So let's
turn write_cmd() into as_send_cmd_and_wait() that has the wait after
a command is sent.
v2:
- New patch
v3:
- Collect R-b
v4:
- No changes
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251128084841.3804658-2-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_mmu.c | 27 ++++++++++++---------------
1 file changed, 12 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
index 9194bad4b6196..c15d2a3906db9 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -510,27 +510,29 @@ static int wait_ready(struct panthor_device *ptdev, u32 as_nr)
return ret;
}
-static int write_cmd(struct panthor_device *ptdev, u32 as_nr, u32 cmd)
+static int as_send_cmd_and_wait(struct panthor_device *ptdev, u32 as_nr, u32 cmd)
{
int status;
/* write AS_COMMAND when MMU is ready to accept another command */
status = wait_ready(ptdev, as_nr);
- if (!status)
+ if (!status) {
gpu_write(ptdev, AS_COMMAND(as_nr), cmd);
+ status = wait_ready(ptdev, as_nr);
+ }
return status;
}
-static void lock_region(struct panthor_device *ptdev, u32 as_nr,
- u64 region_start, u64 size)
+static int lock_region(struct panthor_device *ptdev, u32 as_nr,
+ u64 region_start, u64 size)
{
u8 region_width;
u64 region;
u64 region_end = region_start + size;
if (!size)
- return;
+ return 0;
/*
* The locked region is a naturally aligned power of 2 block encoded as
@@ -553,7 +555,7 @@ static void lock_region(struct panthor_device *ptdev, u32 as_nr,
/* Lock the region that needs to be updated */
gpu_write64(ptdev, AS_LOCKADDR(as_nr), region);
- write_cmd(ptdev, as_nr, AS_COMMAND_LOCK);
+ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_LOCK);
}
static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
@@ -586,9 +588,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
* power it up
*/
- lock_region(ptdev, as_nr, iova, size);
-
- ret = wait_ready(ptdev, as_nr);
+ ret = lock_region(ptdev, as_nr, iova, size);
if (ret)
return ret;
@@ -601,10 +601,7 @@ static int mmu_hw_do_operation_locked(struct panthor_device *ptdev, int as_nr,
* at the end of the GPU_CONTROL cache flush command, unlike
* AS_COMMAND_FLUSH_MEM or AS_COMMAND_FLUSH_PT.
*/
- write_cmd(ptdev, as_nr, AS_COMMAND_UNLOCK);
-
- /* Wait for the unlock command to complete */
- return wait_ready(ptdev, as_nr);
+ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UNLOCK);
}
static int mmu_hw_do_operation(struct panthor_vm *vm,
@@ -633,7 +630,7 @@ static int panthor_mmu_as_enable(struct panthor_device *ptdev, u32 as_nr,
gpu_write64(ptdev, AS_MEMATTR(as_nr), memattr);
gpu_write64(ptdev, AS_TRANSCFG(as_nr), transcfg);
- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE);
+ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE);
}
static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr)
@@ -648,7 +645,7 @@ static int panthor_mmu_as_disable(struct panthor_device *ptdev, u32 as_nr)
gpu_write64(ptdev, AS_MEMATTR(as_nr), 0);
gpu_write64(ptdev, AS_TRANSCFG(as_nr), AS_TRANSCFG_ADRMODE_UNMAPPED);
- return write_cmd(ptdev, as_nr, AS_COMMAND_UPDATE);
+ return as_send_cmd_and_wait(ptdev, as_nr, AS_COMMAND_UPDATE);
}
static u32 panthor_mmu_fault_mask(struct panthor_device *ptdev, u32 value)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 126/844] drm/xe/xe3_lpg: Apply Wa_16028005424
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (124 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 125/844] drm/panthor: Always wait after sending a command to an AS Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 127/844] drm/panel-edp: Add CSW MNE007QB3-1 Sasha Levin
` (726 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Balasubramani Vivekanandan, Matt Roper, Sasha Levin
From: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
[ Upstream commit 9d94c1cf6ef938abd4b849b66f8eab11e3c537ef ]
Applied Wa_16028005424 to Graphics version from 30.00 to 30.05
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
Link: https://patch.msgid.link/20251121100822.20076-2-balasubramani.vivekanandan@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/regs/xe_guc_regs.h | 3 +++
drivers/gpu/drm/xe/xe_wa.c | 5 +++++
2 files changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/xe/regs/xe_guc_regs.h b/drivers/gpu/drm/xe/regs/xe_guc_regs.h
index 2118f7dec287f..87984713dd126 100644
--- a/drivers/gpu/drm/xe/regs/xe_guc_regs.h
+++ b/drivers/gpu/drm/xe/regs/xe_guc_regs.h
@@ -90,6 +90,9 @@
#define GUC_SEND_INTERRUPT XE_REG(0xc4c8)
#define GUC_SEND_TRIGGER REG_BIT(0)
+#define GUC_INTR_CHICKEN XE_REG(0xc50c)
+#define DISABLE_SIGNALING_ENGINES REG_BIT(1)
+
#define GUC_BCS_RCS_IER XE_REG(0xc550)
#define GUC_VCS2_VCS1_IER XE_REG(0xc554)
#define GUC_WD_VECS_IER XE_REG(0xc558)
diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
index c7eab0c4af7a8..68238e73015b7 100644
--- a/drivers/gpu/drm/xe/xe_wa.c
+++ b/drivers/gpu/drm/xe/xe_wa.c
@@ -15,6 +15,7 @@
#include "regs/xe_engine_regs.h"
#include "regs/xe_gt_regs.h"
+#include "regs/xe_guc_regs.h"
#include "regs/xe_regs.h"
#include "xe_device_types.h"
#include "xe_force_wake.h"
@@ -315,6 +316,10 @@ static const struct xe_rtp_entry_sr gt_was[] = {
XE_RTP_ACTIONS(SET(VDBOX_CGCTL3F10(0), RAMDFTUNIT_CLKGATE_DIS)),
XE_RTP_ENTRY_FLAG(FOREACH_ENGINE),
},
+ { XE_RTP_NAME("16028005424"),
+ XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3005)),
+ XE_RTP_ACTIONS(SET(GUC_INTR_CHICKEN, DISABLE_SIGNALING_ENGINES))
+ },
};
static const struct xe_rtp_entry_sr engine_was[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 127/844] drm/panel-edp: Add CSW MNE007QB3-1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (125 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 126/844] drm/xe/xe3_lpg: Apply Wa_16028005424 Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 128/844] gpu/panel-edp: add AUO panel entry for B140HAN06.4 Sasha Levin
` (725 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Langyan Ye, Douglas Anderson, Sasha Levin
From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
[ Upstream commit b1ea3babb67dcb8b0881c2ab49dfba88b1445856 ]
Add support for the CSW MNE007QB3-1, pleace the EDID here for
subsequent reference.
00 ff ff ff ff ff ff 00 0e 77 7c 14 00 00 00 00
00 23 01 04 a5 1e 13 78 07 ee 95 a3 54 4c 99 26
0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20
36 00 2d bc 10 00 00 18 2b 30 80 a0 70 b0 23 40
30 20 36 00 2d bc 10 00 00 18 00 00 00 fd 00 28
3c 4a 4a 0f 01 0a 20 20 20 20 20 20 00 00 00 fc
00 4d 4e 45 30 30 37 51 42 33 2d 31 0a 20 01 5b
70 20 79 02 00 21 00 1d c8 0b 5d 07 80 07 b0 04
00 3d 8a 54 cd a4 99 66 62 0f 02 45 54 40 5e 40
5e 00 44 12 78 2e 00 06 00 44 40 5e 40 5e 81 00
20 74 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c
00 00 00 00 8d 00 e3 05 04 00 e6 06 01 00 60 60
ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 90
Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251127121601.1608379-1-yelangyan@huaqin.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-edp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 415b894890ad7..023fbbb10eb4f 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -2033,6 +2033,7 @@ static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1462, &delay_200_500_e50, "MNE007QS5-2"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1468, &delay_200_500_e50, "MNE007QB2-2"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x146e, &delay_80_500_e50_d50, "MNE007QB3-1"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x147c, &delay_200_500_e50_d100, "MNE007QB3-1"),
EDP_PANEL_ENTRY('C', 'S', 'W', 0x1519, &delay_200_500_e80_d50, "MNF601BS1-3"),
EDP_PANEL_ENTRY('E', 'T', 'C', 0x0000, &delay_50_500_e200_d200_po2e335, "LP079QX1-SP0V"),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 128/844] gpu/panel-edp: add AUO panel entry for B140HAN06.4
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (126 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 127/844] drm/panel-edp: Add CSW MNE007QB3-1 Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 129/844] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg() Sasha Levin
` (724 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexey Klimov, Bjorn Andersson, Vinod Koul, Douglas Anderson,
Sasha Levin
From: Alexey Klimov <alexey.klimov@linaro.org>
[ Upstream commit 2976aeb0de77da599ad37691963efbdcb07435ce ]
Add an eDP panel entry for AUO B140HAN06.4 that is also used in
some variants of Lenovo Flex 5G with Qcom SC8180 SoC.
The raw edid of the panel is:
00 ff ff ff ff ff ff 00 06 af 3d 64 00 00 00 00
2b 1d 01 04 a5 1f 11 78 03 b8 1a a6 54 4a 9b 26
0e 52 55 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 14 37 80 b8 70 38 24 40 10 10
3e 00 35 ae 10 00 00 18 10 2c 80 b8 70 38 24 40
10 10 3e 00 35 ae 10 00 00 18 00 00 00 fe 00 41
55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe
00 42 31 34 30 48 41 4e 30 36 2e 34 20 0a 00 eb
I do not have access to the datasheet and but it is tested on above
mentioned laptop for a few weeks and seems to work just fine with
timing info of similar panels.
Cc: Bjorn Andersson <andersson@kernel.org>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251203074555.690613-1-alexey.klimov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-edp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 023fbbb10eb4f..2c35970377431 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1904,6 +1904,7 @@ static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('A', 'U', 'O', 0x615c, &delay_200_500_e50, "B116XAN06.1"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x635c, &delay_200_500_e50, "B116XAN06.3"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x639c, &delay_200_500_e50, "B140HAK02.7"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x643d, &delay_200_500_e50, "B140HAN06.4"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x723c, &delay_200_500_e50, "B140XTN07.2"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x73aa, &delay_200_500_e50, "B116XTN02.3"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x8594, &delay_200_500_e50, "B133UAN01.0"),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 129/844] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (127 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 128/844] gpu/panel-edp: add AUO panel entry for B140HAN06.4 Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 130/844] drm/amdgpu: fix NULL pointer issue buffer funcs Sasha Levin
` (723 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Lizhi Hou, Maciej Falkowski, Sasha Levin
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit cd77d5a4aaf8c5c1d819f47cf814bf7d4920b0a2 ]
In mailbox_get_msg(), mailbox_reg_read_non_zero() is called to poll for a
non-zero tail pointer. This assumed that a zero value indicates an error.
However, certain corner cases legitimately produce a zero tail pointer.
To handle these cases, remove mailbox_reg_read_non_zero(). The zero tail
pointer will be treated as a valid rewind event.
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251204181603.793824-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/amdxdna_mailbox.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
index 8b72cf6bd6e4d..469242ed82246 100644
--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
+++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
@@ -112,22 +112,6 @@ static u32 mailbox_reg_read(struct mailbox_channel *mb_chann, u32 mbox_reg)
return readl(ringbuf_addr);
}
-static int mailbox_reg_read_non_zero(struct mailbox_channel *mb_chann, u32 mbox_reg, u32 *val)
-{
- struct xdna_mailbox_res *mb_res = &mb_chann->mb->res;
- void __iomem *ringbuf_addr = mb_res->mbox_base + mbox_reg;
- int ret, value;
-
- /* Poll till value is not zero */
- ret = readx_poll_timeout(readl, ringbuf_addr, value,
- value, 1 /* us */, 100);
- if (ret < 0)
- return ret;
-
- *val = value;
- return 0;
-}
-
static inline void
mailbox_set_headptr(struct mailbox_channel *mb_chann, u32 headptr_val)
{
@@ -291,8 +275,7 @@ static int mailbox_get_msg(struct mailbox_channel *mb_chann)
u32 start_addr;
int ret;
- if (mailbox_reg_read_non_zero(mb_chann, mb_chann->res[CHAN_RES_I2X].mb_tail_ptr_reg, &tail))
- return -EINVAL;
+ tail = mailbox_get_tailptr(mb_chann, CHAN_RES_I2X);
head = mb_chann->i2x_head;
ringbuf_size = mailbox_get_ringbuf_size(mb_chann, CHAN_RES_I2X);
start_addr = mb_chann->res[CHAN_RES_I2X].rb_start_addr;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 130/844] drm/amdgpu: fix NULL pointer issue buffer funcs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (128 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 129/844] accel/amdxdna: Fix tail-pointer polling in mailbox_get_msg() Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 131/844] drm/amdgpu: fix the calculation of RAS bad page number Sasha Levin
` (722 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Likun Gao, Hawking Zhang, Alex Deucher, Sasha Levin
From: Likun Gao <Likun.Gao@amd.com>
[ Upstream commit 9877a865d62c9c3e0f4cc369dc9ca9f7f24f5ee9 ]
If SDMA block not enabled, buffer_funcs will not initialize,
fix the null pointer issue if buffer_funcs not initialized.
Signed-off-by: Likun Gao <Likun.Gao@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index d2c3885de711f..ba6fb23b840a0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3309,7 +3309,8 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
if (r)
goto init_failed;
- if (adev->mman.buffer_funcs_ring->sched.ready)
+ if (adev->mman.buffer_funcs_ring &&
+ adev->mman.buffer_funcs_ring->sched.ready)
amdgpu_ttm_set_buffer_funcs_status(adev, true);
/* Don't init kfd if whole hive need to be reset during init */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 131/844] drm/amdgpu: fix the calculation of RAS bad page number
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (129 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 130/844] drm/amdgpu: fix NULL pointer issue buffer funcs Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 132/844] drm/amdgpu/ras: Move ras data alloc before bad page check Sasha Levin
` (721 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tao Zhou, Hawking Zhang, Alex Deucher, Sasha Levin
From: Tao Zhou <tao.zhou1@amd.com>
[ Upstream commit f752e79d38857011f1293fcb6c810409c3b669ee ]
__amdgpu_ras_restore_bad_pages is responsible for the maintenance of bad
page number, drop the unnecessary bad page number update in the error
handling path of add_bad_pages.
Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 8de9f68f7bea6..9c21401c9b830 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -3249,8 +3249,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev,
/* deal with retire_unit records a time */
ret = __amdgpu_ras_convert_rec_array_from_rom(adev,
&bps[i], &err_data, nps);
- if (ret)
- con->bad_page_num -= adev->umc.retire_unit;
i += (adev->umc.retire_unit - 1);
} else {
break;
@@ -3263,8 +3261,6 @@ int amdgpu_ras_add_bad_pages(struct amdgpu_device *adev,
for (; i < pages; i++) {
ret = __amdgpu_ras_convert_rec_from_rom(adev,
&bps[i], &err_data, nps);
- if (ret)
- con->bad_page_num -= adev->umc.retire_unit;
}
con->eh_data->count_saved = con->eh_data->count;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 132/844] drm/amdgpu/ras: Move ras data alloc before bad page check
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (130 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 131/844] drm/amdgpu: fix the calculation of RAS bad page number Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 133/844] drm/amd/display: Correct DSC padding accounting Sasha Levin
` (720 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Asad Kamal, Lijo Lazar, Hawking Zhang, Alex Deucher, Sasha Levin
From: Asad Kamal <asad.kamal@amd.com>
[ Upstream commit bd68a1404b6fa2e7e9957b38ba22616faba43e75 ]
In the rare event if eeprom has only invalid address entries,
allocation is skipped, this causes following NULL pointer issue
[ 547.103445] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 547.118897] #PF: supervisor read access in kernel mode
[ 547.130292] #PF: error_code(0x0000) - not-present page
[ 547.141689] PGD 124757067 P4D 0
[ 547.148842] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 547.158504] CPU: 49 PID: 8167 Comm: cat Tainted: G OE 6.8.0-38-generic #38-Ubuntu
[ 547.177998] Hardware name: Supermicro AS -8126GS-TNMR/H14DSG-OD, BIOS 1.7 09/12/2025
[ 547.195178] RIP: 0010:amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
[ 547.210375] Code: e8 63 78 82 c0 45 31 d2 45 3b 75 08 48 8b 45 a0 73 44 44 89 f1 48 8b 7d 88 48 89 ca 48 c1 e2 05 48 29 ca 49 8b 4d 00 48 01 d1 <48> 83 79 10 00 74 17 49 63 f2 48 8b 49 08 41 83 c2 01 48 8d 34 76
[ 547.252045] RSP: 0018:ffa0000067287ac0 EFLAGS: 00010246
[ 547.263636] RAX: ff11000167c28130 RBX: ff11000127600000 RCX: 0000000000000000
[ 547.279467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ff11000125b1c800
[ 547.295298] RBP: ffa0000067287b50 R08: 0000000000000000 R09: 0000000000000000
[ 547.311129] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[ 547.326959] R13: ff11000217b1de00 R14: 0000000000000000 R15: 0000000000000092
[ 547.342790] FS: 0000746e59d14740(0000) GS:ff11017dfda80000(0000) knlGS:0000000000000000
[ 547.360744] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 547.373489] CR2: 0000000000000010 CR3: 000000019585e001 CR4: 0000000000f71ef0
[ 547.389321] PKRU: 55555554
[ 547.395316] Call Trace:
[ 547.400737] <TASK>
[ 547.405386] ? show_regs+0x6d/0x80
[ 547.412929] ? __die+0x24/0x80
[ 547.419697] ? page_fault_oops+0x99/0x1b0
[ 547.428588] ? do_user_addr_fault+0x2ee/0x6b0
[ 547.438249] ? exc_page_fault+0x83/0x1b0
[ 547.446949] ? asm_exc_page_fault+0x27/0x30
[ 547.456225] ? amdgpu_ras_sysfs_badpages_read+0x2f2/0x5d0 [amdgpu]
[ 547.470040] ? mas_wr_modify+0xcd/0x140
[ 547.478548] sysfs_kf_bin_read+0x63/0xb0
[ 547.487248] kernfs_file_read_iter+0xa1/0x190
[ 547.496909] kernfs_fop_read_iter+0x25/0x40
[ 547.506182] vfs_read+0x255/0x390
This also result in space left assigned to negative values.
Moving data alloc call before bad page check resolves both the issue.
Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 9c21401c9b830..6b069dc4bab06 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -3076,6 +3076,11 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
struct ras_err_handler_data *data = con->eh_data;
for (j = 0; j < count; j++) {
+ if (!data->space_left &&
+ amdgpu_ras_realloc_eh_data_space(adev, data, 256)) {
+ return -ENOMEM;
+ }
+
if (amdgpu_ras_check_bad_page_unlock(con,
bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) {
data->count++;
@@ -3083,11 +3088,6 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
continue;
}
- if (!data->space_left &&
- amdgpu_ras_realloc_eh_data_space(adev, data, 256)) {
- return -ENOMEM;
- }
-
amdgpu_ras_reserve_page(adev, bps[j].retired_page);
memcpy(&data->bps[data->count], &(bps[j]),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 133/844] drm/amd/display: Correct DSC padding accounting
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (131 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 132/844] drm/amdgpu/ras: Move ras data alloc before bad page check Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 134/844] drm/amd/display: Fix wrong x_pos and y_pos for cursor offload Sasha Levin
` (719 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Relja Vojvodic, Chris Park, Wenjing Liu, Alex Hung, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Relja Vojvodic <rvojvodi@amd.com>
[ Upstream commit c7062be3380cb20c8b1c4a935a13f1848ead0719 ]
[WHY]
- After the addition of all OVT patches, DSC padding was being accounted
for multiple times, effectively doubling the padding
- This caused compliance failures or corruption
[HOW]
- Add padding to DSC pic width when required by HW, and do not re-add
when calculating reg values
- Do not add padding when computing PPS values, and instead track padding
separately to add when calculating slice width values
Reviewed-by: Chris Park <chris.park@amd.com>
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Relja Vojvodic <rvojvodi@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 2 +-
drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 2 +-
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 2 +-
drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 ++-
.../gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c | 6 +++---
5 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
index 4ee6ed610de0b..3e239124c17d8 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
@@ -108,7 +108,7 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
+ dsc_cfg.dsc_padding = 0;
dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg);
dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst);
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
index be1f3caf4096f..24af5e94c7fce 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
@@ -1063,7 +1063,7 @@ void dcn32_update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
+ dsc_cfg.dsc_padding = 0;
if (should_use_dto_dscclk)
dccg->funcs->set_dto_dscclk(dccg, dsc->inst, dsc_cfg.dc_dsc_cfg.num_slices_h);
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
index 7aa0f452e8f7a..cb2dfd34b5e2e 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
@@ -364,7 +364,7 @@ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
+ dsc_cfg.dsc_padding = 0;
dsc->funcs->dsc_set_config(dsc, &dsc_cfg, &dsc_optc_cfg);
dsc->funcs->dsc_enable(dsc, pipe_ctx->stream_res.opp->inst);
diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
index 635f614c06734..770c9cd128ae8 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
@@ -841,7 +841,7 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
ASSERT(dsc_cfg.dc_dsc_cfg.num_slices_h % opp_cnt == 0);
dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
+ dsc_cfg.dsc_padding = 0;
if (should_use_dto_dscclk)
dccg->funcs->set_dto_dscclk(dccg, dsc->inst, dsc_cfg.dc_dsc_cfg.num_slices_h);
@@ -857,6 +857,7 @@ void link_set_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
}
dsc_cfg.dc_dsc_cfg.num_slices_h *= opp_cnt;
dsc_cfg.pic_width *= opp_cnt;
+ dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
optc_dsc_mode = dsc_optc_cfg.is_pixel_format_444 ? OPTC_DSC_ENABLED_444 : OPTC_DSC_ENABLED_NATIVE_SUBSAMPLED;
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
index 6679c1a14f2fe..8d10aac9c510c 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
@@ -1660,8 +1660,8 @@ bool dcn20_validate_dsc(struct dc *dc, struct dc_state *new_ctx)
if (pipe_ctx->top_pipe || pipe_ctx->prev_odm_pipe || !stream || !stream->timing.flags.DSC)
continue;
- dsc_cfg.pic_width = (stream->timing.h_addressable + stream->timing.h_border_left
- + stream->timing.h_border_right) / opp_cnt;
+ dsc_cfg.pic_width = (stream->timing.h_addressable + pipe_ctx->dsc_padding_params.dsc_hactive_padding
+ + stream->timing.h_border_left + stream->timing.h_border_right) / opp_cnt;
dsc_cfg.pic_height = stream->timing.v_addressable + stream->timing.v_border_top
+ stream->timing.v_border_bottom;
dsc_cfg.pixel_encoding = stream->timing.pixel_encoding;
@@ -1669,7 +1669,7 @@ bool dcn20_validate_dsc(struct dc *dc, struct dc_state *new_ctx)
dsc_cfg.is_odm = pipe_ctx->next_odm_pipe ? true : false;
dsc_cfg.dc_dsc_cfg = stream->timing.dsc_cfg;
dsc_cfg.dc_dsc_cfg.num_slices_h /= opp_cnt;
- dsc_cfg.dsc_padding = pipe_ctx->dsc_padding_params.dsc_hactive_padding;
+ dsc_cfg.dsc_padding = 0;
if (!pipe_ctx->stream_res.dsc->funcs->dsc_validate_stream(pipe_ctx->stream_res.dsc, &dsc_cfg))
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 134/844] drm/amd/display: Fix wrong x_pos and y_pos for cursor offload
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (132 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 133/844] drm/amd/display: Correct DSC padding accounting Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 135/844] drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition Sasha Levin
` (718 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicholas Kazlauskas, Alvin Lee, Roman Li, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
[ Upstream commit c02288724b98cbc018231200891d66578f83f848 ]
[Why]
The hubp401_cursor_set_position function programs a different value
than it stores for use with cursor offload.
This can cause a desync when switching between cursor programming paths.
[How]
We do the translation to destination space currently twice: once in the
HWSS layer, and then again in the HUBP layer since we never store the
translated result.
HUBP expects to program the pos->x and pos->y directly for other ASIC,
so follow that pattern here as well.
Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 14 ++++++--------
.../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 3 +++
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
index f01eae50d02f7..c205500290ecd 100644
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
@@ -733,10 +733,8 @@ void hubp401_cursor_set_position(
const struct dc_cursor_mi_param *param)
{
struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp);
- int x_pos = pos->x - param->recout.x;
- int y_pos = pos->y - param->recout.y;
- int rec_x_offset = x_pos - pos->x_hotspot;
- int rec_y_offset = y_pos - pos->y_hotspot;
+ int rec_x_offset = pos->x - pos->x_hotspot;
+ int rec_y_offset = pos->y - pos->y_hotspot;
int dst_x_offset;
int x_pos_viewport = 0;
int x_hot_viewport = 0;
@@ -748,10 +746,10 @@ void hubp401_cursor_set_position(
* within preceeding ODM slices.
*/
if (param->recout.width) {
- x_pos_viewport = x_pos * param->viewport.width / param->recout.width;
+ x_pos_viewport = pos->x * param->viewport.width / param->recout.width;
x_hot_viewport = pos->x_hotspot * param->viewport.width / param->recout.width;
} else {
- ASSERT(!cur_en || x_pos == 0);
+ ASSERT(!cur_en || pos->x == 0);
ASSERT(!cur_en || pos->x_hotspot == 0);
}
@@ -790,8 +788,8 @@ void hubp401_cursor_set_position(
if (!hubp->cursor_offload) {
REG_SET_2(CURSOR_POSITION, 0,
- CURSOR_X_POSITION, x_pos,
- CURSOR_Y_POSITION, y_pos);
+ CURSOR_X_POSITION, pos->x,
+ CURSOR_Y_POSITION, pos->y);
REG_SET_2(CURSOR_HOT_SPOT, 0,
CURSOR_HOT_SPOT_X, pos->x_hotspot,
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index 5eda7648d0d2b..5ffe41a96864a 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -1215,6 +1215,9 @@ void dcn401_set_cursor_position(struct pipe_ctx *pipe_ctx)
if (recout_y_pos + (int)hubp->curs_attr.height <= 0)
pos_cpy.enable = false; /* not visible beyond top edge*/
+ pos_cpy.x = x_pos;
+ pos_cpy.y = y_pos;
+
hubp->funcs->set_cursor_position(hubp, &pos_cpy, ¶m);
dpp->funcs->set_cursor_position(dpp, &pos_cpy, ¶m, hubp->curs_attr.width, hubp->curs_attr.height);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 135/844] drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (133 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 134/844] drm/amd/display: Fix wrong x_pos and y_pos for cursor offload Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 136/844] drm/amd/display: Guard FAMS2 configuration updates Sasha Levin
` (717 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jing Zhou, Charlene Liu, Wenjing Liu, Roman Li, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Jing Zhou <Jing.Zhou@amd.com>
[ Upstream commit 531fe6e0fee85a1bdb5b8223a706fff654ed0a61 ]
[WHY&HOW]
The condition is only perform toggle if FIXED_VS LTTPR reports
no IEEE OUI.
The literal "\x0,\x0,\x0" contains commas changes the
bytes being compared to {0x00,0x2C,0X00}.
The correct literal should be "\x00\x00\x00" without commas.
Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Jing Zhou <Jing.Zhou@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
index ce174ce5579c0..6a7c4a59ff4c7 100644
--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
+++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c
@@ -271,7 +271,7 @@ enum link_training_result dp_perform_fixed_vs_pe_training_sequence(
rate = get_dpcd_link_rate(<_settings->link_settings);
// Only perform toggle if FIXED_VS LTTPR reports no IEEE OUI
- if (memcmp("\x0,\x0,\x0", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
+ if (memcmp("\x00\x00\x00", &link->dpcd_caps.lttpr_caps.lttpr_ieee_oui[0], 3) == 0) {
/* Vendor specific: Toggle link rate */
toggle_rate = (rate == 0x6) ? 0xA : 0x6;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 136/844] drm/amd/display: Guard FAMS2 configuration updates
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (134 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 135/844] drm/amd/display: Correct FIXED_VS Link Rate Toggle Condition Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 137/844] drm/panel-edp: Add AUO B140QAX01.H panel Sasha Levin
` (716 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dillon Varone, Sridevi Arvindekar, Roman Li, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Dillon Varone <Dillon.Varone@amd.com>
[ Upstream commit 7dedb906cdfec100061daf41f8e54266e975987d ]
[WHY&HOW]
If DMCUB is not initialized or FAMS2 is not supported, the
interface should not be called.
Reviewed-by: Sridevi Arvindekar <sridevi.arvindekar@amd.com>
Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
Signed-off-by: Roman Li <roman.li@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index 5ffe41a96864a..12ce3789f5130 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -1774,7 +1774,8 @@ void dcn401_unblank_stream(struct pipe_ctx *pipe_ctx,
void dcn401_hardware_release(struct dc *dc)
{
if (!dc->debug.disable_force_pstate_allow_on_hw_release) {
- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
+ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable)
+ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
/* If pstate unsupported, or still supported
* by firmware, force it supported by dcn
@@ -1794,7 +1795,9 @@ void dcn401_hardware_release(struct dc *dc)
dc->clk_mgr->clks.p_state_change_support = false;
dc->clk_mgr->funcs->update_clocks(dc->clk_mgr, dc->current_state, true);
}
- dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
+
+ if (dc->ctx->dmub_srv && dc->debug.fams2_config.bits.enable)
+ dc_dmub_srv_fams2_update_config(dc, dc->current_state, false);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 137/844] drm/panel-edp: Add AUO B140QAX01.H panel
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (135 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 136/844] drm/amd/display: Guard FAMS2 configuration updates Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 138/844] drm/amdkfd: Handle GPU reset and drain retry fault race Sasha Levin
` (715 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Val Packett, Douglas Anderson, Sasha Levin
From: Val Packett <val@packett.cool>
[ Upstream commit bcd752c706c357229185a330ab450b86236d9031 ]
A 14-inch 2560x1600 60Hz matte touch panel, found on a Dell Latitude 7455
laptop (second-source with BOE NE14QDM), according to online sources it's
also found on the Latitude 7440 and some ASUS models.
Raw EDID dump:
00 ff ff ff ff ff ff 00 06 af a4 0b 00 00 00 00
00 20 01 04 a5 1e 13 78 03 ad f5 a8 54 47 9c 24
0e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 f0 68 00 a0 a0 40 2e 60 30 20
35 00 2d bc 10 00 00 1a f3 53 00 a0 a0 40 2e 60
30 20 35 00 2d bc 10 00 00 1a 00 00 00 fe 00 36
39 52 31 57 80 42 31 34 30 51 41 58 00 00 00 00
00 02 41 21 a8 00 01 00 00 1a 41 0a 20 20 00 a1
Don't have datasheet access, but the same timing as for other panels from
the same manufacturer works fine.
Signed-off-by: Val Packett <val@packett.cool>
[dianders: Moved to the right location in the table]
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251206173739.2222940-1-val@packett.cool
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-edp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 2c35970377431..85dd3f4cb8e1c 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1880,6 +1880,7 @@ static const struct panel_delay delay_80_500_e50_d50 = {
*/
static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('A', 'U', 'O', 0x04a4, &delay_200_500_e50, "B122UAN01.0"),
+ EDP_PANEL_ENTRY('A', 'U', 'O', 0x0ba4, &delay_200_500_e50, "B140QAX01.H"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x105c, &delay_200_500_e50, "B116XTN01.0"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x1062, &delay_200_500_e50, "B120XAN01.0"),
EDP_PANEL_ENTRY('A', 'U', 'O', 0x125c, &delay_200_500_e50, "Unknown"),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 138/844] drm/amdkfd: Handle GPU reset and drain retry fault race
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (136 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 137/844] drm/panel-edp: Add AUO B140QAX01.H panel Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 139/844] spi-geni-qcom: initialize mode related registers to 0 Sasha Levin
` (714 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Philip Yang, Harish Kasiviswanathan, Alex Deucher, Sasha Levin
From: Philip Yang <Philip.Yang@amd.com>
[ Upstream commit 5b57c3c3f22336e8fd5edb7f0fef3c7823f8eac1 ]
Only check and drain IH1 ring if CAM is not enabled.
If GPU is under reset, don't access IH to drain retry fault.
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 79ea138897fcf..a10cf8650c92b 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -33,6 +33,7 @@
#include "amdgpu_hmm.h"
#include "amdgpu.h"
#include "amdgpu_xgmi.h"
+#include "amdgpu_reset.h"
#include "kfd_priv.h"
#include "kfd_svm.h"
#include "kfd_migrate.h"
@@ -2349,6 +2350,9 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
pr_debug("drain retry fault gpu %d svms %p\n", i, svms);
+ if (!down_read_trylock(&pdd->dev->adev->reset_domain->sem))
+ continue;
+
amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
pdd->dev->adev->irq.retry_cam_enabled ?
&pdd->dev->adev->irq.ih :
@@ -2358,6 +2362,7 @@ static void svm_range_drain_retry_fault(struct svm_range_list *svms)
amdgpu_ih_wait_on_checkpoint_process_ts(pdd->dev->adev,
&pdd->dev->adev->irq.ih_soft);
+ up_read(&pdd->dev->adev->reset_domain->sem);
pr_debug("drain retry fault gpu %d svms 0x%p done\n", i, svms);
}
@@ -2541,7 +2546,7 @@ svm_range_unmap_from_cpu(struct mm_struct *mm, struct svm_range *prange,
adev = pdd->dev->adev;
/* Check and drain ih1 ring if cam not available */
- if (adev->irq.ih1.ring_size) {
+ if (!adev->irq.retry_cam_enabled && adev->irq.ih1.ring_size) {
ih = &adev->irq.ih1;
checkpoint_wptr = amdgpu_ih_get_wptr(adev, ih);
if (ih->rptr != checkpoint_wptr) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 139/844] spi-geni-qcom: initialize mode related registers to 0
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (137 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 138/844] drm/amdkfd: Handle GPU reset and drain retry fault race Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 140/844] spi-geni-qcom: use xfer->bits_per_word for can_dma() Sasha Levin
` (713 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jonathan Marek, Mark Brown, Sasha Levin
From: Jonathan Marek <jonathan@marek.ca>
[ Upstream commit 739062a9f1e9a77a9687c8fd30f8e5dd12ec70be ]
setup_fifo_params assumes these will be zero, it won't write these
registers if the initial mode is zero.
Signed-off-by: Jonathan Marek <jonathan@marek.ca>
Link: https://patch.msgid.link/20251120211204.24078-4-jonathan@marek.ca
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-geni-qcom.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index a0d8d3425c6c6..9e9953469b3a0 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -724,6 +724,12 @@ static int spi_geni_init(struct spi_geni_master *mas)
case 0:
mas->cur_xfer_mode = GENI_SE_FIFO;
geni_se_select_mode(se, GENI_SE_FIFO);
+ /* setup_fifo_params assumes that these registers start with a zero value */
+ writel(0, se->base + SE_SPI_LOOPBACK);
+ writel(0, se->base + SE_SPI_DEMUX_SEL);
+ writel(0, se->base + SE_SPI_CPHA);
+ writel(0, se->base + SE_SPI_CPOL);
+ writel(0, se->base + SE_SPI_DEMUX_OUTPUT_INV);
ret = 0;
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 140/844] spi-geni-qcom: use xfer->bits_per_word for can_dma()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (138 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 139/844] spi-geni-qcom: initialize mode related registers to 0 Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 141/844] spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing Sasha Levin
` (712 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jonathan Marek, Mark Brown, Sasha Levin
From: Jonathan Marek <jonathan@marek.ca>
[ Upstream commit fb2bbe3838728f572485706677590e4fc41eec5c ]
mas->cur_bits_per_word may not reflect the value of xfer->bits_per_word
when can_dma() is called. Use the right value instead.
Signed-off-by: Jonathan Marek <jonathan@marek.ca>
Link: https://patch.msgid.link/20251120211204.24078-3-jonathan@marek.ca
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-geni-qcom.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index 9e9953469b3a0..5ab20d7955121 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -548,10 +548,10 @@ static u32 get_xfer_len_in_words(struct spi_transfer *xfer,
{
u32 len;
- if (!(mas->cur_bits_per_word % MIN_WORD_LEN))
- len = xfer->len * BITS_PER_BYTE / mas->cur_bits_per_word;
+ if (!(xfer->bits_per_word % MIN_WORD_LEN))
+ len = xfer->len * BITS_PER_BYTE / xfer->bits_per_word;
else
- len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1);
+ len = xfer->len / (xfer->bits_per_word / BITS_PER_BYTE + 1);
len &= TRANS_LEN_MSK;
return len;
@@ -571,7 +571,7 @@ static bool geni_can_dma(struct spi_controller *ctlr,
return true;
len = get_xfer_len_in_words(xfer, mas);
- fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / mas->cur_bits_per_word;
+ fifo_size = mas->tx_fifo_depth * mas->fifo_width_bits / xfer->bits_per_word;
if (len > fifo_size)
return true;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 141/844] spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (139 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 140/844] spi-geni-qcom: use xfer->bits_per_word for can_dma() Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 142/844] drm/amd/display: Fix DP no audio issue Sasha Levin
` (711 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Mark Brown, Francesco Dolcini, Sasha Levin
From: Mark Brown <broonie@kernel.org>
[ Upstream commit 9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3 ]
The recent refactoring of where runtime PM is enabled done in commit
f1eb4e792bb1 ("spi: spi-cadence-quadspi: Enable pm runtime earlier to
avoid imbalance") made the fact that when we do a pm_runtime_disable()
in the error paths of probe() we can trigger a runtime disable which in
turn results in duplicate clock disables. This is particularly likely
to happen when there is missing or broken DT description for the flashes
attached to the controller.
Early on in the probe function we do a pm_runtime_get_noresume() since
the probe function leaves the device in a powered up state but in the
error path we can't assume that PM is enabled so we also manually
disable everything, including clocks. This means that when runtime PM is
active both it and the probe function release the same reference to the
main clock for the IP, triggering warnings from the clock subsystem:
[ 8.693719] clk:75:7 already disabled
[ 8.693791] WARNING: CPU: 1 PID: 185 at /usr/src/kernel/drivers/clk/clk.c:1188 clk_core_disable+0xa0/0xb
...
[ 8.694261] clk_core_disable+0xa0/0xb4 (P)
[ 8.694272] clk_disable+0x38/0x60
[ 8.694283] cqspi_probe+0x7c8/0xc5c [spi_cadence_quadspi]
[ 8.694309] platform_probe+0x5c/0xa4
Dealing with this issue properly is complicated by the fact that we
don't know if runtime PM is active so can't tell if it will disable the
clocks or not. We can, however, sidestep the issue for the flash
descriptions by moving their parsing to when we parse the controller
properties which also save us doing a bunch of setup which can never be
used so let's do that.
Reported-by: Francesco Dolcini <francesco@dolcini.it>
Closes: https://lore.kernel.org/r/20251201072844.GA6785@francesco-nb
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20251204-spi-cadence-qspi-runtime-pm-imbalance-v2-1-10af9115d531@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-cadence-quadspi.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
index b9a560c75c5cd..b1cf182d65665 100644
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -1844,6 +1844,12 @@ static int cqspi_probe(struct platform_device *pdev)
return -ENODEV;
}
+ ret = cqspi_setup_flash(cqspi);
+ if (ret) {
+ dev_err(dev, "failed to setup flash parameters %d\n", ret);
+ return ret;
+ }
+
/* Obtain QSPI clock. */
cqspi->clk = devm_clk_get(dev, NULL);
if (IS_ERR(cqspi->clk)) {
@@ -1987,12 +1993,6 @@ static int cqspi_probe(struct platform_device *pdev)
pm_runtime_get_noresume(dev);
}
- ret = cqspi_setup_flash(cqspi);
- if (ret) {
- dev_err(dev, "failed to setup flash parameters %d\n", ret);
- goto probe_setup_failed;
- }
-
host->num_chipselect = cqspi->num_chipselect;
if (ddata && (ddata->quirks & CQSPI_SUPPORT_DEVICE_RESET))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 142/844] drm/amd/display: Fix DP no audio issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (140 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 141/844] spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 143/844] drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 Sasha Levin
` (710 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Charlene Liu, Swapnil Patel, Chenyu Chen, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Charlene Liu <Charlene.Liu@amd.com>
[ Upstream commit bf5e396957acafd46003318965500914d5f4edfa ]
[why]
need to enable APG_CLOCK_ENABLE enable first
also need to wake up az from D3 before access az block
Reviewed-by: Swapnil Patel <swapnil.patel@amd.com>
Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index 12ce3789f5130..e1f5b1a34cde8 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -297,7 +297,6 @@ void dcn401_init_hw(struct dc *dc)
}
}
}
-
for (i = 0; i < res_pool->audio_count; i++) {
struct audio *audio = res_pool->audios[i];
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 143/844] drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (141 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 142/844] drm/amd/display: Fix DP no audio issue Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 144/844] drm/amd/display: Don't disable DPCD mst_en if sink connected Sasha Levin
` (709 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: LinCheng Ku, PeiChen Huang, Chenyu Chen, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: LinCheng Ku <lincheng.ku@amd.com>
[ Upstream commit cea573a8e1ed83840a2173d153dd68e172849d44 ]
[Why]
USB-C DisplayPort Alt Mode with concurrent USB data needs lane count
limitation to prevent incorrect 4-lane DP configuration when only 2 lanes
are available due to hardware lane sharing between DP and USB3.
[How]
Query DMUB for Alt Mode status (is_dp_alt_disable, is_usb, is_dp4) in
dcn32_link_encoder_get_max_link_cap() and cap DP to 2 lanes when USB is
active on USB-C port. Added inline documentation explaining the USB-C
lane sharing constraint.
Reviewed-by: PeiChen Huang <peichen.huang@amd.com>
Signed-off-by: LinCheng Ku <lincheng.ku@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../display/dc/dio/dcn32/dcn32_dio_link_encoder.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
index 06907e8a4eda1..ddc736af776c9 100644
--- a/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dio/dcn32/dcn32_dio_link_encoder.c
@@ -188,9 +188,18 @@ void dcn32_link_encoder_get_max_link_cap(struct link_encoder *enc,
if (!query_dp_alt_from_dmub(enc, &cmd))
return;
- if (cmd.query_dp_alt.data.is_usb &&
- cmd.query_dp_alt.data.is_dp4 == 0)
- link_settings->lane_count = MIN(LANE_COUNT_TWO, link_settings->lane_count);
+ /*
+ * USB-C DisplayPort Alt Mode lane count limitation logic:
+ * When USB and DP share the same USB-C connector, hardware must allocate
+ * some lanes for USB data, limiting DP to maximum 2 lanes instead of 4.
+ * This ensures USB functionality remains available while DP is active.
+ */
+ if (cmd.query_dp_alt.data.is_dp_alt_disable == 0 &&
+ cmd.query_dp_alt.data.is_usb &&
+ cmd.query_dp_alt.data.is_dp4 == 0) {
+ link_settings->lane_count =
+ MIN(LANE_COUNT_TWO, link_settings->lane_count);
+ }
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 144/844] drm/amd/display: Don't disable DPCD mst_en if sink connected
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (142 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 143/844] drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 145/844] ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET Sasha Levin
` (708 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peichen Huang, Wenjing Liu, Chenyu Chen, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Peichen Huang <PeiChen.Huang@amd.com>
[ Upstream commit 9aeb31b2456452257ad1ff7ec566f21bab1f3e8a ]
[WHY]
User may connect mst dock with multi monitors and do quick unplug
and plug in one of the monitor. This operatioin may create CSN from
dock to display driver. Then display driver would disable and then enable
mst link and also disable/enable DPCD mst_en bit in dock RX. However,
when mst_en bit being disabled, if dock has another CSN message to
transmit then the message would be removed because of the disabling of
mst_en. In this case, the message is missing and it ends up no display in
the replugged monitor.
[HOW]
Don't disable mst_en bit when link still has sink connected.
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Peichen Huang <PeiChen.Huang@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
index 770c9cd128ae8..a36762915943b 100644
--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
@@ -1931,7 +1931,7 @@ static void disable_link_dp(struct dc_link *link,
link->dc->hwss.edp_power_control(link, false);
}
- if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+ if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST && link->sink_count == 0)
/* set the sink to SST mode after disabling the link */
enable_mst_on_sink(link, false);
@@ -2082,7 +2082,12 @@ static enum dc_status enable_link_dp(struct dc_state *state,
pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT &&
link->dc->debug.set_mst_en_for_sst) {
enable_mst_on_sink(link, true);
+ } else if (link->dpcd_caps.is_mst_capable &&
+ pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT) {
+ /* disable mst on sink */
+ enable_mst_on_sink(link, false);
}
+
if (pipe_ctx->stream->signal == SIGNAL_TYPE_EDP) {
/*in case it is not on*/
if (!link->dc->config.edp_no_power_sequencing)
@@ -2380,9 +2385,9 @@ void link_set_dpms_off(struct pipe_ctx *pipe_ctx)
if (pipe_ctx->stream->sink) {
if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) {
- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__,
+ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__,
pipe_ctx->stream->sink->edid_caps.display_name,
- pipe_ctx->stream->signal, link->link_index);
+ pipe_ctx->stream->signal, link->link_index, link->sink_count);
}
}
@@ -2496,10 +2501,11 @@ void link_set_dpms_on(
if (pipe_ctx->stream->sink) {
if (pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_VIRTUAL &&
pipe_ctx->stream->sink->sink_signal != SIGNAL_TYPE_NONE) {
- DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d\n", __func__,
+ DC_LOG_DC("%s pipe_ctx dispname=%s signal=%x link=%d sink_count=%d\n", __func__,
pipe_ctx->stream->sink->edid_caps.display_name,
pipe_ctx->stream->signal,
- link->link_index);
+ link->link_index,
+ link->sink_count);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 145/844] ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (143 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 144/844] drm/amd/display: Don't disable DPCD mst_en if sink connected Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:20 ` [PATCH 6.19 146/844] media: dvb-core: dmxdevfilter must always flush bufs Sasha Levin
` (707 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Seppo Ingalsuo, Ranjani Sridharan, Bard Liao,
Kai Vehmanen, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit d96cb0b86d6e8bbbbfa425771606f6c1aebc318e ]
There are message types when we would need to send a payload along with
the LARGE_CONFIG_GET message to provide information to the firmware on
what data is requested.
Such cases are the ALSA Kcontrol related messages when the high level
param_id tells only the type of the control, but the ID/index of the exact
control is specified in the payload area.
The caller must place the payload for TX before calling the set_get_data()
and this payload will be sent alongside with the message to the firmware.
The data area will be overwritten by the received data from firmware.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://patch.msgid.link/20251217143945.2667-7-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/ipc4.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 42 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sof/ipc4.c b/sound/soc/sof/ipc4.c
index a4a090e6724a6..20d723f48fff0 100644
--- a/sound/soc/sof/ipc4.c
+++ b/sound/soc/sof/ipc4.c
@@ -15,6 +15,7 @@
#include "sof-audio.h"
#include "ipc4-fw-reg.h"
#include "ipc4-priv.h"
+#include "ipc4-topology.h"
#include "ipc4-telemetry.h"
#include "ops.h"
@@ -433,6 +434,23 @@ static int sof_ipc4_tx_msg(struct snd_sof_dev *sdev, void *msg_data, size_t msg_
return ret;
}
+static bool sof_ipc4_tx_payload_for_get_data(struct sof_ipc4_msg *tx)
+{
+ /*
+ * Messages that require TX payload with LARGE_CONFIG_GET.
+ * The TX payload is placed into the IPC message data section by caller,
+ * which needs to be copied to temporary buffer since the received data
+ * will overwrite it.
+ */
+ switch (tx->extension & SOF_IPC4_MOD_EXT_MSG_PARAM_ID_MASK) {
+ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_SWITCH_CONTROL_PARAM_ID):
+ case SOF_IPC4_MOD_EXT_MSG_PARAM_ID(SOF_IPC4_ENUM_CONTROL_PARAM_ID):
+ return true;
+ default:
+ return false;
+ }
+}
+
static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
size_t payload_bytes, bool set)
{
@@ -444,6 +462,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
struct sof_ipc4_msg tx = {{ 0 }};
struct sof_ipc4_msg rx = {{ 0 }};
size_t remaining = payload_bytes;
+ void *tx_payload_for_get = NULL;
+ size_t tx_data_size = 0;
size_t offset = 0;
size_t chunk_size;
int ret;
@@ -469,10 +489,20 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
tx.extension |= SOF_IPC4_MOD_EXT_MSG_FIRST_BLOCK(1);
+ if (sof_ipc4_tx_payload_for_get_data(&tx)) {
+ tx_data_size = min(ipc4_msg->data_size, payload_limit);
+ tx_payload_for_get = kmemdup(ipc4_msg->data_ptr, tx_data_size,
+ GFP_KERNEL);
+ if (!tx_payload_for_get)
+ return -ENOMEM;
+ }
+
/* ensure the DSP is in D0i0 before sending IPC */
ret = snd_sof_dsp_set_power_state(sdev, &target_state);
- if (ret < 0)
+ if (ret < 0) {
+ kfree(tx_payload_for_get);
return ret;
+ }
/* Serialise IPC TX */
mutex_lock(&sdev->ipc->tx_mutex);
@@ -506,7 +536,15 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
rx.data_size = chunk_size;
rx.data_ptr = ipc4_msg->data_ptr + offset;
- tx_size = 0;
+ if (tx_payload_for_get) {
+ tx_size = tx_data_size;
+ tx.data_size = tx_size;
+ tx.data_ptr = tx_payload_for_get;
+ } else {
+ tx_size = 0;
+ tx.data_size = 0;
+ tx.data_ptr = NULL;
+ }
rx_size = chunk_size;
}
@@ -553,6 +591,8 @@ static int sof_ipc4_set_get_data(struct snd_sof_dev *sdev, void *data,
mutex_unlock(&sdev->ipc->tx_mutex);
+ kfree(tx_payload_for_get);
+
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 146/844] media: dvb-core: dmxdevfilter must always flush bufs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (144 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 145/844] ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET Sasha Levin
@ 2026-02-28 17:20 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 147/844] gpio: pca953x: Add support for TCAL6408 TCAL6416 Sasha Levin
` (706 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:20 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Hans Verkuil <hverkuil@xs4all.nl>
[ Upstream commit c4e620eccbef76aa5564ebb295e23d6540e27215 ]
Currently the buffers are being filled until full, which works fine
for the transport stream, but not when reading sections, those have
to be returned to userspace immediately, otherwise dvbv5-scan will
just wait forever.
Add a 'flush' argument to dvb_vb2_fill_buffer to indicate whether
the buffer must be flushed or wait until it is full.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dmxdev.c | 8 ++++----
drivers/media/dvb-core/dvb_vb2.c | 5 +++--
include/media/dvb_vb2.h | 6 ++++--
3 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 8c6f5aafda1d6..17184b3674904 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -397,11 +397,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
if (dvb_vb2_is_streaming(&dmxdevfilter->vb2_ctx)) {
ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
buffer1, buffer1_len,
- buffer_flags);
+ buffer_flags, true);
if (ret == buffer1_len)
ret = dvb_vb2_fill_buffer(&dmxdevfilter->vb2_ctx,
buffer2, buffer2_len,
- buffer_flags);
+ buffer_flags, true);
} else {
ret = dvb_dmxdev_buffer_write(&dmxdevfilter->buffer,
buffer1, buffer1_len);
@@ -452,10 +452,10 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
if (dvb_vb2_is_streaming(ctx)) {
ret = dvb_vb2_fill_buffer(ctx, buffer1, buffer1_len,
- buffer_flags);
+ buffer_flags, false);
if (ret == buffer1_len)
ret = dvb_vb2_fill_buffer(ctx, buffer2, buffer2_len,
- buffer_flags);
+ buffer_flags, false);
} else {
if (buffer->error) {
spin_unlock(&dmxdevfilter->dev->lock);
diff --git a/drivers/media/dvb-core/dvb_vb2.c b/drivers/media/dvb-core/dvb_vb2.c
index 29edaaff7a5c9..7444bbc2f24d9 100644
--- a/drivers/media/dvb-core/dvb_vb2.c
+++ b/drivers/media/dvb-core/dvb_vb2.c
@@ -249,7 +249,8 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx)
int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
const unsigned char *src, int len,
- enum dmx_buffer_flags *buffer_flags)
+ enum dmx_buffer_flags *buffer_flags,
+ bool flush)
{
unsigned long flags = 0;
void *vbuf = NULL;
@@ -306,7 +307,7 @@ int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
}
}
- if (ctx->nonblocking && ctx->buf) {
+ if (flush && ctx->buf) {
vb2_set_plane_payload(&ctx->buf->vb, 0, ll);
vb2_buffer_done(&ctx->buf->vb, VB2_BUF_STATE_DONE);
list_del(&ctx->buf->list);
diff --git a/include/media/dvb_vb2.h b/include/media/dvb_vb2.h
index 8cb88452cd6c2..0fbbfc65157e6 100644
--- a/include/media/dvb_vb2.h
+++ b/include/media/dvb_vb2.h
@@ -124,7 +124,7 @@ static inline int dvb_vb2_release(struct dvb_vb2_ctx *ctx)
return 0;
};
#define dvb_vb2_is_streaming(ctx) (0)
-#define dvb_vb2_fill_buffer(ctx, file, wait, flags) (0)
+#define dvb_vb2_fill_buffer(ctx, file, wait, flags, flush) (0)
static inline __poll_t dvb_vb2_poll(struct dvb_vb2_ctx *ctx,
struct file *file,
@@ -166,10 +166,12 @@ int dvb_vb2_is_streaming(struct dvb_vb2_ctx *ctx);
* @buffer_flags:
* pointer to buffer flags as defined by &enum dmx_buffer_flags.
* can be NULL.
+ * @flush: flush the buffer, even if it isn't full.
*/
int dvb_vb2_fill_buffer(struct dvb_vb2_ctx *ctx,
const unsigned char *src, int len,
- enum dmx_buffer_flags *buffer_flags);
+ enum dmx_buffer_flags *buffer_flags,
+ bool flush);
/**
* dvb_vb2_poll - Wrapper to vb2_core_streamon() for Digital TV
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 147/844] gpio: pca953x: Add support for TCAL6408 TCAL6416
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (145 preceding siblings ...)
2026-02-28 17:20 ` [PATCH 6.19 146/844] media: dvb-core: dmxdevfilter must always flush bufs Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 148/844] spi: stm32: fix Overrun issue at < 8bpw Sasha Levin
` (705 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jan Remmet, Bartosz Golaszewski, Sasha Levin
From: Jan Remmet <j.remmet@phytec.de>
[ Upstream commit a30a9cb9bca4296d25f253619883e7013b6be158 ]
TCAL6408 and TCAL6416 supports latchable inputs and maskable interrupt.
Tested on a TCAL6416, checked datasheets for the TCAL6408.
They use the same programming model ad the NXP PCAL64xx, but
support a lower supply power (1.08V to 3.6V) compared to PCAL
(1.65V to 5.5V)
Datasheet: https://www.ti.com/lit/ds/symlink/tcal6408.pdf
Datasheet: https://www.ti.com/lit/ds/symlink/tcal6416.pdf
Signed-off-by: Jan Remmet <j.remmet@phytec.de>
Link: https://lore.kernel.org/r/20251216-wip-jremmet-tcal6416rtw-v2-3-6516d98a9836@phytec.de
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/Kconfig | 4 ++--
drivers/gpio/gpio-pca953x.c | 6 ++++++
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index bd185482a7fdf..3439e025ba1c6 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1193,11 +1193,11 @@ config GPIO_PCA953X
8 bits: max7310, max7315, pca6107, pca9534, pca9538, pca9554,
pca9556, pca9557, pca9574, tca6408, tca9554, xra1202,
- pcal6408, pcal9554b, tca9538
+ pcal6408, pcal9554b, tca9538, tcal6408
16 bits: max7312, max7313, pca9535, pca9539, pca9555, pca9575,
tca6416, pca6416, pcal6416, pcal9535, pcal9555a, max7318,
- tca9539
+ tca9539, tcal6416
18 bits: tca6418
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index f93a3dbb2daaf..52e96cc5f67bb 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -126,6 +126,9 @@ static const struct i2c_device_id pca953x_id[] = {
{ "tca9539", 16 | PCA953X_TYPE | PCA_INT, },
{ "tca9554", 8 | PCA953X_TYPE | PCA_INT, },
{ "xra1202", 8 | PCA953X_TYPE },
+
+ { "tcal6408", 8 | PCA953X_TYPE | PCA_LATCH_INT, },
+ { "tcal6416", 16 | PCA953X_TYPE | PCA_LATCH_INT, },
{ }
};
MODULE_DEVICE_TABLE(i2c, pca953x_id);
@@ -1469,6 +1472,9 @@ static const struct of_device_id pca953x_dt_ids[] = {
{ .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), },
{ .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), },
+ { .compatible = "ti,tcal6408", .data = OF_953X( 8, PCA_LATCH_INT), },
+ { .compatible = "ti,tcal6416", .data = OF_953X(16, PCA_LATCH_INT), },
+
{ .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), },
{ .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), },
{ .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 148/844] spi: stm32: fix Overrun issue at < 8bpw
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (146 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 147/844] gpio: pca953x: Add support for TCAL6408 TCAL6416 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 149/844] drm/ast: Swap framebuffer writes on big-endian machines Sasha Levin
` (704 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Deepak Kumar, Alain Volmat, Mark Brown, Sasha Levin
From: Deepak Kumar <deepak.kumar01@st.com>
[ Upstream commit 1ac3be217c01d5df55ec5052f81e4f1708f46552 ]
When SPI communication is suspended by hardware automatically, it could
happen that few bits of next frame are already clocked out due to
internal synchronization delay.
To achieve a safe suspension, we need to ensure that each word must be
at least 8 SPI clock cycles long. That's why, if bpw is less than 8
bits, we need to use midi to reach 8 SPI clock cycles at least.
This will ensure that each word achieve safe suspension and prevent
overrun condition.
Signed-off-by: Deepak Kumar <deepak.kumar01@st.com>
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Link: https://patch.msgid.link/20251218-stm32-spi-enhancements-v2-2-3b69901ca9fe@foss.st.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-stm32.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
index 2c804c1aef989..80986bd251d29 100644
--- a/drivers/spi/spi-stm32.c
+++ b/drivers/spi/spi-stm32.c
@@ -1906,11 +1906,12 @@ static void stm32h7_spi_data_idleness(struct stm32_spi *spi, struct spi_transfer
cfg2_clrb |= STM32H7_SPI_CFG2_MIDI;
if ((len > 1) && (spi->cur_midi > 0)) {
u32 sck_period_ns = DIV_ROUND_UP(NSEC_PER_SEC, spi->cur_speed);
- u32 midi = min_t(u32,
- DIV_ROUND_UP(spi->cur_midi, sck_period_ns),
- FIELD_GET(STM32H7_SPI_CFG2_MIDI,
- STM32H7_SPI_CFG2_MIDI));
+ u32 midi = DIV_ROUND_UP(spi->cur_midi, sck_period_ns);
+ if ((spi->cur_bpw + midi) < 8)
+ midi = 8 - spi->cur_bpw;
+
+ midi = min_t(u32, midi, FIELD_MAX(STM32H7_SPI_CFG2_MIDI));
dev_dbg(spi->dev, "period=%dns, midi=%d(=%dns)\n",
sck_period_ns, midi, midi * sck_period_ns);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 149/844] drm/ast: Swap framebuffer writes on big-endian machines
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (147 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 148/844] spi: stm32: fix Overrun issue at < 8bpw Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 150/844] ALSA: hda/realtek - Enable Mute LED for Lenovo platform Sasha Levin
` (703 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: René Rebe, Thomas Zimmermann, Sasha Levin
From: René Rebe <rene@exactco.de>
[ Upstream commit 50c26c301c5176cc8b431044390e10ec862b9b77 ]
Swap the pixel data when writing to framebuffer memory on big-endian
machines. Fixes incorrect output. Aspeed graphics does not appear to
support big-endian framebuffers after AST2400, although the feature
has been documented.
There's a lengthy discussion at [1].
v5:
- avoid restricted cast from __be16 (kernel test robot)
Signed-off-by: René Rebe <rene@exactco.de>
Link: https://lore.kernel.org/dri-devel/20251202.170626.2134482663677806825.rene@exactco.de/ # [1]
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20251212.210504.1355099120650239629.rene@exactco.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/ast/ast_cursor.c | 11 ++++++++---
drivers/gpu/drm/ast/ast_mode.c | 11 +++++++++--
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_cursor.c b/drivers/gpu/drm/ast/ast_cursor.c
index 2d3ad7610c2e9..7da0a2d463e6c 100644
--- a/drivers/gpu/drm/ast/ast_cursor.c
+++ b/drivers/gpu/drm/ast/ast_cursor.c
@@ -92,12 +92,17 @@ static void ast_set_cursor_image(struct ast_device *ast, const u8 *src,
unsigned int width, unsigned int height)
{
u8 __iomem *dst = ast_plane_vaddr(&ast->cursor_plane.base);
- u32 csum;
-
- csum = ast_cursor_calculate_checksum(src, width, height);
+ u32 csum = ast_cursor_calculate_checksum(src, width, height);
/* write pixel data */
+#if defined(__BIG_ENDIAN)
+ unsigned int i;
+
+ for (i = 0; i < AST_HWC_SIZE; i += 2)
+ writew(swab16(*(const __u16 *)&src[i]), &dst[i]);
+#else
memcpy_toio(dst, src, AST_HWC_SIZE);
+#endif
/* write checksum + signature */
dst += AST_HWC_SIZE;
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index cd08990a10f93..57c6fbc3232b0 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -526,12 +526,18 @@ static int ast_primary_plane_helper_atomic_check(struct drm_plane *plane,
static void ast_handle_damage(struct ast_plane *ast_plane, struct iosys_map *src,
struct drm_framebuffer *fb,
- const struct drm_rect *clip)
+ const struct drm_rect *clip,
+ struct drm_format_conv_state *fmtcnv_state)
{
struct iosys_map dst = IOSYS_MAP_INIT_VADDR_IOMEM(ast_plane_vaddr(ast_plane));
iosys_map_incr(&dst, drm_fb_clip_offset(fb->pitches[0], fb->format, clip));
+
+#if defined(__BIG_ENDIAN)
+ drm_fb_swab(&dst, fb->pitches, src, fb, clip, !src[0].is_iomem, fmtcnv_state);
+#else
drm_fb_memcpy(&dst, fb->pitches, src, fb, clip);
+#endif
}
static void ast_primary_plane_helper_atomic_update(struct drm_plane *plane,
@@ -561,7 +567,8 @@ static void ast_primary_plane_helper_atomic_update(struct drm_plane *plane,
if (drm_gem_fb_begin_cpu_access(fb, DMA_FROM_DEVICE) == 0) {
drm_atomic_helper_damage_iter_init(&iter, old_plane_state, plane_state);
drm_atomic_for_each_plane_damage(&iter, &damage) {
- ast_handle_damage(ast_plane, shadow_plane_state->data, fb, &damage);
+ ast_handle_damage(ast_plane, shadow_plane_state->data, fb, &damage,
+ &shadow_plane_state->fmtcnv_state);
}
drm_gem_fb_end_cpu_access(fb, DMA_FROM_DEVICE);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 150/844] ALSA: hda/realtek - Enable Mute LED for Lenovo platform
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (148 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 149/844] drm/ast: Swap framebuffer writes on big-endian machines Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 151/844] drm/v3d: Set DMA segment size to avoid debug warnings Sasha Levin
` (702 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kailang Yang, Takashi Iwai, Sasha Levin
From: Kailang Yang <kailang@realtek.com>
[ Upstream commit 5de5db35350d9c4def1de2ae273e224a4eee5ed1 ]
Enable SPK Mute Led and Mic Mute Led for Lenovo platform.
Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://patch.msgid.link/8a99edffee044e13b6e348d1b69c2b57@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 57 +++++++++++++++++++++++++++++++
1 file changed, 57 insertions(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 15203c5855eb5..1964494321006 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -1616,6 +1616,20 @@ static void alc295_fixup_hp_mute_led_coefbit11(struct hda_codec *codec,
}
}
+static void alc233_fixup_lenovo_coef_micmute_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ spec->mic_led_coef.idx = 0x10;
+ spec->mic_led_coef.mask = 1 << 13;
+ spec->mic_led_coef.on = 0;
+ spec->mic_led_coef.off = 1 << 13;
+ snd_hda_gen_add_micmute_led_cdev(codec, coef_micmute_led_set);
+ }
+}
+
static void alc285_fixup_hp_mute_led(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
@@ -1918,6 +1932,39 @@ static void alc280_fixup_hp_gpio2_mic_hotkey(struct hda_codec *codec,
}
}
+/* GPIO2 = mic mute hotkey
+ * GPIO3 = mic mute LED
+ */
+static void alc233_fixup_lenovo_gpio2_mic_hotkey(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ struct alc_spec *spec = codec->spec;
+
+ alc233_fixup_lenovo_coef_micmute_led(codec, fix, action);
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ alc_update_coef_idx(codec, 0x10, 1<<2, 1<<2);
+ if (alc_register_micmute_input_device(codec) != 0)
+ return;
+
+ spec->gpio_mask |= 0x04;
+ spec->gpio_dir |= 0x0;
+ snd_hda_codec_write_cache(codec, codec->core.afg, 0,
+ AC_VERB_SET_GPIO_UNSOLICITED_RSP_MASK, 0x04);
+ snd_hda_jack_detect_enable_callback(codec, codec->core.afg,
+ gpio2_mic_hotkey_event);
+ return;
+ }
+
+ if (!spec->kb_dev)
+ return;
+
+ switch (action) {
+ case HDA_FIXUP_ACT_FREE:
+ input_unregister_device(spec->kb_dev);
+ spec->kb_dev = NULL;
+ }
+}
+
/* Line2 = mic mute hotkey
* GPIO2 = mic mute LED
*/
@@ -3816,6 +3863,7 @@ enum {
ALC245_FIXUP_HP_TAS2781_I2C_MUTE_LED,
ALC288_FIXUP_SURFACE_SWAP_DACS,
ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO,
+ ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY,
};
/* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -6306,6 +6354,10 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc288_fixup_surface_swap_dacs,
},
+ [ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc233_fixup_lenovo_gpio2_mic_hotkey,
+ },
};
static const struct hda_quirk alc269_fixup_tbl[] = {
@@ -7213,7 +7265,12 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x17aa, 0x31af, "ThinkCentre Station", ALC623_FIXUP_LENOVO_THINKSTATION_P340),
+ SND_PCI_QUIRK(0x17aa, 0x3341, "Lenovo ThinkCentre M90 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3342, "Lenovo ThinkCentre M90 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3343, "Lenovo ThinkCentre M70 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3344, "Lenovo ThinkCentre M70 Gen4", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
SND_PCI_QUIRK(0x17aa, 0x334b, "Lenovo ThinkCentre M70 Gen5", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x334f, "Lenovo ThinkCentre M90a Gen5", ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY),
SND_PCI_QUIRK(0x17aa, 0x3384, "ThinkCentre M90a PRO", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
SND_PCI_QUIRK(0x17aa, 0x3386, "ThinkCentre M90a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
SND_PCI_QUIRK(0x17aa, 0x3387, "ThinkCentre M70a Gen6", ALC233_FIXUP_LENOVO_L2MH_LOW_ENLED),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 151/844] drm/v3d: Set DMA segment size to avoid debug warnings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (149 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 150/844] ALSA: hda/realtek - Enable Mute LED for Lenovo platform Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 152/844] media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes Sasha Levin
` (701 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Xiaolei Wang, Maíra Canal, Sasha Levin
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit 9eb018828b1b30dfba689c060735c50fc5b9f704 ]
When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
kernel occasionally reports a segment size mismatch. This is because
'max_seg_size' is not set. The kernel defaults to 64K. setting
'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
from complaining about the over-mapping of the V3D segment length.
DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
claims to support [len=8290304] [max=65536]
WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_dma_map_sg+0x330/0x388
lr : debug_dma_map_sg+0x330/0x388
sp : ffff8000829a3ac0
x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
Call trace:
debug_dma_map_sg+0x330/0x388
__dma_map_sg_attrs+0xc0/0x278
dma_map_sgtable+0x30/0x58
drm_gem_shmem_get_pages_sgt+0xb4/0x140
v3d_bo_create_finish+0x28/0x130 [v3d]
v3d_create_bo_ioctl+0x54/0x180 [v3d]
drm_ioctl_kernel+0xc8/0x140
drm_ioctl+0x2d4/0x4d8
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Link: https://patch.msgid.link/20251203130323.2247072-1-xiaolei.wang@windriver.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/v3d/v3d_drv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/v3d/v3d_drv.c b/drivers/gpu/drm/v3d/v3d_drv.c
index e8a46c8bad8a2..f469de456f9bb 100644
--- a/drivers/gpu/drm/v3d/v3d_drv.c
+++ b/drivers/gpu/drm/v3d/v3d_drv.c
@@ -378,6 +378,8 @@ static int v3d_platform_drm_probe(struct platform_device *pdev)
if (ret)
goto clk_disable;
+ dma_set_max_seg_size(&pdev->dev, UINT_MAX);
+
v3d->va_width = 30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_VA_WIDTH);
ident1 = V3D_READ(V3D_HUB_IDENT1);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 152/844] media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (150 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 151/844] drm/v3d: Set DMA segment size to avoid debug warnings Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 153/844] media: omap3isp: isppreview: always clamp in preview_try_format() Sasha Levin
` (700 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hans Verkuil, Sakari Ailus, Sasha Levin
From: Hans Verkuil <hverkuil+cisco@kernel.org>
[ Upstream commit 44c03802a5191626996ee9db4bac090b164ca340 ]
The isp_video_mbus_to_pix/pix_to_mbus functions did not take
the last empty entry { 0, } of the formats array into account.
As a result, isp_video_mbus_to_pix would accept code 0 and
isp_video_pix_to_mbus would select code 0 if no match was found.
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti/omap3isp/ispvideo.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
index 0e7f0bf2b3463..68e6a24be5614 100644
--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
+++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
@@ -148,12 +148,12 @@ static unsigned int isp_video_mbus_to_pix(const struct isp_video *video,
pix->width = mbus->width;
pix->height = mbus->height;
- for (i = 0; i < ARRAY_SIZE(formats); ++i) {
+ for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
if (formats[i].code == mbus->code)
break;
}
- if (WARN_ON(i == ARRAY_SIZE(formats)))
+ if (WARN_ON(i == ARRAY_SIZE(formats) - 1))
return 0;
min_bpl = pix->width * formats[i].bpp;
@@ -191,7 +191,7 @@ static void isp_video_pix_to_mbus(const struct v4l2_pix_format *pix,
/* Skip the last format in the loop so that it will be selected if no
* match is found.
*/
- for (i = 0; i < ARRAY_SIZE(formats) - 1; ++i) {
+ for (i = 0; i < ARRAY_SIZE(formats) - 2; ++i) {
if (formats[i].pixelformat == pix->pixelformat)
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 153/844] media: omap3isp: isppreview: always clamp in preview_try_format()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (151 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 152/844] media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 154/844] media: omap3isp: set initial format Sasha Levin
` (699 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hans Verkuil, Sakari Ailus, Sasha Levin
From: Hans Verkuil <hverkuil+cisco@kernel.org>
[ Upstream commit 17e1e1641f74a89824d4de3aa38c78daa5686cc1 ]
If prev->input != PREVIEW_INPUT_MEMORY the width and height weren't
clamped. Just always clamp.
This fixes a v4l2-compliance error:
fail: v4l2-test-subdevs.cpp(171): fse.max_width == ~0U || fse.max_height == ~0U
fail: v4l2-test-subdevs.cpp(270): ret && ret != ENOTTY
test Try VIDIOC_SUBDEV_ENUM_MBUS_CODE/FRAME_SIZE/FRAME_INTERVAL: FAIL
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/ti/omap3isp/isppreview.c | 21 +++++++------------
1 file changed, 8 insertions(+), 13 deletions(-)
diff --git a/drivers/media/platform/ti/omap3isp/isppreview.c b/drivers/media/platform/ti/omap3isp/isppreview.c
index e383a57654de8..5c492b31b5160 100644
--- a/drivers/media/platform/ti/omap3isp/isppreview.c
+++ b/drivers/media/platform/ti/omap3isp/isppreview.c
@@ -1742,22 +1742,17 @@ static void preview_try_format(struct isp_prev_device *prev,
switch (pad) {
case PREV_PAD_SINK:
- /* When reading data from the CCDC, the input size has already
- * been mangled by the CCDC output pad so it can be accepted
- * as-is.
- *
- * When reading data from memory, clamp the requested width and
- * height. The TRM doesn't specify a minimum input height, make
+ /*
+ * Clamp the requested width and height.
+ * The TRM doesn't specify a minimum input height, make
* sure we got enough lines to enable the noise filter and color
* filter array interpolation.
*/
- if (prev->input == PREVIEW_INPUT_MEMORY) {
- fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
- preview_max_out_width(prev));
- fmt->height = clamp_t(u32, fmt->height,
- PREV_MIN_IN_HEIGHT,
- PREV_MAX_IN_HEIGHT);
- }
+ fmt->width = clamp_t(u32, fmt->width, PREV_MIN_IN_WIDTH,
+ preview_max_out_width(prev));
+ fmt->height = clamp_t(u32, fmt->height,
+ PREV_MIN_IN_HEIGHT,
+ PREV_MAX_IN_HEIGHT);
fmt->colorspace = V4L2_COLORSPACE_SRGB;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 154/844] media: omap3isp: set initial format
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (152 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 153/844] media: omap3isp: isppreview: always clamp in preview_try_format() Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 155/844] media: chips-media: wave5: Fix conditional in start_streaming Sasha Levin
` (698 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hans Verkuil, Sakari Ailus, Sasha Levin
From: Hans Verkuil <hverkuil+cisco@kernel.org>
[ Upstream commit 7575b8dfa91f82fcb34ffd5568ff415ac4685794 ]
Initialize the v4l2_format to a default. Empty formats are
not allowed in V4L2, so this fixes v4l2-compliance issues:
fail: v4l2-test-formats.cpp(514): !pix.width || !pix.height
test VIDIOC_G_FMT: FAIL
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/ti/omap3isp/ispvideo.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/media/platform/ti/omap3isp/ispvideo.c b/drivers/media/platform/ti/omap3isp/ispvideo.c
index 68e6a24be5614..eb33a776f27c9 100644
--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
+++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
@@ -1288,6 +1288,7 @@ static const struct v4l2_ioctl_ops isp_video_ioctl_ops = {
static int isp_video_open(struct file *file)
{
struct isp_video *video = video_drvdata(file);
+ struct v4l2_mbus_framefmt fmt;
struct isp_video_fh *handle;
struct vb2_queue *queue;
int ret = 0;
@@ -1330,6 +1331,13 @@ static int isp_video_open(struct file *file)
memset(&handle->format, 0, sizeof(handle->format));
handle->format.type = video->type;
+ handle->format.fmt.pix.width = 720;
+ handle->format.fmt.pix.height = 480;
+ handle->format.fmt.pix.pixelformat = V4L2_PIX_FMT_UYVY;
+ handle->format.fmt.pix.field = V4L2_FIELD_NONE;
+ handle->format.fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
+ isp_video_pix_to_mbus(&handle->format.fmt.pix, &fmt);
+ isp_video_mbus_to_pix(video, &fmt, &handle->format.fmt.pix);
handle->timeperframe.denominator = 1;
handle->video = video;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 155/844] media: chips-media: wave5: Fix conditional in start_streaming
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (153 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 154/844] media: omap3isp: set initial format Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 156/844] media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder Sasha Levin
` (697 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Brandon Brnich, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Brandon Brnich <b-brnich@ti.com>
[ Upstream commit b4e26c6fc1b3c225caf80d4a95c6f9fcbe959e17 ]
When STREAMON(CAP) is called after STREAMON(OUT), the driver was failing to
switch states from VPU_INST_STATE_OPEN to VPU_INST_STATE_INIT_SEQ and
VPU_INST_STATE_PIC_RUN because the capture queue streaming boolean had not
yet been set to true. This led to a hang in the encoder since the state
was stuck in VPU_INST_STATE_OPEN. During the second call to
start_streaming, the sequence initialization and frame buffer allocation
should occur.
Signed-off-by: Brandon Brnich <b-brnich@ti.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
index 94fb5d7c87021..a11f0f7c7d7b0 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
@@ -1367,7 +1367,8 @@ static int wave5_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count
if (ret)
goto return_buffers;
}
- if (inst->state == VPU_INST_STATE_OPEN && m2m_ctx->cap_q_ctx.q.streaming) {
+ if (inst->state == VPU_INST_STATE_OPEN &&
+ (m2m_ctx->cap_q_ctx.q.streaming || q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)) {
ret = initialize_sequence(inst);
if (ret) {
dev_warn(inst->dev->dev, "Sequence not found: %d\n", ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 156/844] media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (154 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 155/844] media: chips-media: wave5: Fix conditional in start_streaming Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 157/844] drm/panel: edp: add BOE NV140WUM-T08 panel Sasha Levin
` (696 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Brandon Brnich, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Brandon Brnich <b-brnich@ti.com>
[ Upstream commit 5da0380de41439ed64ed9a5218850db38544e315 ]
CMD_STOP being sent to encoder before last job is executed by device_run
can lead to an occasional dropped frame. Ensure that remaining ready
buffers are drained by making a call to v4l2_m2m_try_schedule.
Signed-off-by: Brandon Brnich <b-brnich@ti.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
index a11f0f7c7d7b0..a254830e4009e 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
@@ -649,6 +649,8 @@ static int wave5_vpu_enc_encoder_cmd(struct file *file, void *fh, struct v4l2_en
m2m_ctx->last_src_buf = v4l2_m2m_last_src_buf(m2m_ctx);
m2m_ctx->is_draining = true;
+
+ v4l2_m2m_try_schedule(m2m_ctx);
break;
case V4L2_ENC_CMD_START:
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 157/844] drm/panel: edp: add BOE NV140WUM-T08 panel
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (155 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 156/844] media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 158/844] media: mediatek: vcodec: Don't try to decode 422/444 VP9 Sasha Levin
` (695 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hans de Goede, Douglas Anderson, Sasha Levin
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 349d4efadc1f831ebc0b872ba1e3a2b7dd58b72b ]
Add powerseq timing info for the BOE NV140WUM-T08 panel used on Lenovo
Thinkpad T14s gen 6 (Snapdragon X1 Elite) laptops.
edid-decode (hex):
00 ff ff ff ff ff ff 00 09 e5 26 0c 00 00 00 00
0a 21 01 04 a5 1e 13 78 03 d6 62 99 5e 5a 8e 27
25 53 58 00 00 00 01 01 01 01 01 01 01 01 01 01
01 01 01 01 01 01 33 3f 80 dc 70 b0 3c 40 30 20
36 00 2e bc 10 00 00 1a 00 00 00 fd 00 28 3c 4c
4c 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42
4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe
00 4e 56 31 34 30 57 55 4d 2d 54 30 38 0a 00 fa
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260105155134.83266-1-johannes.goede@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-edp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
index 85dd3f4cb8e1c..679f4af5246d8 100644
--- a/drivers/gpu/drm/panel/panel-edp.c
+++ b/drivers/gpu/drm/panel/panel-edp.c
@@ -1730,6 +1730,12 @@ static const struct panel_delay delay_200_500_p2e100 = {
.prepare_to_enable = 100,
};
+static const struct panel_delay delay_200_500_p2e200 = {
+ .hpd_absent = 200,
+ .unprepare = 500,
+ .prepare_to_enable = 200,
+};
+
static const struct panel_delay delay_200_500_e50 = {
.hpd_absent = 200,
.unprepare = 500,
@@ -1977,6 +1983,7 @@ static const struct edp_panel_entry edp_panels[] = {
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c20, &delay_200_500_e80, "NT140FHM-N47"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c26, &delay_200_500_p2e200, "NV140WUM-T08"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0c93, &delay_200_500_e200, "Unknown"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cb6, &delay_200_500_e200, "NT116WHM-N44"),
EDP_PANEL_ENTRY('B', 'O', 'E', 0x0cf2, &delay_200_500_e200, "NV156FHM-N4S"),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 158/844] media: mediatek: vcodec: Don't try to decode 422/444 VP9
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (156 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 157/844] drm/panel: edp: add BOE NV140WUM-T08 panel Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 159/844] drm/amdgpu: add support for HDP IP version 6.1.1 Sasha Levin
` (694 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicolas Dufresne, AngeloGioacchino Del Regno, Hans Verkuil,
Sasha Levin
From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
[ Upstream commit 3e92d7e4935084ecdbdc88880cc4688618ae1557 ]
This is not supported by the hardware and trying to decode
these leads to LAT timeout errors.
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
index d873159b9b306..9eef3ff2b1278 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_stateless.c
@@ -502,6 +502,12 @@ static int mtk_vdec_s_ctrl(struct v4l2_ctrl *ctrl)
mtk_v4l2_vdec_err(ctx, "VP9: bit_depth:%d", frame->bit_depth);
return -EINVAL;
}
+
+ if (!(frame->flags & V4L2_VP9_FRAME_FLAG_X_SUBSAMPLING) ||
+ !(frame->flags & V4L2_VP9_FRAME_FLAG_Y_SUBSAMPLING)) {
+ mtk_v4l2_vdec_err(ctx, "VP9: only 420 subsampling is supported");
+ return -EINVAL;
+ }
break;
case V4L2_CID_STATELESS_AV1_SEQUENCE:
seq = (struct v4l2_ctrl_av1_sequence *)hdr_ctrl->p_new.p;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 159/844] drm/amdgpu: add support for HDP IP version 6.1.1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (157 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 158/844] media: mediatek: vcodec: Don't try to decode 422/444 VP9 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 160/844] drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path Sasha Levin
` (693 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tim Huang, Mario Limonciello, Alex Deucher, Sasha Levin
From: Tim Huang <tim.huang@amd.com>
[ Upstream commit e2fd14f579b841f54a9b7162fef15234d8c0627a ]
This initializes HDP IP version 6.1.1.
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Tim Huang <tim.huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index fa2a22dfa0487..f9e0e80c4c186 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -3059,6 +3059,7 @@ int amdgpu_discovery_set_ip_blocks(struct amdgpu_device *adev)
case IP_VERSION(6, 0, 0):
case IP_VERSION(6, 0, 1):
case IP_VERSION(6, 1, 0):
+ case IP_VERSION(6, 1, 1):
adev->hdp.funcs = &hdp_v6_0_funcs;
break;
case IP_VERSION(7, 0, 0):
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 160/844] drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (158 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 159/844] drm/amdgpu: add support for HDP IP version 6.1.1 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 161/844] drm/amd/display: Fix dsc eDP issue Sasha Levin
` (692 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicholas Kazlauskas, Swapnil Patel, Chenyu Chen, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
[ Upstream commit af3303970da5ce5bfe6dffdd07f38f42aad603e0 ]
[Why]
The evaluation for whether we need to use the DMUB HW lock isn't the
same as whether we need to unlock which results in a hang when the
fast path is used for ASIC without FAMS support.
[How]
Store a flag that indicates whether we should use the lock and use
that same flag to specify whether unlocking is needed.
Reviewed-by: Swapnil Patel <swapnil.patel@amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
index e2763b60482a0..052d573408c3e 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
@@ -741,6 +741,7 @@ void hwss_build_fast_sequence(struct dc *dc,
struct dce_hwseq *hws = dc->hwseq;
struct pipe_ctx *current_pipe = NULL;
struct pipe_ctx *current_mpc_pipe = NULL;
+ bool is_dmub_lock_required = false;
unsigned int i = 0;
*num_steps = 0; // Initialize to 0
@@ -763,11 +764,12 @@ void hwss_build_fast_sequence(struct dc *dc,
(*num_steps)++;
}
if (dc->hwss.dmub_hw_control_lock_fast) {
+ is_dmub_lock_required = dc_state_is_fams2_in_use(dc, context) ||
+ dmub_hw_lock_mgr_does_link_require_lock(dc, stream->link);
+
block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.dc = dc;
block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.lock = true;
- block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required =
- dc_state_is_fams2_in_use(dc, context) ||
- dmub_hw_lock_mgr_does_link_require_lock(dc, stream->link);
+ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = is_dmub_lock_required;
block_sequence[*num_steps].func = DMUB_HW_CONTROL_LOCK_FAST;
(*num_steps)++;
}
@@ -906,7 +908,7 @@ void hwss_build_fast_sequence(struct dc *dc,
if (dc->hwss.dmub_hw_control_lock_fast) {
block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.dc = dc;
block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.lock = false;
- block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = dc_state_is_fams2_in_use(dc, context);
+ block_sequence[*num_steps].params.dmub_hw_control_lock_fast_params.is_required = is_dmub_lock_required;
block_sequence[*num_steps].func = DMUB_HW_CONTROL_LOCK_FAST;
(*num_steps)++;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 161/844] drm/amd/display: Fix dsc eDP issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (159 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 160/844] drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 162/844] drm/amdgpu: avoid a warning in timedout job handler Sasha Levin
` (691 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Charlene Liu, Mohit Bawa, Chenyu Chen, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Charlene Liu <Charlene.Liu@amd.com>
[ Upstream commit 878a4b73c11111ff5f820730f59a7f8c6fd59374 ]
[why]
Need to add function hook check before use
Reviewed-by: Mohit Bawa <mohit.bawa@amd.com>
Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
index 5896ce5511ab1..9f7087ac41f21 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -1797,6 +1797,9 @@ static void disable_vga_and_power_gate_all_controllers(
struct timing_generator *tg;
struct dc_context *ctx = dc->ctx;
+ if (dc->caps.ips_support)
+ return;
+
for (i = 0; i < dc->res_pool->timing_generator_count; i++) {
tg = dc->res_pool->timing_generators[i];
@@ -1873,13 +1876,16 @@ static void clean_up_dsc_blocks(struct dc *dc)
/* disable DSC in OPTC */
if (i < dc->res_pool->timing_generator_count) {
tg = dc->res_pool->timing_generators[i];
- tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
+ if (tg->funcs->set_dsc_config)
+ tg->funcs->set_dsc_config(tg, OPTC_DSC_DISABLED, 0, 0);
}
/* disable DSC in stream encoder */
if (i < dc->res_pool->stream_enc_count) {
se = dc->res_pool->stream_enc[i];
- se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
- se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
+ if (se->funcs->dp_set_dsc_config)
+ se->funcs->dp_set_dsc_config(se, OPTC_DSC_DISABLED, 0, 0);
+ if (se->funcs->dp_set_dsc_pps_info_packet)
+ se->funcs->dp_set_dsc_pps_info_packet(se, false, NULL, true);
}
/* disable DSC block */
if (dccg->funcs->set_ref_dscclk)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 162/844] drm/amdgpu: avoid a warning in timedout job handler
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (160 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 161/844] drm/amd/display: Fix dsc eDP issue Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 163/844] drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src Sasha Levin
` (690 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Alex Deucher, Timur Kristóf, Sasha Levin
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit c8cf9ddc549fb93cb5a35f3fe23487b1e6707e74 ]
Only set an error on the fence if the fence is not
signalled. We can end up with a warning if the
per queue reset path signals the fence and sets an error
as part of the reset, but fails to recover.
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
index 7ccb724b2488d..aaf5477fcd7ac 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
@@ -147,7 +147,8 @@ static enum drm_gpu_sched_stat amdgpu_job_timedout(struct drm_sched_job *s_job)
dev_err(adev->dev, "Ring %s reset failed\n", ring->sched.name);
}
- dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
+ if (dma_fence_get_status(&s_job->s_fence->finished) == 0)
+ dma_fence_set_error(&s_job->s_fence->finished, -ETIME);
if (amdgpu_device_should_recover_gpu(ring->adev)) {
struct amdgpu_reset_context reset_context;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 163/844] drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (161 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 162/844] drm/amdgpu: avoid a warning in timedout job handler Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 164/844] drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 Sasha Levin
` (689 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dmytro Laktyushkin, Charlene Liu, Chenyu Chen, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
[ Upstream commit c979d8db7b0f293111f2e83795ea353c8ed75de9 ]
Trying to access link enc on a dpia link will cause a crash otherwise
Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index e1f5b1a34cde8..f04cbdb3d3814 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -916,10 +916,10 @@ static void dcn401_enable_stream_calc(
pipe_ctx->stream->link->cur_link_settings.lane_count;
uint32_t active_total_with_borders;
- if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx))
+ if (dc->link_srv->dp_is_128b_132b_signal(pipe_ctx)) {
*dp_hpo_inst = pipe_ctx->stream_res.hpo_dp_stream_enc->inst;
-
- *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
+ *phyd32clk = get_phyd32clk_src(pipe_ctx->stream->link);
+ }
if (dc_is_tmds_signal(pipe_ctx->stream->signal))
dcn401_calculate_dccg_tmds_div_value(pipe_ctx, tmds_div);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 164/844] drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (162 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 163/844] drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-03-02 8:24 ` Jiri Slaby
2026-02-28 17:21 ` [PATCH 6.19 165/844] HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards Sasha Levin
` (688 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Srinivasan Shanmugam, Alex Deucher, Christian König,
Sasha Levin
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ]
This commit simplifies the amdgpu_gem_va_ioctl function, key updates
include:
- Moved the logic for managing the last update fence directly into
amdgpu_gem_va_update_vm.
- Introduced checks for the timeline point to enable conditional
replacement or addition of fences.
v2: Addressed review comments from Christian.
v3: Updated comments (Christian).
v4: The previous version selected the fence too early and did not manage its
reference correctly, which could lead to stale or freed fences being used.
This resulted in refcount underflows and could crash when updating GPU
timelines.
The fence is now chosen only after the VA mapping work is completed, and its
reference is taken safely. After exporting it to the VM timeline syncobj, the
driver always drops its local fence reference, ensuring balanced refcounting
and avoiding use-after-free on dma_fence.
Crash signature:
[ 205.828135] refcount_t: underflow; use-after-free.
[ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
...
[ 206.074014] Call Trace:
[ 206.076488] <TASK>
[ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu]
[ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
[ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm]
[ 206.094415] drm_ioctl+0x26e/0x520 [drm]
[ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu]
[ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu]
[ 206.109387] __x64_sys_ioctl+0x96/0xe0
[ 206.113156] do_syscall_64+0x66/0x2d0
...
[ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90
...
[ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
...
[ 206.553405] Call Trace:
[ 206.553409] <IRQ>
[ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched]
[ 206.553424] dma_fence_signal+0x30/0x60
[ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched]
[ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0
[ 206.553437] dma_fence_signal+0x30/0x60
[ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu]
[ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu]
[ 206.554353] edac_mce_amd(E) ee1004(E)
[ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu]
[ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu]
[ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu]
[ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0
[ 206.555506] handle_irq_event+0x38/0x80
[ 206.555509] handle_edge_irq+0x92/0x1e0
[ 206.555513] __common_interrupt+0x3e/0xb0
[ 206.555519] common_interrupt+0x80/0xa0
[ 206.555525] </IRQ>
[ 206.555527] <TASK>
...
[ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0
...
[ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt
Link: https://patchwork.freedesktop.org/patch/654669/
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Suggested-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 135 ++++++++++++++----------
1 file changed, 82 insertions(+), 53 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 5a93cbadc4f44..f30e32fbff99a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -112,47 +112,6 @@ amdgpu_gem_update_timeline_node(struct drm_file *filp,
return 0;
}
-static void
-amdgpu_gem_update_bo_mapping(struct drm_file *filp,
- struct amdgpu_bo_va *bo_va,
- uint32_t operation,
- uint64_t point,
- struct dma_fence *fence,
- struct drm_syncobj *syncobj,
- struct dma_fence_chain *chain)
-{
- struct amdgpu_bo *bo = bo_va ? bo_va->base.bo : NULL;
- struct amdgpu_fpriv *fpriv = filp->driver_priv;
- struct amdgpu_vm *vm = &fpriv->vm;
- struct dma_fence *last_update;
-
- if (!syncobj)
- return;
-
- /* Find the last update fence */
- switch (operation) {
- case AMDGPU_VA_OP_MAP:
- case AMDGPU_VA_OP_REPLACE:
- if (bo && (bo->tbo.base.resv == vm->root.bo->tbo.base.resv))
- last_update = vm->last_update;
- else
- last_update = bo_va->last_pt_update;
- break;
- case AMDGPU_VA_OP_UNMAP:
- case AMDGPU_VA_OP_CLEAR:
- last_update = fence;
- break;
- default:
- return;
- }
-
- /* Add fence to timeline */
- if (!point)
- drm_syncobj_replace_fence(syncobj, last_update);
- else
- drm_syncobj_add_point(syncobj, chain, last_update, point);
-}
-
static vm_fault_t amdgpu_gem_fault(struct vm_fault *vmf)
{
struct ttm_buffer_object *bo = vmf->vma->vm_private_data;
@@ -761,16 +720,19 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
struct amdgpu_bo_va *bo_va,
uint32_t operation)
{
- struct dma_fence *fence = dma_fence_get_stub();
+ struct dma_fence *clear_fence = dma_fence_get_stub();
+ struct dma_fence *last_update = NULL;
int r;
if (!amdgpu_vm_ready(vm))
- return fence;
+ return clear_fence;
- r = amdgpu_vm_clear_freed(adev, vm, &fence);
+ /* First clear freed BOs and get a fence for that work, if any. */
+ r = amdgpu_vm_clear_freed(adev, vm, &clear_fence);
if (r)
goto error;
+ /* For MAP/REPLACE we also need to update the BO mappings. */
if (operation == AMDGPU_VA_OP_MAP ||
operation == AMDGPU_VA_OP_REPLACE) {
r = amdgpu_vm_bo_update(adev, bo_va, false);
@@ -778,13 +740,59 @@ amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
goto error;
}
+ /* Always update PDEs after we touched the mappings. */
r = amdgpu_vm_update_pdes(adev, vm, false);
+ if (r)
+ goto error;
+
+ /*
+ * Decide which fence represents the "last update" for this VM/BO:
+ *
+ * - For MAP/REPLACE we want the PT update fence, which is tracked as
+ * either vm->last_update (for always-valid BOs) or bo_va->last_pt_update
+ * (for per-BO updates).
+ *
+ * - For UNMAP/CLEAR we rely on the fence returned by
+ * amdgpu_vm_clear_freed(), which already covers the page table work
+ * for the removed mappings.
+ */
+ switch (operation) {
+ case AMDGPU_VA_OP_MAP:
+ case AMDGPU_VA_OP_REPLACE:
+ if (bo_va && bo_va->base.bo) {
+ if (amdgpu_vm_is_bo_always_valid(vm, bo_va->base.bo)) {
+ if (vm->last_update)
+ last_update = dma_fence_get(vm->last_update);
+ } else {
+ if (bo_va->last_pt_update)
+ last_update = dma_fence_get(bo_va->last_pt_update);
+ }
+ }
+ break;
+ case AMDGPU_VA_OP_UNMAP:
+ case AMDGPU_VA_OP_CLEAR:
+ if (clear_fence)
+ last_update = dma_fence_get(clear_fence);
+ break;
+ default:
+ break;
+ }
error:
if (r && r != -ERESTARTSYS)
DRM_ERROR("Couldn't update BO_VA (%d)\n", r);
- return fence;
+ /*
+ * If we managed to pick a more specific last-update fence, prefer it
+ * over the generic clear_fence and drop the extra reference to the
+ * latter.
+ */
+ if (last_update) {
+ dma_fence_put(clear_fence);
+ return last_update;
+ }
+
+ return clear_fence;
}
int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
@@ -810,6 +818,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
uint64_t vm_size;
int r = 0;
+ /* Validate virtual address range against reserved regions. */
if (args->va_address < AMDGPU_VA_RESERVED_BOTTOM) {
dev_dbg(dev->dev,
"va_address 0x%llx is in reserved area 0x%llx\n",
@@ -843,6 +852,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
return -EINVAL;
}
+ /* Validate operation type. */
switch (args->operation) {
case AMDGPU_VA_OP_MAP:
case AMDGPU_VA_OP_UNMAP:
@@ -866,6 +876,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
abo = NULL;
}
+ /* Add input syncobj fences (if any) for synchronization. */
r = amdgpu_gem_add_input_fence(filp,
args->input_fence_syncobj_handles,
args->num_syncobj_handles);
@@ -888,6 +899,7 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
goto error;
}
+ /* Resolve the BO-VA mapping for this VM/BO combination. */
if (abo) {
bo_va = amdgpu_vm_bo_find(&fpriv->vm, abo);
if (!bo_va) {
@@ -900,6 +912,11 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
bo_va = NULL;
}
+ /*
+ * Prepare the timeline syncobj node if the user requested a VM
+ * timeline update. This only allocates/looks up the syncobj and
+ * chain node; the actual fence is attached later.
+ */
r = amdgpu_gem_update_timeline_node(filp,
args->vm_timeline_syncobj_out,
args->vm_timeline_point,
@@ -931,18 +948,30 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
default:
break;
}
+
+ /*
+ * Once the VA operation is done, update the VM and obtain the fence
+ * that represents the last relevant update for this mapping. This
+ * fence can then be exported to the user-visible VM timeline.
+ */
if (!r && !(args->flags & AMDGPU_VM_DELAY_UPDATE) && !adev->debug_vm) {
fence = amdgpu_gem_va_update_vm(adev, &fpriv->vm, bo_va,
args->operation);
- if (timeline_syncobj)
- amdgpu_gem_update_bo_mapping(filp, bo_va,
- args->operation,
- args->vm_timeline_point,
- fence, timeline_syncobj,
- timeline_chain);
- else
- dma_fence_put(fence);
+ if (timeline_syncobj && fence) {
+ if (!args->vm_timeline_point) {
+ /* Replace the existing fence when no point is given. */
+ drm_syncobj_replace_fence(timeline_syncobj,
+ fence);
+ } else {
+ /* Attach the last-update fence at a specific point. */
+ drm_syncobj_add_point(timeline_syncobj,
+ timeline_chain,
+ fence,
+ args->vm_timeline_point);
+ }
+ }
+ dma_fence_put(fence);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 164/844] drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
2026-02-28 17:21 ` [PATCH 6.19 164/844] drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 Sasha Levin
@ 2026-03-02 8:24 ` Jiri Slaby
2026-03-02 13:58 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Jiri Slaby @ 2026-03-02 8:24 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Srinivasan Shanmugam, Alex Deucher, Christian König
On 28. 02. 26, 18:21, Sasha Levin wrote:
> From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
>
> [ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ]
A new fix appeared:
efdc66fe12b0 drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last
Fence Update and Timeline Management v7
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 164/844] drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
2026-03-02 8:24 ` Jiri Slaby
@ 2026-03-02 13:58 ` Sasha Levin
0 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-03-02 13:58 UTC (permalink / raw)
To: Jiri Slaby
Cc: linux-kernel, stable, Srinivasan Shanmugam, Alex Deucher,
Christian König
On Mon, Mar 02, 2026 at 09:24:00AM +0100, Jiri Slaby wrote:
>On 28. 02. 26, 18:21, Sasha Levin wrote:
>>From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
>>
>>[ Upstream commit bd8150a1b3370a9f7761c5814202a3fe5a79f44f ]
>
>A new fix appeared:
>efdc66fe12b0 drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling
>Last Fence Update and Timeline Management v7
Queued up, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* [PATCH 6.19 165/844] HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (163 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 164/844] drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 166/844] HID: pidff: Do not set out of range trigger button Sasha Levin
` (687 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Joey Bednar, Jiri Kosina, Sasha Levin
From: Joey Bednar <linux@joeybednar.com>
[ Upstream commit 7273acfd0aef106093a8ffa3b4973eb70e5a3799 ]
The SoNiX KN85 keyboard identifies as the "Apple, Inc. Aluminium
Keyboard" and is not recognized as a non-apple keyboard. Adding "SoNiX
KN85 Keyboard" to the list of non-apple keyboards fixes the function
keys.
Signed-off-by: Joey Bednar <linux@joeybednar.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-apple.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 57da4f86a9fa7..233e367cce1d1 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
};
static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
+ { "SONiX KN85 Keyboard" },
{ "SONiX USB DEVICE" },
{ "SONiX AK870 PRO" },
{ "Keychron" },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 166/844] HID: pidff: Do not set out of range trigger button
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (164 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 165/844] HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 167/844] HID: multitouch: add quirks for Lenovo Yoga Book 9i Sasha Levin
` (686 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tomasz Pakuła, Jiri Kosina, Sasha Levin
From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
[ Upstream commit e01a029654f7fb67d7151365410aa22be4e63dbe ]
Some games (mainly observed with Kylotonn's WRC Serises) set trigger
button to a random value, or always the same one, out of range.
I observed 307 and other values but, for example, my Moza R9 only
exposes 128 buttons AND it's trigger button field is 8-bit. This causes
errors to appear in dmesg.
Only set the trigger button and trigger interval in the trigger button
is in range of the field.
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/usbhid/hid-pidff.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index 95377c5f63356..a4e700b40ba9b 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -523,9 +523,19 @@ static void pidff_set_effect_report(struct pidff_device *pidff,
pidff_set_duration(&pidff->set_effect[PID_DURATION],
effect->replay.length);
- pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = effect->trigger.button;
- pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT],
- effect->trigger.interval);
+ /* Some games set this to random values that can be out of range */
+ s32 trigger_button_max =
+ pidff->set_effect[PID_TRIGGER_BUTTON].field->logical_maximum;
+ if (effect->trigger.button <= trigger_button_max) {
+ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] =
+ effect->trigger.button;
+ pidff_set_time(&pidff->set_effect[PID_TRIGGER_REPEAT_INT],
+ effect->trigger.interval);
+ } else {
+ pidff->set_effect[PID_TRIGGER_BUTTON].value[0] = 0;
+ pidff->set_effect[PID_TRIGGER_REPEAT_INT].value[0] = 0;
+ }
+
pidff->set_effect[PID_GAIN].value[0] =
pidff->set_effect[PID_GAIN].field->logical_maximum;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 167/844] HID: multitouch: add quirks for Lenovo Yoga Book 9i
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (165 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 166/844] HID: pidff: Do not set out of range trigger button Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 168/844] drm/amdgpu: Skip loading SDMA_RS64 in VF Sasha Levin
` (685 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Brian Howard, Kris Fredrick, Andrei Shumailov, Jiri Kosina,
Sasha Levin
From: Brian Howard <blhoward2@gmail.com>
[ Upstream commit 822bc5b3744b0b2c2c9678aa1d80b2cf04fdfabf ]
The Lenovo Yoga Book 9i is a dual-screen laptop, with a single composite
USB device providing both touch and tablet interfaces for both screens.
All inputs report through a single device, differentiated solely by report
numbers. As there is no way for udev to differentiate the inputs based on
USB vendor/product ID or interface numbers, custom naming is required to
match against for downstream configuration. A firmware bug also results
in an erroneous InRange message report being received after the stylus
leaves proximity, blocking later touch events. Add required quirks for
Gen 8 to Gen 10 models, including a new quirk providing for custom input
device naming and dropping erroneous InRange reports.
Signed-off-by: Brian Howard <blhoward2@gmail.com>
Tested-by: Brian Howard <blhoward2@gmail.com>
Tested-by: Kris Fredrick <linux.baguette800@slmail.me>
Reported-by: Andrei Shumailov <gentoo1993@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220386
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-multitouch.c | 72 ++++++++++++++++++++++++++++++++++++
2 files changed, 73 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 9c2bf584d9f6f..5a18cb41e6d79 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -841,6 +841,7 @@
#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5
#define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe
#define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae
+#define USB_DEVICE_ID_LENOVO_YOGABOOK9I 0x6161
#define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e
#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d
#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index b1c3ef1290587..f21850f7d89e4 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -76,6 +76,7 @@ MODULE_LICENSE("GPL");
#define MT_QUIRK_DISABLE_WAKEUP BIT(21)
#define MT_QUIRK_ORIENTATION_INVERT BIT(22)
#define MT_QUIRK_APPLE_TOUCHBAR BIT(23)
+#define MT_QUIRK_YOGABOOK9I BIT(24)
#define MT_INPUTMODE_TOUCHSCREEN 0x02
#define MT_INPUTMODE_TOUCHPAD 0x03
@@ -231,6 +232,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
#define MT_CLS_RAZER_BLADE_STEALTH 0x0112
#define MT_CLS_SMART_TECH 0x0113
#define MT_CLS_APPLE_TOUCHBAR 0x0114
+#define MT_CLS_YOGABOOK9I 0x0115
#define MT_CLS_SIS 0x0457
#define MT_DEFAULT_MAXCONTACT 10
@@ -427,6 +429,14 @@ static const struct mt_class mt_classes[] = {
.quirks = MT_QUIRK_NOT_SEEN_MEANS_UP |
MT_QUIRK_ALWAYS_VALID |
MT_QUIRK_CONTACT_CNT_ACCURATE,
+ },
+ { .name = MT_CLS_YOGABOOK9I,
+ .quirks = MT_QUIRK_ALWAYS_VALID |
+ MT_QUIRK_FORCE_MULTI_INPUT |
+ MT_QUIRK_SEPARATE_APP_REPORT |
+ MT_QUIRK_HOVERING |
+ MT_QUIRK_YOGABOOK9I,
+ .export_all_inputs = true
},
{ }
};
@@ -1576,6 +1586,38 @@ static void mt_report(struct hid_device *hid, struct hid_report *report)
if (rdata && rdata->is_mt_collection)
return mt_touch_report(hid, rdata);
+ /* Lenovo Yoga Book 9i requires consuming and dropping certain bogus reports */
+ if (rdata && rdata->application &&
+ (rdata->application->quirks & MT_QUIRK_YOGABOOK9I)) {
+
+ bool all_zero_report = true;
+
+ for (int f = 0; f < report->maxfield && all_zero_report; f++) {
+ struct hid_field *fld = report->field[f];
+
+ for (int i = 0; i < fld->report_count; i++) {
+ unsigned int usage = fld->usage[i].hid;
+
+ if (usage == HID_DG_INRANGE ||
+ usage == HID_DG_TIPSWITCH ||
+ usage == HID_DG_BARRELSWITCH ||
+ usage == HID_DG_BARRELSWITCH2 ||
+ usage == HID_DG_CONTACTID ||
+ usage == HID_DG_TILT_X ||
+ usage == HID_DG_TILT_Y) {
+
+ if (fld->value[i] != 0) {
+ all_zero_report = false;
+ break;
+ }
+ }
+ }
+ }
+
+ if (all_zero_report)
+ return;
+ }
+
if (field && field->hidinput && field->hidinput->input)
input_sync(field->hidinput->input);
}
@@ -1772,6 +1814,30 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
break;
}
+ /* Lenovo Yoga Book 9i requires custom naming to allow differentiation in udev */
+ if (hi->report && td->mtclass.quirks & MT_QUIRK_YOGABOOK9I) {
+ switch (hi->report->id) {
+ case 48:
+ suffix = "Touchscreen Top";
+ break;
+ case 56:
+ suffix = "Touchscreen Bottom";
+ break;
+ case 20:
+ suffix = "Stylus Top";
+ break;
+ case 40:
+ suffix = "Stylus Bottom";
+ break;
+ case 80:
+ suffix = "Emulated Touchpad";
+ break;
+ default:
+ suffix = "";
+ break;
+ }
+ }
+
if (suffix) {
hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
"%s %s", hdev->name, suffix);
@@ -2277,6 +2343,12 @@ static const struct hid_device_id mt_devices[] = {
USB_VENDOR_ID_LENOVO,
USB_DEVICE_ID_LENOVO_X12_TAB2) },
+ /* Lenovo Yoga Book 9i */
+ { .driver_data = MT_CLS_YOGABOOK9I,
+ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_LENOVO,
+ USB_DEVICE_ID_LENOVO_YOGABOOK9I) },
+
/* Logitech devices */
{ .driver_data = MT_CLS_NSMU,
HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 168/844] drm/amdgpu: Skip loading SDMA_RS64 in VF
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (166 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 167/844] HID: multitouch: add quirks for Lenovo Yoga Book 9i Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 169/844] drm/amd/display: only power down dig on phy endpoints Sasha Levin
` (684 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: YuBiao Wang, Victor Skvortsov, Gavin Wan, Alex Deucher,
Sasha Levin
From: YuBiao Wang <YuBiao.Wang@amd.com>
[ Upstream commit 39c21b81112321cbe1267b02c77ecd2161ce19aa ]
VFs use the PF SDMA ucode and are unable to load SDMA_RS64.
Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com>
Signed-off-by: Victor Skvortsov <Victor.Skvortsov@amd.com>
Reviewed-by: Gavin Wan <gavin.wan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
index 47a6ce4fdc744..292e2706286a1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
@@ -1261,6 +1261,7 @@ bool amdgpu_virt_fw_load_skip_check(struct amdgpu_device *adev, uint32_t ucode_i
|| ucode_id == AMDGPU_UCODE_ID_SDMA5
|| ucode_id == AMDGPU_UCODE_ID_SDMA6
|| ucode_id == AMDGPU_UCODE_ID_SDMA7
+ || ucode_id == AMDGPU_UCODE_ID_SDMA_RS64
|| ucode_id == AMDGPU_UCODE_ID_RLC_G
|| ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_CNTL
|| ucode_id == AMDGPU_UCODE_ID_RLC_RESTORE_LIST_GPM_MEM
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 169/844] drm/amd/display: only power down dig on phy endpoints
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (167 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 168/844] drm/amdgpu: Skip loading SDMA_RS64 in VF Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 170/844] drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 Sasha Levin
` (683 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dmytro Laktyushkin, Charlene Liu, Matthew Stewart, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
[ Upstream commit 0839d8d24e6f1fc2587c4a976f44da9fa69ae3d0 ]
This avoids any issues with dpia endpoints
Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index f04cbdb3d3814..1ce61f0570201 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -287,6 +287,8 @@ void dcn401_init_hw(struct dc *dc)
for (i = 0; i < dc->link_count; i++) {
struct dc_link *link = dc->links[i];
+ if (link->ep_type != DISPLAY_ENDPOINT_PHY)
+ continue;
if (link->link_enc->funcs->is_dig_enabled &&
link->link_enc->funcs->is_dig_enabled(link->link_enc) &&
hws->funcs.power_down) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 170/844] drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (168 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 169/844] drm/amd/display: only power down dig on phy endpoints Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 171/844] drm/xe: Only toggle scheduling in TDR if GuC is running Sasha Levin
` (682 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicholas Kazlauskas, Yihan Zhu, Matthew Stewart, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
[ Upstream commit 75372d75a4e23783583998ed99d5009d555850da ]
[Why]
A backport of the change made for DCN401 that addresses an issue where
we turn off the PHY PLL when disabling TMDS output, which causes the
OTG to remain stuck.
The OTG being stuck can lead to a hang in the DCHVM's ability to ACK
invalidations when it thinks the HUBP is still on but it's not receiving
global sync.
The transition to PLL_ON needs to be atomic as there's no guarantee
that the thread isn't pre-empted or is able to complete before the
IOMMU watchdog times out.
[How]
Backport the implementation from dcn401 back to dcn35.
There's a functional difference in when the eDP output is disabled in
dcn401 code so we don't want to utilize it directly.
Reviewed-by: Yihan Zhu <yihan.zhu@amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 52 +++++++++++++++++++
.../amd/display/dc/hwss/dcn35/dcn35_hwseq.h | 3 ++
.../amd/display/dc/hwss/dcn35/dcn35_init.c | 2 +-
3 files changed, 56 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
index cb2dfd34b5e2e..88542ca715573 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
@@ -1726,3 +1726,55 @@ void dcn35_program_cursor_offload_now(struct dc *dc, const struct pipe_ctx *pipe
{
dc_dmub_srv_program_cursor_now(dc, pipe);
}
+
+static void disable_link_output_symclk_on_tx_off(struct dc_link *link, enum dp_link_encoding link_encoding)
+{
+ struct dc *dc = link->ctx->dc;
+ struct pipe_ctx *pipe_ctx = NULL;
+ uint8_t i;
+
+ for (i = 0; i < MAX_PIPES; i++) {
+ pipe_ctx = &dc->current_state->res_ctx.pipe_ctx[i];
+ if (pipe_ctx->stream && pipe_ctx->stream->link == link && pipe_ctx->top_pipe == NULL) {
+ pipe_ctx->clock_source->funcs->program_pix_clk(
+ pipe_ctx->clock_source,
+ &pipe_ctx->stream_res.pix_clk_params,
+ link_encoding,
+ &pipe_ctx->pll_settings);
+ break;
+ }
+ }
+}
+
+void dcn35_disable_link_output(struct dc_link *link,
+ const struct link_resource *link_res,
+ enum signal_type signal)
+{
+ struct dc *dc = link->ctx->dc;
+ const struct link_hwss *link_hwss = get_link_hwss(link, link_res);
+ struct dmcu *dmcu = dc->res_pool->dmcu;
+
+ if (signal == SIGNAL_TYPE_EDP &&
+ link->dc->hwss.edp_backlight_control &&
+ !link->skip_implict_edp_power_control)
+ link->dc->hwss.edp_backlight_control(link, false);
+ else if (dmcu != NULL && dmcu->funcs->lock_phy)
+ dmcu->funcs->lock_phy(dmcu);
+
+ if (dc_is_tmds_signal(signal) && link->phy_state.symclk_ref_cnts.otg > 0) {
+ disable_link_output_symclk_on_tx_off(link, DP_UNKNOWN_ENCODING);
+ link->phy_state.symclk_state = SYMCLK_ON_TX_OFF;
+ } else {
+ link_hwss->disable_link_output(link, link_res, signal);
+ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
+ }
+ /*
+ * Add the logic to extract BOTH power up and power down sequences
+ * from enable/disable link output and only call edp panel control
+ * in enable_link_dp and disable_link_dp once.
+ */
+ if (dmcu != NULL && dmcu->funcs->unlock_phy)
+ dmcu->funcs->unlock_phy(dmcu);
+
+ dc->link_srv->dp_trace_source_sequence(link, DPCD_SOURCE_SEQ_AFTER_DISABLE_LINK_PHY);
+}
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
index 1ff41dba556c0..e3459546a908a 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h
@@ -108,5 +108,8 @@ void dcn35_update_cursor_offload_pipe(struct dc *dc, const struct pipe_ctx *pipe
void dcn35_notify_cursor_offload_drr_update(struct dc *dc, struct dc_state *context,
const struct dc_stream_state *stream);
void dcn35_program_cursor_offload_now(struct dc *dc, const struct pipe_ctx *pipe);
+void dcn35_disable_link_output(struct dc_link *link,
+ const struct link_resource *link_res,
+ enum signal_type signal);
#endif /* __DC_HWSS_DCN35_H__ */
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
index 5a66c9db26709..81bd36f3381db 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c
@@ -113,7 +113,7 @@ static const struct hw_sequencer_funcs dcn35_funcs = {
.enable_lvds_link_output = dce110_enable_lvds_link_output,
.enable_tmds_link_output = dce110_enable_tmds_link_output,
.enable_dp_link_output = dce110_enable_dp_link_output,
- .disable_link_output = dcn32_disable_link_output,
+ .disable_link_output = dcn35_disable_link_output,
.z10_restore = dcn35_z10_restore,
.z10_save_init = dcn31_z10_save_init,
.set_disp_pattern_generator = dcn30_set_disp_pattern_generator,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 171/844] drm/xe: Only toggle scheduling in TDR if GuC is running
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (169 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 170/844] drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 172/844] ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask Sasha Levin
` (681 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Matthew Brost, Niranjana Vishwanathapura, Sasha Levin
From: Matthew Brost <matthew.brost@intel.com>
[ Upstream commit dd1ef5e2456558876244795bb22a4d90cb24f160 ]
If the firmware is not running during TDR (e.g., when the driver is
unloading), there's no need to toggle scheduling in the GuC. In such
cases, skip this step.
v4:
- Bail on wait UC not running (Niranjana)
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Link: https://patch.msgid.link/20260110012739.2888434-4-matthew.brost@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_guc_submit.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index f6ba2b0f074d2..ced13f17fb720 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -1304,7 +1304,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
if (exec_queue_reset(q))
err = -EIO;
- if (!exec_queue_destroyed(q)) {
+ if (!exec_queue_destroyed(q) && xe_uc_fw_is_running(&guc->fw)) {
/*
* Wait for any pending G2H to flush out before
* modifying state
@@ -1339,6 +1339,7 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
*/
smp_rmb();
ret = wait_event_timeout(guc->ct.wq,
+ !xe_uc_fw_is_running(&guc->fw) ||
!exec_queue_pending_disable(q) ||
xe_guc_read_stopped(guc) ||
vf_recovery(guc), HZ * 5);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 172/844] ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (170 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 171/844] drm/xe: Only toggle scheduling in TDR if GuC is running Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 173/844] ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug Sasha Levin
` (680 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Krzyszkowiak, Charles Keepax, Mark Brown, Sasha Levin
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
[ Upstream commit 66c26346ae30c883eef70acf9cf9054dfdb4fb2f ]
This bit is handled by a separate control.
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-1-f4f4eeacf089@puri.sm
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8962.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index e9e317ce68982..1040740fc80f8 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -1760,7 +1760,7 @@ SND_SOC_BYTES("EQR Coefficients", WM8962_EQ24, 18),
SOC_SINGLE("3D Switch", WM8962_THREED1, 0, 1, 0),
-SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA),
+SND_SOC_BYTES_MASK("3D Coefficients", WM8962_THREED1, 4, WM8962_THREED_ENA | WM8962_ADC_MONOMIX),
SOC_SINGLE("DF1 Switch", WM8962_DF1, 0, 1, 0),
SND_SOC_BYTES_MASK("DF1 Coefficients", WM8962_DF1, 7, WM8962_DF1_ENA),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 173/844] ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (171 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 172/844] ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 174/844] spi: spi-mem: Limit octal DTR constraints to octal DTR situations Sasha Levin
` (679 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Krzyszkowiak, Charles Keepax, Mark Brown, Sasha Levin
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
[ Upstream commit e590752119029d87ce46d725e11245a52d22e1fe ]
This usually means that a TRS plug with no microphone pin has been plugged
into a TRRS socket. Cases where a user is plugging in a microphone while
pressing a button will be handled via incoming interrupt after the user
releases the button, so the microphone will still be detected once it
becomes usable.
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260105-wm8962-l5-fixes-v1-3-f4f4eeacf089@puri.sm
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8962.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 1040740fc80f8..bff8644674163 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -67,6 +67,8 @@ struct wm8962_priv {
struct mutex dsp2_ena_lock;
u16 dsp2_ena;
+ int mic_status;
+
struct delayed_work mic_work;
struct snd_soc_jack *jack;
@@ -3081,8 +3083,16 @@ static void wm8962_mic_work(struct work_struct *work)
if (reg & WM8962_MICSHORT_STS) {
status |= SND_JACK_BTN_0;
irq_pol |= WM8962_MICSCD_IRQ_POL;
+
+ /* Don't report a microphone if it's shorted right after
+ * plugging in, as this may be a TRS plug in a TRRS socket.
+ */
+ if (!(wm8962->mic_status & WM8962_MICDET_STS))
+ status = 0;
}
+ wm8962->mic_status = status;
+
snd_soc_jack_report(wm8962->jack, status,
SND_JACK_MICROPHONE | SND_JACK_BTN_0);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 174/844] spi: spi-mem: Limit octal DTR constraints to octal DTR situations
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (172 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 173/844] ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 175/844] cgroup/cpuset: Don't fail cpuset.cpus change in v2 Sasha Levin
` (678 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miquel Raynal, Tudor Ambarus, Mark Brown, Sasha Levin
From: Miquel Raynal <miquel.raynal@bootlin.com>
[ Upstream commit 8618271887ca10ac5108fe7e1d82ba8f1b152cf9 ]
In this helper, any operation with a single DTR cycle (like 1S-1S-8D) is
considered requiring a duplicated command opcode. This is wrong as this
constraint only applies to octal DTR operations (8D-8D-8D).
Narrow the application of this constraint to the concerned bus
interface.
Note: none of the possible XD-XD-XD pattern, with X being one of {1, 2,
4} would benefit from this check either as there is only in octal DTR
mode that a single clock edge would be enough to transmit the full
opcode.
Make sure the constraint of expecting two bytes for the command is
applied to the relevant bus interface.
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260109-winbond-v6-17-rc1-oddr-v2-3-1fff6a2ddb80@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-mem.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index c8b2add2640e5..6c7921469b90b 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -178,8 +178,19 @@ bool spi_mem_default_supports_op(struct spi_mem *mem,
if (op->data.swap16 && !spi_mem_controller_is_capable(ctlr, swap16))
return false;
- if (op->cmd.nbytes != 2)
- return false;
+ /* Extra 8D-8D-8D limitations */
+ if (op->cmd.dtr && op->cmd.buswidth == 8) {
+ if (op->cmd.nbytes != 2)
+ return false;
+
+ if ((op->addr.nbytes % 2) ||
+ (op->dummy.nbytes % 2) ||
+ (op->data.nbytes % 2)) {
+ dev_err(&ctlr->dev,
+ "Even byte numbers not allowed in octal DTR operations\n");
+ return false;
+ }
+ }
} else {
if (op->cmd.nbytes != 1)
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 175/844] cgroup/cpuset: Don't fail cpuset.cpus change in v2
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (173 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 174/844] spi: spi-mem: Limit octal DTR constraints to octal DTR situations Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 176/844] media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START Sasha Levin
` (677 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Waiman Long, Chen Ridong, Tejun Heo, Sasha Levin
From: Waiman Long <longman@redhat.com>
[ Upstream commit 6e6f13f6d5095f3a432da421e78f4d7d51ef39c8 ]
Commit fe8cd2736e75 ("cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE
until valid partition") introduced a new check to disallow the setting
of a new cpuset.cpus.exclusive value that is a superset of a sibling's
cpuset.cpus value so that there will at least be one CPU left in the
sibling in case the cpuset becomes a valid partition root. This new
check does have the side effect of failing a cpuset.cpus change that
make it a subset of a sibling's cpuset.cpus.exclusive value.
With v2, users are supposed to be allowed to set whatever value they
want in cpuset.cpus without failure. To maintain this rule, the check
is now restricted to only when cpuset.cpus.exclusive is being changed
not when cpuset.cpus is changed.
The cgroup-v2.rst doc file is also updated to reflect this change.
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/cgroup-v2.rst | 8 +++----
kernel/cgroup/cpuset.c | 30 ++++++++++++-------------
2 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index 7f5b59d95fce5..510df2461aff2 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -2561,10 +2561,10 @@ Cpuset Interface Files
Users can manually set it to a value that is different from
"cpuset.cpus". One constraint in setting it is that the list of
CPUs must be exclusive with respect to "cpuset.cpus.exclusive"
- of its sibling. If "cpuset.cpus.exclusive" of a sibling cgroup
- isn't set, its "cpuset.cpus" value, if set, cannot be a subset
- of it to leave at least one CPU available when the exclusive
- CPUs are taken away.
+ and "cpuset.cpus.exclusive.effective" of its siblings. Another
+ constraint is that it cannot be a superset of "cpuset.cpus"
+ of its sibling in order to leave at least one CPU available to
+ that sibling when the exclusive CPUs are taken away.
For a parent cgroup, any one of its exclusive CPUs can only
be distributed to at most one of its child cgroups. Having an
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index c06e2e96f79dc..dc3ac38c5d160 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -603,33 +603,31 @@ static inline bool cpusets_are_exclusive(struct cpuset *cs1, struct cpuset *cs2)
/**
* cpus_excl_conflict - Check if two cpusets have exclusive CPU conflicts
- * @cs1: first cpuset to check
- * @cs2: second cpuset to check
+ * @trial: the trial cpuset to be checked
+ * @sibling: a sibling cpuset to be checked against
+ * @xcpus_changed: set if exclusive_cpus has been set
*
* Returns: true if CPU exclusivity conflict exists, false otherwise
*
* Conflict detection rules:
* 1. If either cpuset is CPU exclusive, they must be mutually exclusive
* 2. exclusive_cpus masks cannot intersect between cpusets
- * 3. The allowed CPUs of one cpuset cannot be a subset of another's exclusive CPUs
+ * 3. The allowed CPUs of a sibling cpuset cannot be a subset of the new exclusive CPUs
*/
-static inline bool cpus_excl_conflict(struct cpuset *cs1, struct cpuset *cs2)
+static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibling,
+ bool xcpus_changed)
{
/* If either cpuset is exclusive, check if they are mutually exclusive */
- if (is_cpu_exclusive(cs1) || is_cpu_exclusive(cs2))
- return !cpusets_are_exclusive(cs1, cs2);
+ if (is_cpu_exclusive(trial) || is_cpu_exclusive(sibling))
+ return !cpusets_are_exclusive(trial, sibling);
/* Exclusive_cpus cannot intersect */
- if (cpumask_intersects(cs1->exclusive_cpus, cs2->exclusive_cpus))
+ if (cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus))
return true;
- /* The cpus_allowed of one cpuset cannot be a subset of another cpuset's exclusive_cpus */
- if (!cpumask_empty(cs1->cpus_allowed) &&
- cpumask_subset(cs1->cpus_allowed, cs2->exclusive_cpus))
- return true;
-
- if (!cpumask_empty(cs2->cpus_allowed) &&
- cpumask_subset(cs2->cpus_allowed, cs1->exclusive_cpus))
+ /* The cpus_allowed of a sibling cpuset cannot be a subset of the new exclusive_cpus */
+ if (xcpus_changed && !cpumask_empty(sibling->cpus_allowed) &&
+ cpumask_subset(sibling->cpus_allowed, trial->exclusive_cpus))
return true;
return false;
@@ -666,6 +664,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
{
struct cgroup_subsys_state *css;
struct cpuset *c, *par;
+ bool xcpus_changed;
int ret = 0;
rcu_read_lock();
@@ -722,10 +721,11 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
* overlap. exclusive_cpus cannot overlap with each other if set.
*/
ret = -EINVAL;
+ xcpus_changed = !cpumask_equal(cur->exclusive_cpus, trial->exclusive_cpus);
cpuset_for_each_child(c, css, par) {
if (c == cur)
continue;
- if (cpus_excl_conflict(trial, c))
+ if (cpus_excl_conflict(trial, c, xcpus_changed))
goto out;
if (mems_excl_conflict(trial, c))
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 176/844] media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (174 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 175/844] cgroup/cpuset: Don't fail cpuset.cpus change in v2 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 177/844] drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() Sasha Levin
` (676 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ming Qian, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Ming Qian <ming.qian@oss.nxp.com>
[ Upstream commit d85f3207d75df6d7a08be6526b15ff398668206c ]
The V4L2_DEC_CMD_START command may be used to handle the dynamic source
change, which will triggers an implicit decoder drain.
The last_buffer_dequeued flag is set in the implicit decoder drain,
so driver need to clear it to continue the following decoding flow.
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vdec.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c
index c0d2aabb9e0e3..f25dbcebdccf6 100644
--- a/drivers/media/platform/amphion/vdec.c
+++ b/drivers/media/platform/amphion/vdec.c
@@ -724,6 +724,7 @@ static int vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd
switch (cmd->cmd) {
case V4L2_DEC_CMD_START:
vdec_cmd_start(inst);
+ vb2_clear_last_buffer_dequeued(v4l2_m2m_get_dst_vq(inst->fh.m2m_ctx));
break;
case V4L2_DEC_CMD_STOP:
vdec_cmd_stop(inst);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 177/844] drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (175 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 176/844] media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 178/844] media: adv7180: fix frame interval in progressive mode Sasha Levin
` (675 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tuo Li, Neil Armstrong, Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit 95eed73b871111123a8b1d31cb1fce7e902e49ea ]
In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
may be NULL:
if (!jdi)
mipi_dsi_detach(dsi);
However, when jdi is NULL, the function does not return and continues by
calling jdi_panel_disable():
err = jdi_panel_disable(&jdi->base);
Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
lead to a NULL-pointer dereference:
struct jdi_panel *jdi = to_panel_jdi(panel);
backlight_disable(jdi->backlight);
To prevent such a potential NULL-pointer dereference, return early from
jdi_panel_dsi_remove() when jdi is NULL.
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20251218120955.11185-1-islituo@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
index 23462065d726b..ea975170fafff 100644
--- a/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
+++ b/drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c
@@ -434,8 +434,10 @@ static void jdi_panel_dsi_remove(struct mipi_dsi_device *dsi)
int err;
/* only detach from host for the DSI-LINK2 interface */
- if (!jdi)
+ if (!jdi) {
mipi_dsi_detach(dsi);
+ return;
+ }
err = jdi_panel_disable(&jdi->base);
if (err < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 178/844] media: adv7180: fix frame interval in progressive mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (176 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 177/844] drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 179/844] media: pvrusb2: fix URB leak in pvr2_send_request_ex Sasha Levin
` (674 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thorsten Schmelzer, Niklas Söderlund, Michael Tretter,
Hans Verkuil, Sasha Levin
From: Thorsten Schmelzer <tschmelzer@topcon.com>
[ Upstream commit 90289b67c5c1d4c18784059b27460d292e16d208 ]
The ADV7280-M may internally convert interlaced video input to
progressive video. If this mode is enabled, the ADV7280-M delivers
progressive video frames at the field rate of 50 fields per second (PAL)
or 60 fields per second (NTSC).
Fix the reported frame interval if progressive video is enabled.
Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7180.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 378f4e6af12cb..5cbc973df684d 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -507,6 +507,13 @@ static int adv7180_get_frame_interval(struct v4l2_subdev *sd,
fi->interval.denominator = 25;
}
+ /*
+ * If the de-interlacer is active, the chip produces full video frames
+ * at the field rate.
+ */
+ if (state->field == V4L2_FIELD_NONE)
+ fi->interval.denominator *= 2;
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 179/844] media: pvrusb2: fix URB leak in pvr2_send_request_ex
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (177 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 178/844] media: adv7180: fix frame interval in progressive mode Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 180/844] media: solo6x10: Check for out of bounds chip_id Sasha Levin
` (673 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Szymon Wilczek, syzbot+405dcd13121ff75a9e16, Mike Isely,
Hans Verkuil, Sasha Levin
From: Szymon Wilczek <szymonwilczek@gmx.com>
[ Upstream commit a8333c8262aed2aedf608c18edd39cf5342680a7 ]
When pvr2_send_request_ex() submits a write URB successfully but fails to
submit the read URB (e.g. returns -ENOMEM), it returns immediately without
waiting for the write URB to complete. Since the driver reuses the same
URB structure, a subsequent call to pvr2_send_request_ex() attempts to
submit the still-active write URB, triggering a 'URB submitted while
active' warning in usb_submit_urb().
Fix this by ensuring the write URB is unlinked and waited upon if the read
URB submission fails.
Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
Acked-by: Mike Isely <isely@pobox.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index b32bb906a9de2..5807734ae26c6 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -3709,6 +3709,11 @@ status);
"Failed to submit read-control URB status=%d",
status);
hdw->ctl_read_pend_flag = 0;
+ if (hdw->ctl_write_pend_flag) {
+ usb_unlink_urb(hdw->ctl_write_urb);
+ while (hdw->ctl_write_pend_flag)
+ wait_for_completion(&hdw->ctl_done);
+ }
goto done;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 180/844] media: solo6x10: Check for out of bounds chip_id
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (178 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 179/844] media: pvrusb2: fix URB leak in pvr2_send_request_ex Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 181/844] media: cx25821: Fix a resource leak in cx25821_dev_setup() Sasha Levin
` (672 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kees Cook, Nathan Chancellor, Hans Verkuil, Sasha Levin
From: Kees Cook <kees@kernel.org>
[ Upstream commit 0fdf6323c35a134f206dcad5babb4ff488552076 ]
Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
(literal "1" is an "int") could end up being shifted beyond 32 bits,
so instrumentation was added (and due to the double is_tw286x() call
seen via inlining), Clang decides the second one must now be undefined
behavior and elides the rest of the function[1]. This is a known problem
with Clang (that is still being worked on), but we can avoid the entire
problem by actually checking the existing max chip ID, and now there is
no runtime instrumentation added at all since everything is known to be
within bounds.
Additionally use an unsigned value for the shift to remove the
instrumentation even without the explicit bounds checking.
Link: https://github.com/ClangBuiltLinux/linux/issues/2144 [1]
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: fix checkpatch warning for is_tw286x]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/solo6x10/solo6x10-tw28.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
index 1b7c22a9bc94f..8f53946c67928 100644
--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
+++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
};
-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
+#define is_tw286x(__solo, __id) (!((__solo)->tw2815 & (1U << (__id))))
static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
u8 tw_off)
@@ -686,6 +686,9 @@ int tw28_set_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
chip_num = ch / 4;
ch %= 4;
+ if (chip_num >= TW_NUM_CHIP)
+ return -EINVAL;
+
if (val > 255 || val < 0)
return -ERANGE;
@@ -758,6 +761,9 @@ int tw28_get_ctrl_val(struct solo_dev *solo_dev, u32 ctrl, u8 ch,
chip_num = ch / 4;
ch %= 4;
+ if (chip_num >= TW_NUM_CHIP)
+ return -EINVAL;
+
switch (ctrl) {
case V4L2_CID_SHARPNESS:
/* Only 286x has sharpness */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 181/844] media: cx25821: Fix a resource leak in cx25821_dev_setup()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (179 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 180/844] media: solo6x10: Check for out of bounds chip_id Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 182/844] media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE lite Sasha Levin
` (671 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Hans Verkuil, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 68cd8ac994cac38a305200f638b30e13c690753b ]
Add release_mem_region() if ioremap() fails to release the memory
region obtained by cx25821_get_resources().
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx25821/cx25821-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
index 6627fa9166d30..a7336be444748 100644
--- a/drivers/media/pci/cx25821/cx25821-core.c
+++ b/drivers/media/pci/cx25821/cx25821-core.c
@@ -908,6 +908,7 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
if (!dev->lmmio) {
CX25821_ERR("ioremap failed, maybe increasing __VMALLOC_RESERVE in page.h\n");
+ release_mem_region(dev->base_io_addr, pci_resource_len(dev->pci, 0));
cx25821_iounmap(dev);
return -ENOMEM;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 182/844] media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE lite
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (180 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 181/844] media: cx25821: Fix a resource leak in cx25821_dev_setup() Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 183/844] media: v4l2-async: Fix error handling on steps after finding a match Sasha Levin
` (670 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vladimir Zapolskiy, Bryan O'Donoghue, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit a89e490ba3551823511588b7b3828d67f8b82954 ]
The clock is needed to stream images over a full VFE IP on SM8550 CAMSS,
and it should not be enabled, when an image stream is routed over any of
two lite VFE IPs on the SoC.
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index fcc2b2c3cba07..757c548af485a 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2704,12 +2704,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = {
/* VFE3 lite */
{
.regulators = {},
- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb",
+ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb",
"vfe_lite", "cpas_ife_lite", "camnoc_axi" },
.clock_rate = { { 0 },
{ 80000000 },
{ 300000000, 400000000 },
- { 300000000, 400000000 },
{ 400000000, 480000000 },
{ 300000000, 400000000 },
{ 300000000, 400000000 } },
@@ -2726,12 +2725,11 @@ static const struct camss_subdev_resources vfe_res_8550[] = {
/* VFE4 lite */
{
.regulators = {},
- .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb_clk", "vfe_lite_ahb",
+ .clock = { "gcc_axi_hf", "cpas_ahb", "vfe_lite_ahb",
"vfe_lite", "cpas_ife_lite", "camnoc_axi" },
.clock_rate = { { 0 },
{ 80000000 },
{ 300000000, 400000000 },
- { 300000000, 400000000 },
{ 400000000, 480000000 },
{ 300000000, 400000000 },
{ 300000000, 400000000 } },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 183/844] media: v4l2-async: Fix error handling on steps after finding a match
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (181 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 182/844] media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE lite Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 184/844] media: mt9m114: Avoid a reset low spike during probe() Sasha Levin
` (669 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sakari Ailus, Yew, Chang Ching, Hans Verkuil, Sasha Levin
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 7345d6d356336c448d6b9230ed8704f39679fd12 ]
Once an async connection is found to be matching with an fwnode, a
sub-device may be registered (in case it wasn't already), its bound
operation is called, ancillary links are created, the async connection
is added to the sub-device's list of connections and removed from the
global waiting connection list. Further on, the sub-device's possible own
notifier is searched for possible additional matches.
Fix these specific issues:
- If v4l2_async_match_notify() failed before the sub-notifier handling,
the async connection was unbound and its entry removed from the
sub-device's async connection list. The latter part was also done in
v4l2_async_match_notify().
- The async connection's sd field was only set after creating ancillary
links in v4l2_async_match_notify(). It was however dereferenced in
v4l2_async_unbind_subdev_one(), which was called on error path of
v4l2_async_match_notify() failure.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-by: "Yew, Chang Ching" <chang.ching.yew@intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-async.c | 45 +++++++++++++++++++---------
1 file changed, 31 insertions(+), 14 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index ee884a8221fbd..1c08bba9ecb91 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -343,7 +343,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
struct v4l2_subdev *sd,
struct v4l2_async_connection *asc)
{
- struct v4l2_async_notifier *subdev_notifier;
bool registered = false;
int ret;
@@ -389,6 +388,25 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
dev_dbg(notifier_dev(notifier), "v4l2-async: %s bound (ret %d)\n",
dev_name(sd->dev), ret);
+ return 0;
+
+err_call_unbind:
+ v4l2_async_nf_call_unbind(notifier, sd, asc);
+ list_del(&asc->asc_subdev_entry);
+
+err_unregister_subdev:
+ if (registered)
+ v4l2_device_unregister_subdev(sd);
+
+ return ret;
+}
+
+static int
+v4l2_async_nf_try_subdev_notifier(struct v4l2_async_notifier *notifier,
+ struct v4l2_subdev *sd)
+{
+ struct v4l2_async_notifier *subdev_notifier;
+
/*
* See if the sub-device has a notifier. If not, return here.
*/
@@ -404,16 +422,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier,
subdev_notifier->parent = notifier;
return v4l2_async_nf_try_all_subdevs(subdev_notifier);
-
-err_call_unbind:
- v4l2_async_nf_call_unbind(notifier, sd, asc);
- list_del(&asc->asc_subdev_entry);
-
-err_unregister_subdev:
- if (registered)
- v4l2_device_unregister_subdev(sd);
-
- return ret;
}
/* Test all async sub-devices in a notifier for a match. */
@@ -445,6 +453,10 @@ v4l2_async_nf_try_all_subdevs(struct v4l2_async_notifier *notifier)
if (ret < 0)
return ret;
+ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
+ if (ret < 0)
+ return ret;
+
/*
* v4l2_async_match_notify() may lead to registering a
* new notifier and thus changing the async subdevs
@@ -829,7 +841,11 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
ret = v4l2_async_match_notify(notifier, v4l2_dev, sd,
asc);
if (ret)
- goto err_unbind;
+ goto err_unlock;
+
+ ret = v4l2_async_nf_try_subdev_notifier(notifier, sd);
+ if (ret)
+ goto err_unbind_one;
ret = v4l2_async_nf_try_complete(notifier);
if (ret)
@@ -853,9 +869,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module)
if (subdev_notifier)
v4l2_async_nf_unbind_all_subdevs(subdev_notifier);
- if (asc)
- v4l2_async_unbind_subdev_one(notifier, asc);
+err_unbind_one:
+ v4l2_async_unbind_subdev_one(notifier, asc);
+err_unlock:
mutex_unlock(&list_lock);
sd->owner = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 184/844] media: mt9m114: Avoid a reset low spike during probe()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (182 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 183/844] media: v4l2-async: Fix error handling on steps after finding a match Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 185/844] media: mt9m114: Return -EPROBE_DEFER if no endpoint is found Sasha Levin
` (668 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Laurent Pinchart, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 84359d0a5e3afce5e3e3b6562efadff690614d5b ]
mt9m114_probe() requests the reset GPIO in output low state:
sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
and then almost immediately afterwards calls mt9m114_power_on() which does:
gpiod_set_value(sensor->reset, 1);
fsleep(duration);
gpiod_set_value(sensor->reset, 0);
which means that if the reset pin was high before this code runs that
it will very briefly be driven low because of passing GPIOD_OUT_LOW when
requesting the GPIO only to be driven high again possibly directly after
that. Such a very brief driving low of the reset pin may put the chip in
a confused state.
Request the GPIO in high (reset the chip) state instead to avoid this,
turning the initial gpiod_set_value() in mt9m114_power_on() into a no-op.
and the fsleep() ensures that it will stay high long enough to properly
reset the chip.
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/mt9m114.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
index 51ebbe7ae9969..554f25071cca6 100644
--- a/drivers/media/i2c/mt9m114.c
+++ b/drivers/media/i2c/mt9m114.c
@@ -2434,7 +2434,7 @@ static int mt9m114_probe(struct i2c_client *client)
goto error_ep_free;
}
- sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+ sensor->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(sensor->reset)) {
ret = PTR_ERR(sensor->reset);
dev_err_probe(dev, ret, "Failed to get reset GPIO\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 185/844] media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (183 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 184/844] media: mt9m114: Avoid a reset low spike during probe() Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 186/844] media: ipu6: Ensure stream_mutex is acquired when dealing with node list Sasha Levin
` (667 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Laurent Pinchart, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 437e1f6a960035166495a5117aacbc596115eeb6 ]
With IPU# bridges, endpoints may only be created when the IPU bridge is
initialized. This may happen after the sensor driver's first probe().
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/mt9m114.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
index 554f25071cca6..b1325e2cd1321 100644
--- a/drivers/media/i2c/mt9m114.c
+++ b/drivers/media/i2c/mt9m114.c
@@ -2360,11 +2360,17 @@ static int mt9m114_parse_dt(struct mt9m114 *sensor)
struct fwnode_handle *ep;
int ret;
+ /*
+ * On ACPI systems the fwnode graph can be initialized by a bridge
+ * driver, which may not have probed yet. Wait for this.
+ *
+ * TODO: Return an error once bridge driver code will have moved
+ * to the ACPI core.
+ */
ep = fwnode_graph_get_next_endpoint(fwnode, NULL);
- if (!ep) {
- dev_err(&sensor->client->dev, "No endpoint found\n");
- return -EINVAL;
- }
+ if (!ep)
+ return dev_err_probe(&sensor->client->dev, -EPROBE_DEFER,
+ "waiting for fwnode graph endpoint\n");
sensor->bus_cfg.bus_type = V4L2_MBUS_UNKNOWN;
ret = v4l2_fwnode_endpoint_alloc_parse(ep, &sensor->bus_cfg);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 186/844] media: ipu6: Ensure stream_mutex is acquired when dealing with node list
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (184 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 185/844] media: mt9m114: Return -EPROBE_DEFER if no endpoint is found Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 187/844] media: ipu6: Close firmware streams on streaming enable failure Sasha Levin
` (666 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sakari Ailus, Hans Verkuil, Sasha Levin
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 779bdaad2abf718fb8116839e818e58852874b4d ]
The ipu6 isys driver maintains the list of video buffer queues related to
a stream (in ipu6 context streams on the same CSI-2 virtual channel) and
this list is modified through VIDIOC_STREAMON and VIDIOC_STREAMOFF IOCTLs.
Ensure the common mutex is acquired when accessing the linked list, i.e.
the isys device context's stream_mutex.
Add a lockdep assert to ipu6_isys_get_buffer_list() and switch to guard()
while at it as the error handling becomes more simple this way.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu6/ipu6-isys-queue.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
index aa2cf7287477c..8f05987cdb4e7 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys-queue.c
@@ -3,6 +3,7 @@
* Copyright (C) 2013--2024 Intel Corporation
*/
#include <linux/atomic.h>
+#include <linux/cleanup.h>
#include <linux/bug.h>
#include <linux/device.h>
#include <linux/list.h>
@@ -201,6 +202,8 @@ static int buffer_list_get(struct ipu6_isys_stream *stream,
unsigned long flags;
unsigned long buf_flag = IPU6_ISYS_BUFFER_LIST_FL_INCOMING;
+ lockdep_assert_held(&stream->mutex);
+
bl->nbufs = 0;
INIT_LIST_HEAD(&bl->head);
@@ -294,9 +297,8 @@ static int ipu6_isys_stream_start(struct ipu6_isys_video *av,
struct ipu6_isys_buffer_list __bl;
int ret;
- mutex_lock(&stream->isys->stream_mutex);
+ guard(mutex)(&stream->isys->stream_mutex);
ret = ipu6_isys_video_set_streaming(av, 1, bl);
- mutex_unlock(&stream->isys->stream_mutex);
if (ret)
goto out_requeue;
@@ -637,10 +639,10 @@ static void stop_streaming(struct vb2_queue *q)
mutex_lock(&av->isys->stream_mutex);
if (stream->nr_streaming == stream->nr_queues && stream->streaming)
ipu6_isys_video_set_streaming(av, 0, NULL);
+ list_del(&aq->node);
mutex_unlock(&av->isys->stream_mutex);
stream->nr_streaming--;
- list_del(&aq->node);
stream->streaming = 0;
mutex_unlock(&stream->mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 187/844] media: ipu6: Close firmware streams on streaming enable failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (185 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 186/844] media: ipu6: Ensure stream_mutex is acquired when dealing with node list Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 188/844] media: ipu6: Always close firmware stream Sasha Levin
` (665 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sakari Ailus, Bingbu Cao, Mehdi Djait, Hans Verkuil, Sasha Levin
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 5925a92cc70d10c7d3124923c36da09b9c1a6eeb ]
When enabling streaming fails, the stream is stopped in firmware but not
closed. Do this to release resources on firmware side.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
index dec8f5ffcfa5f..919b77107cef7 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
@@ -1066,6 +1066,7 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
out_media_entity_stop_streaming_firmware:
stop_streaming_firmware(av);
+ close_streaming_firmware(av);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 188/844] media: ipu6: Always close firmware stream
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (186 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 187/844] media: ipu6: Close firmware streams on streaming enable failure Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 189/844] ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk Sasha Levin
` (664 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sakari Ailus, Bingbu Cao, Bingbu Cao, Mehdi Djait, Hans Verkuil,
Sasha Levin
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 2b08b7007e55bd1793a58478d3ecea4fd95849a5 ]
Close the firmware stream even when disabling a stream on an upstream
sub-device fails. This allows the firmware to release resources related to
a stream that is stopped in any case.
Suggested-by: Bingbu Cao <bingbu.cao@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu6/ipu6-isys-video.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
index 919b77107cef7..54d861aca0088 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys-video.c
@@ -1036,11 +1036,10 @@ int ipu6_isys_video_set_streaming(struct ipu6_isys_video *av, int state,
sd->name, r_pad->index, stream_mask);
ret = v4l2_subdev_disable_streams(sd, r_pad->index,
stream_mask);
- if (ret) {
+ if (ret)
dev_err(dev, "stream off %s failed with %d\n", sd->name,
ret);
- return ret;
- }
+
close_streaming_firmware(av);
} else {
ret = start_stream_firmware(av, bl);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 189/844] ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (187 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 188/844] media: ipu6: Always close firmware stream Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 190/844] ALSA: usb-audio: presonus s18xx uses little-endian Sasha Levin
` (663 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bharat Dev Burman, Takashi Iwai, Sasha Levin
From: Bharat Dev Burman <bharat.singh7924@gmail.com>
[ Upstream commit 72919c57a055f6d7b79d66731dc398e9b433f47c ]
HP Victus 16-e0xxx with ALC245 codec does not handle the toggling of
the mute LED.
This patch adds a quirk entry for subsystem ID 0x88eb using a new
ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT fixup, enabling correct mute LED
behavior.
Signed-off-by: Bharat Dev Burman <bharat.singh7924@gmail.com>
Link: https://patch.msgid.link/20260112184253.33376-1-bharat.singh7924@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 1964494321006..c9f59e62ee022 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -1551,6 +1551,22 @@ static void alc245_fixup_hp_mute_led_v1_coefbit(struct hda_codec *codec,
}
}
+static void alc245_fixup_hp_mute_led_v2_coefbit(struct hda_codec *codec,
+ const struct hda_fixup *fix,
+ int action)
+{
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ spec->mute_led_polarity = 0;
+ spec->mute_led_coef.idx = 0x0b;
+ spec->mute_led_coef.mask = 1 << 3;
+ spec->mute_led_coef.on = 1 << 3;
+ spec->mute_led_coef.off = 0;
+ snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set);
+ }
+}
+
/* turn on/off mic-mute LED per capture hook by coef bit */
static int coef_micmute_led_set(struct led_classdev *led_cdev,
enum led_brightness brightness)
@@ -3828,6 +3844,7 @@ enum {
ALC287_FIXUP_YOGA7_14ARB7_I2C,
ALC245_FIXUP_HP_MUTE_LED_COEFBIT,
ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT,
+ ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT,
ALC245_FIXUP_HP_X360_MUTE_LEDS,
ALC287_FIXUP_THINKPAD_I2S_SPK,
ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD,
@@ -6165,6 +6182,10 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc245_fixup_hp_mute_led_v1_coefbit,
},
+ [ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_mute_led_v2_coefbit,
+ },
[ALC245_FIXUP_HP_X360_MUTE_LEDS] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc245_fixup_hp_mute_led_coefbit,
@@ -6654,6 +6675,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 190/844] ALSA: usb-audio: presonus s18xx uses little-endian
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (188 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 189/844] ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 191/844] drm/amdkfd: Relax size checking during queue buffer get Sasha Levin
` (662 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: fenugrec, Takashi Iwai, Sasha Levin
From: fenugrec <fenugrec@mail.com>
[ Upstream commit 3ce03297baff0ba116769044e4594fb324d4a551 ]
Use __le32 types for USB control transfers
Signed-off-by: fenugrec <fenugrec@mail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260111-preso_clean1-v2-1-44b4e5129a75@mail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_s1810c.c | 36 ++++++++++++++++++------------------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
index 6e09e074c0e7f..93510aa0dc5ef 100644
--- a/sound/usb/mixer_s1810c.c
+++ b/sound/usb/mixer_s1810c.c
@@ -82,13 +82,13 @@
* mixer and output but a different set for device.
*/
struct s1810c_ctl_packet {
- u32 a;
- u32 b;
- u32 fixed1;
- u32 fixed2;
- u32 c;
- u32 d;
- u32 e;
+ __le32 a;
+ __le32 b;
+ __le32 fixed1;
+ __le32 fixed2;
+ __le32 c;
+ __le32 d;
+ __le32 e;
};
#define SC1810C_CTL_LINE_SW 0
@@ -118,7 +118,7 @@ struct s1810c_ctl_packet {
* being zero and different f1/f2.
*/
struct s1810c_state_packet {
- u32 fields[63];
+ __le32 fields[63];
};
#define SC1810C_STATE_48V_SW 58
@@ -140,14 +140,14 @@ snd_s1810c_send_ctl_packet(struct usb_device *dev, u32 a,
struct s1810c_ctl_packet pkt = { 0 };
int ret = 0;
- pkt.fixed1 = SC1810C_CMD_F1;
- pkt.fixed2 = SC1810C_CMD_F2;
+ pkt.fixed1 = __cpu_to_le32(SC1810C_CMD_F1);
+ pkt.fixed2 = __cpu_to_le32(SC1810C_CMD_F2);
- pkt.a = a;
- pkt.b = b;
- pkt.c = c;
- pkt.d = d;
- pkt.e = e;
+ pkt.a = __cpu_to_le32(a);
+ pkt.b = __cpu_to_le32(b);
+ pkt.c = __cpu_to_le32(c);
+ pkt.d = __cpu_to_le32(d);
+ pkt.e = __cpu_to_le32(e);
ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
SC1810C_CMD_REQ,
@@ -176,8 +176,8 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
struct s1810c_state_packet pkt_in = { { 0 } };
int ret = 0;
- pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1;
- pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2;
+ pkt_out.fields[SC1810C_STATE_F1_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F1);
+ pkt_out.fields[SC1810C_STATE_F2_IDX] = __cpu_to_le32(SC1810C_SET_STATE_F2);
ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
SC1810C_SET_STATE_REQ,
SC1810C_SET_STATE_REQTYPE,
@@ -197,7 +197,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
return ret;
}
- (*field) = pkt_in.fields[field_idx];
+ (*field) = __le32_to_cpu(pkt_in.fields[field_idx]);
(*seqnum)++;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 191/844] drm/amdkfd: Relax size checking during queue buffer get
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (189 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 190/844] ALSA: usb-audio: presonus s18xx uses little-endian Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 192/844] drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() Sasha Levin
` (661 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Donet Tom, Christian König, Philip Yang, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Donet Tom <donettom@linux.ibm.com>
[ Upstream commit 42ea9cf2f16b7131cb7302acb3dac510968f8bdc ]
HW-supported EOP buffer sizes are 4K and 32K. On systems that do not
use 4K pages, the minimum buffer object (BO) allocation size is
PAGE_SIZE (for example, 64K). During queue buffer acquisition, the driver
currently checks the allocated BO size against the supported EOP buffer
size. Since the allocated BO is larger than the expected size, this check
fails, preventing queue creation.
Relax the strict size validation and allow PAGE_SIZE-sized BOs to be used.
Only the required 4K region of the buffer will be used as the EOP buffer
and avoids queue creation failures on non-4K page systems.
Acked-by: Christian König <christian.koenig@amd.com>
Suggested-by: Philip Yang <yangp@amd.com>
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
index 80c4fa2b0975d..2822c90bd7be4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
@@ -275,8 +275,8 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
/* EOP buffer is not required for all ASICs */
if (properties->eop_ring_buffer_address) {
- if (properties->eop_ring_buffer_size != topo_dev->node_props.eop_buffer_size) {
- pr_debug("queue eop bo size 0x%x not equal to node eop buf size 0x%x\n",
+ if (properties->eop_ring_buffer_size < topo_dev->node_props.eop_buffer_size) {
+ pr_debug("queue eop bo size 0x%x is less than node eop buf size 0x%x\n",
properties->eop_ring_buffer_size,
topo_dev->node_props.eop_buffer_size);
err = -EINVAL;
@@ -284,7 +284,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
}
err = kfd_queue_buffer_get(vm, (void *)properties->eop_ring_buffer_address,
&properties->eop_buf_bo,
- properties->eop_ring_buffer_size);
+ ALIGN(properties->eop_ring_buffer_size, PAGE_SIZE));
if (err)
goto out_err_unreserve;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 192/844] drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (190 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 191/844] drm/amdkfd: Relax size checking during queue buffer get Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 193/844] drm: Account property blob allocations to memcg Sasha Levin
` (660 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Donet Tom, Christian König, Philip Yang,
Ritesh Harjani (IBM), Felix Kuehling, Alex Deucher, Sasha Levin
From: Donet Tom <donettom@linux.ibm.com>
[ Upstream commit 6c160001661b6c4e20f5c31909c722741e14c2d8 ]
In svm_migrate_gart_map(), while migrating GART mapping, the number of
bytes copied for the GART table only accounts for CPU pages. On non-4K
systems, each CPU page can contain multiple GPU pages, and the GART
requires one 8-byte PTE per GPU page. As a result, an incorrect size was
passed to the DMA, causing only a partial update of the GART table.
Fix this function to work correctly on non-4K page-size systems by
accounting for the number of GPU pages per CPU page when calculating the
number of bytes to be copied.
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
index 6ada7b4af7c68..5086caac3fd06 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
@@ -61,7 +61,7 @@ svm_migrate_gart_map(struct amdgpu_ring *ring, u64 npages,
*gart_addr = adev->gmc.gart_start;
num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8);
- num_bytes = npages * 8;
+ num_bytes = npages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE;
r = amdgpu_job_alloc_with_ib(adev, &adev->mman.high_pr,
AMDGPU_FENCE_OWNER_UNDEFINED,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 193/844] drm: Account property blob allocations to memcg
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (191 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 192/844] drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 194/844] drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels Sasha Levin
` (659 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Xiao Kan, Xiao Kan, Maxime Ripard, Sasha Levin
From: Xiao Kan <814091656@qq.com>
[ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ]
DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
property blobs backed by kernel memory.
Currently, the blob data allocation is not accounted to the allocating
process's memory cgroup, allowing unprivileged users to trigger unbounded
kernel memory consumption and potentially cause system-wide OOM.
Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
is properly charged to the caller's memcg. This ensures existing cgroup
memory limits apply and prevents uncontrolled kernel memory growth without
introducing additional policy or per-file limits.
Signed-off-by: Xiao Kan <814091656@qq.com>
Signed-off-by: Xiao Kan <xiao.kan@samsung.com>
Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_property.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index 596272149a359..3c88b5fbdf28c 100644
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -562,7 +562,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
return ERR_PTR(-EINVAL);
- blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
+ blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT);
if (!blob)
return ERR_PTR(-ENOMEM);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 194/844] drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (192 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 193/844] drm: Account property blob allocations to memcg Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 195/844] hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed Sasha Levin
` (658 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hugo Villeneuve, Biju Das, Sasha Levin
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
[ Upstream commit 64aa8b3a60a825134f7d866adf05c024bbe0c24c ]
Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
we may get the following kernel panic, for some panels, when rebooting:
systemd-shutdown[1]: Rebooting.
Call trace:
...
do_serror+0x28/0x68
el1h_64_error_handler+0x34/0x50
el1h_64_error+0x6c/0x70
rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
mipi_dsi_device_transfer+0x44/0x58
mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
ili9881c_unprepare+0x38/0x88
drm_panel_unprepare+0xbc/0x108
This happens for panels that need to send MIPI-DSI commands in their
unprepare() callback. Since the MIPI-DSI interface is stopped at that
point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
Fix by moving rzg2l_mipi_dsi_stop() to new callback function
rzg2l_mipi_dsi_atomic_post_disable().
With this change we now have the correct power-down/stop sequence:
systemd-shutdown[1]: Rebooting.
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
reboot: Restarting system
Suggested-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
index 3b52dfc0ea1e0..b164e3a62cc2f 100644
--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
+++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c
@@ -646,6 +646,13 @@ static void rzg2l_mipi_dsi_atomic_disable(struct drm_bridge *bridge,
rzg2l_mipi_dsi_stop_video(dsi);
rzg2l_mipi_dsi_stop_hs_clock(dsi);
+}
+
+static void rzg2l_mipi_dsi_atomic_post_disable(struct drm_bridge *bridge,
+ struct drm_atomic_state *state)
+{
+ struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge);
+
rzg2l_mipi_dsi_stop(dsi);
}
@@ -681,6 +688,7 @@ static const struct drm_bridge_funcs rzg2l_mipi_dsi_bridge_ops = {
.atomic_pre_enable = rzg2l_mipi_dsi_atomic_pre_enable,
.atomic_enable = rzg2l_mipi_dsi_atomic_enable,
.atomic_disable = rzg2l_mipi_dsi_atomic_disable,
+ .atomic_post_disable = rzg2l_mipi_dsi_atomic_post_disable,
.mode_valid = rzg2l_mipi_dsi_bridge_mode_valid,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 195/844] hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (193 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 194/844] drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 196/844] virt: vbox: uapi: Mark inner unions in packed structs " Sasha Levin
` (657 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Weißschuh, kernel test robot, Nathan Chancellor,
Arnd Bergmann, Wei Liu (Microsoft), Nicolas Schier,
Greg Kroah-Hartman, Sasha Levin
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 1e5271393d777f6159d896943b4c44c4f3ecff52 ]
The unpacked union within a packed struct generates alignment warnings
on clang for 32-bit ARM:
./usr/include/linux/hyperv.h:361:2: error: field within 'struct hv_kvp_exchg_msg_value'
is less aligned than 'union hv_kvp_exchg_msg_value::(anonymous at ./usr/include/linux/hyperv.h:361:2)'
and is usually due to 'struct hv_kvp_exchg_msg_value' being packed,
which can lead to unaligned accesses [-Werror,-Wunaligned-access]
361 | union {
| ^
With the recent changes to compile-test the UAPI headers in more cases,
this warning in combination with CONFIG_WERROR breaks the build.
Fix the warning.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Wei Liu (Microsoft) <wei.liu@kernel.org>
Tested-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-1-076aed1623ff@linutronix.de
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/hyperv.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/hyperv.h b/include/uapi/linux/hyperv.h
index aaa502a7bff46..1749b35ab2c21 100644
--- a/include/uapi/linux/hyperv.h
+++ b/include/uapi/linux/hyperv.h
@@ -362,7 +362,7 @@ struct hv_kvp_exchg_msg_value {
__u8 value[HV_KVP_EXCHANGE_MAX_VALUE_SIZE];
__u32 value_u32;
__u64 value_u64;
- };
+ } __attribute__((packed));
} __attribute__((packed));
struct hv_kvp_msg_enumerate {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 196/844] virt: vbox: uapi: Mark inner unions in packed structs as packed
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (194 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 195/844] hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 197/844] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated Sasha Levin
` (656 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Weißschuh, kernel test robot, Nathan Chancellor,
Arnd Bergmann, Nicolas Schier, Greg Kroah-Hartman, Sasha Levin
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit c25d01e1c4f2d43f47af87c00e223f5ca7c71792 ]
The unpacked unions within a packed struct generates alignment warnings
on clang for 32-bit ARM:
./usr/include/linux/vbox_vmmdev_types.h:239:4: error: field u within 'struct vmmdev_hgcm_function_parameter32'
is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:223:2)'
and is usually due to 'struct vmmdev_hgcm_function_parameter32' being packed,
which can lead to unaligned accesses [-Werror,-Wunaligned-access]
239 | } u;
| ^
./usr/include/linux/vbox_vmmdev_types.h:254:6: error: field u within
'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
is less aligned than 'union (unnamed union at ./usr/include/linux/vbox_vmmdev_types.h:251:4)' and is usually due to
'struct vmmdev_hgcm_function_parameter64::(anonymous union)::(unnamed at ./usr/include/linux/vbox_vmmdev_types.h:249:3)'
being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
With the recent changes to compile-test the UAPI headers in more cases,
these warning in combination with CONFIG_WERROR breaks the build.
Fix the warnings.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512140314.DzDxpIVn-lkp@intel.com/
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/linux-kbuild/20260110-uapi-test-disable-headers-arm-clang-unaligned-access-v1-1-b7b0fa541daa@kernel.org/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/linux-kbuild/29b2e736-d462-45b7-a0a9-85f8d8a3de56@app.fastmail.com/
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Tested-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260115-kbuild-alignment-vbox-v1-2-076aed1623ff@linutronix.de
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/vbox_vmmdev_types.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/vbox_vmmdev_types.h b/include/uapi/linux/vbox_vmmdev_types.h
index 6073858d52a2e..11f3627c3729b 100644
--- a/include/uapi/linux/vbox_vmmdev_types.h
+++ b/include/uapi/linux/vbox_vmmdev_types.h
@@ -236,7 +236,7 @@ struct vmmdev_hgcm_function_parameter32 {
/** Relative to the request header. */
__u32 offset;
} page_list;
- } u;
+ } __packed u;
} __packed;
VMMDEV_ASSERT_SIZE(vmmdev_hgcm_function_parameter32, 4 + 8);
@@ -251,7 +251,7 @@ struct vmmdev_hgcm_function_parameter64 {
union {
__u64 phys_addr;
__u64 linear_addr;
- } u;
+ } __packed u;
} __packed pointer;
struct {
/** Size of the buffer described by the page list. */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 197/844] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (195 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 196/844] virt: vbox: uapi: Mark inner unions in packed structs " Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 198/844] ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in ptl_rt722_l0_rt1320_l23 Sasha Levin
` (655 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bard Liao, Liam Girdwood, Ranjani Sridharan, Mark Brown,
Sasha Levin
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 08c09899960118ffb01417242e659eb6cc067d6a ]
rt722 is aggregated with rt1320 amp in arl_rt722_l0_rt1320_l2 and it is
the only audio configuration in the ARL platform. Set .aggregated = 1 to
represent the fact and avoid unexpected issue.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://patch.msgid.link/20260119091749.1752088-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/common/soc-acpi-intel-arl-match.c | 23 +++++++++----------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/sound/soc/intel/common/soc-acpi-intel-arl-match.c b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
index 6bf7a6250ddc3..c952f7d2b2c0e 100644
--- a/sound/soc/intel/common/soc-acpi-intel-arl-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-arl-match.c
@@ -45,23 +45,22 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = {
.group_id = 1,
};
-/*
- * RT722 is a multi-function codec, three endpoints are created for
- * its headset, amp and dmic functions.
- */
-static const struct snd_soc_acpi_endpoint rt722_endpoints[] = {
+static const struct snd_soc_acpi_endpoint jack_amp_g1_dmic_endpoints[] = {
+ /* Jack Endpoint */
{
.num = 0,
.aggregated = 0,
.group_position = 0,
.group_id = 0,
},
+ /* Amp Endpoint, work as spk_l_endpoint */
{
.num = 1,
- .aggregated = 0,
+ .aggregated = 1,
.group_position = 0,
- .group_id = 0,
+ .group_id = 1,
},
+ /* DMIC Endpoint */
{
.num = 2,
.aggregated = 0,
@@ -229,11 +228,11 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = {
}
};
-static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
+static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = {
{
.adr = 0x000030025D072201ull,
- .num_endpoints = ARRAY_SIZE(rt722_endpoints),
- .endpoints = rt722_endpoints,
+ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints),
+ .endpoints = jack_amp_g1_dmic_endpoints,
.name_prefix = "rt722"
}
};
@@ -394,8 +393,8 @@ static const struct snd_soc_acpi_link_adr arl_rt711_l0_rt1316_l3[] = {
static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = {
{
.mask = BIT(0),
- .num_adr = ARRAY_SIZE(rt722_0_single_adr),
- .adr_d = rt722_0_single_adr,
+ .num_adr = ARRAY_SIZE(rt722_0_agg_adr),
+ .adr_d = rt722_0_agg_adr,
},
{
.mask = BIT(2),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 198/844] ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in ptl_rt722_l0_rt1320_l23
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (196 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 197/844] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 199/844] ASoC: sdw_utils: remove dai registered check Sasha Levin
` (654 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bard Liao, Liam Girdwood, Ranjani Sridharan, Mark Brown,
Sasha Levin
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 4fbd3b2ec04dc6ef93090ec24733a5c5671fb71f ]
The rt722 amp and rt1320 amps are aggregated in this case.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://patch.msgid.link/20260119091749.1752088-3-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
index e297c8ecedb72..1055fb4838f61 100644
--- a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
@@ -383,6 +383,15 @@ static const struct snd_soc_acpi_link_adr ptl_rt721_l3[] = {
{},
};
+static const struct snd_soc_acpi_adr_device rt722_0_agg_adr[] = {
+ {
+ .adr = 0x000030025d072201ull,
+ .num_endpoints = ARRAY_SIZE(jack_amp_g1_dmic_endpoints),
+ .endpoints = jack_amp_g1_dmic_endpoints,
+ .name_prefix = "rt722"
+ }
+};
+
static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = {
{
.adr = 0x000030025d072201ull,
@@ -536,8 +545,8 @@ static const struct snd_soc_acpi_link_adr ptl_rt722_l3[] = {
static const struct snd_soc_acpi_link_adr ptl_rt722_l0_rt1320_l23[] = {
{
.mask = BIT(0),
- .num_adr = ARRAY_SIZE(rt722_0_single_adr),
- .adr_d = rt722_0_single_adr,
+ .num_adr = ARRAY_SIZE(rt722_0_agg_adr),
+ .adr_d = rt722_0_agg_adr,
},
{
.mask = BIT(2),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 199/844] ASoC: sdw_utils: remove dai registered check
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (197 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 198/844] ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in ptl_rt722_l0_rt1320_l23 Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 200/844] drm/atmel-hlcdc: destroy properly the plane state in the reset callback Sasha Levin
` (653 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bard Liao, Péter Ujfalusi, Liam Girdwood, Charles Keepax,
Mark Brown, Sasha Levin
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 8d38c275f7ffe257d21bea224d4288eef183817d ]
Checking for a registered DAI for non-existing endpoints causes the
following error. The driver will always return -EPROBE_DEFER if the
codec driver doesn't register the DAI of the unexist endpoint.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20260120065658.1806027-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sdw_utils/soc_sdw_utils.c | 15 ---------------
1 file changed, 15 deletions(-)
diff --git a/sound/soc/sdw_utils/soc_sdw_utils.c b/sound/soc/sdw_utils/soc_sdw_utils.c
index ccf149f949e8f..d03072cd13cb9 100644
--- a/sound/soc/sdw_utils/soc_sdw_utils.c
+++ b/sound/soc/sdw_utils/soc_sdw_utils.c
@@ -1421,29 +1421,14 @@ static int is_sdca_endpoint_present(struct device *dev,
const struct snd_soc_acpi_adr_device *adr_dev = &adr_link->adr_d[adr_index];
const struct snd_soc_acpi_endpoint *adr_end;
const struct asoc_sdw_dai_info *dai_info;
- struct snd_soc_dai_link_component *dlc;
- struct snd_soc_dai *codec_dai;
struct sdw_slave *slave;
struct device *sdw_dev;
const char *sdw_codec_name;
int ret, i;
- dlc = kzalloc(sizeof(*dlc), GFP_KERNEL);
- if (!dlc)
- return -ENOMEM;
-
adr_end = &adr_dev->endpoints[end_index];
dai_info = &codec_info->dais[adr_end->num];
- dlc->dai_name = dai_info->dai_name;
- codec_dai = snd_soc_find_dai_with_mutex(dlc);
- if (!codec_dai) {
- dev_warn(dev, "codec dai %s not registered yet\n", dlc->dai_name);
- kfree(dlc);
- return -EPROBE_DEFER;
- }
- kfree(dlc);
-
sdw_codec_name = _asoc_sdw_get_codec_name(dev, adr_link, adr_index);
if (!sdw_codec_name)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 200/844] drm/atmel-hlcdc: destroy properly the plane state in the reset callback
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (198 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 199/844] ASoC: sdw_utils: remove dai registered check Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 201/844] PCI: Add Intel Nova Lake audio Device ID Sasha Levin
` (652 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ludovic Desroches, Manikandan Muralidharan, Sasha Levin
From: Ludovic Desroches <ludovic.desroches@microchip.com>
[ Upstream commit 81af99cbd9e4f238011af811d544fff75641fc25 ]
If there is a plane state to destroy when doing a plane reset, destroy
it using the atmel_hlcdc_plane_destroy_state() function. So we call
__drm_atomic_helper_plane_destroy_state() and avoid code duplication.
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Link: https://patch.msgid.link/20251218-lcd_cleanup_mainline-v2-8-df837aba878f@microchip.com
Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 52 +++++++++----------
1 file changed, 26 insertions(+), 26 deletions(-)
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 92132be9823f1..0ffec44c6d317 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -1155,32 +1155,6 @@ static int atmel_hlcdc_plane_alloc_dscrs(struct drm_plane *p,
return -ENOMEM;
}
-static void atmel_hlcdc_plane_reset(struct drm_plane *p)
-{
- struct atmel_hlcdc_plane_state *state;
-
- if (p->state) {
- state = drm_plane_state_to_atmel_hlcdc_plane_state(p->state);
-
- if (state->base.fb)
- drm_framebuffer_put(state->base.fb);
-
- kfree(state);
- p->state = NULL;
- }
-
- state = kzalloc(sizeof(*state), GFP_KERNEL);
- if (state) {
- if (atmel_hlcdc_plane_alloc_dscrs(p, state)) {
- kfree(state);
- drm_err(p->dev,
- "Failed to allocate initial plane state\n");
- return;
- }
- __drm_atomic_helper_plane_reset(p, &state->base);
- }
-}
-
static struct drm_plane_state *
atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
{
@@ -1222,6 +1196,32 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
kfree(state);
}
+static void atmel_hlcdc_plane_reset(struct drm_plane *p)
+{
+ struct atmel_hlcdc_plane_state *state;
+ struct atmel_hlcdc_dc *dc = p->dev->dev_private;
+ struct atmel_hlcdc_plane *plane = drm_plane_to_atmel_hlcdc_plane(p);
+
+ if (p->state) {
+ atmel_hlcdc_plane_atomic_destroy_state(p, p->state);
+ p->state = NULL;
+ }
+
+ state = kzalloc(sizeof(*state), GFP_KERNEL);
+ if (state) {
+ if (atmel_hlcdc_plane_alloc_dscrs(p, state)) {
+ kfree(state);
+ drm_err(p->dev,
+ "Failed to allocate initial plane state\n");
+ return;
+ }
+ __drm_atomic_helper_plane_reset(p, &state->base);
+ }
+
+ if (plane->layer.desc->layout.csc)
+ dc->desc->ops->lcdc_csc_init(plane, plane->layer.desc);
+}
+
static const struct drm_plane_funcs layer_plane_funcs = {
.update_plane = drm_atomic_helper_update_plane,
.disable_plane = drm_atomic_helper_disable_plane,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 201/844] PCI: Add Intel Nova Lake audio Device ID
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (199 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 200/844] drm/atmel-hlcdc: destroy properly the plane state in the reset callback Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 202/844] ALSA: hda: controllers: intel: add support for Nova Lake Sasha Levin
` (651 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Kai Vehmanen, Liam Girdwood, Ranjani Sridharan,
Bjorn Helgaas, Takashi Iwai, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit b190870e0e0cfb375c0d4da02761c32083f3644d ]
Add Nova Lake (NVL) audio Device ID
The ID will be used by HDA legacy, SOF audio stack and the driver
to determine which audio stack should be used (intel-dsp-config).
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260120193507.14019-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pci_ids.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index a9a089566b7cb..f2849ff1830b1 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -3143,6 +3143,7 @@
#define PCI_DEVICE_ID_INTEL_HDA_CML_S 0xa3f0
#define PCI_DEVICE_ID_INTEL_HDA_LNL_P 0xa828
#define PCI_DEVICE_ID_INTEL_S21152BB 0xb152
+#define PCI_DEVICE_ID_INTEL_HDA_NVL 0xd328
#define PCI_DEVICE_ID_INTEL_HDA_BMG 0xe2f7
#define PCI_DEVICE_ID_INTEL_HDA_PTL_H 0xe328
#define PCI_DEVICE_ID_INTEL_HDA_PTL 0xe428
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 202/844] ALSA: hda: controllers: intel: add support for Nova Lake
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (200 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 201/844] PCI: Add Intel Nova Lake audio Device ID Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 203/844] drm/amd/display: Disable FEC when powering down encoders Sasha Levin
` (650 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Kai Vehmanen, Liam Girdwood, Ranjani Sridharan,
Takashi Iwai, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 7f428282fde34f06f3ab898b8a9081bf93a41f22 ]
Add NVL to the PCI-ID list.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260120193507.14019-5-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/controllers/intel.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/controllers/intel.c b/sound/hda/controllers/intel.c
index 1e8e3d61291a1..1b365e0772970 100644
--- a/sound/hda/controllers/intel.c
+++ b/sound/hda/controllers/intel.c
@@ -2551,6 +2551,7 @@ static const struct pci_device_id azx_ids[] = {
/* Wildcat Lake */
{ PCI_DEVICE_DATA(INTEL, HDA_WCL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },
/* Nova Lake */
+ { PCI_DEVICE_DATA(INTEL, HDA_NVL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },
{ PCI_DEVICE_DATA(INTEL, HDA_NVL_S, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_LNL) },
/* Apollolake (Broxton-P) */
{ PCI_DEVICE_DATA(INTEL, HDA_APL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON) },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 203/844] drm/amd/display: Disable FEC when powering down encoders
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (201 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 202/844] ALSA: hda: controllers: intel: add support for Nova Lake Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 204/844] drm/amd/display: Ensure link output is disabled in backend reset for PLL_ON Sasha Levin
` (649 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ovidiu Bunea, Karen Chen, Matthew Stewart, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Ovidiu Bunea <ovidiu.bunea@amd.com>
[ Upstream commit 8cee62904caf95e5698fa0f2d420f5f22b4dea15 ]
[why & how]
VBIOS DMCUB FW can enable FEC for capable eDPs, but S/W DC state is
only updated for link0 when transitioning into OS with driver loaded.
This causes issues when the eDP is immediately hidden and DIG0 is
assigned to another link that does not support FEC. Driver will
attempt to disable FEC but FEC enablement occurs based on the link
state, which does not have fec_state updated since it is a different
link. Thus, FEC disablement on DIG0 will get skipped and cause no
light up.
Reviewed-by: Karen Chen <karen.chen@amd.com>
Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/hwss/dce110/dce110_hwseq.c | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
index 9f7087ac41f21..3d2673a22759a 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -59,6 +59,7 @@
#include "dc_state_priv.h"
#include "dpcd_defs.h"
#include "dsc.h"
+#include "dc_dp_types.h"
/* include DCE11 register header files */
#include "dce/dce_11_0_d.h"
#include "dce/dce_11_0_sh_mask.h"
@@ -1736,20 +1737,25 @@ static void power_down_encoders(struct dc *dc)
int i;
for (i = 0; i < dc->link_count; i++) {
- enum signal_type signal = dc->links[i]->connector_signal;
-
- dc->link_srv->blank_dp_stream(dc->links[i], false);
+ struct dc_link *link = dc->links[i];
+ struct link_encoder *link_enc = link->link_enc;
+ enum signal_type signal = link->connector_signal;
+ dc->link_srv->blank_dp_stream(link, false);
if (signal != SIGNAL_TYPE_EDP)
signal = SIGNAL_TYPE_NONE;
- if (dc->links[i]->ep_type == DISPLAY_ENDPOINT_PHY)
- dc->links[i]->link_enc->funcs->disable_output(
- dc->links[i]->link_enc, signal);
+ if (link->ep_type == DISPLAY_ENDPOINT_PHY)
+ link_enc->funcs->disable_output(link_enc, signal);
+
+ if (link->fec_state == dc_link_fec_enabled) {
+ link_enc->funcs->fec_set_enable(link_enc, false);
+ link_enc->funcs->fec_set_ready(link_enc, false);
+ link->fec_state = dc_link_fec_not_ready;
+ }
- dc->links[i]->link_status.link_active = false;
- memset(&dc->links[i]->cur_link_settings, 0,
- sizeof(dc->links[i]->cur_link_settings));
+ link->link_status.link_active = false;
+ memset(&link->cur_link_settings, 0, sizeof(link->cur_link_settings));
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 204/844] drm/amd/display: Ensure link output is disabled in backend reset for PLL_ON
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (202 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 203/844] drm/amd/display: Disable FEC when powering down encoders Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 205/844] drm/amd/display: Revert "init dispclk from bootup clock for DCN314" Sasha Levin
` (648 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicholas Kazlauskas, Ovidiu (Ovi) Bunea, Matthew Stewart,
Dan Wheeler, Alex Deucher, Sasha Levin
From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
[ Upstream commit 4589712e0111352973131bad975023b25569287c ]
[Why]
We're missing the code to actually disable the link output when we have
to leave the SYMCLK_ON but the TX remains OFF.
[How]
Port the code from DCN401 that detects SYMCLK_ON_TX_OFF and disable
the link output when the backend is reset.
Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
index d1ecdb92b072b..20f700b59847c 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c
@@ -546,8 +546,22 @@ static void dcn31_reset_back_end_for_pipe(
if (pipe_ctx->stream_res.tg->funcs->set_odm_bypass)
pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+ /*
+ * TODO - convert symclk_ref_cnts for otg to a bit map to solve
+ * the case where the same symclk is shared across multiple otg
+ * instances
+ */
if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal))
- pipe_ctx->stream->link->phy_state.symclk_ref_cnts.otg = 0;
+ link->phy_state.symclk_ref_cnts.otg = 0;
+
+ if (pipe_ctx->top_pipe == NULL) {
+ if (link->phy_state.symclk_state == SYMCLK_ON_TX_OFF) {
+ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
+
+ link_hwss->disable_link_output(link, &pipe_ctx->link_res, pipe_ctx->stream->signal);
+ link->phy_state.symclk_state = SYMCLK_OFF_TX_OFF;
+ }
+ }
set_drr_and_clear_adjust_pending(pipe_ctx, pipe_ctx->stream, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 205/844] drm/amd/display: Revert "init dispclk from bootup clock for DCN314"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (203 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 204/844] drm/amd/display: Ensure link output is disabled in backend reset for PLL_ON Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:21 ` [PATCH 6.19 206/844] drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback Sasha Levin
` (647 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wang, Sung-huai, Nicholas Kazlauskas, Matthew Stewart,
Dan Wheeler, Alex Deucher, Sasha Levin
From: "Wang, Sung-huai" <Danny.Wang@amd.com>
[ Upstream commit bdc26342c49e1dc1afb48feeb20c9d74d15b784c ]
[Why&How]
This reverts commit f082daf08f2f.
Due to the change, the display shows garbage on startup.
We have an alternative solution for the original issue:
d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not")
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Wang, Sung-huai <Danny.Wang@amd.com>
Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 133 +-----------------
.../dc/clk_mgr/dcn314/dcn314_clk_mgr.h | 5 -
2 files changed, 4 insertions(+), 134 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
index db687a13174d5..0cb37827a62b6 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
@@ -77,7 +77,6 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
#undef DC_LOGGER
#define DC_LOGGER \
clk_mgr->base.base.ctx->logger
-
#define regCLK1_CLK_PLL_REQ 0x0237
#define regCLK1_CLK_PLL_REQ_BASE_IDX 0
@@ -88,70 +87,8 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
#define CLK1_CLK_PLL_REQ__PllSpineDiv_MASK 0x0000F000L
#define CLK1_CLK_PLL_REQ__FbMult_frac_MASK 0xFFFF0000L
-#define regCLK1_CLK0_DFS_CNTL 0x0269
-#define regCLK1_CLK0_DFS_CNTL_BASE_IDX 0
-#define regCLK1_CLK1_DFS_CNTL 0x026c
-#define regCLK1_CLK1_DFS_CNTL_BASE_IDX 0
-#define regCLK1_CLK2_DFS_CNTL 0x026f
-#define regCLK1_CLK2_DFS_CNTL_BASE_IDX 0
-#define regCLK1_CLK3_DFS_CNTL 0x0272
-#define regCLK1_CLK3_DFS_CNTL_BASE_IDX 0
-#define regCLK1_CLK4_DFS_CNTL 0x0275
-#define regCLK1_CLK4_DFS_CNTL_BASE_IDX 0
-#define regCLK1_CLK5_DFS_CNTL 0x0278
-#define regCLK1_CLK5_DFS_CNTL_BASE_IDX 0
-
-#define regCLK1_CLK0_CURRENT_CNT 0x02fb
-#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK1_CURRENT_CNT 0x02fc
-#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK2_CURRENT_CNT 0x02fd
-#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK3_CURRENT_CNT 0x02fe
-#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK4_CURRENT_CNT 0x02ff
-#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK5_CURRENT_CNT 0x0300
-#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX 0
-
-#define regCLK1_CLK0_BYPASS_CNTL 0x028a
-#define regCLK1_CLK0_BYPASS_CNTL_BASE_IDX 0
-#define regCLK1_CLK1_BYPASS_CNTL 0x0293
-#define regCLK1_CLK1_BYPASS_CNTL_BASE_IDX 0
#define regCLK1_CLK2_BYPASS_CNTL 0x029c
#define regCLK1_CLK2_BYPASS_CNTL_BASE_IDX 0
-#define regCLK1_CLK3_BYPASS_CNTL 0x02a5
-#define regCLK1_CLK3_BYPASS_CNTL_BASE_IDX 0
-#define regCLK1_CLK4_BYPASS_CNTL 0x02ae
-#define regCLK1_CLK4_BYPASS_CNTL_BASE_IDX 0
-#define regCLK1_CLK5_BYPASS_CNTL 0x02b7
-#define regCLK1_CLK5_BYPASS_CNTL_BASE_IDX 0
-
-#define regCLK1_CLK0_DS_CNTL 0x0283
-#define regCLK1_CLK0_DS_CNTL_BASE_IDX 0
-#define regCLK1_CLK1_DS_CNTL 0x028c
-#define regCLK1_CLK1_DS_CNTL_BASE_IDX 0
-#define regCLK1_CLK2_DS_CNTL 0x0295
-#define regCLK1_CLK2_DS_CNTL_BASE_IDX 0
-#define regCLK1_CLK3_DS_CNTL 0x029e
-#define regCLK1_CLK3_DS_CNTL_BASE_IDX 0
-#define regCLK1_CLK4_DS_CNTL 0x02a7
-#define regCLK1_CLK4_DS_CNTL_BASE_IDX 0
-#define regCLK1_CLK5_DS_CNTL 0x02b0
-#define regCLK1_CLK5_DS_CNTL_BASE_IDX 0
-
-#define regCLK1_CLK0_ALLOW_DS 0x0284
-#define regCLK1_CLK0_ALLOW_DS_BASE_IDX 0
-#define regCLK1_CLK1_ALLOW_DS 0x028d
-#define regCLK1_CLK1_ALLOW_DS_BASE_IDX 0
-#define regCLK1_CLK2_ALLOW_DS 0x0296
-#define regCLK1_CLK2_ALLOW_DS_BASE_IDX 0
-#define regCLK1_CLK3_ALLOW_DS 0x029f
-#define regCLK1_CLK3_ALLOW_DS_BASE_IDX 0
-#define regCLK1_CLK4_ALLOW_DS 0x02a8
-#define regCLK1_CLK4_ALLOW_DS_BASE_IDX 0
-#define regCLK1_CLK5_ALLOW_DS 0x02b1
-#define regCLK1_CLK5_ALLOW_DS_BASE_IDX 0
#define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL__SHIFT 0x0
#define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV__SHIFT 0x10
@@ -248,8 +185,6 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
{
struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
- struct clk_mgr_dcn314 *clk_mgr_dcn314 = TO_CLK_MGR_DCN314(clk_mgr_int);
- struct clk_log_info log_info = {0};
memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
// Assumption is that boot state always supports pstate
@@ -265,9 +200,6 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
dce_adjust_dp_ref_freq_for_ss(clk_mgr_int, clk_mgr->dprefclk_khz);
else
clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz;
-
- dcn314_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn314->base.base, &log_info);
- clk_mgr->clks.dispclk_khz = clk_mgr->boot_snapshot.dispclk * 1000;
}
void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
@@ -278,7 +210,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk;
struct dc *dc = clk_mgr_base->ctx->dc;
- int display_count;
+ int display_count = 0;
bool update_dppclk = false;
bool update_dispclk = false;
bool dpp_clock_lowered = false;
@@ -287,7 +219,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
return;
display_count = dcn314_get_active_display_cnt_wa(dc, context);
-
/*
* if it is safe to lower, but we are already in the lower state, we don't have to do anything
* also if safe to lower is false, we just go in the higher state
@@ -363,7 +294,7 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
}
if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) &&
- (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) {
+ (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) {
int requested_dispclk_khz = new_clocks->dispclk_khz;
dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true);
@@ -374,7 +305,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
dcn314_smu_set_dispclk(clk_mgr, requested_dispclk_khz);
clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
-
dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false);
update_dispclk = true;
@@ -462,65 +392,10 @@ bool dcn314_are_clock_states_equal(struct dc_clocks *a,
return true;
}
-
-static void dcn314_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
-{
- struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
-
- // read dtbclk
- internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
- internal->CLK1_CLK4_BYPASS_CNTL = REG_READ(CLK1_CLK4_BYPASS_CNTL);
-
- // read dcfclk
- internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
- internal->CLK1_CLK3_BYPASS_CNTL = REG_READ(CLK1_CLK3_BYPASS_CNTL);
-
- // read dcf deep sleep divider
- internal->CLK1_CLK3_DS_CNTL = REG_READ(CLK1_CLK3_DS_CNTL);
- internal->CLK1_CLK3_ALLOW_DS = REG_READ(CLK1_CLK3_ALLOW_DS);
-
- // read dppclk
- internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
- internal->CLK1_CLK1_BYPASS_CNTL = REG_READ(CLK1_CLK1_BYPASS_CNTL);
-
- // read dprefclk
- internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
- internal->CLK1_CLK2_BYPASS_CNTL = REG_READ(CLK1_CLK2_BYPASS_CNTL);
-
- // read dispclk
- internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
- internal->CLK1_CLK0_BYPASS_CNTL = REG_READ(CLK1_CLK0_BYPASS_CNTL);
-}
-
-void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
+static void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info)
{
-
- struct dcn35_clk_internal internal = {0};
-
- dcn314_dump_clk_registers_internal(&internal, clk_mgr_base);
-
- regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
- regs_and_bypass->dcf_deep_sleep_divider = internal.CLK1_CLK3_DS_CNTL / 10;
- regs_and_bypass->dcf_deep_sleep_allow = internal.CLK1_CLK3_ALLOW_DS;
- regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
- regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
- regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
- regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
-
- regs_and_bypass->dppclk_bypass = internal.CLK1_CLK1_BYPASS_CNTL & 0x0007;
- if (regs_and_bypass->dppclk_bypass > 4)
- regs_and_bypass->dppclk_bypass = 0;
- regs_and_bypass->dcfclk_bypass = internal.CLK1_CLK3_BYPASS_CNTL & 0x0007;
- if (regs_and_bypass->dcfclk_bypass > 4)
- regs_and_bypass->dcfclk_bypass = 0;
- regs_and_bypass->dispclk_bypass = internal.CLK1_CLK0_BYPASS_CNTL & 0x0007;
- if (regs_and_bypass->dispclk_bypass > 4)
- regs_and_bypass->dispclk_bypass = 0;
- regs_and_bypass->dprefclk_bypass = internal.CLK1_CLK2_BYPASS_CNTL & 0x0007;
- if (regs_and_bypass->dprefclk_bypass > 4)
- regs_and_bypass->dprefclk_bypass = 0;
-
+ return;
}
static struct clk_bw_params dcn314_bw_params = {
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
index 0577eb527bc36..002c28e807208 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
@@ -65,9 +65,4 @@ void dcn314_clk_mgr_construct(struct dc_context *ctx,
void dcn314_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int);
-
-void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
- struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info);
-
-
#endif //__DCN314_CLK_MGR_H__
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 206/844] drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (204 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 205/844] drm/amd/display: Revert "init dispclk from bootup clock for DCN314" Sasha Levin
@ 2026-02-28 17:21 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 207/844] drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts Sasha Levin
` (646 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:21 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ludovic Desroches, Manikandan Muralidharan, Sasha Levin
From: Ludovic Desroches <ludovic.desroches@microchip.com>
[ Upstream commit f12352471061df83a36edf54bbb16284793284e4 ]
After several commits, the slab memory increases. Some drm_crtc_commit
objects are not freed. The atomic_destroy_state callback only put the
framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
to put all the objects that are no longer needed.
It has been seen after hours of usage of a graphics application or using
kmemleak:
unreferenced object 0xc63a6580 (size 64):
comm "egt_basic", pid 171, jiffies 4294940784
hex dump (first 32 bytes):
40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
backtrace (crc c25aa925):
kmemleak_alloc+0x34/0x3c
__kmalloc_cache_noprof+0x150/0x1a4
drm_atomic_helper_setup_commit+0x1e8/0x7bc
drm_atomic_helper_commit+0x3c/0x15c
drm_atomic_commit+0xc0/0xf4
drm_atomic_helper_set_config+0x84/0xb8
drm_mode_setcrtc+0x32c/0x810
drm_ioctl+0x20c/0x488
sys_ioctl+0x14c/0xc20
ret_fast_syscall+0x0/0x54
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-1-79b615130dc3@microchip.com
Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 0ffec44c6d317..c0075894dc422 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -1190,8 +1190,7 @@ static void atmel_hlcdc_plane_atomic_destroy_state(struct drm_plane *p,
state->dscrs[i]->self);
}
- if (s->fb)
- drm_framebuffer_put(s->fb);
+ __drm_atomic_helper_plane_destroy_state(s);
kfree(state);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 207/844] drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (205 preceding siblings ...)
2026-02-28 17:21 ` [PATCH 6.19 206/844] drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 208/844] drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release Sasha Levin
` (645 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ludovic Desroches, Manikandan Muralidharan, Sasha Levin
From: Ludovic Desroches <ludovic.desroches@microchip.com>
[ Upstream commit 06682206e2a1883354ed758c09efeb51f435adbd ]
Don’t reject the commit when the source rectangle has fractional parts.
This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
drm_rect_clip_scaled(), which may introduce fractional parts while
computing the clipped source rectangle. This does not imply the commit is
invalid, so we should accept it instead of discarding it.
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Link: https://patch.msgid.link/20251120-lcd_scaling_fix-v1-1-5ffc98557923@microchip.com
Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 19 ++++---------------
1 file changed, 4 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index c0075894dc422..ec1fb5f9549a2 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -79,8 +79,6 @@ drm_plane_state_to_atmel_hlcdc_plane_state(struct drm_plane_state *s)
return container_of(s, struct atmel_hlcdc_plane_state, base);
}
-#define SUBPIXEL_MASK 0xffff
-
static uint32_t rgb_formats[] = {
DRM_FORMAT_C8,
DRM_FORMAT_XRGB4444,
@@ -745,24 +743,15 @@ static int atmel_hlcdc_plane_atomic_check(struct drm_plane *p,
if (ret || !s->visible)
return ret;
- hstate->src_x = s->src.x1;
- hstate->src_y = s->src.y1;
- hstate->src_w = drm_rect_width(&s->src);
- hstate->src_h = drm_rect_height(&s->src);
+ hstate->src_x = s->src.x1 >> 16;
+ hstate->src_y = s->src.y1 >> 16;
+ hstate->src_w = drm_rect_width(&s->src) >> 16;
+ hstate->src_h = drm_rect_height(&s->src) >> 16;
hstate->crtc_x = s->dst.x1;
hstate->crtc_y = s->dst.y1;
hstate->crtc_w = drm_rect_width(&s->dst);
hstate->crtc_h = drm_rect_height(&s->dst);
- if ((hstate->src_x | hstate->src_y | hstate->src_w | hstate->src_h) &
- SUBPIXEL_MASK)
- return -EINVAL;
-
- hstate->src_x >>= 16;
- hstate->src_y >>= 16;
- hstate->src_w >>= 16;
- hstate->src_h >>= 16;
-
hstate->nplanes = fb->format->num_planes;
if (hstate->nplanes > ATMEL_HLCDC_LAYER_MAX_PLANES)
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 208/844] drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (206 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 207/844] drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 209/844] media: rkisp1: Fix filter mode register configuration Sasha Levin
` (644 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ludovic Desroches, Manikandan Muralidharan, Sasha Levin
From: Ludovic Desroches <ludovic.desroches@microchip.com>
[ Upstream commit bc847787233277a337788568e90a6ee1557595eb ]
The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
the atmel_hlcdc_plane state structure without properly duplicating the
drm_plane_state. In particular, state->commit remained set to the old
state commit, which can lead to a use-after-free in the next
drm_atomic_commit() call.
Fix this by calling
__drm_atomic_helper_duplicate_plane_state(), which correctly clones
the base drm_plane_state (including the ->commit pointer).
It has been seen when closing and re-opening the device node while
another DRM client (e.g. fbdev) is still attached:
=============================================================================
BUG kmalloc-64 (Not tainted): Poison overwritten
-----------------------------------------------------------------------------
0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
pid=29
drm_atomic_helper_setup_commit+0x1e8/0x7bc
drm_atomic_helper_commit+0x3c/0x15c
drm_atomic_commit+0xc0/0xf4
drm_framebuffer_remove+0x4cc/0x5a8
drm_mode_rmfb_work_fn+0x6c/0x80
process_one_work+0x12c/0x2cc
worker_thread+0x2a8/0x400
kthread+0xc0/0xdc
ret_from_fork+0x14/0x28
Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
pid=169
drm_atomic_helper_commit_hw_done+0x100/0x150
drm_atomic_helper_commit_tail+0x64/0x8c
commit_tail+0x168/0x18c
drm_atomic_helper_commit+0x138/0x15c
drm_atomic_commit+0xc0/0xf4
drm_atomic_helper_set_config+0x84/0xb8
drm_mode_setcrtc+0x32c/0x810
drm_ioctl+0x20c/0x488
sys_ioctl+0x14c/0xc20
ret_fast_syscall+0x0/0x54
Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
flags=0x200(workingset|zone=0)
Object 0xc611b340 @offset=832 fp=0xc611b7c0
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Reviewed-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Link: https://patch.msgid.link/20251024-lcd_fixes_mainlining-v1-2-79b615130dc3@microchip.com
Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index ec1fb5f9549a2..e55e88d44e829 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -1160,8 +1160,7 @@ atmel_hlcdc_plane_atomic_duplicate_state(struct drm_plane *p)
return NULL;
}
- if (copy->base.fb)
- drm_framebuffer_get(copy->base.fb);
+ __drm_atomic_helper_plane_duplicate_state(p, ©->base);
return ©->base;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 209/844] media: rkisp1: Fix filter mode register configuration
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (207 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 208/844] drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 210/844] drm/amd/display: Revert "init dispclk from bootup clock for DCN315" Sasha Levin
` (643 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Rui Wang, Stefan Klug, Kieran Bingham, Laurent Pinchart,
Hans Verkuil, Sasha Levin
From: Rui Wang <rui.wang@ideasonboard.com>
[ Upstream commit 5a50f2b61104d0d351b59ec179f67abab7870453 ]
The rkisp1_flt_config() function performs an initial direct write to
RKISP1_CIF_ISP_FILT_MODE without including the RKISP1_CIF_ISP_FLT_ENA
bit, which clears the filter enable bit in the hardware.
The subsequent read/modify/write sequence then reads back the register
with the enable bit already cleared and cannot restore it, resulting in
the filter being inadvertently disabled.
Remove the redundant direct write. The read/modify/write sequence alone
correctly preserves the existing enable bit state while updating the
DNR mode and filter configuration bits.
Signed-off-by: Rui Wang <rui.wang@ideasonboard.com>
Reviewed-by: Stefan Klug <stefan.klug@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patch.msgid.link/20260105171142.147792-2-rui.wang@ideasonboard.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rkisp1/rkisp1-params.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
index c9f88635224cc..6442436a5e428 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-params.c
@@ -411,12 +411,6 @@ static void rkisp1_flt_config(struct rkisp1_params *params,
rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_LUM_WEIGHT,
arg->lum_weight);
- rkisp1_write(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE,
- (arg->mode ? RKISP1_CIF_ISP_FLT_MODE_DNR : 0) |
- RKISP1_CIF_ISP_FLT_CHROMA_V_MODE(arg->chr_v_mode) |
- RKISP1_CIF_ISP_FLT_CHROMA_H_MODE(arg->chr_h_mode) |
- RKISP1_CIF_ISP_FLT_GREEN_STAGE1(arg->grn_stage1));
-
/* avoid to override the old enable value */
filt_mode = rkisp1_read(params->rkisp1, RKISP1_CIF_ISP_FILT_MODE);
filt_mode &= RKISP1_CIF_ISP_FLT_ENA;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 210/844] drm/amd/display: Revert "init dispclk from bootup clock for DCN315"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (208 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 209/844] media: rkisp1: Fix filter mode register configuration Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 211/844] drm/amdgpu: mark invalid records with U64_MAX Sasha Levin
` (642 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wang, Sung-huai, Nicholas Kazlauskas, Matthew Stewart,
Dan Wheeler, Alex Deucher, Sasha Levin
From: "Wang, Sung-huai" <Danny.Wang@amd.com>
[ Upstream commit a625dc4989a2affb8f06e7b418bf30e1474b99c1 ]
[Why&How]
This reverts commit 14bb17cc37e0.
Due to the change, the display shows garbage on startup.
We have an alternative solution for the original issue:
d24203bb629f ("drm/amd/display: Re-check seamless boot can be enabled or not")
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Wang, Sung-huai <Danny.Wang@amd.com>
Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 90 +------------------
.../dc/clk_mgr/dcn315/dcn315_clk_mgr.h | 1 -
2 files changed, 3 insertions(+), 88 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
index 3a881451e9da4..c49268db85f68 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
@@ -40,7 +40,7 @@
#include "dm_helpers.h"
#include "dc_dmub_srv.h"
-#include "reg_helper.h"
+
#include "logger_types.h"
#undef DC_LOGGER
#define DC_LOGGER \
@@ -48,43 +48,9 @@
#include "link_service.h"
-#define MAX_INSTANCE 7
-#define MAX_SEGMENT 8
-
-struct IP_BASE_INSTANCE {
- unsigned int segment[MAX_SEGMENT];
-};
-
-struct IP_BASE {
- struct IP_BASE_INSTANCE instance[MAX_INSTANCE];
-};
-
-static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0, 0, 0, 0 } },
- { { 0x00016E00, 0x02401C00, 0, 0, 0, 0, 0, 0 } },
- { { 0x00017000, 0x02402000, 0, 0, 0, 0, 0, 0 } },
- { { 0x00017200, 0x02402400, 0, 0, 0, 0, 0, 0 } },
- { { 0x0001B000, 0x0242D800, 0, 0, 0, 0, 0, 0 } },
- { { 0x0001B200, 0x0242DC00, 0, 0, 0, 0, 0, 0 } } } };
-
-#define regCLK1_CLK0_CURRENT_CNT 0x0314
-#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK1_CURRENT_CNT 0x0315
-#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK2_CURRENT_CNT 0x0316
-#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK3_CURRENT_CNT 0x0317
-#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK4_CURRENT_CNT 0x0318
-#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX 0
-#define regCLK1_CLK5_CURRENT_CNT 0x0319
-#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX 0
-
#define TO_CLK_MGR_DCN315(clk_mgr)\
container_of(clk_mgr, struct clk_mgr_dcn315, base)
-#define REG(reg_name) \
- (CLK_BASE.instance[0].segment[reg ## reg_name ## _BASE_IDX] + reg ## reg_name)
-
#define UNSUPPORTED_DCFCLK 10000000
#define MIN_DPP_DISP_CLK 100000
@@ -172,7 +138,7 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
if (dc->work_arounds.skip_clock_update)
return;
- clk_mgr_base->clks.zstate_support = new_clocks->zstate_support;
+ display_count = dcn315_get_active_display_cnt_wa(dc, context);
/*
* if it is safe to lower, but we are already in the lower state, we don't have to do anything
* also if safe to lower is false, we just go in the higher state
@@ -185,7 +151,6 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
}
/* check that we're not already in lower */
if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) {
- display_count = dcn315_get_active_display_cnt_wa(dc, context);
/* if we can go lower, go lower */
if (display_count == 0) {
union display_idle_optimization_u idle_info = { 0 };
@@ -279,38 +244,9 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
dc_wake_and_execute_dmub_cmd(dc->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
}
-static void dcn315_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
-{
- struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
-
- // read dtbclk
- internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
-
- // read dcfclk
- internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
-
- // read dppclk
- internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
-
- // read dprefclk
- internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
-
- // read dispclk
- internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
-}
-
static void dcn315_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info)
{
- struct dcn35_clk_internal internal = {0};
-
- dcn315_dump_clk_registers_internal(&internal, clk_mgr_base);
-
- regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
- regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
- regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
- regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
- regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
return;
}
@@ -657,32 +593,13 @@ static struct clk_mgr_funcs dcn315_funcs = {
.get_dp_ref_clk_frequency = dce12_get_dp_ref_freq_khz,
.get_dtb_ref_clk_frequency = dcn31_get_dtb_ref_freq_khz,
.update_clocks = dcn315_update_clocks,
- .init_clocks = dcn315_init_clocks,
+ .init_clocks = dcn31_init_clocks,
.enable_pme_wa = dcn315_enable_pme_wa,
.are_clock_states_equal = dcn31_are_clock_states_equal,
.notify_wm_ranges = dcn315_notify_wm_ranges
};
extern struct clk_mgr_funcs dcn3_fpga_funcs;
-void dcn315_init_clocks(struct clk_mgr *clk_mgr)
-{
- struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
- uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
- struct clk_mgr_dcn315 *clk_mgr_dcn315 = TO_CLK_MGR_DCN315(clk_mgr_int);
- struct clk_log_info log_info = {0};
-
- memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
- // Assumption is that boot state always supports pstate
- clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk
- clk_mgr->clks.p_state_change_support = true;
- clk_mgr->clks.prev_p_state_change_support = true;
- clk_mgr->clks.pwr_state = DCN_PWR_STATE_UNKNOWN;
- clk_mgr->clks.zstate_support = DCN_ZSTATE_SUPPORT_UNKNOWN;
-
- dcn315_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn315->base.base, &log_info);
- clk_mgr->clks.dispclk_khz = clk_mgr->boot_snapshot.dispclk * 1000;
-}
-
void dcn315_clk_mgr_construct(
struct dc_context *ctx,
struct clk_mgr_dcn315 *clk_mgr,
@@ -743,7 +660,6 @@ void dcn315_clk_mgr_construct(
/* Saved clocks configured at boot for debug purposes */
dcn315_dump_clk_registers(&clk_mgr->base.base.boot_snapshot,
&clk_mgr->base.base, &log_info);
- clk_mgr->base.base.clks.dispclk_khz = clk_mgr->base.base.boot_snapshot.dispclk * 1000;
clk_mgr->base.base.dprefclk_khz = 600000;
clk_mgr->base.base.dprefclk_khz = dcn315_smu_get_dpref_clk(&clk_mgr->base);
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h
index 642ae3d4a7909..ac36ddf5dd1af 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.h
@@ -44,7 +44,6 @@ void dcn315_clk_mgr_construct(struct dc_context *ctx,
struct pp_smu_funcs *pp_smu,
struct dccg *dccg);
-void dcn315_init_clocks(struct clk_mgr *clk_mgr);
void dcn315_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int);
#endif //__DCN315_CLK_MGR_H__
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 211/844] drm/amdgpu: mark invalid records with U64_MAX
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (209 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 210/844] drm/amd/display: Revert "init dispclk from bootup clock for DCN315" Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 212/844] HID: multitouch: add eGalaxTouch EXC3188 support Sasha Levin
` (641 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Gangliang Xie, Tao Zhou, Alex Deucher, Sasha Levin
From: Gangliang Xie <ganglxie@amd.com>
[ Upstream commit 0028b86b52f7609e36af635ef6cb908925306233 ]
set retired_page of invalid ras records to U64_MAX, and skip
them when reading ras records
Signed-off-by: Gangliang Xie <ganglxie@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 6b069dc4bab06..ee4d08b0988d3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -2777,6 +2777,10 @@ static int amdgpu_ras_badpages_read(struct amdgpu_device *adev,
if (!data->bps[i].ts)
continue;
+ /* U64_MAX is used to mark the record as invalid */
+ if (data->bps[i].retired_page == U64_MAX)
+ continue;
+
bps[r].bp = data->bps[i].retired_page;
r++;
if (r >= count)
@@ -3083,6 +3087,8 @@ static int __amdgpu_ras_restore_bad_pages(struct amdgpu_device *adev,
if (amdgpu_ras_check_bad_page_unlock(con,
bps[j].retired_page << AMDGPU_GPU_PAGE_SHIFT)) {
+ /* set to U64_MAX to mark it as invalid */
+ data->bps[data->count].retired_page = U64_MAX;
data->count++;
data->space_left--;
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 212/844] HID: multitouch: add eGalaxTouch EXC3188 support
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (210 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 211/844] drm/amdgpu: mark invalid records with U64_MAX Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 213/844] media: uvcvideo: Create an ID namespace for streaming output terminals Sasha Levin
` (640 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thorsten Schmelzer, Michael Tretter, Jiri Kosina, Sasha Levin
From: Thorsten Schmelzer <tschmelzer@topcon.com>
[ Upstream commit 8e4ac86b2ddd36fe501e20ecfcc080e536df1f48 ]
Add support for the for the EXC3188 touchscreen from eGalaxy.
Signed-off-by: Thorsten Schmelzer <tschmelzer@topcon.com>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-multitouch.c | 3 +++
2 files changed, 4 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5a18cb41e6d79..6d8b64872cefe 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -437,6 +437,7 @@
#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
+#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000 0xc000
#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
#define USB_VENDOR_ID_EDIFIER 0x2d99
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f21850f7d89e4..7daa8f6d81870 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -2212,6 +2212,9 @@ static const struct hid_device_id mt_devices[] = {
{ .driver_data = MT_CLS_EGALAX_SERIAL,
MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C000) },
{ .driver_data = MT_CLS_EGALAX,
MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 213/844] media: uvcvideo: Create an ID namespace for streaming output terminals
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (211 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 212/844] HID: multitouch: add eGalaxTouch EXC3188 support Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 214/844] HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK Sasha Levin
` (639 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ricardo Ribalda, Laurent Pinchart, Lili Orosz, Hans Verkuil,
Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 3d9f32e02c2ed85338be627de672e2b81b88a836 ]
Some devices, such as the Grandstream GUV3100 and the LSK Meeting Eye
for Business & Home, exhibit entity ID collisions between units and
streaming output terminals.
The UVC specification requires unit and terminal IDs to be unique, and
uses the ID to reference entities:
- In control requests, to identify the target entity
- In the UVC units and terminals descriptors' bSourceID field, to
identify source entities
- In the UVC input header descriptor's bTerminalLink, to identify the
terminal associated with a streaming interface
Entity ID collisions break accessing controls and make the graph
description in the UVC descriptors ambiguous. However, collisions where
one of the entities is a streaming output terminal and the other entity
is not a streaming terminal are less severe. Streaming output terminals
have no controls, and, as they are the final entity in pipelines, they
are never referenced in descriptors as source entities. They are
referenced by ID only from innput header descriptors, which by
definition only reference streaming terminals.
For these reasons, we can work around the collision by giving streaming
output terminals their own ID namespace. Do so by setting bit
UVC_TERM_OUTPUT (15) in the uvc_entity.id field, which is normally never
set as the ID is a 8-bit value.
This ID change doesn't affect the entity name in the media controller
graph as the name isn't constructed from the ID, so there should not be
any impact on the uAPI.
Although this change handles some ID collisions automagically, keep
printing an error in uvc_alloc_new_entity() when a camera has invalid
descriptors. Hopefully this message will help vendors fix their invalid
descriptors.
This new method of handling ID collisions includes a revert of commit
758dbc756aad ("media: uvcvideo: Use heuristic to find stream entity")
that attempted to fix the problem urgently due to regression reports.
Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-by: Lili Orosz <lily@floofy.city>
Co-developed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patch.msgid.link/20251113210400.28618-1-laurent.pinchart@ideasonboard.com
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_driver.c | 54 ++++++++++++++++++------------
drivers/media/usb/uvc/uvcvideo.h | 3 +-
2 files changed, 35 insertions(+), 22 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index ee4f54d683496..aa3e8d295e0f5 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -165,28 +165,17 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev,
return NULL;
}
-static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id)
+static struct uvc_streaming *uvc_stream_for_terminal(struct uvc_device *dev,
+ struct uvc_entity *term)
{
- struct uvc_streaming *stream, *last_stream;
- unsigned int count = 0;
+ u16 id = UVC_HARDWARE_ENTITY_ID(term->id);
+ struct uvc_streaming *stream;
list_for_each_entry(stream, &dev->streams, list) {
- count += 1;
- last_stream = stream;
if (stream->header.bTerminalLink == id)
return stream;
}
- /*
- * If the streaming entity is referenced by an invalid ID, notify the
- * user and use heuristics to guess the correct entity.
- */
- if (count == 1 && id == UVC_INVALID_ENTITY_ID) {
- dev_warn(&dev->intf->dev,
- "UVC non compliance: Invalid USB header. The streaming entity has an invalid ID, guessing the correct one.");
- return last_stream;
- }
-
return NULL;
}
@@ -823,10 +812,12 @@ static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
}
/* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
- if (uvc_entity_by_id(dev, id)) {
- dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id);
+ if (uvc_entity_by_id(dev, UVC_HARDWARE_ENTITY_ID(id)))
+ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n",
+ UVC_HARDWARE_ENTITY_ID(id));
+
+ if (uvc_entity_by_id(dev, id))
id = UVC_INVALID_ENTITY_ID;
- }
extra_size = roundup(extra_size, sizeof(*entity->pads));
if (num_pads)
@@ -982,6 +973,7 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
struct usb_host_interface *alts = dev->intf->cur_altsetting;
unsigned int i, n, p, len;
const char *type_name;
+ unsigned int id;
u16 type;
switch (buffer[2]) {
@@ -1120,8 +1112,28 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
return 0;
}
+ id = buffer[3];
+
+ /*
+ * Some devices, such as the Grandstream GUV3100, exhibit entity
+ * ID collisions between units and streaming output terminals.
+ * Move streaming output terminals to their own ID namespace by
+ * setting bit UVC_TERM_OUTPUT (15), above the ID's 8-bit value.
+ * The bit is ignored in uvc_stream_for_terminal() when looking
+ * up the streaming interface for the terminal.
+ *
+ * This hack is safe to enable unconditionally, as the ID is not
+ * used for any other purpose (streaming output terminals have
+ * no controls and are never referenced as sources in UVC
+ * descriptors). Other types output terminals can have controls,
+ * so limit usage of this separate namespace to streaming output
+ * terminals.
+ */
+ if (type & UVC_TT_STREAMING)
+ id |= UVC_TERM_OUTPUT;
+
term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
- buffer[3], 1, 0);
+ id, 1, 0);
if (IS_ERR(term))
return PTR_ERR(term);
@@ -2118,8 +2130,8 @@ static int uvc_register_terms(struct uvc_device *dev,
if (UVC_ENTITY_TYPE(term) != UVC_TT_STREAMING)
continue;
- stream = uvc_stream_by_id(dev, term->id);
- if (stream == NULL) {
+ stream = uvc_stream_for_terminal(dev, term);
+ if (!stream) {
dev_info(&dev->intf->dev,
"No streaming interface found for terminal %u.",
term->id);
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index ed7bad31f75ca..3f2e832025e71 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -41,7 +41,8 @@
#define UVC_EXT_GPIO_UNIT 0x7ffe
#define UVC_EXT_GPIO_UNIT_ID 0x100
-#define UVC_INVALID_ENTITY_ID 0xffff
+#define UVC_HARDWARE_ENTITY_ID(id) ((id) & 0xff)
+#define UVC_INVALID_ENTITY_ID 0xffff
/* ------------------------------------------------------------------------
* Driver specific constants.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 214/844] HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (212 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 213/844] media: uvcvideo: Create an ID namespace for streaming output terminals Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 215/844] ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro Sasha Levin
` (638 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: David Phillips, Jiri Kosina, Sasha Levin
From: David Phillips <david@profile.sh>
[ Upstream commit b8e5fdf0bd022cd5493a5987ef66f5a24f8352d8 ]
New model in the ELECOM HUGE trackball line that has 8 buttons but the
report descriptor specifies only 5. The HUGE Plus supports connecting via
Bluetooth, 2.4GHz wireless USB dongle, and directly via a USB-C cable.
Each connection type reports a different device id, 01AA for cable,
01AB for USB dongle, and 01AC for Bluetooth.
This patch adds these device IDs and applies the fixups similar to the
other ELECOM devices to get all 8 buttons working for all 3 connection
types.
For reference, the usbhid-dump output:
001:013:001:DESCRIPTOR 1769085639.598405
05 01 09 02 A1 01 85 01 09 01 A1 00 05 09 19 01
29 05 15 00 25 01 75 01 95 05 81 02 75 03 95 01
81 01 05 01 09 30 09 31 16 01 80 26 FF 7F 75 10
95 02 81 06 09 38 15 81 25 7F 75 08 95 01 81 06
05 0C 0A 38 02 15 81 25 7F 75 08 95 01 81 06 C0
C0 05 0C 09 01 A1 01 85 02 15 01 26 8C 02 19 01
2A 8C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01
85 03 09 82 09 81 09 83 15 00 25 01 19 01 29 03
75 01 95 03 81 02 95 05 81 01 C0 06 01 FF 09 00
A1 01 85 08 09 00 15 00 26 FF 00 75 08 95 07 81
02 C0 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26
FF 00 75 08 95 07 B1 02 C0
Signed-off-by: David Phillips <david@profile.sh>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/Kconfig | 1 +
drivers/hid/hid-elecom.c | 16 ++++++++++++++++
drivers/hid/hid-ids.h | 3 +++
drivers/hid/hid-quirks.c | 3 +++
4 files changed, 23 insertions(+)
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 920a64b66b25b..6ff4a3ad34cbf 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -369,6 +369,7 @@ config HID_ELECOM
- EX-G Trackballs (M-XT3DRBK, M-XT3URBK)
- DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
- HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
+ - HUGE Plus Trackball (M-HT1MRBK)
config HID_ELO
tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index 2003d2dcda7cc..37d88ce57f671 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -5,6 +5,7 @@
* - EX-G Trackballs (M-XT3DRBK, M-XT3URBK, M-XT4DRBK)
* - DEFT Trackballs (M-DT1DRBK, M-DT1URBK, M-DT2DRBK, M-DT2URBK)
* - HUGE Trackballs (M-HT1DRBK, M-HT1URBK)
+ * - HUGE Plus Trackball (M-HT1MRBK)
*
* Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
* Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
@@ -123,12 +124,25 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
*/
mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
break;
+ case USB_DEVICE_ID_ELECOM_M_HT1MRBK:
+ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB:
+ case USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC:
+ /*
+ * Report descriptor format:
+ * 24: button bit count
+ * 28: padding bit count
+ * 22: button report size
+ * 16: button usage maximum
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 24, 28, 22, 16, 8);
+ break;
}
return rdesc;
}
static const struct hid_device_id elecom_devices[] = {
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
@@ -142,6 +156,8 @@ static const struct hid_device_id elecom_devices[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
{ }
};
MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 6d8b64872cefe..85ab1ac511096 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -466,6 +466,9 @@
#define USB_DEVICE_ID_ELECOM_M_HT1URBK_019B 0x019b
#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
+#define USB_DEVICE_ID_ELECOM_M_HT1MRBK 0x01aa
+#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB 0x01ab
+#define USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC 0x01ac
#define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
#define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 11438039cdb7f..3217e436c052c 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -420,6 +420,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
#if IS_ENABLED(CONFIG_HID_ELECOM)
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AC) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK_00FC) },
@@ -432,6 +433,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK_019B) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
{ HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1MRBK_01AB) },
#endif
#if IS_ENABLED(CONFIG_HID_ELO)
{ HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 215/844] ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (213 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 214/844] HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 216/844] ALSA: hda/realtek: fix LG Gram Style 14 speakers Sasha Levin
` (637 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: gongqi, Takashi Iwai, Sasha Levin
From: gongqi <550230171hxy@gmail.com>
[ Upstream commit f2581ea2d9f30844c437e348a462027ea25c12e9 ]
The headset microphone on the MECHREVO Wujie 15X Pro requires the
CXT_FIXUP_HEADSET_MIC quirk to function properly. Add the PCI SSID
(0x1d05:0x3012) to the quirk table.
Signed-off-by: gongqi <550230171hxy@gmail.com>
Link: https://patch.msgid.link/20260122155501.376199-5-550230171hxy@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/conexant.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index 0c517378a6d28..f71123a475464 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -1134,6 +1134,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad/Ideapad", CXT_FIXUP_LENOVO_XPAD_ACPI),
SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
SND_PCI_QUIRK(0x1c06, 0x2012, "Lemote A1205", CXT_PINCFG_LEMOTE_A1205),
+ SND_PCI_QUIRK(0x1d05, 0x3012, "MECHREVO Wujie 15X Pro", CXT_FIXUP_HEADSET_MIC),
HDA_CODEC_QUIRK(0x2782, 0x12c3, "Sirius Gen1", CXT_PINCFG_TOP_SPEAKER),
HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER),
{}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 216/844] ALSA: hda/realtek: fix LG Gram Style 14 speakers
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (214 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 215/844] ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 217/844] gpio: aspeed-sgpio: Change the macro to support deferred probe Sasha Levin
` (636 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Damien Dagorn, Takashi Iwai, Sasha Levin
From: Damien Dagorn <damien.dagorn29@gmail.com>
[ Upstream commit cc051fbd7f40226cc407558bc97c5099513e8657 ]
The LG Gram Style 14 (14Z90RS-G.AD77F, SSID 1854:0490) with Realtek ALC298
shows normal routing and volume changes, but internal speakers stay silent
unless a userland HDA-verb workaround is applied.
Add a dedicated quirk for the LG Gram Style 14 that programs the codec
coefficient sequence used by the known workaround and enables the speaker
amps only during playback.
Tested-by: Damien Dagorn <damien.dagorn29@gmail.com>
Signed-off-by: Damien Dagorn <damien.dagorn29@gmail.com>
Link: https://lore.kernel.org/CAN59QMUhd4kHrkRoJA6VzEr2VKezN2yjHnANaQoZn2-Bnwe3bQ@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 170 ++++++++++++++++++++++++++++++
1 file changed, 170 insertions(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index c9f59e62ee022..b6fae275919c6 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -1854,6 +1854,163 @@ static void alc298_samsung_v2_init_amps(struct hda_codec *codec,
spec->gen.pcm_playback_hook = alc298_samsung_v2_playback_hook;
}
+/* LG Gram Style 14: program vendor coef sequence used by HDA-verb workaround */
+struct alc298_lg_gram_style_seq {
+ unsigned short verb;
+ unsigned short idx;
+ unsigned short val;
+};
+
+static void alc298_lg_gram_style_coef_write(struct hda_codec *codec,
+ unsigned int verb,
+ unsigned int idx,
+ unsigned int val)
+{
+ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x23);
+ snd_hda_codec_write(codec, 0x20, 0, verb, idx);
+ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0x00);
+ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, val);
+ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb011);
+}
+
+static void alc298_lg_gram_style_run_seq(struct hda_codec *codec,
+ const struct alc298_lg_gram_style_seq *seq,
+ int seq_size)
+{
+ int i;
+
+ for (i = 0; i < seq_size; i++)
+ alc298_lg_gram_style_coef_write(codec, seq[i].verb,
+ seq[i].idx, seq[i].val);
+}
+
+/* Coef sequences derived from the HDA-verb workaround for this model. */
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_preinit_seq[] = {
+ { 0x420, 0x00, 0x01 },
+};
+
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_disable_seq[] = {
+ { 0x423, 0xff, 0x00 },
+ { 0x420, 0x3a, 0x80 },
+};
+
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_enable_seq[] = {
+ { 0x420, 0x3a, 0x81 },
+ { 0x423, 0xff, 0x01 },
+};
+
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_38[] = {
+ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
+ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
+ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
+ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
+ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
+ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
+};
+
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_39[] = {
+ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
+ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
+ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
+ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
+ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0x99, 0x03 },
+ { 0x423, 0xa4, 0xb5 }, { 0x423, 0xa5, 0x01 }, { 0x423, 0xba, 0x94 },
+};
+
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3c[] = {
+ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
+ { 0x420, 0x1b, 0x01 }, { 0x420, 0x1d, 0x01 }, { 0x420, 0x1f, 0xfe },
+ { 0x420, 0x21, 0x00 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
+ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
+ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
+};
+
+static const struct alc298_lg_gram_style_seq alc298_lg_gram_style_init_seq_3d[] = {
+ { 0x423, 0xe1, 0x00 }, { 0x420, 0x12, 0x6f }, { 0x420, 0x14, 0x00 },
+ { 0x420, 0x1b, 0x02 }, { 0x420, 0x1d, 0x02 }, { 0x420, 0x1f, 0xfd },
+ { 0x420, 0x21, 0x01 }, { 0x420, 0x22, 0x10 }, { 0x420, 0x3d, 0x05 },
+ { 0x420, 0x3f, 0x03 }, { 0x420, 0x50, 0x2c }, { 0x420, 0x76, 0x0e },
+ { 0x420, 0x7c, 0x4a }, { 0x420, 0x81, 0x03 }, { 0x423, 0xba, 0x8d },
+};
+
+struct alc298_lg_gram_style_amp_desc {
+ unsigned char nid;
+ const struct alc298_lg_gram_style_seq *init_seq;
+ int init_seq_size;
+};
+
+static const struct alc298_lg_gram_style_amp_desc alc298_lg_gram_style_amps[] = {
+ { 0x38, alc298_lg_gram_style_init_seq_38,
+ ARRAY_SIZE(alc298_lg_gram_style_init_seq_38) },
+ { 0x39, alc298_lg_gram_style_init_seq_39,
+ ARRAY_SIZE(alc298_lg_gram_style_init_seq_39) },
+ { 0x3c, alc298_lg_gram_style_init_seq_3c,
+ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3c) },
+ { 0x3d, alc298_lg_gram_style_init_seq_3d,
+ ARRAY_SIZE(alc298_lg_gram_style_init_seq_3d) },
+};
+
+static void alc298_lg_gram_style_enable_amps(struct hda_codec *codec)
+{
+ struct alc_spec *spec = codec->spec;
+ int i;
+
+ for (i = 0; i < spec->num_speaker_amps; i++) {
+ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
+ alc298_lg_gram_style_run_seq(codec,
+ alc298_lg_gram_style_enable_seq,
+ ARRAY_SIZE(alc298_lg_gram_style_enable_seq));
+ }
+}
+
+static void alc298_lg_gram_style_disable_amps(struct hda_codec *codec)
+{
+ struct alc_spec *spec = codec->spec;
+ int i;
+
+ for (i = 0; i < spec->num_speaker_amps; i++) {
+ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
+ alc298_lg_gram_style_run_seq(codec,
+ alc298_lg_gram_style_disable_seq,
+ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
+ }
+}
+
+static void alc298_lg_gram_style_playback_hook(struct hda_pcm_stream *hinfo,
+ struct hda_codec *codec,
+ struct snd_pcm_substream *substream,
+ int action)
+{
+ if (action == HDA_GEN_PCM_ACT_OPEN)
+ alc298_lg_gram_style_enable_amps(codec);
+ if (action == HDA_GEN_PCM_ACT_CLOSE)
+ alc298_lg_gram_style_disable_amps(codec);
+}
+
+static void alc298_lg_gram_style_init_amps(struct hda_codec *codec)
+{
+ struct alc_spec *spec = codec->spec;
+ int i;
+
+ spec->num_speaker_amps = ARRAY_SIZE(alc298_lg_gram_style_amps);
+
+ for (i = 0; i < spec->num_speaker_amps; i++) {
+ alc_write_coef_idx(codec, 0x22, alc298_lg_gram_style_amps[i].nid);
+ alc298_lg_gram_style_run_seq(codec,
+ alc298_lg_gram_style_preinit_seq,
+ ARRAY_SIZE(alc298_lg_gram_style_preinit_seq));
+ alc298_lg_gram_style_run_seq(codec,
+ alc298_lg_gram_style_disable_seq,
+ ARRAY_SIZE(alc298_lg_gram_style_disable_seq));
+ alc298_lg_gram_style_run_seq(codec,
+ alc298_lg_gram_style_amps[i].init_seq,
+ alc298_lg_gram_style_amps[i].init_seq_size);
+ alc_write_coef_idx(codec, 0x89, 0x0);
+ }
+
+ spec->gen.pcm_playback_hook = alc298_lg_gram_style_playback_hook;
+}
+
static void alc298_fixup_samsung_amp_v2_2_amps(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
@@ -1868,6 +2025,13 @@ static void alc298_fixup_samsung_amp_v2_4_amps(struct hda_codec *codec,
alc298_samsung_v2_init_amps(codec, 4);
}
+static void alc298_fixup_lg_gram_style_14(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ if (action == HDA_FIXUP_ACT_PROBE)
+ alc298_lg_gram_style_init_amps(codec);
+}
+
static void gpio2_mic_hotkey_event(struct hda_codec *codec,
struct hda_jack_callback *event)
{
@@ -3764,6 +3928,7 @@ enum {
ALC298_FIXUP_SAMSUNG_AMP,
ALC298_FIXUP_SAMSUNG_AMP_V2_2_AMPS,
ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS,
+ ALC298_FIXUP_LG_GRAM_STYLE_14,
ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET,
ALC295_FIXUP_ASUS_MIC_NO_PRESENCE,
@@ -5459,6 +5624,10 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc298_fixup_samsung_amp_v2_4_amps
},
+ [ALC298_FIXUP_LG_GRAM_STYLE_14] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc298_fixup_lg_gram_style_14
+ },
[ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = {
.type = HDA_FIXUP_VERBS,
.v.verbs = (const struct hda_verb[]) {
@@ -7406,6 +7575,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1854, 0x0488, "LG gram 16 (16Z90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
SND_PCI_QUIRK(0x1854, 0x0489, "LG gram 16 (16Z90R-A)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
SND_PCI_QUIRK(0x1854, 0x048a, "LG gram 17 (17ZD90R)", ALC298_FIXUP_SAMSUNG_AMP_V2_4_AMPS),
+ SND_PCI_QUIRK(0x1854, 0x0490, "LG Gram Style 14 (14Z90RS)", ALC298_FIXUP_LG_GRAM_STYLE_14),
SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 217/844] gpio: aspeed-sgpio: Change the macro to support deferred probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (215 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 216/844] ALSA: hda/realtek: fix LG Gram Style 14 speakers Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 218/844] ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio Sasha Levin
` (635 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Billy Tsai, Linus Walleij, Bartosz Golaszewski, Sasha Levin
From: Billy Tsai <billy_tsai@aspeedtech.com>
[ Upstream commit e18533b023ec7a33488bcf33140ce69bbba2894f ]
Use module_platform_driver() to replace module_platform_driver_probe().
The former utilizes platform_driver_register(), which allows the driver to
defer probing when it doesn't acquire the necessary resources due to probe
order. In contrast, the latter uses __platform_driver_probe(), which
includes the comment "Note that this is incompatible with deferred
probing." Since our SGPIO driver requires access to the clock resource, the
former is more suitable.
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Link: https://lore.kernel.org/r/20260123-upstream_sgpio-v2-1-69cfd1631400@aspeedtech.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-aspeed-sgpio.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
index 7622f9e9f54af..318cd0e397416 100644
--- a/drivers/gpio/gpio-aspeed-sgpio.c
+++ b/drivers/gpio/gpio-aspeed-sgpio.c
@@ -516,7 +516,7 @@ static const struct of_device_id aspeed_sgpio_of_table[] = {
MODULE_DEVICE_TABLE(of, aspeed_sgpio_of_table);
-static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+static int aspeed_sgpio_probe(struct platform_device *pdev)
{
u32 nr_gpios, sgpio_freq, sgpio_clk_div, gpio_cnt_regval, pin_mask;
const struct aspeed_sgpio_pdata *pdata;
@@ -611,11 +611,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
}
static struct platform_driver aspeed_sgpio_driver = {
+ .probe = aspeed_sgpio_probe,
.driver = {
.name = KBUILD_MODNAME,
.of_match_table = aspeed_sgpio_of_table,
},
};
-module_platform_driver_probe(aspeed_sgpio_driver, aspeed_sgpio_probe);
+module_platform_driver(aspeed_sgpio_driver);
MODULE_DESCRIPTION("Aspeed Serial GPIO Driver");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 218/844] ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (216 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 217/844] gpio: aspeed-sgpio: Change the macro to support deferred probe Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 219/844] spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end Sasha Levin
` (634 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chen Ni, Mark Brown, Sasha Levin
From: Chen Ni <nichen@iscas.ac.cn>
[ Upstream commit 74823db9ba2e13f3ec007b354759b3d8125e462c ]
Add check for the return value of devm_regmap_init_mmio() and return the
error if it fails in order to catch the error.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://patch.msgid.link/20260127033250.2044608-1-nichen@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sunxi/sun50i-dmic.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/soc/sunxi/sun50i-dmic.c b/sound/soc/sunxi/sun50i-dmic.c
index bab1e29c99887..eddfebe166169 100644
--- a/sound/soc/sunxi/sun50i-dmic.c
+++ b/sound/soc/sunxi/sun50i-dmic.c
@@ -358,6 +358,9 @@ static int sun50i_dmic_probe(struct platform_device *pdev)
host->regmap = devm_regmap_init_mmio(&pdev->dev, base,
&sun50i_dmic_regmap_config);
+ if (IS_ERR(host->regmap))
+ return dev_err_probe(&pdev->dev, PTR_ERR(host->regmap),
+ "failed to initialise regmap\n");
/* Clocks */
host->bus_clk = devm_clk_get(&pdev->dev, "bus");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 219/844] spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (217 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 218/844] ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 220/844] drm/amd/display: Fix GFX12 family constant checks Sasha Levin
` (633 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chin-Ting Kuo, Paul Menzel, Mark Brown, Sasha Levin
From: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
[ Upstream commit 53f826ff5e0e3ecb279862ca7cce1491b94bb017 ]
spi_mem_dirmap_create() may reconfigure controller-wide settings,
which can interfere with concurrent transfers to other devices
sharing the same SPI controller but using different chip selects.
Wrap the ->dirmap_create() callback with spi_mem_access_start() and
spi_mem_access_end() to serialize access and prevent cross-CS
interference during dirmap creation.
This patch has been verified on a setup where a SPI TPM is connected
to CS0 of a SPI controller, while a SPI NOR flash is connected to CS1
of the same controller. Without this patch, spi_mem_dirmap_create()
for the SPI NOR flash interferes with ongoing SPI TPM data transfers,
resulting in failure to create the TPM device. This was tested on an
ASPEED AST2700 EVB.
Signed-off-by: Chin-Ting Kuo <chin-ting_kuo@aspeedtech.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Link: https://patch.msgid.link/20260120123005.1392071-2-chin-ting_kuo@aspeedtech.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-mem.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
index 6c7921469b90b..965673bac98b9 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
@@ -719,9 +719,18 @@ spi_mem_dirmap_create(struct spi_mem *mem,
desc->mem = mem;
desc->info = *info;
- if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create)
+ if (ctlr->mem_ops && ctlr->mem_ops->dirmap_create) {
+ ret = spi_mem_access_start(mem);
+ if (ret) {
+ kfree(desc);
+ return ERR_PTR(ret);
+ }
+
ret = ctlr->mem_ops->dirmap_create(desc);
+ spi_mem_access_end(mem);
+ }
+
if (ret) {
desc->nodirmap = true;
if (!spi_mem_supports_op(desc->mem, &desc->info.op_tmpl))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 220/844] drm/amd/display: Fix GFX12 family constant checks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (218 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 219/844] spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 221/844] drm/amd/display: avoid dig reg access timeout on usb4 link training fail Sasha Levin
` (632 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Matthew Stewart, Aurabindo Pillai, Dan Wheeler, Alex Deucher,
Sasha Levin
From: Matthew Stewart <Matthew.Stewart2@amd.com>
[ Upstream commit bdad08670278829771626ea7b57c4db531e2544f ]
Using >=, <= for checking the family is not always correct.
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 62622aa622066..209a6e5c713ca 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -11853,7 +11853,7 @@ static int dm_check_cursor_fb(struct amdgpu_crtc *new_acrtc,
* check tiling flags when the FB doesn't have a modifier.
*/
if (!(fb->flags & DRM_MODE_FB_MODIFIERS)) {
- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
+ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
linear = AMDGPU_TILING_GET(afb->tiling_flags, GFX12_SWIZZLE_MODE) == 0;
} else if (adev->family >= AMDGPU_FAMILY_AI) {
linear = AMDGPU_TILING_GET(afb->tiling_flags, SWIZZLE_MODE) == 0;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
index f0946e67aef97..7474f1bc1d0b8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -278,7 +278,7 @@ static int amdgpu_dm_plane_validate_dcc(struct amdgpu_device *adev,
if (!dcc->enable)
return 0;
- if (adev->family < AMDGPU_FAMILY_GC_12_0_0 &&
+ if (adev->family != AMDGPU_FAMILY_GC_12_0_0 &&
format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN)
return -EINVAL;
@@ -901,7 +901,7 @@ int amdgpu_dm_plane_fill_plane_buffer_attributes(struct amdgpu_device *adev,
upper_32_bits(chroma_addr);
}
- if (adev->family >= AMDGPU_FAMILY_GC_12_0_0) {
+ if (adev->family == AMDGPU_FAMILY_GC_12_0_0) {
ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format,
rotation, plane_size,
tiling_info, dcc,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 221/844] drm/amd/display: avoid dig reg access timeout on usb4 link training fail
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (219 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 220/844] drm/amd/display: Fix GFX12 family constant checks Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 222/844] spi: cadence-qspi: Fix probe error path and remove Sasha Levin
` (631 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhongwei, Wenjing Liu, Aurabindo Pillai, Dan Wheeler,
Alex Deucher, Sasha Levin
From: Zhongwei <Zhongwei.Zhang@amd.com>
[ Upstream commit 15b1d7b77e9836ff4184093163174a1ef28bbdd7 ]
[Why]
When usb4 link training fails, the dpia sym clock will be disabled and SYMCLK
source should be changed back to phy clock. In enable_streams, it is
assumed that link training succeeded and will switch from refclk to
phy clock. But phy clk here might not be on. Dig reg access timeout
will occur.
[How]
When enable_stream is hit, check if link training failed for usb4.
If it did, fall back to the ref clock to avoid reg access timeout.
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Signed-off-by: Zhongwei <Zhongwei.Zhang@amd.com>
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
index c8ff8ae85a030..517d4c08d34c4 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
@@ -3058,9 +3058,17 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx)
dccg->funcs->enable_symclk32_se(dccg, dp_hpo_inst, phyd32clk);
}
} else {
- if (dccg->funcs->enable_symclk_se)
- dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
+ if (dccg->funcs->enable_symclk_se && link_enc) {
+ if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA
+ && link->cur_link_settings.link_rate == LINK_RATE_UNKNOWN
+ && !link->link_status.link_active) {
+ if (dccg->funcs->disable_symclk_se)
+ dccg->funcs->disable_symclk_se(dccg, stream_enc->stream_enc_inst,
link_enc->transmitter - TRANSMITTER_UNIPHY_A);
+ } else
+ dccg->funcs->enable_symclk_se(dccg, stream_enc->stream_enc_inst,
+ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
+ }
}
if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 222/844] spi: cadence-qspi: Fix probe error path and remove
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (220 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 221/844] drm/amd/display: avoid dig reg access timeout on usb4 link training fail Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 223/844] drm/amdgpu: validate user queue size constraints Sasha Levin
` (630 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miquel Raynal (Schneider Electric), Wolfram Sang,
Santhosh Kumar K, Mark Brown, Sasha Levin
From: "Miquel Raynal (Schneider Electric)" <miquel.raynal@bootlin.com>
[ Upstream commit f18c8cfa4f1af2cf7d68d86989a7d6109acfa1bb ]
The probe has been modified by many different users, it is hard to track
history, but for sure its current state is partially broken. One easy
rule to follow is to drop/free/release the resources in the opposite
order they have been queried.
Fix the labels, the order for freeing the resources, and add the
missing DMA channel step. Replicate these changes in the remove path as
well.
Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
Tested-by: Santhosh Kumar K <s-k6@ti.com>
Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-8-f9c21419a3e6@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-cadence-quadspi.c | 44 ++++++++++++++++++-------------
1 file changed, 25 insertions(+), 19 deletions(-)
diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
index b1cf182d65665..ab74808debe98 100644
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -1891,7 +1891,7 @@ static int cqspi_probe(struct platform_device *pdev)
ret = clk_prepare_enable(cqspi->clk);
if (ret) {
dev_err(dev, "Cannot enable QSPI clock.\n");
- goto probe_clk_failed;
+ goto disable_rpm;
}
/* Obtain QSPI reset control */
@@ -1899,14 +1899,14 @@ static int cqspi_probe(struct platform_device *pdev)
if (IS_ERR(rstc)) {
ret = PTR_ERR(rstc);
dev_err(dev, "Cannot get QSPI reset.\n");
- goto probe_reset_failed;
+ goto disable_clk;
}
rstc_ocp = devm_reset_control_get_optional_exclusive(dev, "qspi-ocp");
if (IS_ERR(rstc_ocp)) {
ret = PTR_ERR(rstc_ocp);
dev_err(dev, "Cannot get QSPI OCP reset.\n");
- goto probe_reset_failed;
+ goto disable_clk;
}
if (of_device_is_compatible(pdev->dev.of_node, "starfive,jh7110-qspi")) {
@@ -1914,7 +1914,7 @@ static int cqspi_probe(struct platform_device *pdev)
if (IS_ERR(rstc_ref)) {
ret = PTR_ERR(rstc_ref);
dev_err(dev, "Cannot get QSPI REF reset.\n");
- goto probe_reset_failed;
+ goto disable_clk;
}
reset_control_assert(rstc_ref);
reset_control_deassert(rstc_ref);
@@ -1956,7 +1956,7 @@ static int cqspi_probe(struct platform_device *pdev)
if (ddata->jh7110_clk_init) {
ret = cqspi_jh7110_clk_init(pdev, cqspi);
if (ret)
- goto probe_reset_failed;
+ goto disable_clk;
}
if (ddata->quirks & CQSPI_DISABLE_STIG_MODE)
cqspi->disable_stig_mode = true;
@@ -1964,7 +1964,7 @@ static int cqspi_probe(struct platform_device *pdev)
if (ddata->quirks & CQSPI_DMA_SET_MASK) {
ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
if (ret)
- goto probe_reset_failed;
+ goto disable_clks;
}
}
@@ -1975,7 +1975,7 @@ static int cqspi_probe(struct platform_device *pdev)
pdev->name, cqspi);
if (ret) {
dev_err(dev, "Cannot request IRQ.\n");
- goto probe_reset_failed;
+ goto disable_clks;
}
cqspi_wait_idle(cqspi);
@@ -2002,31 +2002,36 @@ static int cqspi_probe(struct platform_device *pdev)
ret = cqspi_request_mmap_dma(cqspi);
if (ret == -EPROBE_DEFER) {
dev_err_probe(&pdev->dev, ret, "Failed to request mmap DMA\n");
- goto probe_setup_failed;
+ goto disable_controller;
}
}
ret = spi_register_controller(host);
if (ret) {
dev_err(&pdev->dev, "failed to register SPI ctlr %d\n", ret);
- goto probe_setup_failed;
+ goto release_dma_chan;
}
if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
pm_runtime_put_autosuspend(dev);
return 0;
-probe_setup_failed:
- if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
- pm_runtime_disable(dev);
+
+release_dma_chan:
+ if (cqspi->rx_chan)
+ dma_release_channel(cqspi->rx_chan);
+disable_controller:
cqspi_controller_enable(cqspi, 0);
-probe_reset_failed:
+disable_clks:
if (cqspi->is_jh7110)
cqspi_jh7110_disable_clk(pdev, cqspi);
-
+disable_clk:
if (pm_runtime_get_sync(&pdev->dev) >= 0)
clk_disable_unprepare(cqspi->clk);
-probe_clk_failed:
+disable_rpm:
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+ pm_runtime_disable(dev);
+
return ret;
}
@@ -2044,18 +2049,19 @@ static void cqspi_remove(struct platform_device *pdev)
cqspi_wait_idle(cqspi);
spi_unregister_controller(cqspi->host);
- cqspi_controller_enable(cqspi, 0);
if (cqspi->rx_chan)
dma_release_channel(cqspi->rx_chan);
- if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
- if (pm_runtime_get_sync(&pdev->dev) >= 0)
- clk_disable(cqspi->clk);
+ cqspi_controller_enable(cqspi, 0);
if (cqspi->is_jh7110)
cqspi_jh7110_disable_clk(pdev, cqspi);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+ if (pm_runtime_get_sync(&pdev->dev) >= 0)
+ clk_disable(cqspi->clk);
+
if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
pm_runtime_put_sync(&pdev->dev);
pm_runtime_disable(&pdev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 223/844] drm/amdgpu: validate user queue size constraints
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (221 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 222/844] spi: cadence-qspi: Fix probe error path and remove Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 224/844] spi: cadence-qspi: Try hard to disable the clocks Sasha Levin
` (629 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jesse.Zhang, Christian König, Jesse Zhang, Alex Deucher,
Sasha Levin
From: "Jesse.Zhang" <Jesse.Zhang@amd.com>
[ Upstream commit 8079b87c02e531cc91601f72ea8336dd2262fdf1 ]
Add validation to ensure user queue sizes meet hardware requirements:
- Size must be a power of two for efficient ring buffer wrapping
- Size must be at least AMDGPU_GPU_PAGE_SIZE to prevent undersized allocations
This prevents invalid configurations that could lead to GPU faults or
unexpected behavior.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 58b26c78b6425..ab934723579c9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -860,6 +860,17 @@ static int amdgpu_userq_input_args_validate(struct drm_device *dev,
drm_file_err(filp, "invalidate userq queue va or size\n");
return -EINVAL;
}
+
+ if (!is_power_of_2(args->in.queue_size)) {
+ drm_file_err(filp, "Queue size must be a power of 2\n");
+ return -EINVAL;
+ }
+
+ if (args->in.queue_size < AMDGPU_GPU_PAGE_SIZE) {
+ drm_file_err(filp, "Queue size smaller than AMDGPU_GPU_PAGE_SIZE\n");
+ return -EINVAL;
+ }
+
if (!args->in.wptr_va || !args->in.rptr_va) {
drm_file_err(filp, "invalidate userq queue rptr or wptr\n");
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 224/844] spi: cadence-qspi: Try hard to disable the clocks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (222 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 223/844] drm/amdgpu: validate user queue size constraints Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 225/844] drm/amd/pm: Fix null pointer dereference issue Sasha Levin
` (628 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miquel Raynal (Schneider Electric), Wolfram Sang,
Santhosh Kumar K, Mark Brown, Sasha Levin
From: "Miquel Raynal (Schneider Electric)" <miquel.raynal@bootlin.com>
[ Upstream commit 612227b392eed94a3398dc03334a84a699a82276 ]
In the remove path, we should try hard to perform all steps as we simply
cannot fail.
The "no runtime PM" quirk must only alter the state of the RPM core, but
the clocks should still be disabled if that is possible. Move the
disable call outside of the RPM quirk.
Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Miquel Raynal (Schneider Electric) <miquel.raynal@bootlin.com>
Tested-by: Santhosh Kumar K <s-k6@ti.com>
Link: https://patch.msgid.link/20260122-schneider-6-19-rc1-qspi-v4-9-f9c21419a3e6@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-cadence-quadspi.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
index ab74808debe98..51ed666a0fdd1 100644
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -2040,6 +2040,7 @@ static void cqspi_remove(struct platform_device *pdev)
const struct cqspi_driver_platdata *ddata;
struct cqspi_st *cqspi = platform_get_drvdata(pdev);
struct device *dev = &pdev->dev;
+ int ret = 0;
ddata = of_device_get_match_data(dev);
@@ -2059,8 +2060,10 @@ static void cqspi_remove(struct platform_device *pdev)
cqspi_jh7110_disable_clk(pdev, cqspi);
if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
- if (pm_runtime_get_sync(&pdev->dev) >= 0)
- clk_disable(cqspi->clk);
+ ret = pm_runtime_get_sync(&pdev->dev);
+
+ if (ret >= 0)
+ clk_disable(cqspi->clk);
if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
pm_runtime_put_sync(&pdev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 225/844] drm/amd/pm: Fix null pointer dereference issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (223 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 224/844] spi: cadence-qspi: Try hard to disable the clocks Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 226/844] ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() Sasha Levin
` (627 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jinzhou Su, Yang Wang, Alex Deucher, Sasha Levin
From: Jinzhou Su <jinzhou.su@amd.com>
[ Upstream commit 1197366cca89a4c44c541ddedb8ce8bf0757993d ]
If SMU is disabled, during RAS initialization,
there will be null pointer dereference issue here.
Signed-off-by: Jinzhou Su <jinzhou.su@amd.com>
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index f51fa265230b3..2a0e826d0317d 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -618,6 +618,9 @@ int amdgpu_smu_ras_send_msg(struct amdgpu_device *adev, enum smu_message_type ms
struct smu_context *smu = adev->powerplay.pp_handle;
int ret = -EOPNOTSUPP;
+ if (!smu)
+ return ret;
+
if (smu->ppt_funcs && smu->ppt_funcs->ras_send_msg)
ret = smu->ppt_funcs->ras_send_msg(smu, msg, param, read_arg);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 226/844] ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (224 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 225/844] drm/amd/pm: Fix null pointer dereference issue Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 227/844] hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A Sasha Levin
` (626 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chen Ni, Mark Brown, Sasha Levin
From: Chen Ni <nichen@iscas.ac.cn>
[ Upstream commit a1d14d8364eac2611fe1391c73ff0e5b26064f0e ]
The devm_gpiod_get_optional() function may return an error pointer
(ERR_PTR) in case of a genuine failure during GPIO acquisition,
not just NULL which indicates the legitimate absence of an optional
GPIO.
Add an IS_ERR() check after the function call to catch such errors and
propagate them to the probe function, ensuring the driver fails to load
safely rather than proceeding with an invalid pointer.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://patch.msgid.link/20260130091904.3426149-1-nichen@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/max98390.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/soc/codecs/max98390.c b/sound/soc/codecs/max98390.c
index 3dd4dd94bc371..ff58805e97d17 100644
--- a/sound/soc/codecs/max98390.c
+++ b/sound/soc/codecs/max98390.c
@@ -1067,6 +1067,9 @@ static int max98390_i2c_probe(struct i2c_client *i2c)
reset_gpio = devm_gpiod_get_optional(&i2c->dev,
"reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(reset_gpio))
+ return dev_err_probe(&i2c->dev, PTR_ERR(reset_gpio),
+ "Failed to get reset gpio\n");
/* Power on device */
if (reset_gpio) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 227/844] hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (225 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 226/844] ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 228/844] hwmon: (dell-smm) Add support for Dell OptiPlex 7080 Sasha Levin
` (625 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Robert McIntyre, Eugene Shalygin, Guenter Roeck, Sasha Levin
From: Robert McIntyre <rjmcinty@hotmail.com>
[ Upstream commit af7e57d444141ac9e77b57296d59c3e965c4c4fa ]
Adding support for Pro WS TRX50-SAGE WIFI A, which is identical
sensors-wise to Pro WS TRX50-SAGE WIFI
Signed-off-by: Robert McIntyre <rjmcinty@hotmail.com>
Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
Link: https://lore.kernel.org/r/20251213200531.259435-4-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/asus_ec_sensors.rst | 1 +
drivers/hwmon/asus-ec-sensors.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/Documentation/hwmon/asus_ec_sensors.rst b/Documentation/hwmon/asus_ec_sensors.rst
index 232885f24430d..b5e1bc7ac0643 100644
--- a/Documentation/hwmon/asus_ec_sensors.rst
+++ b/Documentation/hwmon/asus_ec_sensors.rst
@@ -10,6 +10,7 @@ Supported boards:
* PRIME X670E-PRO WIFI
* PRIME Z270-A
* Pro WS TRX50-SAGE WIFI
+ * Pro WS TRX50-SAGE WIFI A
* Pro WS X570-ACE
* Pro WS WRX90E-SAGE SE
* ProArt X570-CREATOR WIFI
diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
index 61b18b88ee8ff..a1445799e23d8 100644
--- a/drivers/hwmon/asus-ec-sensors.c
+++ b/drivers/hwmon/asus-ec-sensors.c
@@ -793,6 +793,8 @@ static const struct dmi_system_id dmi_table[] = {
&board_info_pro_art_x870E_creator_wifi),
DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS TRX50-SAGE WIFI",
&board_info_pro_ws_trx50_sage_wifi),
+ DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS TRX50-SAGE WIFI A",
+ &board_info_pro_ws_trx50_sage_wifi),
DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS WRX90E-SAGE SE",
&board_info_pro_ws_wrx90e_sage_se),
DMI_EXACT_MATCH_ASUS_BOARD_NAME("Pro WS X570-ACE",
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 228/844] hwmon: (dell-smm) Add support for Dell OptiPlex 7080
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (226 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 227/844] hwmon: (asus-ec-sensors) add Pro WS TRX50-SAGE WIFI A Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 229/844] hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE Sasha Levin
` (624 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Armin Wolf, Pali Rohár, Guenter Roeck, Sasha Levin
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 46c3e87a79179454f741f797c274dd25f5c6125e ]
The Dell OptiPlex 7080 supports the legacy SMM interface for reading
sensors and performing fan control. Whitelist this machine so that
this driver loads automatically.
Closes: https://github.com/Wer-Wolf/i8kutils/issues/16
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Acked-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20260104000654.6406-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index 93143cfc157cf..038edffc1ac74 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -1325,6 +1325,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
DMI_MATCH(DMI_PRODUCT_NAME, "MP061"),
},
},
+ {
+ .ident = "Dell OptiPlex 7080",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7080"),
+ },
+ },
{
.ident = "Dell OptiPlex 7060",
.matches = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 229/844] hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (227 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 228/844] hwmon: (dell-smm) Add support for Dell OptiPlex 7080 Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 230/844] hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi Sasha Levin
` (623 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Denis Pauk, Marcus, Guenter Roeck, Sasha Levin
From: Denis Pauk <pauk.denis@gmail.com>
[ Upstream commit 246167b17c14e8a5142368ac6457e81622055e0a ]
Boards Pro WS WRX90E-SAGE SE has got a nct6775 chip, but by default there's
no use of it because of resource conflict with WMI method.
Add the board to the WMI monitoring list.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204807
Signed-off-by: Denis Pauk <pauk.denis@gmail.com>
Tested-by: Marcus <shoes2ga@gmail.com>
Link: https://lore.kernel.org/r/20251231155316.2048-1-pauk.denis@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/nct6775-platform.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c
index c3a719aef1ace..555029dfe713f 100644
--- a/drivers/hwmon/nct6775-platform.c
+++ b/drivers/hwmon/nct6775-platform.c
@@ -1357,6 +1357,7 @@ static const char * const asus_msi_boards[] = {
"Pro WS W680-ACE IPMI",
"Pro WS W790-ACE",
"Pro WS W790E-SAGE SE",
+ "Pro WS WRX90E-SAGE SE",
"ProArt B650-CREATOR",
"ProArt B660-CREATOR D4",
"ProArt B760-CREATOR D4",
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 230/844] hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (228 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 229/844] hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 231/844] hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child Sasha Levin
` (622 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Anj Duvnjak, Guenter Roeck, Sasha Levin
From: Anj Duvnjak <avian@extremenerds.net>
[ Upstream commit c0fa7879c9850bd4597740a79d4fac5ebfcf69cc ]
Add support for customer ID 0x1621 found on ASRock Z590 Taichi
boards using the Nuvoton NCT6686D embedded controller.
This allows the driver to instantiate without requiring the
force=1 module parameter.
Tested on two separate ASRock Z590 Taichi boards, both with
EC firmware version 1.0 build 01/25/21.
Signed-off-by: Anj Duvnjak <avian@extremenerds.net>
Link: https://lore.kernel.org/r/20251222220942.10762-1-avian@extremenerds.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/nct6683.rst | 1 +
drivers/hwmon/nct6683.c | 3 +++
2 files changed, 4 insertions(+)
diff --git a/Documentation/hwmon/nct6683.rst b/Documentation/hwmon/nct6683.rst
index 3e549ba95a15a..45eec9dd349aa 100644
--- a/Documentation/hwmon/nct6683.rst
+++ b/Documentation/hwmon/nct6683.rst
@@ -65,6 +65,7 @@ AMD BC-250 NCT6686D EC firmware version 1.0 build 07/28/21
ASRock X570 NCT6683D EC firmware version 1.0 build 06/28/19
ASRock X670E NCT6686D EC firmware version 1.0 build 05/19/22
ASRock B650 Steel Legend WiFi NCT6686D EC firmware version 1.0 build 11/09/23
+ASRock Z590 Taichi NCT6686D EC firmware version 1.0 build 01/25/21
MSI B550 NCT6687D EC firmware version 1.0 build 05/07/20
MSI X670-P NCT6687D EC firmware version 0.0 build 09/27/22
MSI X870E NCT6687D EC firmware version 0.0 build 11/13/24
diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
index 6cda35388b24c..4a83804140386 100644
--- a/drivers/hwmon/nct6683.c
+++ b/drivers/hwmon/nct6683.c
@@ -181,6 +181,7 @@ superio_exit(int ioreg)
#define NCT6683_CUSTOMER_ID_ASROCK2 0xe1b
#define NCT6683_CUSTOMER_ID_ASROCK3 0x1631
#define NCT6683_CUSTOMER_ID_ASROCK4 0x163e
+#define NCT6683_CUSTOMER_ID_ASROCK5 0x1621
#define NCT6683_REG_BUILD_YEAR 0x604
#define NCT6683_REG_BUILD_MONTH 0x605
@@ -1242,6 +1243,8 @@ static int nct6683_probe(struct platform_device *pdev)
break;
case NCT6683_CUSTOMER_ID_ASROCK4:
break;
+ case NCT6683_CUSTOMER_ID_ASROCK5:
+ break;
default:
if (!force)
return -ENODEV;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 231/844] hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (229 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 230/844] hwmon: (nct6683) Add customer ID for ASRock Z590 Taichi Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 232/844] hwmon: (f71882fg) Add F81968 support Sasha Levin
` (621 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Felix Gu, Guenter Roeck, Sasha Levin
From: Felix Gu <gu_0233@qq.com>
[ Upstream commit 2954ce672b7623478c1cfeb69e6a6e4042a3656e ]
When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In emc2305_of_parse_pwm_child, it does not release the reference,
causing a resource leak.
Signed-off-by: Felix Gu <gu_0233@qq.com>
Link: https://lore.kernel.org/r/tencent_738BA80BBF28F3440301EEE6F9E470165105@qq.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/emc2305.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
index ceae96c07ac45..67e82021da210 100644
--- a/drivers/hwmon/emc2305.c
+++ b/drivers/hwmon/emc2305.c
@@ -578,6 +578,7 @@ static int emc2305_of_parse_pwm_child(struct device *dev,
data->pwm_output_mask |= EMC2305_OPEN_DRAIN << ch;
}
+ of_node_put(args.np);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 232/844] hwmon: (f71882fg) Add F81968 support
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (230 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 231/844] hwmon: (emc2305) Fix a resource leak in emc2305_of_parse_pwm_child Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 233/844] hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin Sasha Levin
` (620 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ji-Ze Hong (Peter Hong), Guenter Roeck, Sasha Levin
From: "Ji-Ze Hong (Peter Hong)" <peter_hong@fintek.com.tw>
[ Upstream commit e4a3d6f79c9933fece64368168c46d6cf5fc2e52 ]
Add hardware monitoring support for the Fintek F81968 Super I/O chip.
It is fully compatible with F81866.
Several products share compatibility with the F81866. To better distinguish
between them, ensure that the Product ID is displayed when the device is
probed.
Signed-off-by: Ji-Ze Hong (Peter Hong) <peter_hong@fintek.com.tw>
Link: https://lore.kernel.org/r/20251223051040.10227-1-peter_hong@fintek.com.tw
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/f71882fg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index df83f9866fbcf..204059d2de6cd 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -51,6 +51,7 @@
#define SIO_F81866_ID 0x1010 /* Chipset ID */
#define SIO_F71858AD_ID 0x0903 /* Chipset ID */
#define SIO_F81966_ID 0x1502 /* Chipset ID */
+#define SIO_F81968_ID 0x1806 /* Chipset ID */
#define REGION_LENGTH 8
#define ADDR_REG_OFFSET 5
@@ -2570,6 +2571,7 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
break;
case SIO_F81866_ID:
case SIO_F81966_ID:
+ case SIO_F81968_ID:
sio_data->type = f81866a;
break;
default:
@@ -2599,9 +2601,9 @@ static int __init f71882fg_find(int sioaddr, struct f71882fg_sio_data *sio_data)
address &= ~(REGION_LENGTH - 1); /* Ignore 3 LSB */
err = address;
- pr_info("Found %s chip at %#x, revision %d\n",
+ pr_info("Found %s chip at %#x, revision %d, devid: %04x\n",
f71882fg_names[sio_data->type], (unsigned int)address,
- (int)superio_inb(sioaddr, SIO_REG_DEVREV));
+ (int)superio_inb(sioaddr, SIO_REG_DEVREV), devid);
exit:
superio_exit(sioaddr);
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 233/844] hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (231 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 232/844] hwmon: (f71882fg) Add F81968 support Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 234/844] HID: logitech-hidpp: Add support for Logitech K980 Sasha Levin
` (619 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Felix Gu, Guenter Roeck, Sasha Levin
From: Felix Gu <gu_0233@qq.com>
[ Upstream commit 4923bbff0bcffe488b3aa76829c829bd15b02585 ]
When calling of_parse_phandle_with_args(), the caller is responsible
to call of_node_put() to release the reference of device node.
In nct7363_present_pwm_fanin, it does not release the reference,
causing a resource leak.
Signed-off-by: Felix Gu <gu_0233@qq.com>
Link: https://lore.kernel.org/r/tencent_9717645269E4C07D3D131F52201E12E5E10A@qq.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/nct7363.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/nct7363.c b/drivers/hwmon/nct7363.c
index 71cef794835df..47fc1b4a0f3f9 100644
--- a/drivers/hwmon/nct7363.c
+++ b/drivers/hwmon/nct7363.c
@@ -349,6 +349,7 @@ static int nct7363_present_pwm_fanin(struct device *dev,
if (ret)
return ret;
+ of_node_put(args.np);
if (args.args[0] >= NCT7363_PWM_COUNT)
return -EINVAL;
data->pwm_mask |= BIT(args.args[0]);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 234/844] HID: logitech-hidpp: Add support for Logitech K980
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (232 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 233/844] hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 235/844] ASoC: es8328: Add error unwind in resume Sasha Levin
` (618 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bastien Nocera, Jiri Kosina, Sasha Levin
From: Bastien Nocera <hadess@hadess.net>
[ Upstream commit af4fe07a9d963a72438ade96cf090e84b3399d0c ]
Add support for the solar-charging Logitech K980 keyboard, over
Bluetooth. Bolt traffic doesn't get routed through logitech-dj, so
this code isn't triggered when Bolt is used.
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index e871f1729d4b3..ca96102121b85 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4666,6 +4666,8 @@ static const struct hid_device_id hidpp_devices[] = {
HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb037) },
{ /* MX Anywhere 3SB mouse over Bluetooth */
HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb038) },
+ { /* Slim Solar+ K980 Keyboard over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb391) },
{}
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 235/844] ASoC: es8328: Add error unwind in resume
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (233 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 234/844] HID: logitech-hidpp: Add support for Logitech K980 Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 236/844] ALSA: hda/realtek: Add quirk for Minisforum V3 SE Sasha Levin
` (617 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hsieh Hung-En, Mark Brown, Sasha Levin
From: Hsieh Hung-En <hungen3108@gmail.com>
[ Upstream commit 8232e6079ae6f8d3a61d87973cb427385aa469b9 ]
Handle failures in the resume path by unwinding previously enabled
resources.
If enabling regulators or syncing the regcache fails, disable regulators
and unprepare the clock to avoid leaking resources and leaving the device
in a partially resumed state.
Signed-off-by: Hsieh Hung-En <hungen3108@gmail.com>
Link: https://patch.msgid.link/20260130160017.2630-6-hungen3108@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/es8328.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index 1e11175cfbbbf..47c6b0c218b2c 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -758,17 +758,23 @@ static int es8328_resume(struct snd_soc_component *component)
es8328->supplies);
if (ret) {
dev_err(component->dev, "unable to enable regulators\n");
- return ret;
+ goto err_clk;
}
regcache_mark_dirty(regmap);
ret = regcache_sync(regmap);
if (ret) {
dev_err(component->dev, "unable to sync regcache\n");
- return ret;
+ goto err_regulators;
}
return 0;
+
+err_regulators:
+ regulator_bulk_disable(ARRAY_SIZE(es8328->supplies), es8328->supplies);
+err_clk:
+ clk_disable_unprepare(es8328->clk);
+ return ret;
}
static int es8328_component_probe(struct snd_soc_component *component)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 236/844] ALSA: hda/realtek: Add quirk for Minisforum V3 SE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (234 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 235/844] ASoC: es8328: Add error unwind in resume Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 237/844] modpost: Amend ppc64 save/restfpr symnames for -Os build Sasha Levin
` (616 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Samuel Dionne-Riel, Takashi Iwai, Sasha Levin
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
[ Upstream commit e3474301824926ecce1d45f2ede7ecdda9a35840 ]
First, adding a generic quirk for Bass speaker DAC avoidance.
This pattern (re-routing the bass speakers off of a DAC without volume
control) seems common enough that having a "model" to match against and
quickly use to verify may be worthwhile.
The alc285_fixup_thinkpad_x1_gen7 routing was selected, amongst the
different options, as it should allow tuning the ratio between both
speaker set.
The routing was verified using `hda-verb`, and picking either 0x00 or
0x01. Either routing made the volume of the bass speakers controllable.
hda-verb /dev/snd/hwC1D0 0x17 SET_CONNECT_SEL 0x01
This likely will apply for the Minisforum V3, though there isn't a lot
of information to confirm whether or not the identifiers are the same.
This was verified on the Minisforum V3 SE, and the root cause (the bass
speakers routing) was found out by using pink noise, and playing with
the mixers.
Signed-off-by: Samuel Dionne-Riel <samuel@dionne-riel.com>
Link: https://patch.msgid.link/20260203010132.1981419-2-samuel@dionne-riel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index b6fae275919c6..82219f03b212c 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -4046,6 +4046,7 @@ enum {
ALC288_FIXUP_SURFACE_SWAP_DACS,
ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO,
ALC233_FIXUP_LENOVO_GPIO2_MIC_HOTKEY,
+ ALC245_FIXUP_BASS_HP_DAC,
};
/* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -6548,6 +6549,11 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc233_fixup_lenovo_gpio2_mic_hotkey,
},
+ [ALC245_FIXUP_BASS_HP_DAC] = {
+ .type = HDA_FIXUP_FUNC,
+ /* Borrow the DAC routing selected for those Thinkpads */
+ .v.func = alc285_fixup_thinkpad_x1_gen7,
+ },
};
static const struct hda_quirk alc269_fixup_tbl[] = {
@@ -7609,6 +7615,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
SND_PCI_QUIRK(0x1e39, 0xca14, "MEDION NM14LNL", ALC233_FIXUP_MEDION_MTL_SPK),
SND_PCI_QUIRK(0x1ee7, 0x2078, "HONOR BRB-X M1010", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1f4c, 0xe001, "Minisforum V3 (SE)", ALC245_FIXUP_BASS_HP_DAC),
SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
SND_PCI_QUIRK(0x2039, 0x0001, "Inspur S14-G1", ALC295_FIXUP_CHROME_BOOK),
@@ -7824,6 +7831,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
{.id = ALC285_FIXUP_HP_GPIO_AMP_INIT, .name = "alc285-hp-amp-init"},
{.id = ALC236_FIXUP_LENOVO_INV_DMIC, .name = "alc236-fixup-lenovo-inv-mic"},
{.id = ALC2XX_FIXUP_HEADSET_MIC, .name = "alc2xx-fixup-headset-mic"},
+ {.id = ALC245_FIXUP_BASS_HP_DAC, .name = "alc245-fixup-bass-hp-dac"},
{}
};
#define ALC225_STANDARD_PINS \
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 237/844] modpost: Amend ppc64 save/restfpr symnames for -Os build
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (235 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 236/844] ALSA: hda/realtek: Add quirk for Minisforum V3 SE Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 238/844] ASoC: qcom: q6asm: drop DSP responses for closed data streams Sasha Levin
` (615 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: René Rebe, Nathan Chancellor, Sasha Levin
From: René Rebe <rene@exactco.de>
[ Upstream commit 3cd9763ce4ad999d015cf0734e6b968cead95077 ]
Building a size optimized ppc64 kernel (-Os), gcc emits more FP
save/restore symbols, that the linker generates on demand into the
.sfpr section. Explicitly allow-list those in scripts/mod/modpost.c,
too. They are needed for the amdgpu in-kernel floating point support.
MODPOST Module.symvers
ERROR: modpost: "_restfpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_restfpr_26" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_restfpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_savegpr1_27" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_savegpr1_25" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_restfpr_28" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_savegpr1_29" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_savefpr_20" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_savefpr_22" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
ERROR: modpost: "_restfpr_15" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined!
WARNING: modpost: suppressed 56 unresolved symbol warnings because there were too many)
Signed-off-by: René Rebe <rene@exactco.de>
Link: https://patch.msgid.link/20251123.131330.407910684435629198.rene@exactco.de
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mod/modpost.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 755b842f1f9b7..88ad227f87cd1 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -602,6 +602,10 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
/* Special register function linked on all modules during final link of .ko */
if (strstarts(symname, "_restgpr0_") ||
strstarts(symname, "_savegpr0_") ||
+ strstarts(symname, "_restgpr1_") ||
+ strstarts(symname, "_savegpr1_") ||
+ strstarts(symname, "_restfpr_") ||
+ strstarts(symname, "_savefpr_") ||
strstarts(symname, "_restvr_") ||
strstarts(symname, "_savevr_") ||
strcmp(symname, ".TOC.") == 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 238/844] ASoC: qcom: q6asm: drop DSP responses for closed data streams
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (236 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 237/844] modpost: Amend ppc64 save/restfpr symnames for -Os build Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 239/844] power: sequencing: fix missing state_lock in pwrseq_power_on() error path Sasha Levin
` (614 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Cédric Bellegarde, Mark Brown, Sasha Levin
From: Cédric Bellegarde <cedric.bellegarde@adishatz.org>
[ Upstream commit 8a066a81ee0c1b6cdbd81393536c3b2d19ccef25 ]
'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses
after closing")' attempted to ignore DSP responses arriving
after a stream had been closed.
However, those responses were still handled, causing lockups.
Fix this by unconditionally dropping all DSP responses associated with
closed data streams.
Signed-off-by: Cédric Bellegarde <cedric.bellegarde@adishatz.org>
Link: https://patch.msgid.link/20260102215225.609166-1-cedric.bellegarde@adishatz.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/qcom/qdsp6/q6asm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/qcom/qdsp6/q6asm.c b/sound/soc/qcom/qdsp6/q6asm.c
index e7295b7b24610..3c4a24c9dba22 100644
--- a/sound/soc/qcom/qdsp6/q6asm.c
+++ b/sound/soc/qcom/qdsp6/q6asm.c
@@ -638,7 +638,6 @@ static int32_t q6asm_stream_callback(struct apr_device *adev,
client_event = ASM_CLIENT_EVENT_CMD_OUT_FLUSH_DONE;
break;
case ASM_STREAM_CMD_OPEN_WRITE_V3:
- case ASM_DATA_CMD_WRITE_V2:
case ASM_STREAM_CMD_OPEN_READ_V3:
case ASM_STREAM_CMD_OPEN_READWRITE_V2:
case ASM_STREAM_CMD_SET_ENCDEC_PARAM:
@@ -657,8 +656,9 @@ static int32_t q6asm_stream_callback(struct apr_device *adev,
break;
case ASM_DATA_CMD_EOS:
case ASM_DATA_CMD_READ_V2:
+ case ASM_DATA_CMD_WRITE_V2:
/* response as result of close stream */
- break;
+ goto done;
default:
dev_err(ac->dev, "command[0x%x] not expecting rsp\n",
result->opcode);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 239/844] power: sequencing: fix missing state_lock in pwrseq_power_on() error path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (237 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 238/844] ASoC: qcom: q6asm: drop DSP responses for closed data streams Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 240/844] ASoC: SOF: Intel: hda: Fix NULL pointer dereference Sasha Levin
` (613 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ziyi Guo, Bartosz Golaszewski, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit e1dccb485c2876ac1318f36ccc0155416c633a48 ]
pwrseq_power_on() calls pwrseq_unit_disable() when the
post_enable callback fails. However, this call is outside the
scoped_guard(mutex, &pwrseq->state_lock) block that ends.
pwrseq_unit_disable() has lockdep_assert_held(&pwrseq->state_lock),
which will fail when called from this error path.
Add the scoped_guard block to cover the post_enable callback and its
error handling to ensure the lock is held when pwrseq_unit_disable() is
called.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Link: https://patch.msgid.link/20260130182651.1576579-1-n7l8m4@u.northwestern.edu
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/sequencing/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/power/sequencing/core.c b/drivers/power/sequencing/core.c
index 190564e559885..1fcf0af7cc0bb 100644
--- a/drivers/power/sequencing/core.c
+++ b/drivers/power/sequencing/core.c
@@ -914,8 +914,10 @@ int pwrseq_power_on(struct pwrseq_desc *desc)
if (target->post_enable) {
ret = target->post_enable(pwrseq);
if (ret) {
- pwrseq_unit_disable(pwrseq, unit);
- desc->powered_on = false;
+ scoped_guard(mutex, &pwrseq->state_lock) {
+ pwrseq_unit_disable(pwrseq, unit);
+ desc->powered_on = false;
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 240/844] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (238 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 239/844] power: sequencing: fix missing state_lock in pwrseq_power_on() error path Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 241/844] spi: geni-qcom: Fix abort sequence execution for serial engine errors Sasha Levin
` (612 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ranjani Sridharan, Bard Liao, Liam Girdwood, Mateusz Redzynia,
Peter Ujfalusi, Mark Brown, Sasha Levin
From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
[ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ]
If there's a mismatch between the DAI links in the machine driver and
the topology, it is possible that the playback/capture widget is not
set, especially in the case of loopback capture for echo reference
where we use the dummy DAI link. Return the error when the widget is not
set to avoid a null pointer dereference like below when the topology is
broken.
RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]
Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Reviewed-by: Mateusz Redzynia <mateuszx.redzynia@intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
index 883d0d3bae9ec..3c742d5351333 100644
--- a/sound/soc/sof/intel/hda-dai.c
+++ b/sound/soc/sof/intel/hda-dai.c
@@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops *
hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai)
{
struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream);
- struct snd_sof_widget *swidget = w->dobj.private;
+ struct snd_sof_widget *swidget;
struct snd_sof_dev *sdev;
struct snd_sof_dai *sdai;
- sdev = widget_to_sdev(w);
+ /*
+ * this is unlikely if the topology and the machine driver DAI links match.
+ * But if there's a missing DAI link in topology, this will prevent a NULL pointer
+ * dereference later on.
+ */
+ if (!w) {
+ dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__);
+ return NULL;
+ }
+ sdev = widget_to_sdev(w);
+ swidget = w->dobj.private;
if (!swidget) {
dev_err(sdev->dev, "%s: swidget is NULL\n", __func__);
return NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 241/844] spi: geni-qcom: Fix abort sequence execution for serial engine errors
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (239 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 240/844] ASoC: SOF: Intel: hda: Fix NULL pointer dereference Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 242/844] ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe Sasha Levin
` (611 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Praveen Talari, Konrad Dybcio, Mark Brown, Sasha Levin
From: Praveen Talari <praveen.talari@oss.qualcomm.com>
[ Upstream commit 96e041647bb0f9d92f95df1d69cb7442d7408b79 ]
The driver currently skips the abort sequence for target mode when serial
engine errors occur. This leads to improper error recovery as the serial
engine may remain in an undefined state without proper cleanup, potentially
causing subsequent operations to fail or behave unpredictably.
Fix this by ensuring the abort sequence and DMA reset always execute during
error recovery, as both are required for proper serial engine error
handling.
Co-developed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260204162854.1206323-3-praveen.talari@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-geni-qcom.c | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index 5ab20d7955121..acfcf870efd84 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -160,24 +160,20 @@ static void handle_se_timeout(struct spi_controller *spi,
xfer = mas->cur_xfer;
mas->cur_xfer = NULL;
- if (spi->target) {
- /*
- * skip CMD Cancel sequnece since spi target
- * doesn`t support CMD Cancel sequnece
- */
+ /* The controller doesn't support the Cancel commnand in target mode */
+ if (!spi->target) {
+ reinit_completion(&mas->cancel_done);
+ geni_se_cancel_m_cmd(se);
+
spin_unlock_irq(&mas->lock);
- goto reset_if_dma;
- }
- reinit_completion(&mas->cancel_done);
- geni_se_cancel_m_cmd(se);
- spin_unlock_irq(&mas->lock);
+ time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
+ if (time_left)
+ goto reset_if_dma;
- time_left = wait_for_completion_timeout(&mas->cancel_done, HZ);
- if (time_left)
- goto reset_if_dma;
+ spin_lock_irq(&mas->lock);
+ }
- spin_lock_irq(&mas->lock);
reinit_completion(&mas->abort_done);
geni_se_abort_m_cmd(se);
spin_unlock_irq(&mas->lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 242/844] ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (240 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 241/844] spi: geni-qcom: Fix abort sequence execution for serial engine errors Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 243/844] ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx Sasha Levin
` (610 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ziyi Guo, Frank Li, Mark Brown, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit 84faa91585fa22a161763f2fe8f84a602a196c87 ]
imx_rpmsg_probe() calls snd_soc_find_dai() without holding client_mutex.
However, snd_soc_find_dai() has lockdep_assert_held(&client_mutex)
indicating callers must hold this lock, as the function iterates over the
global component list.
All other callers of snd_soc_find_dai() either hold client_mutex via the
snd_soc_bind_card() path or use the snd_soc_find_dai_with_mutex() wrapper.
Use snd_soc_find_dai_with_mutex() instead to fix the missing lock
protection.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260205052429.4046903-1-n7l8m4@u.northwestern.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/imx-rpmsg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c
index 53f04d1f32806..76a8e68c1b620 100644
--- a/sound/soc/fsl/imx-rpmsg.c
+++ b/sound/soc/fsl/imx-rpmsg.c
@@ -145,7 +145,7 @@ static int imx_rpmsg_probe(struct platform_device *pdev)
data->dai.ignore_pmdown_time = 1;
data->dai.cpus->dai_name = pdev->dev.platform_data;
- cpu_dai = snd_soc_find_dai(data->dai.cpus);
+ cpu_dai = snd_soc_find_dai_with_mutex(data->dai.cpus);
if (!cpu_dai) {
ret = -EPROBE_DEFER;
goto fail;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 243/844] ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (241 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 242/844] ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 244/844] ALSA: mixer: oss: Add card disconnect checkpoints Sasha Levin
` (609 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Illia Barbashyn, Takashi Iwai, Sasha Levin
From: Illia Barbashyn <04baril@gmail.com>
[ Upstream commit ac1ff574bbc09a6c90f4fe8f9e6b8d66c983064c ]
The mute and mic-mute LEDs on HP ENVY x360 Convertible 15-es0xxx
(PCI SSID 103c:88b3) do not work with the current driver.
This model requires a combination of COEFBIT and GPIO fixups to
correctly control the LEDs. Introduce a new fixup function
alc245_fixup_hp_envy_x360_mute_led and add a quirk to apply it.
Signed-off-by: Illia Barbashyn <04baril@gmail.com>
Link: https://patch.msgid.link/20260207221955.24132-1-04baril@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index 82219f03b212c..c11312aa5ca76 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -1660,6 +1660,13 @@ static void alc285_fixup_hp_spectre_x360_mute_led(struct hda_codec *codec,
alc285_fixup_hp_gpio_micmute_led(codec, fix, action);
}
+static void alc245_fixup_hp_envy_x360_mute_led(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ alc245_fixup_hp_mute_led_v1_coefbit(codec, fix, action);
+ alc245_fixup_hp_gpio_led(codec, fix, action);
+}
+
static void alc236_fixup_hp_mute_led(struct hda_codec *codec,
const struct hda_fixup *fix, int action)
{
@@ -3919,6 +3926,7 @@ enum {
ALC285_FIXUP_HP_GPIO_LED,
ALC285_FIXUP_HP_MUTE_LED,
ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED,
+ ALC245_FIXUP_HP_ENVY_X360_MUTE_LED,
ALC285_FIXUP_HP_BEEP_MICMUTE_LED,
ALC236_FIXUP_HP_MUTE_LED_COEFBIT2,
ALC236_FIXUP_HP_GPIO_LED,
@@ -5575,6 +5583,10 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc285_fixup_hp_spectre_x360_mute_led,
},
+ [ALC245_FIXUP_HP_ENVY_X360_MUTE_LED] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc245_fixup_hp_envy_x360_mute_led,
+ },
[ALC285_FIXUP_HP_BEEP_MICMUTE_LED] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc285_fixup_hp_beep,
@@ -6848,6 +6860,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED),
SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88b3, "HP ENVY x360 Convertible 15-es0xxx", ALC245_FIXUP_HP_ENVY_X360_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 244/844] ALSA: mixer: oss: Add card disconnect checkpoints
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (242 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 243/844] ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 245/844] ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102) Sasha Levin
` (608 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Takashi Iwai, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 084d5d44418148662365eced3e126ad1a81ee3e2 ]
ALSA OSS mixer layer calls the kcontrol ops rather individually, and
pending calls might be not always caught at disconnecting the device.
For avoiding the potential UAF scenarios, add sanity checks of the
card disconnection at each entry point of OSS mixer accesses. The
rwsem is taken just before that check, hence the rest context should
be covered by that properly.
Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/oss/mixer_oss.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 8d2d46d03301b..f4ad0bfb4dac6 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -523,6 +523,8 @@ static void snd_mixer_oss_get_volume1_vol(struct snd_mixer_oss_file *fmixer,
if (numid == ID_UNKNOWN)
return;
guard(rwsem_read)(&card->controls_rwsem);
+ if (card->shutdown)
+ return;
kctl = snd_ctl_find_numid(card, numid);
if (!kctl)
return;
@@ -557,6 +559,8 @@ static void snd_mixer_oss_get_volume1_sw(struct snd_mixer_oss_file *fmixer,
if (numid == ID_UNKNOWN)
return;
guard(rwsem_read)(&card->controls_rwsem);
+ if (card->shutdown)
+ return;
kctl = snd_ctl_find_numid(card, numid);
if (!kctl)
return;
@@ -618,6 +622,8 @@ static void snd_mixer_oss_put_volume1_vol(struct snd_mixer_oss_file *fmixer,
if (numid == ID_UNKNOWN)
return;
guard(rwsem_read)(&card->controls_rwsem);
+ if (card->shutdown)
+ return;
kctl = snd_ctl_find_numid(card, numid);
if (!kctl)
return;
@@ -656,6 +662,8 @@ static void snd_mixer_oss_put_volume1_sw(struct snd_mixer_oss_file *fmixer,
if (numid == ID_UNKNOWN)
return;
guard(rwsem_read)(&card->controls_rwsem);
+ if (card->shutdown)
+ return;
kctl = snd_ctl_find_numid(card, numid);
if (!kctl)
return;
@@ -796,6 +804,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
if (uinfo == NULL || uctl == NULL)
return -ENOMEM;
guard(rwsem_read)(&card->controls_rwsem);
+ if (card->shutdown)
+ return -ENODEV;
kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
if (!kctl)
return -ENOENT;
@@ -839,6 +849,8 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
if (uinfo == NULL || uctl == NULL)
return -ENOMEM;
guard(rwsem_read)(&card->controls_rwsem);
+ if (card->shutdown)
+ return -ENODEV;
kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
if (!kctl)
return -ENOENT;
@@ -885,6 +897,8 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl
if (!info)
return -ENOMEM;
scoped_guard(rwsem_read, &card->controls_rwsem) {
+ if (card->shutdown)
+ return -ENODEV;
kcontrol = snd_mixer_oss_test_id(mixer, name, index);
if (kcontrol == NULL)
return 0;
@@ -1006,6 +1020,8 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer,
if (snd_mixer_oss_build_test_all(mixer, ptr, &slot))
return 0;
guard(rwsem_read)(&mixer->card->controls_rwsem);
+ if (mixer->card->shutdown)
+ return -ENODEV;
kctl = NULL;
if (!ptr->index)
kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 245/844] ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102)
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (243 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 244/844] ALSA: mixer: oss: Add card disconnect checkpoints Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 246/844] ALSA: usb-audio: Add DSD support for iBasso DC04U Sasha Levin
` (607 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Harin Lee, Takashi Iwai, Sasha Levin
From: Harin Lee <me@harin.net>
[ Upstream commit 3a92733e052753d87fdd56bd6f621f969be28447 ]
Add quirk for the Onkyo SE-300PCIE variant with PCI subsystem ID
(160b:0102). This variant (OK0011) was found in the official Windows
driver packages.
Also, reorder entries and fix the indentation to maintain
consistency.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://patch.msgid.link/20260208133001.680550-1-me@harin.net
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/ctxfi/ctatc.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
index 227d8c8490e1f..a25a599fc5bec 100644
--- a/sound/pci/ctxfi/ctatc.c
+++ b/sound/pci/ctxfi/ctatc.c
@@ -52,18 +52,19 @@ static const struct snd_pci_quirk subsys_20k1_list[] = {
static const struct snd_pci_quirk subsys_20k2_list[] = {
SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB0760,
"SB0760", CTSB0760),
- SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB1270,
- "SB1270", CTSB1270),
SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08801,
"SB0880", CTSB0880),
SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08802,
"SB0880", CTSB0880),
SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB08803,
"SB0880", CTSB0880),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_CREATIVE, PCI_SUBDEVICE_ID_CREATIVE_SB1270,
+ "SB1270", CTSB1270),
+ SND_PCI_QUIRK(0x160b, 0x0101, "OK0010", CTOK0010),
+ SND_PCI_QUIRK(0x160b, 0x0102, "OK0010", CTOK0010),
SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_CREATIVE, 0xf000,
PCI_SUBDEVICE_ID_CREATIVE_HENDRIX, "HENDRIX",
CTHENDRIX),
- SND_PCI_QUIRK(0x160b, 0x0101, "OK0010", CTOK0010),
{ } /* terminator */
};
@@ -78,8 +79,8 @@ static const char *ct_subsys_name[NUM_CTCARDS] = {
[CTSB0760] = "SB076x",
[CTHENDRIX] = "Hendrix",
[CTSB0880] = "SB0880",
- [CTSB1270] = "SB1270",
- [CTOK0010] = "OK0010",
+ [CTSB1270] = "SB1270",
+ [CTOK0010] = "OK0010",
[CT20K2_UNKNOWN] = "Unknown",
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 246/844] ALSA: usb-audio: Add DSD support for iBasso DC04U
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (244 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 245/844] ALSA: ctxfi: Add quirk for SE-300PCIE variant (160b:0102) Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 247/844] ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio Sasha Levin
` (606 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Qihang Guo, Takashi Iwai, Sasha Levin
From: Qihang Guo <v-conet@outlook.com>
[ Upstream commit fe7cd89f0e29f0852316857b4861309f9b891370 ]
Vendor ID 0x0661 is assigned to Hamamatsu Photonics K.K.,
but is used by iBasso for iBasso DC04U (0x0661:0x0883),
which supports native DSD playback.
This patch adds QUIRK_FLAG_DSD_RAW for iBasso DC04U, enabling
native DSD playback (DSD_U32_BE). The change has been verified
on Arch Linux using mpd and pw-cat.
Signed-off-by: Qihang Guo <v-conet@outlook.com>
Link: https://patch.msgid.link/TYYPR01MB14098529E0BD900921BE6F42CF465A@TYYPR01MB14098.jpnprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 4f9d19bf1ccac..7fabaeb3781a2 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2235,6 +2235,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
DEVICE_FLG(0x0644, 0x806c, /* Esoteric XD */
QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY |
QUIRK_FLAG_IFACE_DELAY | QUIRK_FLAG_FORCE_IFACE_RESET),
+ DEVICE_FLG(0x0661, 0x0883, /* iBasso DC04 Ultra */
+ QUIRK_FLAG_DSD_RAW),
DEVICE_FLG(0x06f8, 0xb000, /* Hercules DJ Console (Windows Edition) */
QUIRK_FLAG_IGNORE_CTL_ERROR),
DEVICE_FLG(0x06f8, 0xd002, /* Hercules DJ Console (Macintosh Edition) */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 247/844] ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (245 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 246/844] ALSA: usb-audio: Add DSD support for iBasso DC04U Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 248/844] jfs: Add missing set_freezable() for freezable kthread Sasha Levin
` (605 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Lianqin Hu, Takashi Iwai, Sasha Levin
From: Lianqin Hu <hulianqin@vivo.com>
[ Upstream commit ac656d7d7c70f7c352c7652bc2bb0c1c8c2dde08 ]
Setting up the interface when suspended/resumeing fail on this card.
Adding a reset and delay quirk will eliminate this problem.
usb 1-1: New USB device found, idVendor=001f, idProduct=0b21
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: AB13X USB Audio
usb 1-1: Manufacturer: Generic
usb 1-1: SerialNumber: 20210926172016
Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Link: https://patch.msgid.link/TYUPR06MB6217522D0DB6E2C9DF46B56ED265A@TYUPR06MB6217.apcprd06.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 7fabaeb3781a2..86c329632e396 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2146,6 +2146,8 @@ struct usb_audio_quirk_flags_table {
static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
/* Device matches */
+ DEVICE_FLG(0x001f, 0x0b21, /* AB13X USB Audio */
+ QUIRK_FLAG_FORCE_IFACE_RESET | QUIRK_FLAG_IFACE_DELAY),
DEVICE_FLG(0x03f0, 0x654a, /* HP 320 FHD Webcam */
QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
DEVICE_FLG(0x041e, 0x3000, /* Creative SB Extigy */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 248/844] jfs: Add missing set_freezable() for freezable kthread
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (246 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 247/844] ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 249/844] jfs: nlink overflow in jfs_rename Sasha Levin
` (604 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haotian Zhang, Dave Kleikamp, Sasha Levin
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit eb0cfcf265714b419cc3549895a00632e76732ae ]
The jfsIOWait() thread calls try_to_freeze() but lacks set_freezable(),
causing it to remain non-freezable by default. This prevents proper
freezing during system suspend.
Add set_freezable() to make the thread freezable as intended.
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_logmgr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index b343c5ea11592..5b1c5da041630 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -2311,6 +2311,7 @@ int jfsIOWait(void *arg)
{
struct lbuf *bp;
+ set_freezable();
do {
spin_lock_irq(&log_redrive_lock);
while ((bp = log_redrive_list)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 249/844] jfs: nlink overflow in jfs_rename
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (247 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 248/844] jfs: Add missing set_freezable() for freezable kthread Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 250/844] PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up Sasha Levin
` (603 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jori Koolstra, syzbot+9131ddfd7870623b719f, Dave Kleikamp,
Sasha Levin
From: Jori Koolstra <jkoolstra@xs4all.nl>
[ Upstream commit 9218dc26fd922b09858ecd3666ed57dfd8098da8 ]
If nlink is maximal for a directory (-1) and inside that directory you
perform a rename for some child directory (not moving from the parent),
then the nlink of the first directory is first incremented and later
decremented. Normally this is fine, but when nlink = -1 this causes a
wrap around to 0, and then drop_nlink issues a warning.
After applying the patch syzbot no longer issues any warnings. I also
ran some basic fs tests to look for any regressions.
Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
Reported-by: syzbot+9131ddfd7870623b719f@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=9131ddfd7870623b719f
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/namei.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8faf..7879c049632b3 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*
@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);
+ if (new_ip || old_dir != new_dir)
+ drop_nlink(old_dir);
+
if (old_dir != new_dir) {
/*
* Change inode number of parent for moved directory
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 250/844] PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (248 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 249/844] jfs: nlink overflow in jfs_rename Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 251/844] wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero Sasha Levin
` (602 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Manivannan Sadhasivam, Manivannan Sadhasivam, Vincent Guittot,
Frank Li, Shawn Lin, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit cfd2fdfd0a8da2e5bbfdc4009b9c4b8bf164c937 ]
During system suspend, if the PCIe link is not up, then there is no need
to broadcast PME_Turn_Off message and wait for L2/L3 transition. So skip
them.
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Vincent Guittot <vincent.guittot@linaro.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/20251218-pci-dwc-suspend-rework-v2-1-5a7778c6094a@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-designware-host.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 372207c33a857..250725ced9026 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -1158,8 +1158,11 @@ static int dw_pcie_pme_turn_off(struct dw_pcie *pci)
int dw_pcie_suspend_noirq(struct dw_pcie *pci)
{
u8 offset = dw_pcie_find_capability(pci, PCI_CAP_ID_EXP);
+ int ret = 0;
u32 val;
- int ret;
+
+ if (!dw_pcie_link_up(pci))
+ goto stop_link;
/*
* If L1SS is supported, then do not put the link into L2 as some
@@ -1194,6 +1197,7 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci)
*/
udelay(1);
+stop_link:
dw_pcie_stop_link(pci);
if (pci->pp.ops->deinit)
pci->pp.ops->deinit(&pci->pp);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 251/844] wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (249 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 250/844] PCI: dwc: Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if link is not up Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 252/844] wifi: rtw89: 8852au: add support for TP TX30U Plus Sasha Levin
` (601 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Roman Peshkichev, Ping-Ke Shih, Sasha Levin
From: Roman Peshkichev <roman.peshkichev@gmail.com>
[ Upstream commit 9f68fdcdc9dbf21be2a48feced90ff7f77d07443 ]
The function rtw_set_dtim_period() accepted an 'int' dtim_period parameter,
while mac80211 provides dtim_period as 'u8' in struct ieee80211_bss_conf.
In IBSS (ad-hoc) mode mac80211 may set dtim_period to 0.
The driver unconditionally wrote (dtim_period - 1) to
REG_DTIM_COUNTER_ROOT, which resulted in 0xFF when dtim_period was 0. This
caused delays in broadcast/multicast traffic processing and issues with
ad-hoc operation.
Convert the function parameter to u8 to match ieee80211_bss_conf and avoid
the underflow by writing 0 when dtim_period is 0.
Link: https://github.com/lwfinger/rtw88/issues/406
Signed-off-by: Roman Peshkichev <roman.peshkichev@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251125180937.22977-1-roman.peshkichev@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
drivers/net/wireless/realtek/rtw88/main.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index d93d21656f26c..f72d12c3b2bc6 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -730,10 +730,10 @@ void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel)
}
EXPORT_SYMBOL(rtw_set_rx_freq_band);
-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period)
+void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period)
{
rtw_write32_set(rtwdev, REG_TCR, BIT_TCR_UPDATE_TIMIE);
- rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period - 1);
+ rtw_write8(rtwdev, REG_DTIM_COUNTER_ROOT, dtim_period ? dtim_period - 1 : 0);
}
void rtw_update_channel(struct rtw_dev *rtwdev, u8 center_channel,
diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
index 43ed6d6b42919..1ab70214ce36e 100644
--- a/drivers/net/wireless/realtek/rtw88/main.h
+++ b/drivers/net/wireless/realtek/rtw88/main.h
@@ -2226,7 +2226,7 @@ enum nl80211_band rtw_hw_to_nl80211_band(enum rtw_supported_band hw_band)
}
void rtw_set_rx_freq_band(struct rtw_rx_pkt_stat *pkt_stat, u8 channel);
-void rtw_set_dtim_period(struct rtw_dev *rtwdev, int dtim_period);
+void rtw_set_dtim_period(struct rtw_dev *rtwdev, u8 dtim_period);
void rtw_get_channel_params(struct cfg80211_chan_def *chandef,
struct rtw_channel_params *ch_param);
bool check_hw_ready(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 target);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 252/844] wifi: rtw89: 8852au: add support for TP TX30U Plus
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (250 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 251/844] wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 253/844] wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() Sasha Levin
` (600 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jan Gerber, Ping-Ke Shih, Sasha Levin
From: Jan Gerber <j@mailb.org>
[ Upstream commit a2f1fc9ab6fb0d5c9d701a516c342944258fb20e ]
the device shows up like this and everything seams to work:
Bus 004 Device 003: ID 3625:010d Realtek 802.11ax WLAN Adapter
Signed-off-by: Jan Gerber <j@mailb.org>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251212005515.2059533-1-j@mailb.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
index ca782469c455d..74a976c984ad8 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
@@ -60,6 +60,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = {
.driver_info = (kernel_ulong_t)&rtw89_8852au_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0141, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010d, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010f, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852au_info },
{},
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 253/844] wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (251 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 252/844] wifi: rtw89: 8852au: add support for TP TX30U Plus Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 254/844] wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H Sasha Levin
` (599 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bitterblue Smith, Ping-Ke Shih, Sasha Levin
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
[ Upstream commit 44d1f624bbdd2d60319374ba85f7195a28d00c90 ]
rtw8822b_set_antenna() can be called from userspace when the chip is
powered off. In that case a WARNING is triggered in
rtw8822b_config_trx_mode() because trying to read the RF registers
when the chip is powered off returns an unexpected value.
Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
the chip is powered on.
------------[ cut here ]------------
write RF mode table fail
WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
Call Trace:
<TASK>
rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? netdev_run_todo+0x63/0x550
genl_family_rcv_msg_doit+0xfc/0x160
genl_rcv_msg+0x1aa/0x2b0
? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? __pfx_genl_rcv_msg+0x10/0x10
netlink_rcv_skb+0x59/0x110
genl_rcv+0x28/0x40
netlink_unicast+0x285/0x3c0
? __alloc_skb+0xdb/0x1a0
netlink_sendmsg+0x20d/0x430
____sys_sendmsg+0x39f/0x3d0
? import_iovec+0x2f/0x40
___sys_sendmsg+0x99/0xe0
? refill_obj_stock+0x12e/0x240
__sys_sendmsg+0x8a/0xf0
do_syscall_64+0x81/0x970
? do_syscall_64+0x81/0x970
? ksys_read+0x73/0xf0
? do_syscall_64+0x81/0x970
? count_memcg_events+0xc2/0x190
? handle_mm_fault+0x1d7/0x2d0
? do_user_addr_fault+0x21a/0x690
? exc_page_fault+0x7e/0x1a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
---[ end trace 0000000000000000 ]---
Link: https://github.com/lwfinger/rtw88/issues/366
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/fb9a3444-9319-4aa2-8719-35a6308bf568@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/rtw8822b.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
index 89b6485b229a8..4d88cc2f41485 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
@@ -1005,7 +1005,8 @@ static int rtw8822b_set_antenna(struct rtw_dev *rtwdev,
hal->antenna_tx = antenna_tx;
hal->antenna_rx = antenna_rx;
- rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
+ if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
+ rtw8822b_config_trx_mode(rtwdev, antenna_tx, antenna_rx, false);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 254/844] wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (252 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 253/844] wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 255/844] wifi: rtw89: 8922a: set random mac if efuse contains zeroes Sasha Levin
` (598 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Hsiu-Ming Chang, Ping-Ke Shih, Sasha Levin
From: Hsiu-Ming Chang <cges30901@gmail.com>
[ Upstream commit 77653c327e11c71c5363b18a53fbf2b92ed21da4 ]
Add support for Mercusys MU6H AC650 High Gain Wireless Dual Band USB
Adapter V1.30. It is based on RTL8811CU, usb device ID is 2c4e:0105.
Signed-off-by: Hsiu-Ming Chang <cges30901@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251205003245.5762-1-cges30901@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/rtw8821cu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
index 7a0fffc359e25..8cd09d66655db 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8821cu.c
@@ -37,6 +37,8 @@ static const struct usb_device_id rtw_8821cu_id_table[] = {
.driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xd811, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Edimax */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0105, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&(rtw8821c_hw_spec) }, /* Mercusys */
{},
};
MODULE_DEVICE_TABLE(usb, rtw_8821cu_id_table);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 255/844] wifi: rtw89: 8922a: set random mac if efuse contains zeroes
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (253 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 254/844] wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 256/844] wifi: rtw89: ser: enable error IMR after recovering from L1 Sasha Levin
` (597 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jose Ignacio Tornos Martinez, Ping-Ke Shih, Sasha Levin
From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
[ Upstream commit 41be33d3efc120f6a2c02d12742655f2aa09e1b6 ]
I have some rtl8922ae devices with no permanent mac stored in efuse.
It could be properly saved and/or configured from user tools like
NetworkManager, but it would be desirable to be able to initialize it
somehow to get the device working by default.
So, in the same way as with other devices, if the mac address read from
efuse contains zeros, a random mac address is assigned to at least allow
operation, and the user is warned about this in case any action needs to
be considered.
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251126091905.217951-1-jtornosm@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 22 +++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
index 4437279c554b0..4bcf20612a455 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
@@ -636,16 +636,30 @@ static int rtw8922a_read_efuse_rf(struct rtw89_dev *rtwdev, u8 *log_map)
static int rtw8922a_read_efuse(struct rtw89_dev *rtwdev, u8 *log_map,
enum rtw89_efuse_block block)
{
+ struct rtw89_efuse *efuse = &rtwdev->efuse;
+ int ret;
+
switch (block) {
case RTW89_EFUSE_BLOCK_HCI_DIG_PCIE_SDIO:
- return rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
+ ret = rtw8922a_read_efuse_pci_sdio(rtwdev, log_map);
+ break;
case RTW89_EFUSE_BLOCK_HCI_DIG_USB:
- return rtw8922a_read_efuse_usb(rtwdev, log_map);
+ ret = rtw8922a_read_efuse_usb(rtwdev, log_map);
+ break;
case RTW89_EFUSE_BLOCK_RF:
- return rtw8922a_read_efuse_rf(rtwdev, log_map);
+ ret = rtw8922a_read_efuse_rf(rtwdev, log_map);
+ break;
default:
- return 0;
+ ret = 0;
+ break;
+ }
+
+ if (!ret && is_zero_ether_addr(efuse->addr)) {
+ rtw89_info(rtwdev, "efuse mac address is zero, using random mac\n");
+ eth_random_addr(efuse->addr);
}
+
+ return ret;
}
#define THM_TRIM_POSITIVE_MASK BIT(6)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 256/844] wifi: rtw89: ser: enable error IMR after recovering from L1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (254 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 255/844] wifi: rtw89: 8922a: set random mac if efuse contains zeroes Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 257/844] wifi: rtw89: setting TBTT AGG number when mac port initialization Sasha Levin
` (596 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zong-Zhe Yang, Ping-Ke Shih, Sasha Levin
From: Zong-Zhe Yang <kevin_yang@realtek.com>
[ Upstream commit f4de946bdb379f543e3a599f8f048d741ad4a58e ]
After recovering from L1, explicitly enable error IMR to ensure next
L1 SER (system error recovery) can work normally.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251223030651.480633-6-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/mac.c | 1 +
drivers/net/wireless/realtek/rtw89/mac.h | 1 +
drivers/net/wireless/realtek/rtw89/mac_be.c | 1 +
drivers/net/wireless/realtek/rtw89/ser.c | 10 ++++++++++
4 files changed, 13 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index d78fbe73e3657..b4c292c7e829d 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -7184,6 +7184,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_ax = {
.check_mac_en = rtw89_mac_check_mac_en_ax,
.sys_init = sys_init_ax,
.trx_init = trx_init_ax,
+ .err_imr_ctrl = err_imr_ctrl_ax,
.hci_func_en = rtw89_mac_hci_func_en_ax,
.dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_ax,
.dle_func_en = dle_func_en_ax,
diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
index 0007229d67537..a4ed1c545609e 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.h
+++ b/drivers/net/wireless/realtek/rtw89/mac.h
@@ -1019,6 +1019,7 @@ struct rtw89_mac_gen_def {
enum rtw89_mac_hwmod_sel sel);
int (*sys_init)(struct rtw89_dev *rtwdev);
int (*trx_init)(struct rtw89_dev *rtwdev);
+ void (*err_imr_ctrl)(struct rtw89_dev *rtwdev, bool en);
void (*hci_func_en)(struct rtw89_dev *rtwdev);
void (*dmac_func_pre_en)(struct rtw89_dev *rtwdev);
void (*dle_func_en)(struct rtw89_dev *rtwdev, bool enable);
diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
index 556e5f98e8d41..9b9e646487346 100644
--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
+++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
@@ -2601,6 +2601,7 @@ const struct rtw89_mac_gen_def rtw89_mac_gen_be = {
.check_mac_en = rtw89_mac_check_mac_en_be,
.sys_init = sys_init_be,
.trx_init = trx_init_be,
+ .err_imr_ctrl = err_imr_ctrl_be,
.hci_func_en = rtw89_mac_hci_func_en_be,
.dmac_func_pre_en = rtw89_mac_dmac_func_pre_en_be,
.dle_func_en = dle_func_en_be,
diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
index f99e179f7ff9f..7fdc69578da31 100644
--- a/drivers/net/wireless/realtek/rtw89/ser.c
+++ b/drivers/net/wireless/realtek/rtw89/ser.c
@@ -431,6 +431,14 @@ static void hal_send_m4_event(struct rtw89_ser *ser)
rtw89_mac_set_err_status(rtwdev, MAC_AX_ERR_L1_RCVY_EN);
}
+static void hal_enable_err_imr(struct rtw89_ser *ser)
+{
+ struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
+ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
+
+ mac->err_imr_ctrl(rtwdev, true);
+}
+
/* state handler */
static void ser_idle_st_hdl(struct rtw89_ser *ser, u8 evt)
{
@@ -552,6 +560,8 @@ static void ser_do_hci_st_hdl(struct rtw89_ser *ser, u8 evt)
break;
case SER_EV_MAC_RESET_DONE:
+ hal_enable_err_imr(ser);
+
ser_state_goto(ser, SER_IDLE_ST);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 257/844] wifi: rtw89: setting TBTT AGG number when mac port initialization
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (255 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 256/844] wifi: rtw89: ser: enable error IMR after recovering from L1 Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 258/844] wifi: rtw89: mcc: reset probe counter when receiving beacon Sasha Levin
` (595 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chih-Kang Chang, Ping-Ke Shih, Sasha Levin
From: Chih-Kang Chang <gary.chang@realtek.com>
[ Upstream commit 5e5f83fba48381098b26a8b2513a6d5fc5c66ccb ]
When initializing mac port, needs to set TBTT AGG number to trigger TBTT
related interrupts. Otherwise, after sending join info H2C command with
disconnection mode, firmware will clear TBTT AGG number. Without the
setting from mac port initialization after that, this port will not be
able to transmit beacons.
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251223030651.480633-12-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/mac.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index b4c292c7e829d..6734e5d5a5e22 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -4341,6 +4341,7 @@ static void rtw89_mac_bcn_drop(struct rtw89_dev *rtwdev,
#define BCN_HOLD_DEF 200
#define BCN_MASK_DEF 0
#define TBTT_ERLY_DEF 5
+#define TBTT_AGG_DEF 1
#define BCN_SET_UNIT 32
#define BCN_ERLY_SET_DLY (10 * 2)
@@ -4644,6 +4645,16 @@ static void rtw89_mac_port_cfg_tbtt_early(struct rtw89_dev *rtwdev,
B_AX_TBTTERLY_MASK, TBTT_ERLY_DEF);
}
+static void rtw89_mac_port_cfg_tbtt_agg(struct rtw89_dev *rtwdev,
+ struct rtw89_vif_link *rtwvif_link)
+{
+ const struct rtw89_mac_gen_def *mac = rtwdev->chip->mac_def;
+ const struct rtw89_port_reg *p = mac->port_base;
+
+ rtw89_write16_port_mask(rtwdev, rtwvif_link, p->tbtt_agg,
+ B_AX_TBTT_AGG_NUM_MASK, TBTT_AGG_DEF);
+}
+
static void rtw89_mac_port_cfg_bss_color(struct rtw89_dev *rtwdev,
struct rtw89_vif_link *rtwvif_link)
{
@@ -4904,6 +4915,7 @@ int rtw89_mac_port_update(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvi
rtw89_mac_port_cfg_bcn_hold_time(rtwdev, rtwvif_link);
rtw89_mac_port_cfg_bcn_mask_area(rtwdev, rtwvif_link);
rtw89_mac_port_cfg_tbtt_early(rtwdev, rtwvif_link);
+ rtw89_mac_port_cfg_tbtt_agg(rtwdev, rtwvif_link);
rtw89_mac_port_cfg_bss_color(rtwdev, rtwvif_link);
rtw89_mac_port_cfg_mbssid(rtwdev, rtwvif_link);
rtw89_mac_port_cfg_func_en(rtwdev, rtwvif_link, true);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 258/844] wifi: rtw89: mcc: reset probe counter when receiving beacon
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (256 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 257/844] wifi: rtw89: setting TBTT AGG number when mac port initialization Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 259/844] wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Sasha Levin
` (594 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chih-Kang Chang, Ping-Ke Shih, Sasha Levin
From: Chih-Kang Chang <gary.chang@realtek.com>
[ Upstream commit 1b40c1c7571fcf926095ed92f25bd87900bdc8ed ]
For BE chips, needs to transmit QoS null data periodically to ensure
the connection with AP in GC+STA mode. However, in environments
with interference, the Qos null data might fail to transmit
successfully. Therefore, when receive the beacon from AP will
reset the QoS null data failure counter to avoid unnecessary
disconnection.
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251223030651.480633-13-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/chan.c | 5 ++++-
drivers/net/wireless/realtek/rtw89/mac80211.c | 1 +
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/chan.c b/drivers/net/wireless/realtek/rtw89/chan.c
index 86f1b39a967fe..8fe6a7ef738f7 100644
--- a/drivers/net/wireless/realtek/rtw89/chan.c
+++ b/drivers/net/wireless/realtek/rtw89/chan.c
@@ -2608,17 +2608,20 @@ bool rtw89_mcc_detect_go_bcn(struct rtw89_dev *rtwdev,
static void rtw89_mcc_detect_connection(struct rtw89_dev *rtwdev,
struct rtw89_mcc_role *role)
{
+ struct rtw89_vif_link *rtwvif_link = role->rtwvif_link;
struct ieee80211_vif *vif;
bool start_detect;
int ret;
ret = rtw89_core_send_nullfunc(rtwdev, role->rtwvif_link, true, false,
RTW89_MCC_PROBE_TIMEOUT);
- if (ret)
+ if (ret &&
+ READ_ONCE(rtwvif_link->sync_bcn_tsf) == rtwvif_link->last_sync_bcn_tsf)
role->probe_count++;
else
role->probe_count = 0;
+ rtwvif_link->last_sync_bcn_tsf = READ_ONCE(rtwvif_link->sync_bcn_tsf);
if (role->probe_count < RTW89_MCC_PROBE_MAX_TRIES)
return;
diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c
index f39ca1c2ed100..d08eac3d99266 100644
--- a/drivers/net/wireless/realtek/rtw89/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw89/mac80211.c
@@ -127,6 +127,7 @@ static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev,
rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;
rtwvif_link->rand_tsf_done = false;
rtwvif_link->detect_bcn_count = 0;
+ rtwvif_link->last_sync_bcn_tsf = 0;
rcu_read_lock();
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 259/844] wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (257 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 258/844] wifi: rtw89: mcc: reset probe counter when receiving beacon Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 260/844] wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data Sasha Levin
` (593 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bitterblue Smith, Ping-Ke Shih, Sasha Levin
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
[ Upstream commit 2ba12401cc1f2d970fa2e7d5b15abde3f5abd40d ]
Simplify the code by using device managed memory allocations.
This also fixes a memory leak in rtw_register_hw(). The supported bands
were not freed in the error path.
Copied from commit 145df52a8671 ("wifi: rtw89: Convert
rtw89_core_set_supported_band to use devm_*").
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/main.c | 19 ++++++-------------
1 file changed, 6 insertions(+), 13 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index f72d12c3b2bc6..6f35357e73246 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -1661,11 +1661,13 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
static void rtw_set_supported_band(struct ieee80211_hw *hw,
const struct rtw_chip_info *chip)
{
- struct rtw_dev *rtwdev = hw->priv;
struct ieee80211_supported_band *sband;
+ struct rtw_dev *rtwdev = hw->priv;
+ struct device *dev = rtwdev->dev;
if (chip->band & RTW_BAND_2G) {
- sband = kmemdup(&rtw_band_2ghz, sizeof(*sband), GFP_KERNEL);
+ sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
+ GFP_KERNEL);
if (!sband)
goto err_out;
if (chip->ht_supported)
@@ -1674,7 +1676,8 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
}
if (chip->band & RTW_BAND_5G) {
- sband = kmemdup(&rtw_band_5ghz, sizeof(*sband), GFP_KERNEL);
+ sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
+ GFP_KERNEL);
if (!sband)
goto err_out;
if (chip->ht_supported)
@@ -1690,13 +1693,6 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
rtw_err(rtwdev, "failed to set supported band\n");
}
-static void rtw_unset_supported_band(struct ieee80211_hw *hw,
- const struct rtw_chip_info *chip)
-{
- kfree(hw->wiphy->bands[NL80211_BAND_2GHZ]);
- kfree(hw->wiphy->bands[NL80211_BAND_5GHZ]);
-}
-
static void rtw_vif_smps_iter(void *data, u8 *mac,
struct ieee80211_vif *vif)
{
@@ -2320,10 +2316,7 @@ EXPORT_SYMBOL(rtw_register_hw);
void rtw_unregister_hw(struct rtw_dev *rtwdev, struct ieee80211_hw *hw)
{
- const struct rtw_chip_info *chip = rtwdev->chip;
-
ieee80211_unregister_hw(hw);
- rtw_unset_supported_band(hw, chip);
rtw_debugfs_deinit(rtwdev);
rtw_led_deinit(rtwdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 260/844] wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (258 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 259/844] wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 261/844] PCI: cadence: Avoid signed 64-bit truncation and invalid sort Sasha Levin
` (592 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bitterblue Smith, Ping-Ke Shih, Sasha Levin
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
[ Upstream commit fcac0f23d4d20b11014a39f8e2527cdc12ec9c82 ]
Internally wiphy writes to individual channels in this structure,
so we must not share one static definition of channel list between
multiple device instances, because that causes hard to debug
breakage.
For example, with two rtw88 driven devices in the system, channel
information may get incoherent, preventing channel use.
Copied from commit 0ae36391c804 ("wifi: rtw89: Fix inadverent sharing
of struct ieee80211_supported_band data").
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/main.c | 34 +++++++++++++++++++----
1 file changed, 29 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
index 6f35357e73246..dde2ea6a00e06 100644
--- a/drivers/net/wireless/realtek/rtw88/main.c
+++ b/drivers/net/wireless/realtek/rtw88/main.c
@@ -1658,16 +1658,41 @@ static u16 rtw_get_max_scan_ie_len(struct rtw_dev *rtwdev)
return len;
}
+static struct ieee80211_supported_band *
+rtw_sband_dup(struct rtw_dev *rtwdev,
+ const struct ieee80211_supported_band *sband)
+{
+ struct ieee80211_supported_band *dup;
+
+ dup = devm_kmemdup(rtwdev->dev, sband, sizeof(*sband), GFP_KERNEL);
+ if (!dup)
+ return NULL;
+
+ dup->channels = devm_kmemdup_array(rtwdev->dev, sband->channels,
+ sband->n_channels,
+ sizeof(*sband->channels),
+ GFP_KERNEL);
+ if (!dup->channels)
+ return NULL;
+
+ dup->bitrates = devm_kmemdup_array(rtwdev->dev, sband->bitrates,
+ sband->n_bitrates,
+ sizeof(*sband->bitrates),
+ GFP_KERNEL);
+ if (!dup->bitrates)
+ return NULL;
+
+ return dup;
+}
+
static void rtw_set_supported_band(struct ieee80211_hw *hw,
const struct rtw_chip_info *chip)
{
struct ieee80211_supported_band *sband;
struct rtw_dev *rtwdev = hw->priv;
- struct device *dev = rtwdev->dev;
if (chip->band & RTW_BAND_2G) {
- sband = devm_kmemdup(dev, &rtw_band_2ghz, sizeof(*sband),
- GFP_KERNEL);
+ sband = rtw_sband_dup(rtwdev, &rtw_band_2ghz);
if (!sband)
goto err_out;
if (chip->ht_supported)
@@ -1676,8 +1701,7 @@ static void rtw_set_supported_band(struct ieee80211_hw *hw,
}
if (chip->band & RTW_BAND_5G) {
- sband = devm_kmemdup(dev, &rtw_band_5ghz, sizeof(*sband),
- GFP_KERNEL);
+ sband = rtw_sband_dup(rtwdev, &rtw_band_5ghz);
if (!sband)
goto err_out;
if (chip->ht_supported)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 261/844] PCI: cadence: Avoid signed 64-bit truncation and invalid sort
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (259 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 260/844] wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 262/844] wifi: rtw89: regd: 6 GHz power type marks default when inactive Sasha Levin
` (591 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ian Rogers, Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
From: Ian Rogers <irogers@google.com>
[ Upstream commit 0297dce758a021ccf2c0f4e164d5403ef722961c ]
The cdns_pcie_host_dma_ranges_cmp() element comparison function used by
list_sort() is of type list_cmp_func_t, so it returns a 32-bit int.
cdns_pcie_host_dma_ranges_cmp() computes a resource_size_t difference that
may be a 64-bit value, and truncating that difference to a 32-bit return
value may change the sign and result in an invalid sort order.
Avoid the truncation and invalid sort order by returning -1, 0, or 1.
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251209223756.2321578-1-irogers@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../controller/cadence/pcie-cadence-host-common.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
index 15415d7f35ee9..2b0211870f02a 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
@@ -173,11 +173,21 @@ int cdns_pcie_host_dma_ranges_cmp(void *priv, const struct list_head *a,
const struct list_head *b)
{
struct resource_entry *entry1, *entry2;
+ u64 size1, size2;
entry1 = container_of(a, struct resource_entry, node);
entry2 = container_of(b, struct resource_entry, node);
- return resource_size(entry2->res) - resource_size(entry1->res);
+ size1 = resource_size(entry1->res);
+ size2 = resource_size(entry2->res);
+
+ if (size1 > size2)
+ return -1;
+
+ if (size1 < size2)
+ return 1;
+
+ return 0;
}
EXPORT_SYMBOL_GPL(cdns_pcie_host_dma_ranges_cmp);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 262/844] wifi: rtw89: regd: 6 GHz power type marks default when inactive
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (260 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 261/844] PCI: cadence: Avoid signed 64-bit truncation and invalid sort Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 263/844] dm: replace -EEXIST with -EBUSY Sasha Levin
` (590 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zong-Zhe Yang, Ping-Ke Shih, Sasha Levin
From: Zong-Zhe Yang <kevin_yang@realtek.com>
[ Upstream commit 8c96752d99c0b094af68317a8c701b09bd0862d9 ]
When inactive, 6 GHz power type has been assigned to the default one,
but missed to mark the local control variable, dflt, true. Then, this
might let some 6 GHz power info of disconnected APs keep being taken
into account under certain cases.
So, mark default when inactive.
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251229030926.27004-12-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/regd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/realtek/rtw89/regd.c b/drivers/net/wireless/realtek/rtw89/regd.c
index 209d84909f885..c3425ed44732e 100644
--- a/drivers/net/wireless/realtek/rtw89/regd.c
+++ b/drivers/net/wireless/realtek/rtw89/regd.c
@@ -1142,6 +1142,7 @@ static int rtw89_reg_6ghz_power_recalc(struct rtw89_dev *rtwdev,
}
} else {
rtwvif_link->reg_6ghz_power = RTW89_REG_6GHZ_POWER_DFLT;
+ dflt = true;
}
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 263/844] dm: replace -EEXIST with -EBUSY
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (261 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 262/844] wifi: rtw89: regd: 6 GHz power type marks default when inactive Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 264/844] dm: remove fake timeout to avoid leak request Sasha Levin
` (589 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Daniel Gomez, Mikulas Patocka, Sasha Levin
From: Daniel Gomez <da.gomez@samsung.com>
[ Upstream commit b13ef361d47f09b7aecd18e0383ecc83ff61057e ]
The -EEXIST error code is reserved by the module loading infrastructure
to indicate that a module is already loaded. When a module's init
function returns -EEXIST, userspace tools like kmod interpret this as
"module already loaded" and treat the operation as successful, returning
0 to the user even though the module initialization actually failed.
This follows the precedent set by commit 54416fd76770 ("netfilter:
conntrack: helper: Replace -EEXIST by -EBUSY") which fixed the same
issue in nf_conntrack_helper_register().
Affected modules:
* dm_cache dm_clone dm_integrity dm_mirror dm_multipath dm_pcache
* dm_vdo dm-ps-round-robin dm_historical_service_time dm_io_affinity
* dm_queue_length dm_service_time dm_snapshot
Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-exception-store.c | 2 +-
drivers/md/dm-log.c | 2 +-
drivers/md/dm-path-selector.c | 2 +-
drivers/md/dm-target.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index c3799757bf4a0..88f119a0a2ae0 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -116,7 +116,7 @@ int dm_exception_store_type_register(struct dm_exception_store_type *type)
if (!__find_exception_store_type(type->name))
list_add(&type->list, &_exception_store_types);
else
- r = -EEXIST;
+ r = -EBUSY;
spin_unlock(&_lock);
return r;
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 9d85d045f9d9d..bced5a783ee33 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -121,7 +121,7 @@ int dm_dirty_log_type_register(struct dm_dirty_log_type *type)
if (!__find_dirty_log_type(type->name))
list_add(&type->list, &_log_types);
else
- r = -EEXIST;
+ r = -EBUSY;
spin_unlock(&_lock);
return r;
diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
index d0b883fabfeb6..2b0ac200f1c02 100644
--- a/drivers/md/dm-path-selector.c
+++ b/drivers/md/dm-path-selector.c
@@ -107,7 +107,7 @@ int dm_register_path_selector(struct path_selector_type *pst)
if (__find_path_selector_type(pst->name)) {
kfree(psi);
- r = -EEXIST;
+ r = -EBUSY;
} else
list_add(&psi->list, &_path_selectors);
diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
index 8fede41adec00..1fd41289de367 100644
--- a/drivers/md/dm-target.c
+++ b/drivers/md/dm-target.c
@@ -88,7 +88,7 @@ int dm_register_target(struct target_type *tt)
if (__find_target_type(tt->name)) {
DMERR("%s: '%s' target already registered",
__func__, tt->name);
- rv = -EEXIST;
+ rv = -EBUSY;
} else {
list_add(&tt->list, &_targets);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 264/844] dm: remove fake timeout to avoid leak request
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (262 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 263/844] dm: replace -EEXIST with -EBUSY Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 265/844] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency Sasha Levin
` (588 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ding Hui, Christoph Hellwig, Mikulas Patocka, Sasha Levin
From: Ding Hui <dinghui@sangfor.com.cn>
[ Upstream commit f3a9c95a15d2f4466acad5c68faeff79ca5e9f47 ]
Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
blk_mq_complete_request"), drivers are responsible for calling
blk_should_fake_timeout() at appropriate code paths and opportunities.
However, the dm driver does not implement its own timeout handler and
relies on the timeout handling of its slave devices.
If an io-timeout-fail error is injected to a dm device, the request
will be leaked and never completed, causing tasks to hang indefinitely.
Reproduce:
1. prepare dm which has iscsi slave device
2. inject io-timeout-fail to dm
echo 1 >/sys/class/block/dm-0/io-timeout-fail
echo 100 >/sys/kernel/debug/fail_io_timeout/probability
echo 10 >/sys/kernel/debug/fail_io_timeout/times
3. read/write dm
4. iscsiadm -m node -u
Result: hang task like below
[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
[ 862.245264] Call Trace:
[ 862.245587] <TASK>
[ 862.245814] __schedule+0x810/0x15c0
[ 862.246557] schedule+0x69/0x180
[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
[ 862.247688] elevator_change+0x16d/0x460
[ 862.247893] elevator_set_none+0x87/0xf0
[ 862.248798] blk_unregister_queue+0x12e/0x2a0
[ 862.248995] __del_gendisk+0x231/0x7e0
[ 862.250143] del_gendisk+0x12f/0x1d0
[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
[ 862.250650] device_release_driver_internal+0x36d/0x530
[ 862.250849] bus_remove_device+0x1dd/0x3f0
[ 862.251042] device_del+0x38a/0x930
[ 862.252095] __scsi_remove_device+0x293/0x360
[ 862.252291] scsi_remove_target+0x486/0x760
[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
[ 862.252886] process_one_work+0x633/0xe50
[ 862.253101] worker_thread+0x6df/0xf10
[ 862.253647] kthread+0x36d/0x720
[ 862.254533] ret_from_fork+0x2a6/0x470
[ 862.255852] ret_from_fork_asm+0x1a/0x30
[ 862.256037] </TASK>
Remove the blk_should_fake_timeout() check from dm, as dm has no
native timeout handling and should not attempt to fake timeouts.
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-rq.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index a6ca92049c10e..5e08546696145 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -278,8 +278,7 @@ static void dm_complete_request(struct request *rq, blk_status_t error)
struct dm_rq_target_io *tio = tio_from_request(rq);
tio->error = error;
- if (likely(!blk_should_fake_timeout(rq->q)))
- blk_mq_complete_request(rq);
+ blk_mq_complete_request(rq);
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 265/844] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (263 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 264/844] dm: remove fake timeout to avoid leak request Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:22 ` [PATCH 6.19 266/844] net: wwan: mhi: Add network support for Foxconn T99W760 Sasha Levin
` (587 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexander Grest, Mostafa Saleh, Nicolin Chen, Jacob Pan,
Will Deacon, Sasha Levin
From: Alexander Grest <Alexander.Grest@microsoft.com>
[ Upstream commit df180b1a4cc51011c5f8c52c7ec02ad2e42962de ]
The SMMU CMDQ lock is highly contentious when there are multiple CPUs
issuing commands and the queue is nearly full.
The lock has the following states:
- 0: Unlocked
- >0: Shared lock held with count
- INT_MIN+N: Exclusive lock held, where N is the # of shared waiters
- INT_MIN: Exclusive lock held, no shared waiters
When multiple CPUs are polling for space in the queue, they attempt to
grab the exclusive lock to update the cons pointer from the hardware. If
they fail to get the lock, they will spin until either the cons pointer
is updated by another CPU.
The current code allows the possibility of shared lock starvation
if there is a constant stream of CPUs trying to grab the exclusive lock.
This leads to severe latency issues and soft lockups.
Consider the following scenario where CPU1's attempt to acquire the
shared lock is starved by CPU2 and CPU0 contending for the exclusive
lock.
CPU0 (exclusive) | CPU1 (shared) | CPU2 (exclusive) | `cmdq->lock`
--------------------------------------------------------------------------
trylock() //takes | | | 0
| shared_lock() | | INT_MIN
| fetch_inc() | | INT_MIN
| no return | | INT_MIN + 1
| spins // VAL >= 0 | | INT_MIN + 1
unlock() | spins... | | INT_MIN + 1
set_release(0) | spins... | | 0 see[NOTE]
(done) | (sees 0) | trylock() // takes | 0
| *exits loop* | cmpxchg(0, INT_MIN) | 0
| | *cuts in* | INT_MIN
| cmpxchg(0, 1) | | INT_MIN
| fails // != 0 | | INT_MIN
| spins // VAL >= 0 | | INT_MIN
| *starved* | | INT_MIN
[NOTE] The current code resets the exclusive lock to 0 regardless of the
state of the lock. This causes two problems:
1. It opens the possibility of back-to-back exclusive locks and the
downstream effect of starving shared lock.
2. The count of shared lock waiters are lost.
To mitigate this, we release the exclusive lock by only clearing the sign
bit while retaining the shared lock waiter count as a way to avoid
starving the shared lock waiters.
Also deleted cmpxchg loop while trying to acquire the shared lock as it
is not needed. The waiters can see the positive lock count and proceed
immediately after the exclusive lock is released.
Exclusive lock is not starved in that submitters will try exclusive lock
first when new spaces become available.
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Alexander Grest <Alexander.Grest@microsoft.com>
Signed-off-by: Jacob Pan <jacob.pan@linux.microsoft.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 31 ++++++++++++++-------
1 file changed, 21 insertions(+), 10 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index d16d35c78c068..7a6aea3b61c11 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -487,20 +487,26 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
*/
static void arm_smmu_cmdq_shared_lock(struct arm_smmu_cmdq *cmdq)
{
- int val;
-
/*
- * We can try to avoid the cmpxchg() loop by simply incrementing the
- * lock counter. When held in exclusive state, the lock counter is set
- * to INT_MIN so these increments won't hurt as the value will remain
- * negative.
+ * When held in exclusive state, the lock counter is set to INT_MIN
+ * so these increments won't hurt as the value will remain negative.
+ * The increment will also signal the exclusive locker that there are
+ * shared waiters.
*/
if (atomic_fetch_inc_relaxed(&cmdq->lock) >= 0)
return;
- do {
- val = atomic_cond_read_relaxed(&cmdq->lock, VAL >= 0);
- } while (atomic_cmpxchg_relaxed(&cmdq->lock, val, val + 1) != val);
+ /*
+ * Someone else is holding the lock in exclusive state, so wait
+ * for them to finish. Since we already incremented the lock counter,
+ * no exclusive lock can be acquired until we finish. We don't need
+ * the return value since we only care that the exclusive lock is
+ * released (i.e. the lock counter is non-negative).
+ * Once the exclusive locker releases the lock, the sign bit will
+ * be cleared and our increment will make the lock counter positive,
+ * allowing us to proceed.
+ */
+ atomic_cond_read_relaxed(&cmdq->lock, VAL > 0);
}
static void arm_smmu_cmdq_shared_unlock(struct arm_smmu_cmdq *cmdq)
@@ -527,9 +533,14 @@ static bool arm_smmu_cmdq_shared_tryunlock(struct arm_smmu_cmdq *cmdq)
__ret; \
})
+/*
+ * Only clear the sign bit when releasing the exclusive lock this will
+ * allow any shared_lock() waiters to proceed without the possibility
+ * of entering the exclusive lock in a tight loop.
+ */
#define arm_smmu_cmdq_exclusive_unlock_irqrestore(cmdq, flags) \
({ \
- atomic_set_release(&cmdq->lock, 0); \
+ atomic_fetch_andnot_release(INT_MIN, &cmdq->lock); \
local_irq_restore(flags); \
})
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 266/844] net: wwan: mhi: Add network support for Foxconn T99W760
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (264 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 265/844] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency Sasha Levin
@ 2026-02-28 17:22 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 267/844] wifi: rtw89: fix potential zero beacon interval in beacon tracking Sasha Levin
` (586 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:22 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Slark Xiao, Jakub Kicinski, Sasha Levin
From: Slark Xiao <slark_xiao@163.com>
[ Upstream commit 915a5f60ad947e8dd515d2cc77a96a14dffb3f15 ]
T99W760 is designed based on Qualcomm SDX35 chip. It use similar
architecture with SDX72/SDX75 chip. So we need to assign initial
link id for this device to make sure network available.
Signed-off-by: Slark Xiao <slark_xiao@163.com>
Link: https://patch.msgid.link/20260105022646.10630-1-slark_xiao@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/mhi_wwan_mbim.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index f8bc9a39bfa30..1d7e3ad900c12 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c
@@ -98,7 +98,8 @@ static struct mhi_mbim_link *mhi_mbim_get_link_rcu(struct mhi_mbim_context *mbim
static int mhi_mbim_get_link_mux_id(struct mhi_controller *cntrl)
{
if (strcmp(cntrl->name, "foxconn-dw5934e") == 0 ||
- strcmp(cntrl->name, "foxconn-t99w640") == 0)
+ strcmp(cntrl->name, "foxconn-t99w640") == 0 ||
+ strcmp(cntrl->name, "foxconn-t99w760") == 0)
return WDS_BIND_MUX_DATA_PORT_MUX_ID;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 267/844] wifi: rtw89: fix potential zero beacon interval in beacon tracking
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (265 preceding siblings ...)
2026-02-28 17:22 ` [PATCH 6.19 266/844] net: wwan: mhi: Add network support for Foxconn T99W760 Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 268/844] rtla: Fix NULL pointer dereference in actions_parse Sasha Levin
` (585 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kuan-Chung Chen, Ping-Ke Shih, Sasha Levin
From: Kuan-Chung Chen <damon.chen@realtek.com>
[ Upstream commit eb57be32f438c57c88d6ce756101c1dfbcc03bba ]
During fuzz testing, it was discovered that bss_conf->beacon_int
might be zero, which could result in a division by zero error in
subsequent calculations. Set a default value of 100 TU if the
interval is zero to ensure stability.
Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251231090647.56407-11-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/core.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 53d32f3137ebe..c5934e4eff711 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -2787,7 +2787,7 @@ static void rtw89_core_bcn_track_assoc(struct rtw89_dev *rtwdev,
rcu_read_lock();
bss_conf = rtw89_vif_rcu_dereference_link(rtwvif_link, true);
- beacon_int = bss_conf->beacon_int;
+ beacon_int = bss_conf->beacon_int ?: 100;
dtim = bss_conf->dtim_period;
rcu_read_unlock();
@@ -2817,9 +2817,7 @@ static void rtw89_core_bcn_track_reset(struct rtw89_dev *rtwdev)
memset(&rtwdev->bcn_track, 0, sizeof(rtwdev->bcn_track));
}
-static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
- struct ieee80211_bss_conf *bss_conf,
- struct sk_buff *skb)
+static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, struct sk_buff *skb)
{
#define RTW89_APPEND_TSF_2GHZ 384
#define RTW89_APPEND_TSF_5GHZ 52
@@ -2828,7 +2826,7 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
struct rtw89_beacon_stat *bcn_stat = &rtwdev->phystat.bcn_stat;
struct rtw89_beacon_track_info *bcn_track = &rtwdev->bcn_track;
- u32 bcn_intvl_us = ieee80211_tu_to_usec(bss_conf->beacon_int);
+ u32 bcn_intvl_us = ieee80211_tu_to_usec(bcn_track->beacon_int);
u64 tsf = le64_to_cpu(mgmt->u.beacon.timestamp);
u8 wp, num = bcn_stat->num;
u16 append;
@@ -2836,6 +2834,10 @@ static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev,
if (!RTW89_CHK_FW_FEATURE(BEACON_TRACKING, &rtwdev->fw))
return;
+ /* Skip if not yet associated */
+ if (!bcn_intvl_us)
+ return;
+
switch (rx_status->band) {
default:
case NL80211_BAND_2GHZ:
@@ -2923,7 +2925,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
pkt_stat->beacon_rate = desc_info->data_rate;
pkt_stat->beacon_len = skb->len;
- rtw89_vif_rx_bcn_stat(rtwdev, bss_conf, skb);
+ rtw89_vif_rx_bcn_stat(rtwdev, skb);
}
if (!ether_addr_equal(bss_conf->addr, hdr->addr1))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 268/844] rtla: Fix NULL pointer dereference in actions_parse
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (266 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 267/844] wifi: rtw89: fix potential zero beacon interval in beacon tracking Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 269/844] wifi: libertas: fix WARNING in usb_tx_block Sasha Levin
` (584 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Wander Lairson Costa, Tomas Glozar, Sasha Levin
From: Wander Lairson Costa <wander@redhat.com>
[ Upstream commit a0890f9dbd24b302d327fe7dad9b9c5be0e278aa ]
The actions_parse() function uses strtok() to tokenize the trigger
string, but does not check if the returned token is NULL before
passing it to strcmp(). If the trigger parameter is an empty string
or contains only delimiter characters, strtok() returns NULL, causing
strcmp() to dereference a NULL pointer and crash the program.
This issue can be triggered by malformed user input or edge cases in
trigger string parsing. Add a NULL check immediately after the strtok()
call to validate that a token was successfully extracted before using
it. If no token is found, the function now returns -1 to indicate a
parsing error.
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Link: https://lore.kernel.org/r/20260106133655.249887-13-wander@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/rtla/src/actions.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/tracing/rtla/src/actions.c b/tools/tracing/rtla/src/actions.c
index 8945aee58d511..15986505b4376 100644
--- a/tools/tracing/rtla/src/actions.c
+++ b/tools/tracing/rtla/src/actions.c
@@ -141,6 +141,8 @@ actions_parse(struct actions *self, const char *trigger, const char *tracefn)
strcpy(trigger_c, trigger);
token = strtok(trigger_c, ",");
+ if (!token)
+ return -1;
if (strcmp(token, "trace") == 0)
type = ACTION_TRACE_OUTPUT;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 269/844] wifi: libertas: fix WARNING in usb_tx_block
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (267 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 268/844] rtla: Fix NULL pointer dereference in actions_parse Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 270/844] iommu/amd: move wait_on_sem() out of spinlock Sasha Levin
` (583 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Szymon Wilczek, syzbot+67969ab6a2551c27f71b, Johannes Berg,
Sasha Levin
From: Szymon Wilczek <swilczek.lx@gmail.com>
[ Upstream commit d66676e6ca96bf8680f869a9bd6573b26c634622 ]
The function usb_tx_block() submits cardp->tx_urb without ensuring that
any previous transmission on this URB has completed. If a second call
occurs while the URB is still active (e.g. during rapid firmware loading),
usb_submit_urb() detects the active state and triggers a warning:
'URB submitted while active'.
Fix this by enforcing serialization: call usb_kill_urb() before
submitting the new request. This ensures the URB is idle and safe to reuse.
Reported-by: syzbot+67969ab6a2551c27f71b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=67969ab6a2551c27f71b
Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
Link: https://patch.msgid.link/20251221155806.23925-1-swilczek.lx@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
index b3c4040257a67..924ab93b7b671 100644
--- a/drivers/net/wireless/marvell/libertas/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas/if_usb.c
@@ -426,6 +426,8 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload, uint16_t nb
goto tx_ret;
}
+ usb_kill_urb(cardp->tx_urb);
+
usb_fill_bulk_urb(cardp->tx_urb, cardp->udev,
usb_sndbulkpipe(cardp->udev,
cardp->ep_out),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 270/844] iommu/amd: move wait_on_sem() out of spinlock
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (268 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 269/844] wifi: libertas: fix WARNING in usb_tx_block Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 271/844] wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N) Sasha Levin
` (582 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ankit Soni, Vasant Hegde, Joerg Roedel, Sasha Levin
From: Ankit Soni <Ankit.Soni@amd.com>
[ Upstream commit d2a0cac10597068567d336e85fa3cbdbe8ca62bf ]
With iommu.strict=1, the existing completion wait path can cause soft
lockups under stressed environment, as wait_on_sem() busy-waits under the
spinlock with interrupts disabled.
Move the completion wait in iommu_completion_wait() out of the spinlock.
wait_on_sem() only polls the hardware-updated cmd_sem and does not require
iommu->lock, so holding the lock during the busy wait unnecessarily
increases contention and extends the time with interrupts disabled.
Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/iommu.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 0f9045ce93af1..c5f7e003d01c9 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -1180,7 +1180,12 @@ static int wait_on_sem(struct amd_iommu *iommu, u64 data)
{
int i = 0;
- while (*iommu->cmd_sem != data && i < LOOP_TIMEOUT) {
+ /*
+ * cmd_sem holds a monotonically non-decreasing completion sequence
+ * number.
+ */
+ while ((__s64)(READ_ONCE(*iommu->cmd_sem) - data) < 0 &&
+ i < LOOP_TIMEOUT) {
udelay(1);
i += 1;
}
@@ -1432,14 +1437,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
raw_spin_lock_irqsave(&iommu->lock, flags);
ret = __iommu_queue_command_sync(iommu, &cmd, false);
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
+
if (ret)
- goto out_unlock;
+ return ret;
ret = wait_on_sem(iommu, data);
-out_unlock:
- raw_spin_unlock_irqrestore(&iommu->lock, flags);
-
return ret;
}
@@ -3115,13 +3119,18 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
raw_spin_lock_irqsave(&iommu->lock, flags);
ret = __iommu_queue_command_sync(iommu, &cmd, true);
if (ret)
- goto out;
+ goto out_err;
ret = __iommu_queue_command_sync(iommu, &cmd2, false);
if (ret)
- goto out;
+ goto out_err;
+ raw_spin_unlock_irqrestore(&iommu->lock, flags);
+
wait_on_sem(iommu, data);
-out:
+ return;
+
+out_err:
raw_spin_unlock_irqrestore(&iommu->lock, flags);
+ return;
}
static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 271/844] wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N)
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (269 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 270/844] iommu/amd: move wait_on_sem() out of spinlock Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 272/844] wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18) Sasha Levin
` (581 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zenm Chen, Ping-Ke Shih, Sasha Levin
From: Zenm Chen <zenmchen@gmail.com>
[ Upstream commit 3116f287b81fe777a00b93ab07ec3c270093b185 ]
Add the ID 0db0:f0c8 to the table to support an additional RTL8832BU
adapter: MSI AX1800 Nano (GUAX18N).
Compile tested only.
Link: https://github.com/morrownr/rtl8852bu-20250826/pull/2
Signed-off-by: Zenm Chen <zenmchen@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260112004358.5516-1-zenmchen@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
index 980d17ef68d0a..84cd3ec971f98 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
@@ -54,6 +54,8 @@ static const struct usb_device_id rtw_8852bu_id_table[] = {
.driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x6931, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0xf0c8, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3327, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3574, 0x6121, 0xff, 0xff, 0xff),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 272/844] wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18)
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (270 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 271/844] wifi: rtw89: Add support for MSI AX1800 Nano (GUAX18N) Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 273/844] wifi: rtw89: pci: validate sequence number of TX release report Sasha Levin
` (580 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zenm Chen, Ping-Ke Shih, Sasha Levin
From: Zenm Chen <zenmchen@gmail.com>
[ Upstream commit 292c0bc8acb687de7e83fc454bb98af19187b6bf ]
Add the ID 2001:3323 to the table to support an additional RTL8832AU
adapter: D-Link VR Air Bridge (DWA-F18).
Compile tested only.
Link: https://github.com/morrownr/rtw89/pull/44
Signed-off-by: Zenm Chen <zenmchen@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260112004759.6028-1-zenmchen@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8852au.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852au.c b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
index 74a976c984ad8..ccdbcc178c2a4 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852au.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852au.c
@@ -52,6 +52,8 @@ static const struct usb_device_id rtw_8852au_id_table[] = {
.driver_info = (kernel_ulong_t)&rtw89_8852au_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3321, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852au_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3323, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852au_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x332c, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852au_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x013f, 0xff, 0xff, 0xff),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 273/844] wifi: rtw89: pci: validate sequence number of TX release report
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (271 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 272/844] wifi: rtw89: Add support for D-Link VR Air Bridge (DWA-F18) Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 274/844] wifi: rtw89: mac: correct page number for CSI response Sasha Levin
` (579 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ping-Ke Shih, Sasha Levin
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 957eda596c7665f2966970fd1dcc35fe299b38e8 ]
Hardware rarely reports abnormal sequence number in TX release report,
which will access out-of-bounds of wd_ring->pages array, causing NULL
pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U
6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)
Call Trace:
<IRQ>
rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]
rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]
net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759
handle_softirqs+0xbe/0x290 kernel/softirq.c:601
? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]
__local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423
</IRQ>
<TASK>
rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]
? irq_thread+0xa7/0x340 kernel/irq/manage.c:0
irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314
? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202
? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220
kthread+0xea/0x110 kernel/kthread.c:376
? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287
? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
To prevent crash, validate rpp_info.seq before using.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260110022019.2254969-2-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/pci.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
index a66fcdb0293b6..093960d7279f8 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -604,11 +604,16 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp)
info->parse_rpp(rtwdev, rpp, &rpp_info);
- if (rpp_info.txch == RTW89_TXCH_CH12) {
+ if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) {
rtw89_warn(rtwdev, "should no fwcmd release report\n");
return;
}
+ if (unlikely(rpp_info.seq >= RTW89_PCI_TXWD_NUM_MAX)) {
+ rtw89_warn(rtwdev, "invalid seq %d\n", rpp_info.seq);
+ return;
+ }
+
tx_ring = &rtwpci->tx.rings[rpp_info.txch];
wd_ring = &tx_ring->wd_ring;
txwd = &wd_ring->pages[rpp_info.seq];
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 274/844] wifi: rtw89: mac: correct page number for CSI response
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (272 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 273/844] wifi: rtw89: pci: validate sequence number of TX release report Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 275/844] wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode Sasha Levin
` (578 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ping-Ke Shih, Sasha Levin
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit aa2a44d0d22d45d659b9f01638809b1735e46cff ]
For beamforming procedure, hardware reserve memory page for CSI response.
The unit of register is (value - 1), so add one accordingly as expected.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260110022019.2254969-7-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/mac_be.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/mac_be.c b/drivers/net/wireless/realtek/rtw89/mac_be.c
index 9b9e646487346..dee5ff71b75fe 100644
--- a/drivers/net/wireless/realtek/rtw89/mac_be.c
+++ b/drivers/net/wireless/realtek/rtw89/mac_be.c
@@ -1175,7 +1175,7 @@ static int resp_pktctl_init_be(struct rtw89_dev *rtwdev, u8 mac_idx)
reg = rtw89_mac_reg_by_idx(rtwdev, R_BE_RESP_CSI_RESERVED_PAGE, mac_idx);
rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_START_PAGE_MASK, qt_cfg.pktid);
- rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num);
+ rtw89_write32_mask(rtwdev, reg, B_BE_CSI_RESERVED_PAGE_NUM_MASK, qt_cfg.pg_num + 1);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 275/844] wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (273 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 274/844] wifi: rtw89: mac: correct page number for CSI response Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 276/844] PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port Sasha Levin
` (577 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chin-Yen Lee, Ping-Ke Shih, Sasha Levin
From: Chin-Yen Lee <timlee@realtek.com>
[ Upstream commit 2fd8f953f25173d14981d8736b6f5bfcd757e51b ]
Some APs disconnect clients by sending a Disassociation frame
rather than a Deauthentication frame. Since these frames use
different reason codes in WoWLAN mode, this commit adds support
for handling Disassociation to prevent missed disconnection events.
Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260110022019.2254969-3-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/wow.c | 4 ++++
drivers/net/wireless/realtek/rtw89/wow.h | 1 +
2 files changed, 5 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 46aba4cb2ee9e..534966b4d9c43 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -809,6 +809,10 @@ static void rtw89_wow_show_wakeup_reason(struct rtw89_dev *rtwdev)
reason = rtw89_read8(rtwdev, wow_reason_reg);
switch (reason) {
+ case RTW89_WOW_RSN_RX_DISASSOC:
+ wakeup.disconnect = true;
+ rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx disassoc\n");
+ break;
case RTW89_WOW_RSN_RX_DEAUTH:
wakeup.disconnect = true;
rtw89_debug(rtwdev, RTW89_DBG_WOW, "WOW: Rx deauth\n");
diff --git a/drivers/net/wireless/realtek/rtw89/wow.h b/drivers/net/wireless/realtek/rtw89/wow.h
index d2ba6cebc2a6b..71e07f482174f 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.h
+++ b/drivers/net/wireless/realtek/rtw89/wow.h
@@ -33,6 +33,7 @@
enum rtw89_wake_reason {
RTW89_WOW_RSN_RX_PTK_REKEY = 0x1,
RTW89_WOW_RSN_RX_GTK_REKEY = 0x2,
+ RTW89_WOW_RSN_RX_DISASSOC = 0x4,
RTW89_WOW_RSN_RX_DEAUTH = 0x8,
RTW89_WOW_RSN_DISCONNECT = 0x10,
RTW89_WOW_RSN_RX_MAGIC_PKT = 0x21,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 276/844] PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (274 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 275/844] wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 277/844] wifi: rtw89: disable EHT protocol by chip capabilities Sasha Levin
` (576 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shawn Lin, Manivannan Sadhasivam, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit b5d712e5b87fc56ff838684afb1bae359eb8069f ]
Some Rockchip PCIe Root Ports report bogus size of 1GiB for the BAR
memories and they cause below resource allocation issue during probe.
pci 0000:00:00.0: [1d87:3588] type 01 class 0x060400 PCIe Root Port
pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x3fffffff]
pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x3fffffff]
pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref]
...
pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: assigned
pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: releasing
pci 0000:00:00.0: ROM [mem 0xf0200000-0xf020ffff pref]: releasing
pci 0000:00:00.0: BAR 0 [mem 0x900000000-0x93fffffff]: assigned
pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: can't assign; no space
pci 0000:00:00.0: BAR 1 [mem size 0x40000000]: failed to assign
Since there is no use of the Root Port BAR memories, disable both of them.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
[mani: reworded the description and comment]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/1766570461-138256-1-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-dw-rockchip.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
index bf8ec3ca6f689..a3daac74d3f18 100644
--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
@@ -80,6 +80,8 @@
#define PCIE_LINKUP_MASK GENMASK(17, 16)
#define PCIE_LTSSM_STATUS_MASK GENMASK(5, 0)
+#define PCIE_TYPE0_HDR_DBI2_OFFSET 0x100000
+
struct rockchip_pcie {
struct dw_pcie pci;
void __iomem *apb_base;
@@ -292,6 +294,8 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
if (irq < 0)
return irq;
+ pci->dbi_base2 = pci->dbi_base + PCIE_TYPE0_HDR_DBI2_OFFSET;
+
ret = rockchip_pcie_init_irq_domain(rockchip);
if (ret < 0)
dev_err(dev, "failed to init irq domain\n");
@@ -302,6 +306,10 @@ static int rockchip_pcie_host_init(struct dw_pcie_rp *pp)
rockchip_pcie_configure_l1ss(pci);
rockchip_pcie_enable_l0s(pci);
+ /* Disable Root Ports BAR0 and BAR1 as they report bogus size */
+ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_0, 0x0);
+ dw_pcie_writel_dbi2(pci, PCI_BASE_ADDRESS_1, 0x0);
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 277/844] wifi: rtw89: disable EHT protocol by chip capabilities
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (275 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 276/844] PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 278/844] wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 Sasha Levin
` (575 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ping-Ke Shih, Sasha Levin
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 7fd36ffedeedc97c44a10249a3f12d471bb2dc26 ]
For certain chip models, EHT protocol is disabled, and driver must follow
the capabilities. Otherwise, chips become unusable.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260110022019.2254969-5-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/core.c | 2 +-
drivers/net/wireless/realtek/rtw89/core.h | 1 +
drivers/net/wireless/realtek/rtw89/fw.h | 4 ++++
drivers/net/wireless/realtek/rtw89/mac.c | 5 +++++
4 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index c5934e4eff711..4b86a7c4fe329 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -5238,7 +5238,7 @@ static void rtw89_init_eht_cap(struct rtw89_dev *rtwdev,
u8 val, val_mcs13;
int sts = 8;
- if (chip->chip_gen == RTW89_CHIP_AX)
+ if (chip->chip_gen == RTW89_CHIP_AX || hal->no_eht)
return;
if (hal->no_mcs_12_13)
diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index 92636cfc5ca58..a032a20d4c23b 100644
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -5039,6 +5039,7 @@ struct rtw89_hal {
bool support_cckpd;
bool support_igi;
bool no_mcs_12_13;
+ bool no_eht;
atomic_t roc_chanctx_idx;
u8 roc_link_index;
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h
index cedb4a47a769c..ba7c332911310 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.h
+++ b/drivers/net/wireless/realtek/rtw89/fw.h
@@ -42,6 +42,10 @@ struct rtw89_c2hreg_phycap {
#define RTW89_C2HREG_PHYCAP_W0_BW GENMASK(31, 24)
#define RTW89_C2HREG_PHYCAP_W1_TX_NSS GENMASK(7, 0)
#define RTW89_C2HREG_PHYCAP_W1_PROT GENMASK(15, 8)
+#define RTW89_C2HREG_PHYCAP_W1_PROT_11N 1
+#define RTW89_C2HREG_PHYCAP_W1_PROT_11AC 2
+#define RTW89_C2HREG_PHYCAP_W1_PROT_11AX 3
+#define RTW89_C2HREG_PHYCAP_W1_PROT_11BE 4
#define RTW89_C2HREG_PHYCAP_W1_NIC GENMASK(23, 16)
#define RTW89_C2HREG_PHYCAP_W1_WL_FUNC GENMASK(31, 24)
#define RTW89_C2HREG_PHYCAP_W2_HW_TYPE GENMASK(7, 0)
diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 6734e5d5a5e22..fbce71cd5a05c 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -3061,6 +3061,7 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev)
struct rtw89_efuse *efuse = &rtwdev->efuse;
struct rtw89_mac_c2h_info c2h_info = {};
struct rtw89_hal *hal = &rtwdev->hal;
+ u8 protocol;
u8 tx_nss;
u8 rx_nss;
u8 tx_ant;
@@ -3108,6 +3109,10 @@ static int rtw89_mac_setup_phycap_part0(struct rtw89_dev *rtwdev)
rtw89_debug(rtwdev, RTW89_DBG_FW, "TX path diversity=%d\n", hal->tx_path_diversity);
rtw89_debug(rtwdev, RTW89_DBG_FW, "Antenna diversity=%d\n", hal->ant_diversity);
+ protocol = u32_get_bits(phycap->w1, RTW89_C2HREG_PHYCAP_W1_PROT);
+ if (protocol < RTW89_C2HREG_PHYCAP_W1_PROT_11BE)
+ hal->no_eht = true;
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 278/844] wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (276 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 277/844] wifi: rtw89: disable EHT protocol by chip capabilities Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 279/844] wifi: ath11k: Fix failure to connect to a 6 GHz AP Sasha Levin
` (574 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ross Vandegrift, Baochen Qiang, Mark Pearson, Jeff Johnson,
Sasha Levin
From: Ross Vandegrift <ross@kallisti.us>
[ Upstream commit 4015b1972763d7d513172276e51439f37e622a92 ]
Z16 Gen1 has the wakeup-from-suspend issues from [1] but was never added
to the appropriate quirk list. I've tested this patch on top of 6.18.2,
it fixes the issue for me on 21D4
Mark Pearson provided the other product IDs covering the second Z16 Gen1
and both Z13 Gen1 identifiers. They share the same firmware, and folks
in the bugzilla report do indeed see the problem on Z13.
[1] - https://bugzilla.kernel.org/show_bug.cgi?id=219196
Signed-off-by: Ross Vandegrift <ross@kallisti.us>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Link: https://patch.msgid.link/wj7o2kmb7g54stdjvxp2hjqrnutnq3jbf4s2uh4ctvmlxdq7tf@nbkj2ebakhrd
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/core.c | 28 ++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c
index 06b4df2370e95..78a1b0edd8b45 100644
--- a/drivers/net/wireless/ath/ath11k/core.c
+++ b/drivers/net/wireless/ath/ath11k/core.c
@@ -994,6 +994,34 @@ static const struct dmi_system_id ath11k_pm_quirk_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
},
},
+ {
+ .driver_data = (void *)ATH11K_PM_WOW,
+ .matches = { /* Z13 G1 */
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "21D2"),
+ },
+ },
+ {
+ .driver_data = (void *)ATH11K_PM_WOW,
+ .matches = { /* Z13 G1 */
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "21D3"),
+ },
+ },
+ {
+ .driver_data = (void *)ATH11K_PM_WOW,
+ .matches = { /* Z16 G1 */
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "21D4"),
+ },
+ },
+ {
+ .driver_data = (void *)ATH11K_PM_WOW,
+ .matches = { /* Z16 G1 */
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "21D5"),
+ },
+ },
{}
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 279/844] wifi: ath11k: Fix failure to connect to a 6 GHz AP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (277 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 278/844] wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 280/844] wifi: ath12k: fix preferred hardware mode calculation Sasha Levin
` (573 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Qian Zhang, Baochen Qiang, Jeff Johnson, Sasha Levin
From: Qian Zhang <qian.zhang@oss.qualcomm.com>
[ Upstream commit 0bc8c48de6f06c0cac52dde024ffda4433de6234 ]
STA fails to connect to a 6 GHz AP with the following errors:
ath11k_pci 0000:01:00.0: failed to handle chan list with power type 1
wlp1s0: deauthenticating from c8:a3:e8:dd:41:e3 by local choice (Reason: 3=DEAUTH_LEAVING)
ath11k_reg_handle_chan_list() treats the update as redundant and
returns -EINVAL. That causes the connection attempt to fail.
Avoid unnecessary validation during association. Apply the regulatory
redundant check only when the power type is IEEE80211_REG_UNSET_AP,
which only occurs during core initialization.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Signed-off-by: Qian Zhang <qian.zhang@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260108034607.812885-1-qian.zhang@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/reg.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index d62a2014315a0..49b79648752cf 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/rtnetlink.h>
@@ -926,8 +926,11 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
*/
if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
!memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
- (char *)reg_info->alpha2, 2))
- goto retfail;
+ (char *)reg_info->alpha2, 2) &&
+ power_type == IEEE80211_REG_UNSET_AP) {
+ ath11k_reg_reset_info(reg_info);
+ return 0;
+ }
/* Intersect new rules with default regd if a new country setting was
* requested, i.e a default regd was already set during initialization
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 280/844] wifi: ath12k: fix preferred hardware mode calculation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (278 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 279/844] wifi: ath11k: Fix failure to connect to a 6 GHz AP Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 281/844] wifi: ath12k: fix mac phy capability parsing Sasha Levin
` (572 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 7f852de0003219c431a6f2ffd951fd82a4673660 ]
For single pdev device like WCN7850/QCC2072, preferred_hw_mode is
initialized to WMI_HOST_HW_MODE_SINGLE. Later when firmware sends
supported modes to host, each mode is compared with the initial one
and if the priority of the new mode is higher, update the parameter
and store mode capability.
For WCN7850, this does not result in issue, as one of the supported
mode indeed has a higher priority. However the only available mode of
QCC2072 at this stage is WMI_HOST_HW_MODE_SINGLE, which fails the
comparison, hence mode capability is not stored. Subsequently driver
initialization fails.
Fix it by accepting a mode with the same priority.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-4-fc8ce1e43969@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 3ce5fcb0e4600..12f4d378f50d4 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -4545,7 +4545,7 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc,
pref = soc->wmi_ab.preferred_hw_mode;
- if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) {
+ if (ath12k_hw_mode_pri_map[mode] <= ath12k_hw_mode_pri_map[pref]) {
svc_rdy_ext->pref_hw_mode_caps = *hw_mode_caps;
soc->wmi_ab.preferred_hw_mode = mode;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 281/844] wifi: ath12k: fix mac phy capability parsing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (279 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 280/844] wifi: ath12k: fix preferred hardware mode calculation Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 282/844] wifi: cfg80211: allow only one NAN interface, also in multi radio Sasha Levin
` (571 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit b5151c9b6e3a347416a4b4b55fc00195526d8771 ]
Currently ath12k_pull_mac_phy_cap_svc_ready_ext() assumes only one band
supported in each phy, hence it skips 5 GHz band if 2 GHz band support
is detected. This does not work for device which gets only one phy but
has both bands supported, such as QCC2072.
Change to check each band individually to fix this issue.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260112-ath12k-support-qcc2072-v2-6-fc8ce1e43969@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wmi.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index 12f4d378f50d4..1613492b38350 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -496,6 +496,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
struct ath12k_band_cap *cap_band;
struct ath12k_pdev_cap *pdev_cap = &pdev->cap;
struct ath12k_fw_pdev *fw_pdev;
+ u32 supported_bands;
u32 phy_map;
u32 hw_idx, phy_idx = 0;
int i;
@@ -519,14 +520,19 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
return -EINVAL;
mac_caps = wmi_mac_phy_caps + phy_idx;
+ supported_bands = le32_to_cpu(mac_caps->supported_bands);
+
+ if (!(supported_bands & WMI_HOST_WLAN_2GHZ_CAP) &&
+ !(supported_bands & WMI_HOST_WLAN_5GHZ_CAP))
+ return -EINVAL;
pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps);
pdev->hw_link_id = ath12k_wmi_mac_phy_get_hw_link_id(mac_caps);
- pdev_cap->supported_bands |= le32_to_cpu(mac_caps->supported_bands);
+ pdev_cap->supported_bands |= supported_bands;
pdev_cap->ampdu_density = le32_to_cpu(mac_caps->ampdu_density);
fw_pdev = &ab->fw_pdev[ab->fw_pdev_count];
- fw_pdev->supported_bands = le32_to_cpu(mac_caps->supported_bands);
+ fw_pdev->supported_bands = supported_bands;
fw_pdev->pdev_id = ath12k_wmi_mac_phy_get_pdev_id(mac_caps);
fw_pdev->phy_id = le32_to_cpu(mac_caps->phy_id);
ab->fw_pdev_count++;
@@ -535,10 +541,12 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
* band to band for a single radio, need to see how this should be
* handled.
*/
- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) {
+ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) {
pdev_cap->tx_chain_mask = le32_to_cpu(mac_caps->tx_chain_mask_2g);
pdev_cap->rx_chain_mask = le32_to_cpu(mac_caps->rx_chain_mask_2g);
- } else if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) {
+ }
+
+ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) {
pdev_cap->vht_cap = le32_to_cpu(mac_caps->vht_cap_info_5g);
pdev_cap->vht_mcs = le32_to_cpu(mac_caps->vht_supp_mcs_5g);
pdev_cap->he_mcs = le32_to_cpu(mac_caps->he_supp_mcs_5g);
@@ -548,8 +556,6 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
WMI_NSS_RATIO_EN_DIS_GET(mac_caps->nss_ratio);
pdev_cap->nss_ratio_info =
WMI_NSS_RATIO_INFO_GET(mac_caps->nss_ratio);
- } else {
- return -EINVAL;
}
/* tx/rx chainmask reported from fw depends on the actual hw chains used,
@@ -565,7 +571,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
pdev_cap->rx_chain_mask_shift =
find_first_bit((unsigned long *)&pdev_cap->rx_chain_mask, 32);
- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_2GHZ_CAP) {
+ if (supported_bands & WMI_HOST_WLAN_2GHZ_CAP) {
cap_band = &pdev_cap->band[NL80211_BAND_2GHZ];
cap_band->phy_id = le32_to_cpu(mac_caps->phy_id);
cap_band->max_bw_supported = le32_to_cpu(mac_caps->max_bw_supported_2g);
@@ -585,7 +591,7 @@ ath12k_pull_mac_phy_cap_svc_ready_ext(struct ath12k_wmi_pdev *wmi_handle,
le32_to_cpu(mac_caps->he_ppet2g.ppet16_ppet8_ru3_ru0[i]);
}
- if (le32_to_cpu(mac_caps->supported_bands) & WMI_HOST_WLAN_5GHZ_CAP) {
+ if (supported_bands & WMI_HOST_WLAN_5GHZ_CAP) {
cap_band = &pdev_cap->band[NL80211_BAND_5GHZ];
cap_band->phy_id = le32_to_cpu(mac_caps->phy_id);
cap_band->max_bw_supported =
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 282/844] wifi: cfg80211: allow only one NAN interface, also in multi radio
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (280 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 281/844] wifi: ath12k: fix mac phy capability parsing Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 283/844] ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() Sasha Levin
` (570 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Miri Korenblit, Johannes Berg, Sasha Levin
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
[ Upstream commit e69fda4d07701373354e52b0321bd40311d743d0 ]
According to Wi-Fi Aware (TM) 4.0 specification 2.8, A NAN device can
have one NAN management interface. This applies also to multi radio
devices.
The current code allows a driver to support more than one NAN interface,
if those are not in the same radio.
Fix it.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260107135129.fdaecec0fe8a.I246b5ba6e9da3ec1481ff197e47f6ce0793d7118@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/core.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a04f96dc9a1d7..16ccf6fb28b21 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -661,12 +661,8 @@ int wiphy_verify_iface_combinations(struct wiphy *wiphy,
c->limits[j].max > 1))
return -EINVAL;
- /* Only a single NAN can be allowed, avoid this
- * check for multi-radio global combination, since it
- * hold the capabilities of all radio combinations.
- */
- if (!combined_radio &&
- WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
+ /* Only a single NAN can be allowed */
+ if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
c->limits[j].max > 1))
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 283/844] ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (281 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 282/844] wifi: cfg80211: allow only one NAN interface, also in multi radio Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 284/844] ipv6: annotate data-races over sysctl.flowlabel_reflect Sasha Levin
` (569 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, Simon Horman, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 03e9d91dd64e2f5ea632df5d59568d91757efc4d ]
Add missing READ_ONCE() when reading sysctl values.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260115094141.3124990-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ipv6.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 6a933690e0ff5..e759a00dbde19 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1010,11 +1010,11 @@ static inline int ip6_default_np_autolabel(struct net *net)
#if IS_ENABLED(CONFIG_IPV6)
static inline int ip6_multipath_hash_policy(const struct net *net)
{
- return net->ipv6.sysctl.multipath_hash_policy;
+ return READ_ONCE(net->ipv6.sysctl.multipath_hash_policy);
}
static inline u32 ip6_multipath_hash_fields(const struct net *net)
{
- return net->ipv6.sysctl.multipath_hash_fields;
+ return READ_ONCE(net->ipv6.sysctl.multipath_hash_fields);
}
#else
static inline int ip6_multipath_hash_policy(const struct net *net)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 284/844] ipv6: annotate data-races over sysctl.flowlabel_reflect
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (282 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 283/844] ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 285/844] ipv6: annotate data-races in net/ipv6/route.c Sasha Levin
` (568 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, Simon Horman, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5ade47c974b46eb2a1279185962a0ffa15dc5450 ]
Add missing READ_ONCE() when reading ipv6.sysctl.flowlabel_reflect,
as its value can be changed under us.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260115094141.3124990-6-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/af_inet6.c | 4 ++--
net/ipv6/icmp.c | 3 ++-
net/ipv6/tcp_ipv6.c | 3 ++-
3 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index d3534bdb805da..56d453a598ec6 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -224,8 +224,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
inet6_set_bit(MC6_LOOP, sk);
inet6_set_bit(MC6_ALL, sk);
np->pmtudisc = IPV6_PMTUDISC_WANT;
- inet6_assign_bit(REPFLOW, sk, net->ipv6.sysctl.flowlabel_reflect &
- FLOWLABEL_REFLECT_ESTABLISHED);
+ inet6_assign_bit(REPFLOW, sk, READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
+ FLOWLABEL_REFLECT_ESTABLISHED);
sk->sk_ipv6only = net->ipv6.sysctl.bindv6only;
sk->sk_txrehash = READ_ONCE(net->core.sysctl_txrehash);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 55b1aa75ab802..0f41ca6f3d83e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -953,7 +953,8 @@ static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)
tmp_hdr.icmp6_type = type;
memset(&fl6, 0, sizeof(fl6));
- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
+ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
+ FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
fl6.flowi6_proto = IPPROTO_ICMPV6;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 280fe59785598..4ae664b05fa91 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1085,7 +1085,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb,
txhash = inet_twsk(sk)->tw_txhash;
}
} else {
- if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET)
+ if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
+ FLOWLABEL_REFLECT_TCP_RESET)
label = ip6_flowlabel(ipv6h);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 285/844] ipv6: annotate data-races in net/ipv6/route.c
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (283 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 284/844] ipv6: annotate data-races over sysctl.flowlabel_reflect Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 286/844] ipv6: exthdrs: annotate data-race over multiple sysctl Sasha Levin
` (567 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, Simon Horman, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f062e8e25102324364aada61b8283356235bc3c1 ]
sysctls are read while their values can change,
add READ_ONCE() annotations.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260115094141.3124990-9-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e3a260a5564ba..cd229974b7974 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2895,7 +2895,7 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
dst_metric_set(&rt->dst, RTAX_MTU, mtu);
rt->rt6i_flags |= RTF_MODIFIED;
- rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
+ rt6_update_expires(rt, READ_ONCE(net->ipv6.sysctl.ip6_rt_mtu_expires));
}
static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
@@ -3256,8 +3256,8 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
rcu_read_lock();
net = dst_dev_net_rcu(dst);
- if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
- mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
+ mtu = max_t(unsigned int, mtu,
+ READ_ONCE(net->ipv6.sysctl.ip6_rt_min_advmss));
rcu_read_unlock();
@@ -3359,10 +3359,10 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
static void ip6_dst_gc(struct dst_ops *ops)
{
struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
- int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
- int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
- int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
- unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
+ int rt_min_interval = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_min_interval);
+ int rt_elasticity = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_elasticity);
+ int rt_gc_timeout = READ_ONCE(net->ipv6.sysctl.ip6_rt_gc_timeout);
+ unsigned long rt_last_gc = READ_ONCE(net->ipv6.ip6_rt_last_gc);
unsigned int val;
int entries;
@@ -5008,7 +5008,7 @@ void rt6_sync_down_dev(struct net_device *dev, unsigned long event)
};
struct net *net = dev_net(dev);
- if (net->ipv6.sysctl.skip_notify_on_dev_down)
+ if (READ_ONCE(net->ipv6.sysctl.skip_notify_on_dev_down))
fib6_clean_all_skip_notify(net, fib6_ifdown, &arg);
else
fib6_clean_all(net, fib6_ifdown, &arg);
@@ -6408,6 +6408,7 @@ void fib6_rt_update(struct net *net, struct fib6_info *rt,
void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
bool offload, bool trap, bool offload_failed)
{
+ u8 fib_notify_on_flag_change;
struct sk_buff *skb;
int err;
@@ -6419,8 +6420,9 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
WRITE_ONCE(f6i->offload, offload);
WRITE_ONCE(f6i->trap, trap);
+ fib_notify_on_flag_change = READ_ONCE(net->ipv6.sysctl.fib_notify_on_flag_change);
/* 2 means send notifications only if offload_failed was changed. */
- if (net->ipv6.sysctl.fib_notify_on_flag_change == 2 &&
+ if (fib_notify_on_flag_change == 2 &&
READ_ONCE(f6i->offload_failed) == offload_failed)
return;
@@ -6432,7 +6434,7 @@ void fib6_info_hw_flags_set(struct net *net, struct fib6_info *f6i,
*/
return;
- if (!net->ipv6.sysctl.fib_notify_on_flag_change)
+ if (!fib_notify_on_flag_change)
return;
skb = nlmsg_new(rt6_nlmsg_size(f6i), GFP_KERNEL);
@@ -6529,7 +6531,7 @@ static int ipv6_sysctl_rtcache_flush(const struct ctl_table *ctl, int write,
return ret;
net = (struct net *)ctl->extra1;
- delay = net->ipv6.sysctl.flush_delay;
+ delay = READ_ONCE(net->ipv6.sysctl.flush_delay);
fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 286/844] ipv6: exthdrs: annotate data-race over multiple sysctl
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (284 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 285/844] ipv6: annotate data-races in net/ipv6/route.c Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 287/844] ext4: mark group add fast-commit ineligible Sasha Levin
` (566 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, Simon Horman, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 978b67d28358b0b4eacfa94453d1ad4e09b123ad ]
Following four sysctls can change under us, add missing READ_ONCE().
- ipv6.sysctl.max_dst_opts_len
- ipv6.sysctl.max_dst_opts_cnt
- ipv6.sysctl.max_hbh_opts_len
- ipv6.sysctl.max_hbh_opts_cnt
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260115094141.3124990-8-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/exthdrs.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index a23eb8734e151..54088fa0c09d0 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -314,7 +314,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
}
extlen = (skb_transport_header(skb)[1] + 1) << 3;
- if (extlen > net->ipv6.sysctl.max_dst_opts_len)
+ if (extlen > READ_ONCE(net->ipv6.sysctl.max_dst_opts_len))
goto fail_and_free;
opt->lastopt = opt->dst1 = skb_network_header_len(skb);
@@ -322,7 +322,8 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
dstbuf = opt->dst1;
#endif
- if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
+ if (ip6_parse_tlv(false, skb,
+ READ_ONCE(net->ipv6.sysctl.max_dst_opts_cnt))) {
skb->transport_header += extlen;
opt = IP6CB(skb);
#if IS_ENABLED(CONFIG_IPV6_MIP6)
@@ -1049,11 +1050,12 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
}
extlen = (skb_transport_header(skb)[1] + 1) << 3;
- if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
+ if (extlen > READ_ONCE(net->ipv6.sysctl.max_hbh_opts_len))
goto fail_and_free;
opt->flags |= IP6SKB_HOPBYHOP;
- if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
+ if (ip6_parse_tlv(true, skb,
+ READ_ONCE(net->ipv6.sysctl.max_hbh_opts_cnt))) {
skb->transport_header += extlen;
opt = IP6CB(skb);
opt->nhoff = sizeof(struct ipv6hdr);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 287/844] ext4: mark group add fast-commit ineligible
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (285 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 286/844] ipv6: exthdrs: annotate data-race over multiple sysctl Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 288/844] ext4: move ext4_percpu_param_init() before ext4_mb_init() Sasha Levin
` (565 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Li Chen, Theodore Ts'o, Sasha Levin
From: Li Chen <me@linux.beauty>
[ Upstream commit 89b4336fd5ec78f51f9d3a1d100f3ffa3228e604 ]
Fast commits only log operations that have dedicated replay support.
Online resize via EXT4_IOC_GROUP_ADD updates the superblock and group
descriptor metadata without going through the fast commit tracking
paths.
In practice these operations are rare and usually followed by further
updates, but mixing them into a fast commit makes the overall
semantics harder to reason about and risks replay gaps if new call
sites appear.
Teach ext4 to mark the filesystem fast-commit ineligible when
ext4_ioctl_group_add() adds new block groups.
This forces those transactions to fall back to a full commit,
ensuring that the filesystem geometry updates are captured by the
normal journal rather than partially encoded in fast commit TLVs.
This change should not affect common workloads but makes online
resize via GROUP_ADD safer and easier to reason about under fast
commit.
Testing:
1. prepare:
dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
mkfs.ext4 -O fast_commit -F /root/fc_resize.img
mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
2. Ran a helper that issues EXT4_IOC_GROUP_ADD on the mounted
filesystem and checked the resize ineligible reason:
./group_add_helper /mnt/fc_resize
cat /proc/fs/ext4/loop0/fc_info
shows "Resize": > 0.
3. Fsynced a file on the resized filesystem and verified that the fast
commit stats report at least one ineligible commit:
touch /mnt/fc_resize/file
/root/fsync_file /mnt/fc_resize/file
sync
cat /proc/fs/ext4/loop0/fc_info
shows fc stats ineligible > 0.
Signed-off-by: Li Chen <me@linux.beauty>
Link: https://patch.msgid.link/20251211115146.897420-5-me@linux.beauty
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ioctl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 7ce0fc40aec2f..5109b005e0286 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -966,6 +966,7 @@ static long ext4_ioctl_group_add(struct file *file,
err = ext4_group_add(sb, input);
if (EXT4_SB(sb)->s_journal) {
+ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE, NULL);
jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 288/844] ext4: move ext4_percpu_param_init() before ext4_mb_init()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (286 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 287/844] ext4: mark group add fast-commit ineligible Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 289/844] ext4: mark group extend fast-commit ineligible Sasha Levin
` (564 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Baokun Li, Zhang Yi, Jan Kara, Theodore Ts'o, Sasha Levin
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 270564513489d98b721a1e4a10017978d5213bff ]
When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the
`DOUBLE_CHECK` macro defined, the following panic is triggered:
==================================================================
EXT4-fs error (device vdc): ext4_validate_block_bitmap:423:
comm mount: bg 0: bad block bitmap checksum
BUG: unable to handle page fault for address: ff110000fa2cc000
PGD 3e01067 P4D 3e02067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W
6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)
RIP: 0010:percpu_counter_add_batch+0x13/0xa0
Call Trace:
<TASK>
ext4_mark_group_bitmap_corrupted+0xcb/0xe0
ext4_validate_block_bitmap+0x2a1/0x2f0
ext4_read_block_bitmap+0x33/0x50
mb_group_bb_bitmap_alloc+0x33/0x80
ext4_mb_add_groupinfo+0x190/0x250
ext4_mb_init_backend+0x87/0x290
ext4_mb_init+0x456/0x640
__ext4_fill_super+0x1072/0x1680
ext4_fill_super+0xd3/0x280
get_tree_bdev_flags+0x132/0x1d0
vfs_get_tree+0x29/0xd0
vfs_cmd_create+0x59/0xe0
__do_sys_fsconfig+0x4f6/0x6b0
do_syscall_64+0x50/0x1f0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
==================================================================
This issue can be reproduced using the following commands:
mkfs.ext4 -F -q -b 1024 /dev/sda 5G
tune2fs -O quota,project /dev/sda
mount /dev/sda /tmp/test
With DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads
and validates the block bitmap. When the validation fails,
ext4_mark_group_bitmap_corrupted() attempts to update
sbi->s_freeclusters_counter. However, this percpu_counter has not been
initialized yet at this point, which leads to the panic described above.
Fix this by moving the execution of ext4_percpu_param_init() to occur
before ext4_mb_init(), ensuring the per-CPU counters are initialized
before they are used.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20251209133116.731350-1-libaokun@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/super.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 87205660c5d02..5c2e931d8a533 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5604,6 +5604,10 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
clear_opt2(sb, MB_OPTIMIZE_SCAN);
}
+ err = ext4_percpu_param_init(sbi);
+ if (err)
+ goto failed_mount5;
+
err = ext4_mb_init(sb);
if (err) {
ext4_msg(sb, KERN_ERR, "failed to initialize mballoc (%d)",
@@ -5619,10 +5623,6 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
sbi->s_journal->j_commit_callback =
ext4_journal_commit_callback;
- err = ext4_percpu_param_init(sbi);
- if (err)
- goto failed_mount6;
-
if (ext4_has_feature_flex_bg(sb))
if (!ext4_fill_flex_info(sb)) {
ext4_msg(sb, KERN_ERR,
@@ -5704,8 +5704,8 @@ failed_mount8: __maybe_unused
failed_mount6:
ext4_mb_release(sb);
ext4_flex_groups_free(sbi);
- ext4_percpu_param_destroy(sbi);
failed_mount5:
+ ext4_percpu_param_destroy(sbi);
ext4_ext_release(sb);
ext4_release_system_zone(sb);
failed_mount4a:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 289/844] ext4: mark group extend fast-commit ineligible
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (287 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 288/844] ext4: move ext4_percpu_param_init() before ext4_mb_init() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 290/844] ext4: use reserved metadata blocks when splitting extent on endio Sasha Levin
` (563 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Li Chen, Theodore Ts'o, Sasha Levin
From: Li Chen <me@linux.beauty>
[ Upstream commit 1f8dd813a1c771b13c303f73d876164bc9b327cc ]
Fast commits only log operations that have dedicated replay support.
EXT4_IOC_GROUP_EXTEND grows the filesystem to the end of the last
block group and updates the same on-disk metadata without going
through the fast commit tracking paths.
In practice these operations are rare and usually followed by further
updates, but mixing them into a fast commit makes the overall
semantics harder to reason about and risks replay gaps if new call
sites appear.
Teach ext4 to mark the filesystem fast-commit ineligible when
EXT4_IOC_GROUP_EXTEND grows the filesystem.
This forces those transactions to fall back to a full commit,
ensuring that the group extension changes are captured by the normal
journal rather than partially encoded in fast commit TLVs.
This change should not affect common workloads but makes online
resize via GROUP_EXTEND safer and easier to reason about under fast
commit.
Testing:
1. prepare:
dd if=/dev/zero of=/root/fc_resize.img bs=1M count=0 seek=256
mkfs.ext4 -O fast_commit -F /root/fc_resize.img
mkdir -p /mnt/fc_resize && mount -t ext4 -o loop /root/fc_resize.img /mnt/fc_resize
2. Extended the filesystem to the end of the last block group using a
helper that calls EXT4_IOC_GROUP_EXTEND on the mounted filesystem
and checked fc_info:
./group_extend_helper /mnt/fc_resize
cat /proc/fs/ext4/loop0/fc_info
shows the "Resize" ineligible reason increased.
3. Fsynced a file on the resized filesystem and confirmed that the fast
commit ineligible counter incremented for the resize transaction:
touch /mnt/fc_resize/file
/root/fsync_file /mnt/fc_resize/file
sync
cat /proc/fs/ext4/loop0/fc_info
Signed-off-by: Li Chen <me@linux.beauty>
Link: https://patch.msgid.link/20251211115146.897420-6-me@linux.beauty
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 5109b005e0286..e5e197ac7d88b 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1612,6 +1612,8 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
if (EXT4_SB(sb)->s_journal) {
+ ext4_fc_mark_ineligible(sb, EXT4_FC_REASON_RESIZE,
+ NULL);
jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
err2 = jbd2_journal_flush(EXT4_SB(sb)->s_journal, 0);
jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 290/844] ext4: use reserved metadata blocks when splitting extent on endio
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (288 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 289/844] ext4: mark group extend fast-commit ineligible Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 291/844] netfilter: nf_conntrack: Add allow_clash to generic protocol handler Sasha Levin
` (562 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zhang Yi, Jan Kara, Baokun Li, Ojaswin Mujoo, Theodore Ts'o,
Sasha Levin
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit 01942af95ab6c9d98e64ae01fdc243a03e4b973f ]
When performing buffered writes, we may need to split and convert an
unwritten extent into a written one during the end I/O process. However,
we do not reserve space specifically for these metadata changes, we only
reserve 2% of space or 4096 blocks. To address this, we use
EXT4_GET_BLOCKS_PRE_IO to potentially split extents in advance and
EXT4_GET_BLOCKS_METADATA_NOFAIL to utilize reserved space if necessary.
These two approaches can reduce the likelihood of running out of space
and losing data. However, these methods are merely best efforts, we
could still run out of space, and there is not much difference between
converting an extent during the writeback process and the end I/O
process, it won't increase the risk of losing data if we postpone the
conversion.
Therefore, also use EXT4_GET_BLOCKS_METADATA_NOFAIL in
ext4_convert_unwritten_extents_endio() to prepare for the buffered I/O
iomap conversion, which may perform extent conversion during the end I/O
process.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/20260105014522.1937690-2-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/extents.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 18b39eed75267..418c4351ef40c 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3809,6 +3809,8 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
* illegal.
*/
if (ee_block != map->m_lblk || ee_len > map->m_len) {
+ int flags = EXT4_GET_BLOCKS_CONVERT |
+ EXT4_GET_BLOCKS_METADATA_NOFAIL;
#ifdef CONFIG_EXT4_DEBUG
ext4_warning(inode->i_sb, "Inode (%ld) finished: extent logical block %llu,"
" len %u; IO logical block %llu, len %u",
@@ -3816,7 +3818,7 @@ ext4_convert_unwritten_extents_endio(handle_t *handle, struct inode *inode,
(unsigned long long)map->m_lblk, map->m_len);
#endif
path = ext4_split_convert_extents(handle, inode, map, path,
- EXT4_GET_BLOCKS_CONVERT, NULL);
+ flags, NULL);
if (IS_ERR(path))
return path;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 291/844] netfilter: nf_conntrack: Add allow_clash to generic protocol handler
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (289 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 290/844] ext4: use reserved metadata blocks when splitting extent on endio Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 292/844] netfilter: xt_tcpmss: check remaining length before reading optlen Sasha Levin
` (561 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Yuto Hamaguchi, Florian Westphal, Sasha Levin
From: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
[ Upstream commit 8a49fc8d8a3e83dc51ec05bcd4007bdea3c56eec ]
The upstream commit, 71d8c47fc653711c41bc3282e5b0e605b3727956
("netfilter: conntrack: introduce clash resolution on insertion race"),
sets allow_clash=true in the UDP/UDPLITE protocol handler
but does not set it in the generic protocol handler.
As a result, packets composed of connectionless protocols at each layer,
such as UDP over IP-in-IP, still drop packets due to conflicts during conntrack insertion.
To resolve this, this patch sets allow_clash in the nf_conntrack_l4proto_generic.
Signed-off-by: Yuto Hamaguchi <Hamaguchi.Yuto@da.MitsubishiElectric.co.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_proto_generic.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index e831637bc8ca8..cb260eb3d012c 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -67,6 +67,7 @@ void nf_conntrack_generic_init_net(struct net *net)
const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
{
.l4proto = 255,
+ .allow_clash = true,
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
.ctnl_timeout = {
.nlattr_to_obj = generic_timeout_nlattr_to_obj,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 292/844] netfilter: xt_tcpmss: check remaining length before reading optlen
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (290 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 291/844] netfilter: nf_conntrack: Add allow_clash to generic protocol handler Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 293/844] openrisc: define arch-specific version of nop() Sasha Levin
` (560 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Florian Westphal, sungzii, Sasha Levin
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 ]
Quoting reporter:
In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
op[i+1] directly without validating the remaining option length.
If the last byte of the option field is not EOL/NOP (0/1), the code attempts
to index op[i+1]. In the case where i + 1 == optlen, this causes an
out-of-bounds read, accessing memory past the optlen boundary
(either reading beyond the stack buffer _opt or the
following payload).
Reported-by: sungzii <sungzii@pm.me>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_tcpmss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
index 37704ab017992..0d32d4841cb32 100644
--- a/net/netfilter/xt_tcpmss.c
+++ b/net/netfilter/xt_tcpmss.c
@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
return (mssval >= info->mss_min &&
mssval <= info->mss_max) ^ info->invert;
}
- if (op[i] < 2)
+ if (op[i] < 2 || i == optlen - 1)
i++;
else
i += op[i+1] ? : 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 293/844] openrisc: define arch-specific version of nop()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (291 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 292/844] netfilter: xt_tcpmss: check remaining length before reading optlen Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 294/844] net: usb: r8152: fix transmit queue timeout Sasha Levin
` (559 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Brian Masney, kernel test robot, Stafford Horne, Sasha Levin
From: Brian Masney <bmasney@redhat.com>
[ Upstream commit 0dfffa5479d6260d04d021f69203b1926f73d889 ]
When compiling a driver written for MIPS on OpenRISC that uses the nop()
function, it fails due to the following error:
drivers/watchdog/pic32-wdt.c: Assembler messages:
drivers/watchdog/pic32-wdt.c:125: Error: unrecognized instruction `nop'
The driver currently uses the generic version of nop() from
include/asm-generic/barrier.h:
#ifndef nop
#define nop() asm volatile ("nop")
#endif
Let's fix this on OpenRISC by defining an architecture-specific version
of nop().
This was tested by performing an allmodconfig openrisc cross compile on
an aarch64 host.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601180236.BVy480We-lkp@intel.com/
Signed-off-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/openrisc/include/asm/barrier.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h
index 7538294721bed..8e592c9909023 100644
--- a/arch/openrisc/include/asm/barrier.h
+++ b/arch/openrisc/include/asm/barrier.h
@@ -4,6 +4,8 @@
#define mb() asm volatile ("l.msync" ::: "memory")
+#define nop() asm volatile ("l.nop")
+
#include <asm-generic/barrier.h>
#endif /* __ASM_BARRIER_H */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 294/844] net: usb: r8152: fix transmit queue timeout
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (292 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 293/844] openrisc: define arch-specific version of nop() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 295/844] PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe Sasha Levin
` (558 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Mingj Ye, Hayes Wang, Jakub Kicinski, Sasha Levin
From: Mingj Ye <insyelu@gmail.com>
[ Upstream commit 833dcd75d54f0bf5aa0a0781ff57456b421fbb40 ]
When the TX queue length reaches the threshold, the netdev watchdog
immediately detects a TX queue timeout.
This patch updates the trans_start timestamp of the transmit queue
on every asynchronous USB URB submission along the transmit path,
ensuring that the network watchdog accurately reflects ongoing
transmission activity.
Signed-off-by: Mingj Ye <insyelu@gmail.com>
Reviewed-by: Hayes Wang <hayeswang@realtek.com>
Link: https://patch.msgid.link/20260120015949.84996-1-insyelu@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/r8152.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 2f3baa5f6e9c9..6b107cf5f37bd 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2449,6 +2449,8 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
ret = usb_submit_urb(agg->urb, GFP_ATOMIC);
if (ret < 0)
usb_autopm_put_interface_async(tp->intf);
+ else
+ netif_trans_update(tp->netdev);
out_tx_fill:
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 295/844] PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (293 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 294/844] net: usb: r8152: fix transmit queue timeout Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 296/844] wifi: iwlwifi: mld: Handle rate selection for NAN interface Sasha Levin
` (557 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Richard Zhu, Manivannan Sadhasivam, Alexander Stein, Frank Li,
Sasha Levin
From: Richard Zhu <hongxing.zhu@nxp.com>
[ Upstream commit 27a064aba2da6bc58fc36a6b8e889187ae3bf89d ]
The CLKREQ# is an open drain, active low signal that is driven low by
the card to request reference clock. It's an optional signal added in
PCIe CEM r4.0, sec 2. Thus, this signal wouldn't be driven low if it's
not exposed on the slot.
On the i.MX95 EVK board, REFCLK to the host and endpoint is gated by this
CLKREQ# signal. So if the CLKREQ# signal is not driven by the endpoint, it
will gate the REFCLK to host too, leading to operational failure.
Hence, enable the REFCLK on this SoC by enabling the CLKREQ# override using
imx95_pcie_clkreq_override() helper during probe. This override should only
be cleared when the CLKREQ# signal is exposed on the slot.
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
[mani: reworded description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251015030428.2980427-11-hongxing.zhu@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-imx6.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index f28e335bbbfaf..dd69af0f195ff 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -52,6 +52,8 @@
#define IMX95_PCIE_REF_CLKEN BIT(23)
#define IMX95_PCIE_PHY_CR_PARA_SEL BIT(9)
#define IMX95_PCIE_SS_RW_REG_1 0xf4
+#define IMX95_PCIE_CLKREQ_OVERRIDE_EN BIT(8)
+#define IMX95_PCIE_CLKREQ_OVERRIDE_VAL BIT(9)
#define IMX95_PCIE_SYS_AUX_PWR_DET BIT(31)
#define IMX95_PE0_GEN_CTRL_1 0x1050
@@ -706,6 +708,22 @@ static int imx7d_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable)
return 0;
}
+static void imx95_pcie_clkreq_override(struct imx_pcie *imx_pcie, bool enable)
+{
+ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1,
+ IMX95_PCIE_CLKREQ_OVERRIDE_EN,
+ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_EN : 0);
+ regmap_update_bits(imx_pcie->iomuxc_gpr, IMX95_PCIE_SS_RW_REG_1,
+ IMX95_PCIE_CLKREQ_OVERRIDE_VAL,
+ enable ? IMX95_PCIE_CLKREQ_OVERRIDE_VAL : 0);
+}
+
+static int imx95_pcie_enable_ref_clk(struct imx_pcie *imx_pcie, bool enable)
+{
+ imx95_pcie_clkreq_override(imx_pcie, enable);
+ return 0;
+}
+
static int imx_pcie_clk_enable(struct imx_pcie *imx_pcie)
{
struct dw_pcie *pci = imx_pcie->pci;
@@ -1916,6 +1934,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
.core_reset = imx95_pcie_core_reset,
.init_phy = imx95_pcie_init_phy,
.wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock,
+ .enable_ref_clk = imx95_pcie_enable_ref_clk,
},
[IMX8MQ_EP] = {
.variant = IMX8MQ_EP,
@@ -1972,6 +1991,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
.core_reset = imx95_pcie_core_reset,
.wait_pll_lock = imx95_pcie_wait_for_phy_pll_lock,
.epc_features = &imx95_pcie_epc_features,
+ .enable_ref_clk = imx95_pcie_enable_ref_clk,
.mode = DW_PCIE_EP_TYPE,
},
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 296/844] wifi: iwlwifi: mld: Handle rate selection for NAN interface
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (294 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 295/844] PCI: imx6: Add CLKREQ# override to enable REFCLK for i.MX95 PCIe Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 297/844] wifi: iwlwifi: mvm: check the validity of noa_len Sasha Levin
` (556 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ilan Peer, Miri Korenblit, Sasha Levin
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit dbbeebece03050cd510073ce89fee83844e06b00 ]
Frames transmitted over a NAN interface might not have channel
information assigned to them. In such cases assign the lowest
OFDM to the frame.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110180612.72046f98f878.Ib784931fffd0747acd9d7bb22eabbbec5282733e@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mld/tx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
index 3b4b575aadaa5..e3fb4fc4f452e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
@@ -345,6 +345,11 @@ u8 iwl_mld_get_lowest_rate(struct iwl_mld *mld,
iwl_mld_get_basic_rates_and_band(mld, vif, info, &basic_rates, &band);
+ if (band >= NUM_NL80211_BANDS) {
+ WARN_ON(vif->type != NL80211_IFTYPE_NAN);
+ return IWL_FIRST_OFDM_RATE;
+ }
+
sband = mld->hw->wiphy->bands[band];
for_each_set_bit(i, &basic_rates, BITS_PER_LONG) {
u16 hw = sband->bitrates[i].hw_value;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 297/844] wifi: iwlwifi: mvm: check the validity of noa_len
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (295 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 296/844] wifi: iwlwifi: mld: Handle rate selection for NAN interface Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 298/844] wifi: iwlwifi: fix 22000 series SMEM parsing Sasha Levin
` (555 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Miri Korenblit, Sasha Levin
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
[ Upstream commit 1e3fb3c4a8e6c581d0f4533dba887fabf53d607d ]
Validate iwl_probe_resp_data_notif::noa_attr::len_low since we are using
its value to determine the noa_len, which is later used for the NoA
attribute.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110150012.99b663d9b424.I206fd54c990ca9e1160b9b94fa8be44e67bcc1b9@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 867807abde664..49ffc4ecee855 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1761,6 +1761,20 @@ void iwl_mvm_probe_resp_data_notif(struct iwl_mvm *mvm,
mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ /*
+ * len_low should be 2 + n*13 (where n is the number of descriptors.
+ * 13 is the size of a NoA descriptor). We can have either one or two
+ * descriptors.
+ */
+ if (IWL_FW_CHECK(mvm, notif->noa_active &&
+ notif->noa_attr.len_low != 2 +
+ sizeof(struct ieee80211_p2p_noa_desc) &&
+ notif->noa_attr.len_low != 2 +
+ sizeof(struct ieee80211_p2p_noa_desc) * 2,
+ "Invalid noa_attr.len_low (%d)\n",
+ notif->noa_attr.len_low))
+ return;
+
new_data = kzalloc(sizeof(*new_data), GFP_KERNEL);
if (!new_data)
return;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 298/844] wifi: iwlwifi: fix 22000 series SMEM parsing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (296 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 297/844] wifi: iwlwifi: mvm: check the validity of noa_len Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 299/844] wifi: iwlwifi: mld: fix chandef start calculation Sasha Levin
` (554 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Johannes Berg, Miri Korenblit, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 58192b9ce09b0f0f86e2036683bd542130b91a98 ]
If the firmware were to report three LMACs (which doesn't
exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is
an overrun of the array. Reject such and use IWL_FW_CHECK
instead of WARN_ON in this function.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110150012.16e8c2d70c26.Iadfcc1aedf43c5175b3f0757bea5aa232454f1ac@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/fw/smem.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
index 90fd69b4860c1..344ddde85b189 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
@@ -6,6 +6,7 @@
*/
#include "iwl-drv.h"
#include "runtime.h"
+#include "dbg.h"
#include "fw/api/commands.h"
static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
@@ -17,7 +18,9 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP,
SHARED_MEM_CFG_CMD, 0);
- if (WARN_ON(lmac_num > ARRAY_SIZE(mem_cfg->lmac_smem)))
+ /* Note: notification has 3 entries, but we only expect 2 */
+ if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac),
+ "FW advertises %d LMACs\n", lmac_num))
return;
fwrt->smem_cfg.num_lmacs = lmac_num;
@@ -26,7 +29,8 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
fwrt->smem_cfg.rxfifo2_size = le32_to_cpu(mem_cfg->rxfifo2_size);
if (api_ver >= 4 &&
- !WARN_ON_ONCE(iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg))) {
+ !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg),
+ "bad shared mem notification size\n")) {
fwrt->smem_cfg.rxfifo2_control_size =
le32_to_cpu(mem_cfg->rxfifo2_control_size);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 299/844] wifi: iwlwifi: mld: fix chandef start calculation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (297 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 298/844] wifi: iwlwifi: fix 22000 series SMEM parsing Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 300/844] wifi: iwlwifi: mld: Fix primary link selection logic Sasha Levin
` (553 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Miri Korenblit, Johannes Berg, Sasha Levin
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
[ Upstream commit d2fcdf36554316cc51f7928b777944738d06e332 ]
A link pair in which both links are in 5 GHz can be used for EMLSR only
if they are separated enough.
To check this condition we calculate the start and the end of the
chandefs of both links in the pair and do some checks.
But the calculation of the start/end of the chandef is currently done
by subtracting/adding half the bandwidth from/to the control channel's
center frequency, when it should really be subtracted/added from/to the
center frequency of the entire chandef.
Fix the wrong calculation.
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260111193638.2138fdb99bd5.I4d2e5957b22482a57b1d6ca444e90fcf73bf2cab@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mld/mlo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
index c6b151f269216..1efefc737248f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mlo.c
@@ -844,9 +844,9 @@ iwl_mld_emlsr_pair_state(struct ieee80211_vif *vif,
if (c_low->chan->center_freq > c_high->chan->center_freq)
swap(c_low, c_high);
- c_low_upper_edge = c_low->chan->center_freq +
+ c_low_upper_edge = c_low->center_freq1 +
cfg80211_chandef_get_width(c_low) / 2;
- c_high_lower_edge = c_high->chan->center_freq -
+ c_high_lower_edge = c_high->center_freq1 -
cfg80211_chandef_get_width(c_high) / 2;
if (a->chandef->chan->band == NL80211_BAND_5GHZ &&
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 300/844] wifi: iwlwifi: mld: Fix primary link selection logic
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (298 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 299/844] wifi: iwlwifi: mld: fix chandef start calculation Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 301/844] driver core: faux: stop using static struct device Sasha Levin
` (552 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Nidhish A N, Miri Korenblit, Sasha Levin
From: Nidhish A N <nidhish.a.n@intel.com>
[ Upstream commit 7a749db26cab2334d5b356ac31e6f1147c7682da ]
When assigning emlsr.primary with emlsr.selected_primary
we are checking if BIT(mld_vif->emlsr.selected_links) are
a part of vif->active_links. This is incorrect as
emlsr.selected_links is a bitmap of possibly two selected links.
Therefore, performing the BIT() operation on it does not
yield any meaningful result and almost always leads to
incorrect primary link selection.
Additionally, we cannot rely on vif->active_links at this
stage of the link switch flow because it contains both the
removed links and also the newly added links.
For example, if we had selected links in the past (0x11)
and we now select links because of TTLM/debugfs (0x100),
vif->active_links will now be (0x111) and primary link
will be 0, while 0 is not even an active link. Thus,
we create our own bitmap of final active links.
Signed-off-by: Nidhish A N <nidhish.a.n@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260111193638.38b2e14e3a20.Ie81a88dfff0c5d2becedabab8398702808f6b1bf@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/intel/iwlwifi/mld/mac80211.c | 23 ++++++++++++-------
1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index cd0dce8de8569..3a1b5bfb9ed66 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -984,7 +984,9 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
{
struct iwl_mld *mld = IWL_MAC80211_GET_MLD(hw);
struct iwl_mld_link *mld_link = iwl_mld_link_from_mac80211(link);
- unsigned int n_active = iwl_mld_count_active_links(mld, vif);
+ struct iwl_mld_link *temp_mld_link;
+ struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
+ u16 final_active_links = 0;
int ret;
lockdep_assert_wiphy(mld->wiphy);
@@ -992,10 +994,7 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
if (WARN_ON(!mld_link))
return -EINVAL;
- /* if the assigned one was not counted yet, count it now */
if (!rcu_access_pointer(mld_link->chan_ctx)) {
- n_active++;
-
/* Track addition of non-BSS link */
if (ieee80211_vif_type_p2p(vif) != NL80211_IFTYPE_STATION) {
ret = iwl_mld_emlsr_check_non_bss_block(mld, 1);
@@ -1016,17 +1015,25 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
rcu_assign_pointer(mld_link->chan_ctx, ctx);
- if (n_active > 1) {
- struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
+ /* We cannot rely on vif->active_links at this stage as it contains
+ * both the removed links and the newly added links.
+ * Therefore, we create our own bitmap of the final active links,
+ * which does not include the removed links.
+ */
+ for_each_mld_vif_valid_link(mld_vif, temp_mld_link) {
+ if (rcu_access_pointer(temp_mld_link->chan_ctx))
+ final_active_links |= BIT(link_id);
+ }
+ if (hweight16(final_active_links) > 1) {
/* Indicate to mac80211 that EML is enabled */
vif->driver_flags |= IEEE80211_VIF_EML_ACTIVE;
mld_vif->emlsr.last_entry_ts = jiffies;
- if (vif->active_links & BIT(mld_vif->emlsr.selected_links))
+ if (final_active_links == mld_vif->emlsr.selected_links)
mld_vif->emlsr.primary = mld_vif->emlsr.selected_primary;
else
- mld_vif->emlsr.primary = __ffs(vif->active_links);
+ mld_vif->emlsr.primary = __ffs(final_active_links);
iwl_dbg_tlv_time_point(&mld->fwrt, IWL_FW_INI_TIME_ESR_LINK_UP,
NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 301/844] driver core: faux: stop using static struct device
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (299 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 300/844] wifi: iwlwifi: mld: Fix primary link selection logic Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 302/844] wifi: rtw89: Add default ID 28de:2432 for RTL8832CU Sasha Levin
` (551 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, Gui-Dong Han, Danilo Krummrich, Sasha Levin
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 61b76d07d2b46a86ea91267d36449fc78f8a1f6e ]
faux_bus_root should not have been a static struct device, but rather a
dynamically created structure so that lockdep and other testing tools do
not trip over it (as well as being the right thing overall to do.) Fix
this up by making it properly dynamic.
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Closes: https://lore.kernel.org/lkml/CALbr=LYKJsj6cbrDLA07qioKhWJcRj+gW8=bq5=4ZvpEe2c4Yg@mail.gmail.com/
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/2026012145-lapping-countless-ef81@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/faux.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/base/faux.c b/drivers/base/faux.c
index 21dd02124231a..23d7258172325 100644
--- a/drivers/base/faux.c
+++ b/drivers/base/faux.c
@@ -29,9 +29,7 @@ struct faux_object {
};
#define to_faux_object(dev) container_of_const(dev, struct faux_object, faux_dev.dev)
-static struct device faux_bus_root = {
- .init_name = "faux",
-};
+static struct device *faux_bus_root;
static int faux_match(struct device *dev, const struct device_driver *drv)
{
@@ -152,7 +150,7 @@ struct faux_device *faux_device_create_with_groups(const char *name,
if (parent)
dev->parent = parent;
else
- dev->parent = &faux_bus_root;
+ dev->parent = faux_bus_root;
dev->bus = &faux_bus_type;
dev_set_name(dev, "%s", name);
device_set_pm_not_required(dev);
@@ -236,9 +234,15 @@ int __init faux_bus_init(void)
{
int ret;
- ret = device_register(&faux_bus_root);
+ faux_bus_root = kzalloc(sizeof(*faux_bus_root), GFP_KERNEL);
+ if (!faux_bus_root)
+ return -ENOMEM;
+
+ dev_set_name(faux_bus_root, "faux");
+
+ ret = device_register(faux_bus_root);
if (ret) {
- put_device(&faux_bus_root);
+ put_device(faux_bus_root);
return ret;
}
@@ -256,6 +260,6 @@ int __init faux_bus_init(void)
bus_unregister(&faux_bus_type);
error_bus:
- device_unregister(&faux_bus_root);
+ device_unregister(faux_bus_root);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 302/844] wifi: rtw89: Add default ID 28de:2432 for RTL8832CU
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (300 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 301/844] driver core: faux: stop using static struct device Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 303/844] wifi: rtw89: fix unable to receive probe responses under MLO connection Sasha Levin
` (550 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shin-Yi Lin, Ping-Ke Shih, Sasha Levin
From: Shin-Yi Lin <isaiah@realtek.com>
[ Upstream commit 5f65ebf9aaf00c7443252136066138435ec03958 ]
Add 28de:2432 for RTL8832CU-based adapters that use this default ID.
Signed-off-by: Shin-Yi Lin <isaiah@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260114014906.21829-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8852cu.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852cu.c b/drivers/net/wireless/realtek/rtw89/rtw8852cu.c
index 2708b523ca141..3b9825c92a0d9 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8852cu.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8852cu.c
@@ -46,6 +46,8 @@ static const struct usb_device_id rtw_8852cu_id_table[] = {
.driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x991d, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x28de, 0x2432, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x35b2, 0x0502, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&rtw89_8852cu_info },
{ USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0101, 0xff, 0xff, 0xff),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 303/844] wifi: rtw89: fix unable to receive probe responses under MLO connection
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (301 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 302/844] wifi: rtw89: Add default ID 28de:2432 for RTL8832CU Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 304/844] wifi: rtw89: 8922a: add digital compensation for 2GHz Sasha Levin
` (549 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Po-Hao Huang, Ping-Ke Shih, Sasha Levin
From: Po-Hao Huang <phhuang@realtek.com>
[ Upstream commit 6f6d7a325fbde4f025ee1b1277f6f44727e21223 ]
During MLO connections, A1 of the probe responses we received are
in link address, these frames will then be dropped by mac80211 due to
not matching the MLD address in ieee80211_scan_accept_presp().
Fix this by using MLD address to scan when not using random MAC address.
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260114013950.19704-13-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/fw.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 7b9d9989e5170..2f68a04cc028f 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -8114,6 +8114,7 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
struct cfg80211_scan_request *req = &scan_req->req;
const struct rtw89_chan *chan = rtw89_chan_get(rtwdev,
rtwvif_link->chanctx_idx);
+ struct ieee80211_vif *vif = rtwvif_link_to_vif(rtwvif_link);
struct rtw89_vif *rtwvif = rtwvif_link->rtwvif;
struct rtw89_chanctx_pause_parm pause_parm = {
.rsn = RTW89_CHANCTX_PAUSE_REASON_HW_SCAN,
@@ -8142,6 +8143,8 @@ int rtw89_hw_scan_start(struct rtw89_dev *rtwdev,
if (req->flags & NL80211_SCAN_FLAG_RANDOM_ADDR)
get_random_mask_addr(mac_addr, req->mac_addr,
req->mac_addr_mask);
+ else if (ieee80211_vif_is_mld(vif))
+ ether_addr_copy(mac_addr, vif->addr);
else
ether_addr_copy(mac_addr, rtwvif_link->mac_addr);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 304/844] wifi: rtw89: 8922a: add digital compensation for 2GHz
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (302 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 303/844] wifi: rtw89: fix unable to receive probe responses under MLO connection Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 305/844] net/rds: No shortcut out of RDS_CONN_ERROR Sasha Levin
` (548 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Po-Hao Huang, Ping-Ke Shih, Sasha Levin
From: Po-Hao Huang <phhuang@realtek.com>
[ Upstream commit 8da7e88682d58a7c2e2c2101e49d3c9c9ac481b0 ]
This fixes transmit power too low under 2GHz connection. Previously
we missed the settings of 2GHz, add the according calibrated tables.
Signed-off-by: Po-Hao Huang <phhuang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260117044157.2392958-10-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/rtw8922a.c | 57 +++++++++++++++----
1 file changed, 47 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8922a.c b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
index 4bcf20612a455..52da0fa02da01 100644
--- a/drivers/net/wireless/realtek/rtw89/rtw8922a.c
+++ b/drivers/net/wireless/realtek/rtw89/rtw8922a.c
@@ -1770,6 +1770,32 @@ static int rtw8922a_ctrl_rx_path_tmac(struct rtw89_dev *rtwdev,
}
#define DIGITAL_PWR_COMP_REG_NUM 22
+static const u32 rtw8922a_digital_pwr_comp_2g_s0_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
+ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010000, 0x00000101,
+ 0x01010101, 0x02020201, 0x02010000, 0x03030202, 0x00000303,
+ 0x03020101, 0x06060504, 0x01010000, 0x06050403, 0x01000606,
+ 0x05040202, 0x07070706},
+ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
+ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
+ 0x01000000, 0x01010101, 0x01010000, 0x02020202, 0x00000404,
+ 0x03020101, 0x04040303, 0x02010000, 0x03030303, 0x00000505,
+ 0x03030201, 0x05050303},
+};
+
+static const u32 rtw8922a_digital_pwr_comp_2g_s1_val[][DIGITAL_PWR_COMP_REG_NUM] = {
+ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
+ 0x0D05091D, 0x14D50FA0, 0x01010000, 0x01010101, 0x00000101,
+ 0x01010100, 0x01010101, 0x01010000, 0x02020202, 0x01000202,
+ 0x02020101, 0x03030202, 0x02010000, 0x05040403, 0x01000606,
+ 0x05040302, 0x07070605},
+ {0x012C0064, 0x04B00258, 0x00432710, 0x019000A7, 0x06400320,
+ 0x0D05091D, 0x14D50FA0, 0x00000000, 0x01010100, 0x00000101,
+ 0x01010000, 0x02020201, 0x02010100, 0x03030202, 0x01000404,
+ 0x04030201, 0x05050404, 0x01010100, 0x04030303, 0x01000505,
+ 0x03030101, 0x05050404},
+};
+
static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
{0x012C0096, 0x044C02BC, 0x00322710, 0x015E0096, 0x03C8028A,
0x0BB80708, 0x17701194, 0x02020100, 0x03030303, 0x01000303,
@@ -1784,7 +1810,7 @@ static const u32 rtw8922a_digital_pwr_comp_val[][DIGITAL_PWR_COMP_REG_NUM] = {
};
static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
- bool enable, u8 nss,
+ u8 band, u8 nss,
enum rtw89_rf_path path)
{
static const u32 ltpc_t0[2] = {R_BE_LTPC_T0_PATH0, R_BE_LTPC_T0_PATH1};
@@ -1792,14 +1818,25 @@ static void rtw8922a_set_digital_pwr_comp(struct rtw89_dev *rtwdev,
u32 addr, val;
u32 i;
- if (nss == 1)
- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
- else
- digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
+ if (nss == 1) {
+ if (band == RTW89_BAND_2G)
+ digital_pwr_comp = path == RF_PATH_A ?
+ rtw8922a_digital_pwr_comp_2g_s0_val[0] :
+ rtw8922a_digital_pwr_comp_2g_s1_val[0];
+ else
+ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[0];
+ } else {
+ if (band == RTW89_BAND_2G)
+ digital_pwr_comp = path == RF_PATH_A ?
+ rtw8922a_digital_pwr_comp_2g_s0_val[1] :
+ rtw8922a_digital_pwr_comp_2g_s1_val[1];
+ else
+ digital_pwr_comp = rtw8922a_digital_pwr_comp_val[1];
+ }
addr = ltpc_t0[path];
for (i = 0; i < DIGITAL_PWR_COMP_REG_NUM; i++, addr += 4) {
- val = enable ? digital_pwr_comp[i] : 0;
+ val = digital_pwr_comp[i];
rtw89_phy_write32(rtwdev, addr, val);
}
}
@@ -1808,7 +1845,7 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
enum rtw89_phy_idx phy_idx)
{
const struct rtw89_chan *chan = rtw89_chan_get(rtwdev, RTW89_CHANCTX_0);
- bool enable = chan->band_type != RTW89_BAND_2G;
+ u8 band = chan->band_type;
u8 path;
if (rtwdev->mlo_dbcc_mode == MLO_1_PLUS_1_1RF) {
@@ -1816,10 +1853,10 @@ static void rtw8922a_digital_pwr_comp(struct rtw89_dev *rtwdev,
path = RF_PATH_A;
else
path = RF_PATH_B;
- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 1, path);
+ rtw8922a_set_digital_pwr_comp(rtwdev, band, 1, path);
} else {
- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_A);
- rtw8922a_set_digital_pwr_comp(rtwdev, enable, 2, RF_PATH_B);
+ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_A);
+ rtw8922a_set_digital_pwr_comp(rtwdev, band, 2, RF_PATH_B);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 305/844] net/rds: No shortcut out of RDS_CONN_ERROR
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (303 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 304/844] wifi: rtw89: 8922a: add digital compensation for 2GHz Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 306/844] ext4: propagate flags to convert_initialized_extent() Sasha Levin
` (547 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Gerd Rausch, Allison Henderson, Jakub Kicinski, Sasha Levin
From: Gerd Rausch <gerd.rausch@oracle.com>
[ Upstream commit ad22d24be635c6beab6a1fdd3f8b1f3c478d15da ]
RDS connections carry a state "rds_conn_path::cp_state"
and transitions from one state to another and are conditional
upon an expected state: "rds_conn_path_transition."
There is one exception to this conditionality, which is
"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
regardless of what state the condition is currently in.
But as soon as a connection enters state "RDS_CONN_ERROR",
the connection handling code expects it to go through the
shutdown-path.
The RDS/TCP multipath changes added a shortcut out of
"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
A subsequent "rds_tcp_reset_callbacks" can then transition
the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
That'll trip up "rds_conn_init_shutdown", which was
never adjusted to handle "RDS_CONN_RESETTING" and subsequently
drops the connection with the dreaded "DR_INV_CONN_STATE",
which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
So we do two things here:
a) Don't shortcut "RDS_CONN_ERROR", but take the longer
path through the shutdown code.
b) Add "RDS_CONN_RESETTING" to the expected states in
"rds_conn_init_shutdown" so that we won't error out
and get stuck, if we ever hit weird state transitions
like this again."
Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://patch.msgid.link/20260122055213.83608-2-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/connection.c | 2 ++
net/rds/tcp_listen.c | 5 -----
2 files changed, 2 insertions(+), 5 deletions(-)
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 68bc88cce84ec..ad8027e6f54ef 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -382,6 +382,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
if (!rds_conn_path_transition(cp, RDS_CONN_UP,
RDS_CONN_DISCONNECTING) &&
!rds_conn_path_transition(cp, RDS_CONN_ERROR,
+ RDS_CONN_DISCONNECTING) &&
+ !rds_conn_path_transition(cp, RDS_CONN_RESETTING,
RDS_CONN_DISCONNECTING)) {
rds_conn_path_error(cp,
"shutdown called in state %d\n",
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 820d3e20de195..27b6107ddc28d 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -59,9 +59,6 @@ void rds_tcp_keepalive(struct socket *sock)
* socket and force a reconneect from smaller -> larger ip addr. The reason
* we special case cp_index 0 is to allow the rds probe ping itself to itself
* get through efficiently.
- * Since reconnects are only initiated from the node with the numerically
- * smaller ip address, we recycle conns in RDS_CONN_ERROR on the passive side
- * by moving them to CONNECTING in this function.
*/
static
struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
@@ -86,8 +83,6 @@ struct rds_tcp_connection *rds_tcp_accept_one_path(struct rds_connection *conn)
struct rds_conn_path *cp = &conn->c_path[i];
if (rds_conn_path_transition(cp, RDS_CONN_DOWN,
- RDS_CONN_CONNECTING) ||
- rds_conn_path_transition(cp, RDS_CONN_ERROR,
RDS_CONN_CONNECTING)) {
return cp->cp_transport_data;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 306/844] ext4: propagate flags to convert_initialized_extent()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (304 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 305/844] net/rds: No shortcut out of RDS_CONN_ERROR Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 307/844] gro: change the BUG_ON() in gro_pull_from_frag0() Sasha Levin
` (546 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ojaswin Mujoo, Zhang Yi, Jan Kara, Theodore Ts'o, Sasha Levin
From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
[ Upstream commit 3fffa44b6ebf65be92a562a5063303979385a1c9 ]
Currently, ext4_zero_range passes EXT4_EX_NOCACHE flag to avoid caching
extents however this is not respected by convert_initialized_extent().
Hence, modify it to accept flags from the caller and to pass the flags
on to other extent manipulation functions it calls. This makes
sure the NOCACHE flag is respected throughout the code path.
Also, we no longer explicitly pass CONVERT_UNWRITTEN as the caller takes
care of this.
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/07008fbb14db727fddcaf4c30e2346c49f6c8fe0.1769149131.git.ojaswin@linux.ibm.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/extents.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 418c4351ef40c..986e85902d06a 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3857,6 +3857,7 @@ static struct ext4_ext_path *
convert_initialized_extent(handle_t *handle, struct inode *inode,
struct ext4_map_blocks *map,
struct ext4_ext_path *path,
+ int flags,
unsigned int *allocated)
{
struct ext4_extent *ex;
@@ -3882,11 +3883,11 @@ convert_initialized_extent(handle_t *handle, struct inode *inode,
if (ee_block != map->m_lblk || ee_len > map->m_len) {
path = ext4_split_convert_extents(handle, inode, map, path,
- EXT4_GET_BLOCKS_CONVERT_UNWRITTEN, NULL);
+ flags, NULL);
if (IS_ERR(path))
return path;
- path = ext4_find_extent(inode, map->m_lblk, path, 0);
+ path = ext4_find_extent(inode, map->m_lblk, path, flags);
if (IS_ERR(path))
return path;
depth = ext_depth(inode);
@@ -4298,7 +4299,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
if ((!ext4_ext_is_unwritten(ex)) &&
(flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) {
path = convert_initialized_extent(handle,
- inode, map, path, &allocated);
+ inode, map, path, flags, &allocated);
if (IS_ERR(path))
err = PTR_ERR(path);
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 307/844] gro: change the BUG_ON() in gro_pull_from_frag0()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (305 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 306/844] ext4: propagate flags to convert_initialized_extent() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 308/844] ipv4: igmp: annotate data-races around idev->mr_maxdelay Sasha Levin
` (545 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Eric Dumazet, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit cbe41362be2c27e0237a94a404ae413cec9c2ad9 ]
Replace the BUG_ON() which never fired with a DEBUG_NET_WARN_ON_ONCE()
$ scripts/bloat-o-meter -t vmlinux.1 vmlinux.2
add/remove: 2/2 grow/shrink: 1/1 up/down: 370/-254 (116)
Function old new delta
gro_try_pull_from_frag0 - 196 +196
napi_gro_frags 771 929 +158
__pfx_gro_try_pull_from_frag0 - 16 +16
__pfx_gro_pull_from_frag0 16 - -16
dev_gro_receive 1514 1464 -50
gro_pull_from_frag0 188 - -188
Total: Before=22565899, After=22566015, chg +0.00%
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260122045720.1221017-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/gro.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/gro.c b/net/core/gro.c
index 482fa7d7f5981..ef61695fbdbb6 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -417,7 +417,7 @@ static void gro_pull_from_frag0(struct sk_buff *skb, int grow)
{
struct skb_shared_info *pinfo = skb_shinfo(skb);
- BUG_ON(skb->end - skb->tail < grow);
+ DEBUG_NET_WARN_ON_ONCE(skb->end - skb->tail < grow);
memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 308/844] ipv4: igmp: annotate data-races around idev->mr_maxdelay
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (306 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 307/844] gro: change the BUG_ON() in gro_pull_from_frag0() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 309/844] net: hns3: extend HCLGE_FD_AD_QID to 11 bits Sasha Levin
` (544 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, David Ahern, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e4faaf65a75f650ac4366ddff5dabb826029ca5a ]
idev->mr_maxdelay is read and written locklessly,
add READ_ONCE()/WRITE_ONCE() annotations.
While we are at it, make this field an u32.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260122172247.2429403-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/inetdevice.h | 2 +-
net/ipv4/igmp.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 5730ba6b1cfaf..dccbeb25f7014 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -38,11 +38,11 @@ struct in_device {
struct ip_mc_list *mc_tomb;
unsigned long mr_v1_seen;
unsigned long mr_v2_seen;
- unsigned long mr_maxdelay;
unsigned long mr_qi; /* Query Interval */
unsigned long mr_qri; /* Query Response Interval */
unsigned char mr_qrv; /* Query Robustness Variable */
unsigned char mr_gq_running;
+ u32 mr_maxdelay;
u32 mr_ifc_count;
struct timer_list mr_gq_timer; /* general query timer */
struct timer_list mr_ifc_timer; /* interface change timer */
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 7182f1419c2a4..0adc993c211d7 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -227,7 +227,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
static void igmp_gq_start_timer(struct in_device *in_dev)
{
- int tv = get_random_u32_below(in_dev->mr_maxdelay);
+ int tv = get_random_u32_below(READ_ONCE(in_dev->mr_maxdelay));
unsigned long exp = jiffies + tv + 2;
if (in_dev->mr_gq_running &&
@@ -1009,7 +1009,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
if (!max_delay)
max_delay = 1; /* can't mod w/ 0 */
- in_dev->mr_maxdelay = max_delay;
+ WRITE_ONCE(in_dev->mr_maxdelay, max_delay);
/* RFC3376, 4.1.6. QRV and 4.1.7. QQIC, when the most recently
* received value was zero, use the default or statically
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 309/844] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (307 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 308/844] ipv4: igmp: annotate data-races around idev->mr_maxdelay Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 310/844] wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode Sasha Levin
` (543 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jijie Shao, Paolo Abeni, Sasha Levin
From: Jijie Shao <shaojijie@huawei.com>
[ Upstream commit 878406d4d6ef85c37fab52074771cc916e532c16 ]
Currently, HCLGE_FD_AD_QID has only 10 bits and supports a
maximum of 1023 queues. However, there are actually scenarios
where the queue_id exceeds 1023.
This patch adds an additional bit to HCLGE_FD_AD_QID to ensure
that queue_id greater than 1023 are supported.
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Link: https://patch.msgid.link/20260123094756.3718516-2-shaojijie@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 +++--
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 +++-
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
index 416e02e7b995f..bc333d8710ac1 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
@@ -727,8 +727,8 @@ struct hclge_fd_tcam_config_3_cmd {
#define HCLGE_FD_AD_DROP_B 0
#define HCLGE_FD_AD_DIRECT_QID_B 1
-#define HCLGE_FD_AD_QID_S 2
-#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
+#define HCLGE_FD_AD_QID_L_S 2
+#define HCLGE_FD_AD_QID_L_M GENMASK(11, 2)
#define HCLGE_FD_AD_USE_COUNTER_B 12
#define HCLGE_FD_AD_COUNTER_NUM_S 13
#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
@@ -741,6 +741,7 @@ struct hclge_fd_tcam_config_3_cmd {
#define HCLGE_FD_AD_TC_OVRD_B 16
#define HCLGE_FD_AD_TC_SIZE_S 17
#define HCLGE_FD_AD_TC_SIZE_M GENMASK(20, 17)
+#define HCLGE_FD_AD_QID_H_B 21
struct hclge_fd_ad_config_cmd {
u8 stage;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index b8e2aa19f9e61..a90f1a91f9973 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -5679,11 +5679,13 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
hnae3_set_field(ad_data, HCLGE_FD_AD_TC_SIZE_M,
HCLGE_FD_AD_TC_SIZE_S, (u32)action->tc_size);
}
+ hnae3_set_bit(ad_data, HCLGE_FD_AD_QID_H_B,
+ action->queue_id >= HCLGE_TQP_MAX_SIZE_DEV_V2 ? 1 : 0);
ad_data <<= 32;
hnae3_set_bit(ad_data, HCLGE_FD_AD_DROP_B, action->drop_packet);
hnae3_set_bit(ad_data, HCLGE_FD_AD_DIRECT_QID_B,
action->forward_to_direct_queue);
- hnae3_set_field(ad_data, HCLGE_FD_AD_QID_M, HCLGE_FD_AD_QID_S,
+ hnae3_set_field(ad_data, HCLGE_FD_AD_QID_L_M, HCLGE_FD_AD_QID_L_S,
action->queue_id);
hnae3_set_bit(ad_data, HCLGE_FD_AD_USE_COUNTER_B, action->use_counter);
hnae3_set_field(ad_data, HCLGE_FD_AD_COUNTER_NUM_M,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 310/844] wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (308 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 309/844] net: hns3: extend HCLGE_FD_AD_QID to 11 bits Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 311/844] wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() Sasha Levin
` (542 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pagadala Yesu Anjaneyulu, Johannes Berg, Miri Korenblit,
Sasha Levin
From: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
[ Upstream commit fd5bfcf430ea2fdbb3e78fd0b82ceb0ab02b72ee ]
Although value 4 (INDOOR_SP_AP_OLD) is deprecated in IEEE standards,
existing APs may still use this control value. Since this value is
based on the old specification, we cannot trust such APs implement
proper power controls.
Therefore, move IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD case
from SP_AP to LPI_AP power type handling to prevent potential
power limit violations.
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260111163601.6b5a36d3601e.I1704ee575fd25edb0d56f48a0a3169b44ef72ad0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/cfg80211.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 2900202588a54..39a04776705eb 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -10147,9 +10147,9 @@ cfg80211_6ghz_power_type(u8 control, u32 client_flags)
case IEEE80211_6GHZ_CTRL_REG_LPI_AP:
case IEEE80211_6GHZ_CTRL_REG_INDOOR_LPI_AP:
case IEEE80211_6GHZ_CTRL_REG_AP_ROLE_NOT_RELEVANT:
+ case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD:
return IEEE80211_REG_LPI_AP;
case IEEE80211_6GHZ_CTRL_REG_SP_AP:
- case IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP_OLD:
return IEEE80211_REG_SP_AP;
case IEEE80211_6GHZ_CTRL_REG_VLP_AP:
return IEEE80211_REG_VLP_AP;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 311/844] wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (309 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 310/844] wifi: cfg80211: treat deprecated INDOOR_SP_AP_OLD control value as LPI mode Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 312/844] wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() Sasha Levin
` (541 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ziyi Guo, Stanislaw Gruszka, Johannes Berg, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ]
il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex.
However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating
that callers must hold this lock.
All other callers of il_set_tx_power() properly acquire the mutex:
- il_bg_scan_completed() acquires mutex at common.c:1683
- il_mac_config() acquires mutex at common.c:5006
- il3945_commit_rxon() and il4965_commit_rxon() are called via work
queues that hold the mutex (like il4965_bg_alive_start)
Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in
the sysfs store function to fix the missing lock protection.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
index 3588dec75ebdd..57fa866efd9f8 100644
--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
@@ -4606,7 +4606,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr,
if (ret)
IL_INFO("%s is not in decimal form.\n", buf);
else {
+ mutex_lock(&il->mutex);
ret = il_set_tx_power(il, val, false);
+ mutex_unlock(&il->mutex);
if (ret)
IL_ERR("failed setting tx power (0x%08x).\n", ret);
else
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 312/844] wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (310 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 311/844] wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 313/844] wifi: rtw89: pci: validate release report content before using for RTL8922DE Sasha Levin
` (540 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ziyi Guo, Stanislaw Gruszka, Johannes Berg, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit 4dd1dda65265ecbc9f43ffc08e333684cf715152 ]
il3945_store_measurement() calls il3945_get_measurement() which internally
calls il_send_cmd_sync() without holding il->mutex. However,
il_send_cmd_sync() has lockdep_assert_held(&il->mutex) indicating that
callers must hold this lock.
Other sysfs store functions in the same file properly acquire the mutex:
- il3945_store_flags() acquires mutex at 3945-mac.c:3110
- il3945_store_filter_flags() acquires mutex at 3945-mac.c:3144
Add mutex_lock()/mutex_unlock() around the il3945_get_measurement() call
in the sysfs store function to fix the missing lock protection.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Link: https://patch.msgid.link/20260125193005.1090429-1-n7l8m4@u.northwestern.edu
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlegacy/3945-mac.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
index 104748fcdc33e..54991f31c52c5 100644
--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
@@ -3224,7 +3224,9 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
D_INFO("Invoking measurement of type %d on " "channel %d (for '%s')\n",
type, params.channel, buf);
+ mutex_lock(&il->mutex);
il3945_get_measurement(il, ¶ms, type);
+ mutex_unlock(&il->mutex);
return count;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 313/844] wifi: rtw89: pci: validate release report content before using for RTL8922DE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (311 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 312/844] wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 314/844] ipv4: fib: Annotate access to struct fib_alias.fa_state Sasha Levin
` (539 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ping-Ke Shih, Sasha Levin
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 5f93d611b33a05bd03d6843c8efe8cb6a1992620 ]
The commit 957eda596c76
("wifi: rtw89: pci: validate sequence number of TX release report")
does validation on existing chips, which somehow a release report of SKB
becomes malformed. As no clear cause found, add rules ahead for RTL8922DE
to avoid crash if it happens.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260123013957.16418-11-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/pci.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
index 093960d7279f8..b8135cf15d13c 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -604,8 +604,10 @@ static void rtw89_pci_release_rpp(struct rtw89_dev *rtwdev, void *rpp)
info->parse_rpp(rtwdev, rpp, &rpp_info);
- if (unlikely(rpp_info.txch == RTW89_TXCH_CH12)) {
- rtw89_warn(rtwdev, "should no fwcmd release report\n");
+ if (unlikely(rpp_info.txch >= RTW89_TXCH_NUM ||
+ info->tx_dma_ch_mask & BIT(rpp_info.txch))) {
+ rtw89_warn(rtwdev, "should no release report on txch %d\n",
+ rpp_info.txch);
return;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 314/844] ipv4: fib: Annotate access to struct fib_alias.fa_state.
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (312 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 313/844] wifi: rtw89: pci: validate release report content before using for RTL8922DE Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 315/844] Bluetooth: btusb: Add support for MediaTek7920 0489:e158 Sasha Levin
` (538 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kuniyuki Iwashima, syzbot+d24f940f770afda885cf, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 6e84fc395e90465f1418f582a9f7d53c87ab010e ]
syzbot reported that struct fib_alias.fa_state can be
modified locklessly by RCU readers. [0]
Let's use READ_ONCE()/WRITE_ONCE() properly.
[0]:
BUG: KCSAN: data-race in fib_table_lookup / fib_table_lookup
write to 0xffff88811b06a7fa of 1 bytes by task 4167 on cpu 0:
fib_alias_accessed net/ipv4/fib_lookup.h:32 [inline]
fib_table_lookup+0x361/0xd60 net/ipv4/fib_trie.c:1565
fib_lookup include/net/ip_fib.h:390 [inline]
ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0x53a/0x600 net/socket.c:2592
___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
__sys_sendmmsg+0x185/0x320 net/socket.c:2735
__do_sys_sendmmsg net/socket.c:2762 [inline]
__se_sys_sendmmsg net/socket.c:2759 [inline]
__x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88811b06a7fa of 1 bytes by task 4168 on cpu 1:
fib_alias_accessed net/ipv4/fib_lookup.h:31 [inline]
fib_table_lookup+0x338/0xd60 net/ipv4/fib_trie.c:1565
fib_lookup include/net/ip_fib.h:390 [inline]
ip_route_output_key_hash_rcu+0x378/0x1380 net/ipv4/route.c:2814
ip_route_output_key_hash net/ipv4/route.c:2705 [inline]
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x65/0x110 net/ipv4/route.c:2932
udp_sendmsg+0x13c3/0x15d0 net/ipv4/udp.c:1450
inet_sendmsg+0xac/0xd0 net/ipv4/af_inet.c:859
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0x53a/0x600 net/socket.c:2592
___sys_sendmsg+0x195/0x1e0 net/socket.c:2646
__sys_sendmmsg+0x185/0x320 net/socket.c:2735
__do_sys_sendmmsg net/socket.c:2762 [inline]
__se_sys_sendmmsg net/socket.c:2759 [inline]
__x64_sys_sendmmsg+0x57/0x70 net/socket.c:2759
x64_sys_call+0x1e28/0x3000 arch/x86/include/generated/asm/syscalls_64.h:308
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00 -> 0x01
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4168 Comm: syz.4.206 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Reported-by: syzbot+d24f940f770afda885cf@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69783ead.050a0220.c9109.0013.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260127043528.514160-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/fib_lookup.h | 6 ++++--
net/ipv4/fib_trie.c | 4 ++--
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index f9b9e26c32c19..0b72796dd1ad3 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -28,8 +28,10 @@ struct fib_alias {
/* Don't write on fa_state unless needed, to keep it shared on all cpus */
static inline void fib_alias_accessed(struct fib_alias *fa)
{
- if (!(fa->fa_state & FA_S_ACCESSED))
- fa->fa_state |= FA_S_ACCESSED;
+ u8 fa_state = READ_ONCE(fa->fa_state);
+
+ if (!(fa_state & FA_S_ACCESSED))
+ WRITE_ONCE(fa->fa_state, fa_state | FA_S_ACCESSED);
}
/* Exported by fib_semantics.c */
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 7e2c17fec3fc4..1308213791f19 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1280,7 +1280,7 @@ int fib_table_insert(struct net *net, struct fib_table *tb,
new_fa->fa_dscp = fa->fa_dscp;
new_fa->fa_info = fi;
new_fa->fa_type = cfg->fc_type;
- state = fa->fa_state;
+ state = READ_ONCE(fa->fa_state);
new_fa->fa_state = state & ~FA_S_ACCESSED;
new_fa->fa_slen = fa->fa_slen;
new_fa->tb_id = tb->tb_id;
@@ -1745,7 +1745,7 @@ int fib_table_delete(struct net *net, struct fib_table *tb,
fib_remove_alias(t, tp, l, fa_to_delete);
- if (fa_to_delete->fa_state & FA_S_ACCESSED)
+ if (READ_ONCE(fa_to_delete->fa_state) & FA_S_ACCESSED)
rt_cache_flush(cfg->fc_nlinfo.nl_net);
fib_release_info(fa_to_delete->fa_info);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 315/844] Bluetooth: btusb: Add support for MediaTek7920 0489:e158
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (313 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 314/844] ipv4: fib: Annotate access to struct fib_alias.fa_state Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 316/844] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is pulled up by hw Sasha Levin
` (537 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bluecross, Luiz Augusto von Dentz, Sasha Levin
From: Bluecross <elantsew.andrew@gmail.com>
[ Upstream commit 2630bcc8343a9d2a38dc1793068e6754b3156811 ]
Add support for MediaTek7920 0489:e158
/sys/kernel/debug/usb/devices reports for that device:
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=03 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e158 Rev= 1.00
S: Manufacturer=MediaTek Inc.
S: Product=Wireless_Device
S: SerialNumber=000000000
C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
Signed-off-by: Andrew Elatsev <elantsew.andrew@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 80ccfa8fd982a..ef08567a7487c 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -639,6 +639,8 @@ static const struct usb_device_id quirks_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0489, 0xe158), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Additional MediaTek MT7921 Bluetooth devices */
{ USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 316/844] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is pulled up by hw
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (314 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 315/844] Bluetooth: btusb: Add support for MediaTek7920 0489:e158 Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 317/844] Bluetooth: hci_conn: Set link_policy on incoming ACL connections Sasha Levin
` (536 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shuai Zhang, Dmitry Baryshkov, Luiz Augusto von Dentz,
Sasha Levin
From: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
[ Upstream commit fce1a9244a0f85683be8530e623bc729f24c5067 ]
On QCS9075 and QCA8275 platforms, the BT_EN pin is always pulled up by hw
and cannot be controlled by the host. As a result, in case of a firmware
crash, the host cannot trigger a cold reset. Instead, the BT controller
performs a warm restart on its own, without reloading the firmware.
This leads to the controller remaining in IBS_WAKE state, while the host
expects it to be in sleep mode. The mismatch causes HCI reset commands
to time out. Additionally, the driver does not clear internal flags
QCA_SSR_TRIGGERED and QCA_IBS_DISABLED, which blocks the reset sequence.
If the SSR duration exceeds 2 seconds, the host may enter TX sleep mode
due to tx_idle_timeout, further preventing recovery. Also, memcoredump_flag
is not cleared, so only the first SSR generates a coredump.
Tell the driver that the BT controller has undergone a proper restart sequence:
- Clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED flags after SSR.
- Add a 50ms delay to allow the controller to complete its warm reset.
- Reset tx_idle_timer to prevent the host from entering TX sleep mode.
- Clear memcoredump_flag to allow multiple coredump captures.
Apply these steps only when HCI_QUIRK_NON_PERSISTENT_SETUP is not set,
which indicates that BT_EN is defined in DTS and cannot be toggled.
Refer to the comment in include/net/bluetooth/hci.h for details on
HCI_QUIRK_NON_PERSISTENT_SETUP.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_qca.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 888176b0faa90..a3c217571c3c4 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1653,6 +1653,39 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
skb_queue_purge(&qca->rx_memdump_q);
}
+ /*
+ * If the BT chip's bt_en pin is connected to a 3.3V power supply via
+ * hardware and always stays high, driver cannot control the bt_en pin.
+ * As a result, during SSR (SubSystem Restart), QCA_SSR_TRIGGERED and
+ * QCA_IBS_DISABLED flags cannot be cleared, which leads to a reset
+ * command timeout.
+ * Add an msleep delay to ensure controller completes the SSR process.
+ *
+ * Host will not download the firmware after SSR, controller to remain
+ * in the IBS_WAKE state, and the host needs to synchronize with it
+ *
+ * Since the bluetooth chip has been reset, clear the memdump state.
+ */
+ if (!hci_test_quirk(hu->hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) {
+ /*
+ * When the SSR (SubSystem Restart) duration exceeds 2 seconds,
+ * it triggers host tx_idle_delay, which sets host TX state
+ * to sleep. Reset tx_idle_timer after SSR to prevent
+ * host enter TX IBS_Sleep mode.
+ */
+ mod_timer(&qca->tx_idle_timer, jiffies +
+ msecs_to_jiffies(qca->tx_idle_delay));
+
+ /* Controller reset completion time is 50ms */
+ msleep(50);
+
+ clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
+ clear_bit(QCA_IBS_DISABLED, &qca->flags);
+
+ qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
+ qca->memdump_state = QCA_MEMDUMP_IDLE;
+ }
+
clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 317/844] Bluetooth: hci_conn: Set link_policy on incoming ACL connections
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (315 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 316/844] Bluetooth: hci_qca: Fix SSR (SubSystem Restart) fail when BT_EN is pulled up by hw Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 318/844] Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE Sasha Levin
` (535 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Stefan Sørensen, Luiz Augusto von Dentz, Sasha Levin
From: Stefan Sørensen <ssorensen@roku.com>
[ Upstream commit 4bb091013ab0f2edfed3f58bebe658a798cbcc4d ]
The connection link policy is only set when establishing an outgoing
ACL connection causing connection idle modes not to be available on
incoming connections. Move the setting of the link policy to the
creation of the connection so all ACL connection will use the link
policy set on the HCI device.
Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_conn.c | 1 +
net/bluetooth/hci_sync.c | 2 --
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5a4374ccf8e84..98f0461b3dd7d 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1002,6 +1002,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
switch (type) {
case ACL_LINK:
conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
+ conn->link_policy = hdev->link_policy;
conn->mtu = hdev->acl_mtu;
break;
case LE_LINK:
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index cbc3a75d73262..334eb4376a266 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -6897,8 +6897,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
conn->attempt++;
- conn->link_policy = hdev->link_policy;
-
memset(&cp, 0, sizeof(cp));
bacpy(&cp.bdaddr, &conn->dst);
cp.pscan_rep_mode = 0x02;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 318/844] Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (316 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 317/844] Bluetooth: hci_conn: Set link_policy on incoming ACL connections Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 319/844] Bluetooth: hci_conn: use mod_delayed_work for active mode timeout Sasha Levin
` (534 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Techie Ernie, Luiz Augusto von Dentz, Sasha Levin
From: Techie Ernie <techieernie@gmail.com>
[ Upstream commit e07094a51ad8faf98ea64320799ce550828e97cd ]
Add USB ID 0489:e112 for the Realtek 8851BE Bluetooth adapter.
Without this entry, the device is not handled correctly by btusb and Bluetooth fails to initialise.
Adding the ID enables proper Realtek initialization for Bluetooth to work on various motherboards using this Bluetooth adapter.
The device identifies as:
Bus 001 Device XXX: ID 0489:e112 Foxconn / Hon Hai Bluetooth Radio
Tested on Realtek 8851BE. Bluetooth works after this change is made.
Signed-off-by: Techie Ernie <techieernie@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ef08567a7487c..66e266e93cc12 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -521,6 +521,8 @@ static const struct usb_device_id quirks_table[] = {
{ USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK },
{ USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK },
{ USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x0489, 0xe112), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Realtek 8851BU Bluetooth devices */
{ USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK |
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 319/844] Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (317 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 318/844] Bluetooth: btusb: Add USB ID 0489:e112 for Realtek 8851BE Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 320/844] Bluetooth: btusb: Add new VID/PID for RTL8852CE Sasha Levin
` (533 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Stefan Sørensen, Luiz Augusto von Dentz, Sasha Levin
From: Stefan Sørensen <ssorensen@roku.com>
[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ]
hci_conn_enter_active_mode() uses queue_delayed_work() with the
intention that the work will run after the given timeout. However,
queue_delayed_work() does nothing if the work is already queued, so
depending on the link policy we may end up putting the connection
into idle mode every hdev->idle_timeout ms.
Use mod_delayed_work() instead so the work is queued if not already
queued, and the timeout is updated otherwise.
Signed-off-by: Stefan Sørensen <ssorensen@roku.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_conn.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 98f0461b3dd7d..dc085856f5e91 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -2620,8 +2620,8 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
timer:
if (hdev->idle_timeout > 0)
- queue_delayed_work(hdev->workqueue, &conn->idle_work,
- msecs_to_jiffies(hdev->idle_timeout));
+ mod_delayed_work(hdev->workqueue, &conn->idle_work,
+ msecs_to_jiffies(hdev->idle_timeout));
}
/* Drop all connection on the device */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 320/844] Bluetooth: btusb: Add new VID/PID for RTL8852CE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (318 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 319/844] Bluetooth: hci_conn: use mod_delayed_work for active mode timeout Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 321/844] Bluetooth: btusb: Add device ID for Realtek RTL8761BU Sasha Levin
` (532 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shell Chen, Luiz Augusto von Dentz, Sasha Levin
From: Shell Chen <w27@sorz.org>
[ Upstream commit d9f7c39c6b7548bd70519b241b6c2d1bcc658d4b ]
Add VID:PID 13d3:3612 to the quirks_table.
This ID pair is found in the Realtek RTL8852CE PCIe module
in an ASUS TUF A14 2025 (FA401KM) laptop.
Tested on aforementioned laptop.
The device info from /sys/kernel/debug/usb/devices is listed as below.
T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3612 Rev= 0.00
S: Manufacturer=Realtek
S: Product=Bluetooth Radio
S: SerialNumber=00e04c000001
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
Signed-off-by: Shell Chen <w27@sorz.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 66e266e93cc12..f177569978d36 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -561,6 +561,8 @@ static const struct usb_device_id quirks_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3612), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 321/844] Bluetooth: btusb: Add device ID for Realtek RTL8761BU
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (319 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 320/844] Bluetooth: btusb: Add new VID/PID for RTL8852CE Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 322/844] octeontx2-af: Workaround SQM/PSE stalls by disabling sticky Sasha Levin
` (531 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jacopo Scannella, Luiz Augusto von Dentz, Sasha Levin
From: Jacopo Scannella <code@charlie.cat>
[ Upstream commit cc6383d4f0cf6127c0552f94cae517a06ccc6b17 ]
Add USB device ID 0x2c0a:0x8761 to the btusb driver fo the Realtek
RTL8761BU Bluetooth adapter.
Reference:
https://www.startech.com/en-us/networking-io/av53c1-usb-bluetooth
Signed-off-by: Jacopo Scannella <code@charlie.cat>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f177569978d36..a41bb1e2a279a 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -781,6 +781,7 @@ static const struct usb_device_id quirks_table[] = {
/* Additional Realtek 8723BU Bluetooth devices */
{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
+ { USB_DEVICE(0x2c0a, 0x8761), .driver_info = BTUSB_REALTEK },
/* Additional Realtek 8723DE Bluetooth devices */
{ USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 322/844] octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (320 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 321/844] Bluetooth: btusb: Add device ID for Realtek RTL8761BU Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 323/844] net: sfp: add quirk for Lantech 8330-265D Sasha Levin
` (530 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Geetha sowjanya, Simon Horman, Jakub Kicinski, Sasha Levin
From: Geetha sowjanya <gakula@marvell.com>
[ Upstream commit 70e9a5760abfb6338d63994d4de6b0778ec795d6 ]
NIX SQ manager sticky mode is known to cause stalls when multiple SQs
share an SMQ and transmit concurrently. Additionally, PSE may deadlock
on transitions between sticky and non-sticky transmissions. There is
also a credit drop issue observed when certain condition clocks are
gated.
work around these hardware errata by:
- Disabling SQM sticky operation:
- Clear TM6 (bit 15)
- Clear TM11 (bit 14)
- Disabling sticky → non-sticky transition path that can deadlock PSE:
- Clear TM5 (bit 23)
- Preventing credit drops by keeping the control-flow clock enabled:
- Set TM9 (bit 21)
These changes are applied via NIX_AF_SQM_DBG_CTL_STATUS. With this
configuration the SQM/PSE maintain forward progress under load without
credit loss, at the cost of disabling sticky optimizations.
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260127125147.1642-1-gakula@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
index 2f485a930edd1..49f7ff5eddfc8 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -4938,12 +4938,18 @@ static int rvu_nix_block_init(struct rvu *rvu, struct nix_hw *nix_hw)
/* Set chan/link to backpressure TL3 instead of TL2 */
rvu_write64(rvu, blkaddr, NIX_AF_PSE_CHANNEL_LEVEL, 0x01);
- /* Disable SQ manager's sticky mode operation (set TM6 = 0)
+ /* Disable SQ manager's sticky mode operation (set TM6 = 0, TM11 = 0)
* This sticky mode is known to cause SQ stalls when multiple
- * SQs are mapped to same SMQ and transmitting pkts at a time.
+ * SQs are mapped to same SMQ and transmitting pkts simultaneously.
+ * NIX PSE may deadlock when there are any sticky to non-sticky
+ * transmission. Hence disable it (TM5 = 0).
*/
cfg = rvu_read64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS);
- cfg &= ~BIT_ULL(15);
+ cfg &= ~(BIT_ULL(15) | BIT_ULL(14) | BIT_ULL(23));
+ /* NIX may drop credits when condition clocks are turned off.
+ * Hence enable control flow clk (set TM9 = 1).
+ */
+ cfg |= BIT_ULL(21);
rvu_write64(rvu, blkaddr, NIX_AF_SQM_DBG_CTL_STATUS, cfg);
ltdefs = rvu->kpu.lt_def;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 323/844] net: sfp: add quirk for Lantech 8330-265D
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (321 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 322/844] octeontx2-af: Workaround SQM/PSE stalls by disabling sticky Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 324/844] wifi: rtw89: pci: restore LDO setting after device resume Sasha Levin
` (529 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Marek Behún, Jakub Kicinski, Sasha Levin
From: Marek Behún <kabel@kernel.org>
[ Upstream commit 86a8e8e0ddbc3d14c799536eb888180b84d002f3 ]
Similar to Lantech 8330-262D-E, the Lantech 8330-265D also reports
2500MBd instead of 3125MBd.
Also, all 8330-265D report normal RX_LOS in EEPROM, but some signal
inverted RX_LOS. We therefore need to ignore RX_LOS on these modules.
Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://patch.msgid.link/20260128170044.15576-1-kabel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/sfp.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 3e023723887c4..43aefdd8b70f7 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -532,9 +532,13 @@ static const struct sfp_quirk sfp_quirks[] = {
SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
sfp_fixup_ignore_tx_fault),
- // Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
- // 2500MBd NRZ in their EEPROM
+ // Lantech 8330-262D-E and 8330-265D can operate at 2500base-X, but
+ // incorrectly report 2500MBd NRZ in their EEPROM.
+ // Some 8330-265D modules have inverted LOS, while all of them report
+ // normal LOS in EEPROM. Therefore we need to ignore LOS entirely.
SFP_QUIRK_S("Lantech", "8330-262D-E", sfp_quirk_2500basex),
+ SFP_QUIRK("Lantech", "8330-265D", sfp_quirk_2500basex,
+ sfp_fixup_ignore_los),
SFP_QUIRK_S("UBNT", "UF-INSTANT", sfp_quirk_ubnt_uf_instant),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 324/844] wifi: rtw89: pci: restore LDO setting after device resume
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (322 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 323/844] net: sfp: add quirk for Lantech 8330-265D Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 325/844] wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() Sasha Levin
` (528 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Dian-Syuan Yang, Ping-Ke Shih, Sasha Levin
From: Dian-Syuan Yang <dian_syuan0116@realtek.com>
[ Upstream commit af1e82232b988f8fc6d635c60609765e49221a64 ]
The LDO (Low Dropout Regulator) setting is missing after suspend/resume
in some platforms, and it will cause card loss. Therefore, reconfigure
this setting to avoid it.
Signed-off-by: Dian-Syuan Yang <dian_syuan0116@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260127085036.44060-6-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/pci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c
index b8135cf15d13c..fb4469a76bc03 100644
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -4605,6 +4605,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev)
rtw89_write32_clr(rtwdev, R_AX_PCIE_PS_CTRL_V1,
B_AX_SEL_REQ_ENTR_L1);
}
+ rtw89_pci_hci_ldo(rtwdev);
rtw89_pci_l2_hci_ldo(rtwdev);
rtw89_pci_basic_cfg(rtwdev, true);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 325/844] wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (323 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 324/844] wifi: rtw89: pci: restore LDO setting after device resume Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:23 ` [PATCH 6.19 326/844] bnxt_en: Allow ntuple filters for drops Sasha Levin
` (527 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ziyi Guo, Baochen Qiang, Jeff Johnson, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit 820ba7dd6859ef8b1eaf6014897e7aa4756fc65d ]
ath10k_wmi_event_peer_sta_ps_state_chg() uses lockdep_assert_held() to
assert that ar->data_lock should be held by the caller, but neither
ath10k_wmi_10_2_op_rx() nor ath10k_wmi_10_4_op_rx() acquire this lock
before calling this function.
The field arsta->peer_ps_state is documented as protected by
ar->data_lock in core.h, and other accessors (ath10k_peer_ps_state_disable,
ath10k_dbg_sta_read_peer_ps_state) properly acquire this lock.
Add spin_lock_bh()/spin_unlock_bh() around the peer_ps_state update,
and remove the lockdep_assert_held() to be aligned with new locking,
following the pattern used by other WMI event handlers in the driver.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260123175611.767731-1-n7l8m4@u.northwestern.edu
[removed excess blank line]
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index b4aad6604d6d9..ce22141e5efd9 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -5289,8 +5289,6 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
struct ath10k_sta *arsta;
u8 peer_addr[ETH_ALEN];
- lockdep_assert_held(&ar->data_lock);
-
ev = (struct wmi_peer_sta_ps_state_chg_event *)skb->data;
ether_addr_copy(peer_addr, ev->peer_macaddr.addr);
@@ -5305,7 +5303,9 @@ ath10k_wmi_event_peer_sta_ps_state_chg(struct ath10k *ar, struct sk_buff *skb)
}
arsta = (struct ath10k_sta *)sta->drv_priv;
+ spin_lock_bh(&ar->data_lock);
arsta->peer_ps_state = __le32_to_cpu(ev->peer_ps_state);
+ spin_unlock_bh(&ar->data_lock);
exit:
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 326/844] bnxt_en: Allow ntuple filters for drops
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (324 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 325/844] wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() Sasha Levin
@ 2026-02-28 17:23 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 327/844] ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match Sasha Levin
` (526 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:23 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Joe Damato, Michael Chan, Jakub Kicinski, Sasha Levin
From: Joe Damato <joe@dama.to>
[ Upstream commit 61cef6454cfbb9fcdbe41401fb53895f86603081 ]
It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action
support for ntuple"), bnxt gained support for ntuple filters for packet
drops.
However, support for this does not seem to work in recent kernels or
against net-next:
% sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
rmgr: Cannot insert RX class rule: Operation not supported
Cannot insert classification rule
The issue is that the existing code uses ethtool_get_flow_spec_ring_vf,
which will return a non-zero value if the ring_cookie is set to
RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return
-EOPNOTSUPP because it thinks the user is trying to set an ntuple filter
for a vf.
Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC.
After this patch, ntuple filters for drops can be added:
% sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1
Added rule with ID 0
% ethtool -n eth0
44 RX rings available
Total 1 rules
Filter: 0
Rule Type: UDP over IPv4
Src IP addr: 1.1.1.1 mask: 0.0.0.0
Dest IP addr: 0.0.0.0 mask: 255.255.255.255
TOS: 0x0 mask: 0xff
Src port: 0 mask: 0xffff
Dest port: 0 mask: 0xffff
Action: Drop
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 068e191ede19e..c76a7623870be 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -1346,16 +1346,17 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
struct bnxt_l2_filter *l2_fltr;
struct bnxt_flow_masks *fmasks;
struct flow_keys *fkeys;
- u32 idx, ring;
+ u32 idx;
int rc;
- u8 vf;
if (!bp->vnic_info)
return -EAGAIN;
- vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie);
- ring = ethtool_get_flow_spec_ring(fs->ring_cookie);
- if ((fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT)) || vf)
+ if (fs->flow_type & (FLOW_MAC_EXT | FLOW_EXT))
+ return -EOPNOTSUPP;
+
+ if (fs->ring_cookie != RX_CLS_FLOW_DISC &&
+ ethtool_get_flow_spec_ring_vf(fs->ring_cookie))
return -EOPNOTSUPP;
if (flow_type == IP_USER_FLOW) {
@@ -1481,7 +1482,7 @@ static int bnxt_add_ntuple_cls_rule(struct bnxt *bp,
if (fs->ring_cookie == RX_CLS_FLOW_DISC)
new_fltr->base.flags |= BNXT_ACT_DROP;
else
- new_fltr->base.rxq = ring;
+ new_fltr->base.rxq = ethtool_get_flow_spec_ring(fs->ring_cookie);
__set_bit(BNXT_FLTR_VALID, &new_fltr->base.state);
rc = bnxt_insert_ntp_filter(bp, new_fltr, idx);
if (!rc) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 327/844] ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (325 preceding siblings ...)
2026-02-28 17:23 ` [PATCH 6.19 326/844] bnxt_en: Allow ntuple filters for drops Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 328/844] net: usb: sr9700: remove code to drive nonexistent multicast filter Sasha Levin
` (525 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Woodhouse, Babis Chalios, Takahiro Itazuri, Jakub Kicinski,
Sasha Levin
From: David Woodhouse <dwmw@amazon.co.uk>
[ Upstream commit ed4d23ed469ca14d47670c0384f6ae6c4ff060a5 ]
As we finalised the spec, we spotted that vmgenid actually says that the
_HID is supposed to be hypervisor-specific. Although in the 13 years
since the original vmgenid doc was published, nobody seems to have cared
about using _HID to distinguish between implementations on different
hypervisors, and we only ever use the _CID.
For consistency, match the _CID of "VMCLOCK" too.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Babis Chalios <bchalios@amazon.es>
Tested-by: Takahiro Itazuri <itazur@amazon.com>
Link: https://patch.msgid.link/20260130173704.12575-6-itazur@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ptp/ptp_vmclock.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c
index b3a83b03d9c14..cbbfc494680c7 100644
--- a/drivers/ptp/ptp_vmclock.c
+++ b/drivers/ptp/ptp_vmclock.c
@@ -591,6 +591,7 @@ static int vmclock_probe(struct platform_device *pdev)
static const struct acpi_device_id vmclock_acpi_ids[] = {
{ "AMZNC10C", 0 },
+ { "VMCLOCK", 0 },
{}
};
MODULE_DEVICE_TABLE(acpi, vmclock_acpi_ids);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 328/844] net: usb: sr9700: remove code to drive nonexistent multicast filter
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (326 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 327/844] ptp: ptp_vmclock: add 'VMCLOCK' to ACPI device match Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 329/844] vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 Sasha Levin
` (524 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ethan Nelson-Moore, Simon Horman, Jakub Kicinski, Sasha Levin
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit 9a9424c756feee9ee6e717405a9d6fa7bacdef08 ]
Several registers referenced in this driver's source code do not
actually exist (they are not writable and read as zero in my testing).
They exist in this driver because it originated as a copy of the dm9601
driver. Notably, these include the multicast filter registers - this
causes the driver to not support multicast packets correctly. Remove
the multicast filter code and register definitions. Instead, set the
chip to receive all multicast filter packets when any multicast
addresses are in the list.
Reviewed-by: Simon Horman <horms@kernel.org> (from v1)
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260203013924.28582-1-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/Kconfig | 1 -
drivers/net/usb/sr9700.c | 25 ++++---------------------
drivers/net/usb/sr9700.h | 7 +------
3 files changed, 5 insertions(+), 28 deletions(-)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 856e648d804e0..da0f6a138f4fc 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -319,7 +319,6 @@ config USB_NET_DM9601
config USB_NET_SR9700
tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
depends on USB_USBNET
- select CRC32
help
This option adds support for CoreChip-sz SR9700 based USB 1.1
10/100 Ethernet adapters.
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 820c4c5069792..a5d364fbc3639 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -18,7 +18,6 @@
#include <linux/ethtool.h>
#include <linux/mii.h>
#include <linux/usb.h>
-#include <linux/crc32.h>
#include <linux/usb/usbnet.h>
#include "sr9700.h"
@@ -265,31 +264,15 @@ static const struct ethtool_ops sr9700_ethtool_ops = {
static void sr9700_set_multicast(struct net_device *netdev)
{
struct usbnet *dev = netdev_priv(netdev);
- /* We use the 20 byte dev->data for our 8 byte filter buffer
- * to avoid allocating memory that is tricky to free later
- */
- u8 *hashes = (u8 *)&dev->data;
/* rx_ctl setting : enable, disable_long, disable_crc */
u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
- memset(hashes, 0x00, SR_MCAST_SIZE);
- /* broadcast address */
- hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
- if (netdev->flags & IFF_PROMISC) {
+ if (netdev->flags & IFF_PROMISC)
rx_ctl |= RCR_PRMSC;
- } else if (netdev->flags & IFF_ALLMULTI ||
- netdev_mc_count(netdev) > SR_MCAST_MAX) {
- rx_ctl |= RCR_RUNT;
- } else if (!netdev_mc_empty(netdev)) {
- struct netdev_hw_addr *ha;
-
- netdev_for_each_mc_addr(ha, netdev) {
- u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
- hashes[crc >> 3] |= 1 << (crc & 0x7);
- }
- }
+ else if (netdev->flags & IFF_ALLMULTI || !netdev_mc_empty(netdev))
+ /* The chip has no multicast filter */
+ rx_ctl |= RCR_ALL;
- sr_write_async(dev, SR_MAR, SR_MCAST_SIZE, hashes);
sr_write_reg_async(dev, SR_RCR, rx_ctl);
}
diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
index ea2b4de621c86..c479908f7d823 100644
--- a/drivers/net/usb/sr9700.h
+++ b/drivers/net/usb/sr9700.h
@@ -104,9 +104,7 @@
#define WCR_LINKEN (1 << 5)
/* Physical Address Reg */
#define SR_PAR 0x10 /* 0x10 ~ 0x15 6 bytes for PAR */
-/* Multicast Address Reg */
-#define SR_MAR 0x16 /* 0x16 ~ 0x1D 8 bytes for MAR */
-/* 0x1e unused */
+/* 0x16 --> 0x1E unused */
/* Phy Reset Reg */
#define SR_PRR 0x1F
#define PRR_PHY_RST (1 << 0)
@@ -161,9 +159,6 @@
/* parameters */
#define SR_SHARE_TIMEOUT 1000
#define SR_EEPROM_LEN 256
-#define SR_MCAST_SIZE 8
-#define SR_MCAST_ADDR_FLAG 0x80
-#define SR_MCAST_MAX 64
#define SR_TX_OVERHEAD 2 /* 2bytes header */
#define SR_RX_OVERHEAD 7 /* 3bytes header + 4crc tail */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 329/844] vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (327 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 328/844] net: usb: sr9700: remove code to drive nonexistent multicast filter Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 330/844] net/rds: Clear reconnect pending bit Sasha Levin
` (523 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Arnd Bergmann, Bobby Eshleman, Stefano Garzarella, Bryan Tan,
Jakub Kicinski, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit e25dbf561e03c0c5e36228e3b8b784392819ce85 ]
The gcc-16.0.1 snapshot produces a false-positive warning that turns
into a build failure with CONFIG_WERROR:
In file included from arch/x86/include/asm/string.h:6,
from net/vmw_vsock/vmci_transport.c:10:
In function 'vmci_transport_packet_init',
inlined from '__vmci_transport_send_control_pkt.constprop' at net/vmw_vsock/vmci_transport.c:198:2:
arch/x86/include/asm/string_32.h:150:25: error: argument 2 null where non-null expected because argument 3 is nonzero [-Werror=nonnull]
150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
| ^~~~~~
arch/x86/include/asm/string_32.h:150:25: note: in a call to built-in function '__builtin_memcpy'
net/vmw_vsock/vmci_transport.c:164:17: note: in expansion of macro 'memcpy'
164 | memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
| ^~~~~~
This seems relatively harmless, and it so far the only instance of this
warning I have found. The __vmci_transport_send_control_pkt function
is called either with wait=NULL or with one of the type values that
pass 'wait' into memcpy() here, but not from the same caller.
Replacing the memcpy with a struct assignment is otherwise the same
but avoids the warning.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Bryan Tan <bryan-bt.tan@broadcom.com>
Link: https://patch.msgid.link/20260203163406.2636463-1-arnd@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/vmci_transport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 7eccd6708d664..aca3132689cf1 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -161,7 +161,7 @@ vmci_transport_packet_init(struct vmci_transport_packet *pkt,
case VMCI_TRANSPORT_PACKET_TYPE_WAITING_READ:
case VMCI_TRANSPORT_PACKET_TYPE_WAITING_WRITE:
- memcpy(&pkt->u.wait, wait, sizeof(pkt->u.wait));
+ pkt->u.wait = *wait;
break;
case VMCI_TRANSPORT_PACKET_TYPE_REQUEST2:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 330/844] net/rds: Clear reconnect pending bit
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (328 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 329/844] vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 331/844] PCI: Mark ASM1164 SATA controller to avoid bus reset Sasha Levin
` (522 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Håkon Bugge, Allison Henderson, Jakub Kicinski, Sasha Levin
From: Håkon Bugge <haakon.bugge@oracle.com>
[ Upstream commit b89fc7c2523b2b0750d91840f4e52521270d70ed ]
When canceling the reconnect worker, care must be taken to reset the
reconnect-pending bit. If the reconnect worker has not yet been
scheduled before it is canceled, the reconnect-pending bit will stay
on forever.
Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://patch.msgid.link/20260203055723.1085751-6-achender@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/connection.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/rds/connection.c b/net/rds/connection.c
index ad8027e6f54ef..dbfea6fa11260 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -429,6 +429,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
* to the conn hash, so we never trigger a reconnect on this
* conn - the reconnect is always triggered by the active peer. */
cancel_delayed_work_sync(&cp->cp_conn_w);
+
+ clear_bit(RDS_RECONNECT_PENDING, &cp->cp_flags);
rcu_read_lock();
if (!hlist_unhashed(&conn->c_hash_node)) {
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 331/844] PCI: Mark ASM1164 SATA controller to avoid bus reset
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (329 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 330/844] net/rds: Clear reconnect pending bit Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 332/844] PCI/AER: Clear stale errors on reporting agents upon probe Sasha Levin
` (521 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alex Williamson, Patrick Bianchi, Bjorn Helgaas, Sasha Levin
From: Alex Williamson <alex.williamson@nvidia.com>
[ Upstream commit beb2f81792a8a619e5122b6b24a374861309c54b ]
User forums report issues when assigning ASM1164 SATA controllers to VMs,
especially in configurations with multiple controllers. Logs show the
device fails to retrain after bus reset. Reports suggest this is an issue
across multiple platforms. The device indicates support for PM reset,
therefore the device still has a viable function level reset mechanism.
The reporting user confirms the device is well behaved in this use case
with bus reset disabled.
Reported-by: Patrick Bianchi <patrick.w.bianchi@gmail.com>
Link: https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260109000211.398300-1-alex.williamson@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6df78efd7f6dc..538ad85cf7c30 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3791,6 +3791,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CAVIUM, 0xa100, quirk_no_bus_reset);
*/
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset);
+/*
+ * Reports from users making use of PCI device assignment with ASM1164
+ * controllers indicate an issue with bus reset where the device fails to
+ * retrain. The issue appears more common in configurations with multiple
+ * controllers. The device does indicate PM reset support (NoSoftRst-),
+ * therefore this still leaves a viable reset method.
+ * https://forum.proxmox.com/threads/problems-with-pcie-passthrough-with-two-identical-devices.149003/
+ */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ASMEDIA, 0x1164, quirk_no_bus_reset);
+
static void quirk_no_pm_reset(struct pci_dev *dev)
{
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 332/844] PCI/AER: Clear stale errors on reporting agents upon probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (330 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 331/844] PCI: Mark ASM1164 SATA controller to avoid bus reset Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 333/844] PCI: Fix pci_slot_lock () device locking Sasha Levin
` (520 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Lukas Wunner, Lucas Van, Bjorn Helgaas,
Kuppuswamy Sathyanarayanan, Sasha Levin
From: Lukas Wunner <lukas@wunner.de>
[ Upstream commit e242d09b58e869f86071b7889acace4cff215935 ]
Correctable and Uncorrectable Error Status Registers on reporting agents
are cleared upon PCI device enumeration in pci_aer_init() to flush past
events. They're cleared again when an error is handled by the AER driver.
If an agent reports a new error after pci_aer_init() and before the AER
driver has probed on the corresponding Root Port or Root Complex Event
Collector, that error is not handled by the AER driver: It clears the
Root Error Status Register on probe, but neglects to re-clear the
Correctable and Uncorrectable Error Status Registers on reporting agents.
The error will eventually be reported when another error occurs. Which
is irritating because to an end user it appears as if the earlier error
has just happened.
Amend the AER driver to clear stale errors on reporting agents upon probe.
Skip reporting agents which have not invoked pci_aer_init() yet to avoid
using an uninitialized pdev->aer_cap. They're recognizable by the error
bits in the Device Control register still being clear.
Reporting agents may execute pci_aer_init() after the AER driver has
probed, particularly when devices are hotplugged or removed/rescanned via
sysfs. For this reason, it continues to be necessary that pci_aer_init()
clears Correctable and Uncorrectable Error Status Registers.
Reported-by: Lucas Van <lucas.van@intel.com> # off-list
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Lucas Van <lucas.van@intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://patch.msgid.link/3011c2ed30c11f858e35e29939add754adea7478.1769332702.git.lukas@wunner.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pcie/aer.c | 26 +++++++++++++++++++++++++-
1 file changed, 25 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index 9472d86cef552..73cb6d587202c 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -1605,6 +1605,20 @@ static void aer_disable_irq(struct pci_dev *pdev)
pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_COMMAND, reg32);
}
+static int clear_status_iter(struct pci_dev *dev, void *data)
+{
+ u16 devctl;
+
+ /* Skip if pci_enable_pcie_error_reporting() hasn't been called yet */
+ pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &devctl);
+ if (!(devctl & PCI_EXP_AER_FLAGS))
+ return 0;
+
+ pci_aer_clear_status(dev);
+ pcie_clear_device_status(dev);
+ return 0;
+}
+
/**
* aer_enable_rootport - enable Root Port's interrupts when receiving messages
* @rpc: pointer to a Root Port data structure
@@ -1626,9 +1640,19 @@ static void aer_enable_rootport(struct aer_rpc *rpc)
pcie_capability_clear_word(pdev, PCI_EXP_RTCTL,
SYSTEM_ERROR_INTR_ON_MESG_MASK);
- /* Clear error status */
+ /* Clear error status of this Root Port or RCEC */
pci_read_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, ®32);
pci_write_config_dword(pdev, aer + PCI_ERR_ROOT_STATUS, reg32);
+
+ /* Clear error status of agents reporting to this Root Port or RCEC */
+ if (reg32 & AER_ERR_STATUS_MASK) {
+ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_RC_EC)
+ pcie_walk_rcec(pdev, clear_status_iter, NULL);
+ else if (pdev->subordinate)
+ pci_walk_bus(pdev->subordinate, clear_status_iter,
+ NULL);
+ }
+
pci_read_config_dword(pdev, aer + PCI_ERR_COR_STATUS, ®32);
pci_write_config_dword(pdev, aer + PCI_ERR_COR_STATUS, reg32);
pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS, ®32);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 333/844] PCI: Fix pci_slot_lock () device locking
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (331 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 332/844] PCI/AER: Clear stale errors on reporting agents upon probe Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 334/844] PCI: Enable ACS after configuring IOMMU for OF platforms Sasha Levin
` (519 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Keith Busch, Bjorn Helgaas, Dan Williams, Sasha Levin
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 1f5e57c622b4dc9b8e7d291d560138d92cfbe5bf ]
Like pci_bus_lock(), pci_slot_lock() needs to lock the bridge device to
prevent warnings like:
pcieport 0000:e2:05.0: unlocked secondary bus reset via: pciehp_reset_slot+0x55/0xa0
Take and release the lock for the bridge providing the slot for the
lock/trylock and unlock routines.
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260130165953.751063-3-kbusch@meta.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a05978f5cf2c7..41596bc72f1dc 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5293,10 +5293,9 @@ static int pci_bus_trylock(struct pci_bus *bus)
/* Do any devices on or below this slot prevent a bus reset? */
static bool pci_slot_resettable(struct pci_slot *slot)
{
- struct pci_dev *dev;
+ struct pci_dev *dev, *bridge = slot->bus->self;
- if (slot->bus->self &&
- (slot->bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
+ if (bridge && (bridge->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET))
return false;
list_for_each_entry(dev, &slot->bus->devices, bus_list) {
@@ -5313,7 +5312,10 @@ static bool pci_slot_resettable(struct pci_slot *slot)
/* Lock devices from the top of the tree down */
static void pci_slot_lock(struct pci_slot *slot)
{
- struct pci_dev *dev;
+ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ if (bridge)
+ pci_dev_lock(bridge);
list_for_each_entry(dev, &slot->bus->devices, bus_list) {
if (!dev->slot || dev->slot != slot)
@@ -5328,7 +5330,7 @@ static void pci_slot_lock(struct pci_slot *slot)
/* Unlock devices from the bottom of the tree up */
static void pci_slot_unlock(struct pci_slot *slot)
{
- struct pci_dev *dev;
+ struct pci_dev *dev, *bridge = slot->bus->self;
list_for_each_entry(dev, &slot->bus->devices, bus_list) {
if (!dev->slot || dev->slot != slot)
@@ -5338,12 +5340,18 @@ static void pci_slot_unlock(struct pci_slot *slot)
else
pci_dev_unlock(dev);
}
+
+ if (bridge)
+ pci_dev_unlock(bridge);
}
/* Return 1 on successful lock, 0 on contention */
static int pci_slot_trylock(struct pci_slot *slot)
{
- struct pci_dev *dev;
+ struct pci_dev *dev, *bridge = slot->bus->self;
+
+ if (bridge && !pci_dev_trylock(bridge))
+ return 0;
list_for_each_entry(dev, &slot->bus->devices, bus_list) {
if (!dev->slot || dev->slot != slot)
@@ -5368,6 +5376,9 @@ static int pci_slot_trylock(struct pci_slot *slot)
else
pci_dev_unlock(dev);
}
+
+ if (bridge)
+ pci_dev_unlock(bridge);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 334/844] PCI: Enable ACS after configuring IOMMU for OF platforms
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (332 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 333/844] PCI: Fix pci_slot_lock () device locking Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 335/844] PCI: Add ACS quirk for Qualcomm Hamoa & Glymur Sasha Levin
` (518 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Manivannan Sadhasivam, Bjorn Helgaas, Marek Szyprowski,
Naresh Kamboju, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit c41e2fb67e26b04d919257875fa954aa5f6e392e ]
Platform, ACPI, or IOMMU drivers call pci_request_acs(), which sets
'pci_acs_enable' to request that ACS be enabled for any devices enumerated
in the future.
OF platforms called pci_enable_acs() for the first device before
of_iommu_configure() called pci_request_acs(), so ACS was never enabled for
that device (typically a Root Port).
Call pci_enable_acs() later, from pci_dma_configure(), after
of_dma_configure() has had a chance to call pci_request_acs().
Here's the call path, showing the move of pci_enable_acs() from
pci_acs_init() to pci_dma_configure(), where it always happens after
pci_request_acs():
pci_device_add
pci_init_capabilities
pci_acs_init
- pci_enable_acs
- if (pci_acs_enable) <-- previous test
- ...
device_add
bus_notify(BUS_NOTIFY_ADD_DEVICE)
iommu_bus_notifier
iommu_probe_device
iommu_init_device
dev->bus->dma_configure
pci_dma_configure # pci_bus_type.dma_configure
of_dma_configure
of_iommu_configure
pci_request_acs
pci_acs_enable = 1 <-- set
+ pci_enable_acs
+ if (pci_acs_enable) <-- new test
+ ...
bus_probe_device
device_initial_probe
...
really_probe
dev->bus->dma_configure
pci_dma_configure # pci_bus_type.dma_configure
...
pci_enable_acs
Note that we will now call pci_enable_acs() twice for every device, first
from the iommu_probe_device() path and again from the really_probe() path.
Presumably that's not an issue since we also call dev->bus->dma_configure()
twice.
For the ACPI platforms, pci_request_acs() is called during ACPI
initialization time itself, independent of the IOMMU framework.
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Link: https://patch.msgid.link/20260102-pci_acs-v3-1-72280b94d288@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci-driver.c | 8 ++++++++
drivers/pci/pci.c | 10 +---------
drivers/pci/pci.h | 1 +
3 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 7c2d9d5962586..301a9418e38e0 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -1650,6 +1650,14 @@ static int pci_dma_configure(struct device *dev)
ret = acpi_dma_configure(dev, acpi_get_dma_attr(adev));
}
+ /*
+ * Attempt to enable ACS regardless of capability because some Root
+ * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
+ * the standard ACS capability but still support ACS via those
+ * quirks.
+ */
+ pci_enable_acs(to_pci_dev(dev));
+
pci_put_host_bridge_device(bridge);
/* @drv may not be valid when we're called from the IOMMU layer */
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 41596bc72f1dc..f21f6933c9b63 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1015,7 +1015,7 @@ static void pci_std_enable_acs(struct pci_dev *dev, struct pci_acs *caps)
* pci_enable_acs - enable ACS if hardware support it
* @dev: the PCI device
*/
-static void pci_enable_acs(struct pci_dev *dev)
+void pci_enable_acs(struct pci_dev *dev)
{
struct pci_acs caps;
bool enable_acs = false;
@@ -3651,14 +3651,6 @@ bool pci_acs_path_enabled(struct pci_dev *start,
void pci_acs_init(struct pci_dev *dev)
{
dev->acs_cap = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
-
- /*
- * Attempt to enable ACS regardless of capability because some Root
- * Ports (e.g. those quirked with *_intel_pch_acs_*) do not have
- * the standard ACS capability but still support ACS via those
- * quirks.
- */
- pci_enable_acs(dev);
}
/**
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 36f32b8af6ab3..ecc67fbb159c4 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -957,6 +957,7 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
}
void pci_acs_init(struct pci_dev *dev);
+void pci_enable_acs(struct pci_dev *dev);
#ifdef CONFIG_PCI_QUIRKS
int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags);
int pci_dev_specific_enable_acs(struct pci_dev *dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 335/844] PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (333 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 334/844] PCI: Enable ACS after configuring IOMMU for OF platforms Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 336/844] PCI: Mark Nvidia GB10 to avoid bus reset Sasha Levin
` (517 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Krishna Chaitanya Chundru, Bjorn Helgaas, Sasha Levin
From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
[ Upstream commit 44d2f70b1fd72c339c72983fcffa181beae3e113 ]
The Qualcomm Hamoa & Glymur Root Ports don't advertise an ACS capability,
but they do provide ACS-like features to disable peer transactions and
validate bus numbers in requests.
Add an ACS quirk for Hamoa & Glymur.
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260109-acs_quirk-v1-1-82adf95a89ae@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 538ad85cf7c30..4463a2da0441f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5117,6 +5117,10 @@ static const struct pci_dev_acs_enabled {
{ PCI_VENDOR_ID_QCOM, 0x0401, pci_quirk_qcom_rp_acs },
/* QCOM SA8775P root port */
{ PCI_VENDOR_ID_QCOM, 0x0115, pci_quirk_qcom_rp_acs },
+ /* QCOM Hamoa root port */
+ { PCI_VENDOR_ID_QCOM, 0x0111, pci_quirk_qcom_rp_acs },
+ /* QCOM Glymur root port */
+ { PCI_VENDOR_ID_QCOM, 0x0120, pci_quirk_qcom_rp_acs },
/* HXT SD4800 root ports. The ACS design is same as QCOM QDF2xxx */
{ PCI_VENDOR_ID_HXT, 0x0401, pci_quirk_qcom_rp_acs },
/* Intel PCH root ports */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 336/844] PCI: Mark Nvidia GB10 to avoid bus reset
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (334 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 335/844] PCI: Add ACS quirk for Qualcomm Hamoa & Glymur Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 337/844] PCI/bwctrl: Disable BW controller on Intel P45 using a quirk Sasha Levin
` (516 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johnny-CC Chang, Bjorn Helgaas, Manivannan Sadhasivam,
Sasha Levin
From: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
[ Upstream commit c81a2ce6b6a844d1a57d2a69833a9d0f00403f00 ]
After asserting Secondary Bus Reset to downstream devices via a GB10 Root
Port, the link may not retrain correctly, e.g., the link may retrain with a
lower lane count or config accesses to downstream devices may fail.
Prevent use of Secondary Bus Reset for devices below GB10.
Signed-off-by: Johnny-CC Chang <Johnny-CC.Chang@mediatek.com>
[bhelgaas: drop pci_ids.h update (only used once), update commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 4463a2da0441f..90676cb2fd10b 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3748,6 +3748,14 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
}
+/*
+ * After asserting Secondary Bus Reset to downstream devices via a GB10
+ * Root Port, the link may not retrain correctly.
+ * https://lore.kernel.org/r/20251113084441.2124737-1-Johnny-CC.Chang@mediatek.com
+ */
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22CE, quirk_no_bus_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, 0x22D0, quirk_no_bus_reset);
+
/*
* Some NVIDIA GPU devices do not work with bus reset, SBR needs to be
* prevented for those affected devices.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 337/844] PCI/bwctrl: Disable BW controller on Intel P45 using a quirk
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (335 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 336/844] PCI: Mark Nvidia GB10 to avoid bus reset Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 338/844] myri10ge: avoid uninitialized variable use Sasha Levin
` (515 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilpo Järvinen, Adam Stylinski, Bjorn Helgaas, Sasha Levin
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 46a9f70e93ef73860d1dbbec75ef840031f8f30a ]
The commit 665745f27487 ("PCI/bwctrl: Re-add BW notification portdrv as
PCIe BW controller") was found to lead to a boot hang on a Intel P45
system. Testing without setting Link Bandwidth Management Interrupt Enable
(LBMIE) and Link Autonomous Bandwidth Interrupt Enable (LABIE) (PCIe r7.0,
sec 7.5.3.7) in bwctrl allowed system to come up.
P45 is a very old chipset and supports only up to gen2 PCIe, so not having
bwctrl does not seem a huge deficiency.
Add no_bw_notif in struct pci_dev and quirk Intel P45 Root Port with it.
Reported-by: Adam Stylinski <kungfujesus06@gmail.com>
Link: https://lore.kernel.org/linux-pci/aUCt1tHhm_-XIVvi@eggsbenedict/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Adam Stylinski <kungfujesus06@gmail.com>
Link: https://patch.msgid.link/20260116131513.2359-1-ilpo.jarvinen@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pcie/bwctrl.c | 3 +++
drivers/pci/quirks.c | 10 ++++++++++
include/linux/pci.h | 1 +
3 files changed, 14 insertions(+)
diff --git a/drivers/pci/pcie/bwctrl.c b/drivers/pci/pcie/bwctrl.c
index 36f939f23d34e..4ae92c9f912a8 100644
--- a/drivers/pci/pcie/bwctrl.c
+++ b/drivers/pci/pcie/bwctrl.c
@@ -250,6 +250,9 @@ static int pcie_bwnotif_probe(struct pcie_device *srv)
struct pci_dev *port = srv->port;
int ret;
+ if (port->no_bw_notif)
+ return -ENODEV;
+
/* Can happen if we run out of bus numbers during enumeration. */
if (!port->subordinate)
return -ENODEV;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 90676cb2fd10b..fd86f72f54aef 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1359,6 +1359,16 @@ static void quirk_transparent_bridge(struct pci_dev *dev)
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82380FB, quirk_transparent_bridge);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TOSHIBA, 0x605, quirk_transparent_bridge);
+/*
+ * Enabling Link Bandwidth Management Interrupts (BW notifications) can cause
+ * boot hangs on P45.
+ */
+static void quirk_p45_bw_notifications(struct pci_dev *dev)
+{
+ dev->no_bw_notif = 1;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e21, quirk_p45_bw_notifications);
+
/*
* Common misconfiguration of the MediaGX/Geode PCI master that will reduce
* PCI bandwidth from 70MB/s to 25MB/s. See the GXM/GXLV/GX1 datasheets
diff --git a/include/linux/pci.h b/include/linux/pci.h
index b5cc0c2b99065..e958ff7443356 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -406,6 +406,7 @@ struct pci_dev {
user sysfs */
unsigned int clear_retrain_link:1; /* Need to clear Retrain Link
bit manually */
+ unsigned int no_bw_notif:1; /* BW notifications may cause issues */
unsigned int d3hot_delay; /* D3hot->D0 transition time in ms */
unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 338/844] myri10ge: avoid uninitialized variable use
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (336 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 337/844] PCI/bwctrl: Disable BW controller on Intel P45 using a quirk Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 339/844] nfc: nxp-nci: remove interrupt trigger type Sasha Levin
` (514 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Arnd Bergmann, Jakub Kicinski, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit fd24173439c033ffb3c2a2628fcbc9cb65e62bdb ]
While compile testing on less common architectures, I noticed that gcc-10 on
s390 finds a bug that all other configurations seem to miss:
drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_set_multicast_list':
drivers/net/ethernet/myricom/myri10ge/myri10ge.c:391:25: error: 'cmd.data0' is used uninitialized in this function [-Werror=uninitialized]
391 | buf->data0 = htonl(data->data0);
| ^~
drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:25: error: '*((void *)&cmd+4)' is used uninitialized in this function [-Werror=uninitialized]
392 | buf->data1 = htonl(data->data1);
| ^~
drivers/net/ethernet/myricom/myri10ge/myri10ge.c: In function 'myri10ge_allocate_rings':
drivers/net/ethernet/myricom/myri10ge/myri10ge.c:392:13: error: 'cmd.data1' is used uninitialized in this function [-Werror=uninitialized]
392 | buf->data1 = htonl(data->data1);
drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data1' was declared here
1939 | struct myri10ge_cmd cmd;
| ^~~
drivers/net/ethernet/myricom/myri10ge/myri10ge.c:393:13: error: 'cmd.data2' is used uninitialized in this function [-Werror=uninitialized]
393 | buf->data2 = htonl(data->data2);
drivers/net/ethernet/myricom/myri10ge/myri10ge.c:1939:22: note: 'cmd.data2' was declared here
1939 | struct myri10ge_cmd cmd;
It would be nice to understand how to make other compilers catch this as
well, but for the moment I'll just shut up the warning by fixing the
undefined behavior in this driver.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260205162935.2126442-1-arnd@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/myricom/myri10ge/myri10ge.c | 28 ++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index 7be30a8df2685..2f0cdbd4e2ac9 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -688,6 +688,9 @@ static int myri10ge_get_firmware_capabilities(struct myri10ge_priv *mgp)
/* probe for IPv6 TSO support */
mgp->features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_TSO;
+ cmd.data0 = 0,
+ cmd.data1 = 0,
+ cmd.data2 = 0,
status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_MAX_TSO6_HDR_SIZE,
&cmd, 0);
if (status == 0) {
@@ -806,6 +809,7 @@ static int myri10ge_update_mac_address(struct myri10ge_priv *mgp,
| (addr[2] << 8) | addr[3]);
cmd.data1 = ((addr[4] << 8) | (addr[5]));
+ cmd.data2 = 0;
status = myri10ge_send_cmd(mgp, MXGEFW_SET_MAC_ADDRESS, &cmd, 0);
return status;
@@ -817,6 +821,9 @@ static int myri10ge_change_pause(struct myri10ge_priv *mgp, int pause)
int status, ctl;
ctl = pause ? MXGEFW_ENABLE_FLOW_CONTROL : MXGEFW_DISABLE_FLOW_CONTROL;
+ cmd.data0 = 0,
+ cmd.data1 = 0,
+ cmd.data2 = 0,
status = myri10ge_send_cmd(mgp, ctl, &cmd, 0);
if (status) {
@@ -834,6 +841,9 @@ myri10ge_change_promisc(struct myri10ge_priv *mgp, int promisc, int atomic)
int status, ctl;
ctl = promisc ? MXGEFW_ENABLE_PROMISC : MXGEFW_DISABLE_PROMISC;
+ cmd.data0 = 0;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
status = myri10ge_send_cmd(mgp, ctl, &cmd, atomic);
if (status)
netdev_err(mgp->dev, "Failed to set promisc mode\n");
@@ -1946,6 +1956,8 @@ static int myri10ge_allocate_rings(struct myri10ge_slice_state *ss)
/* get ring sizes */
slice = ss - mgp->ss;
cmd.data0 = slice;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
tx_ring_size = cmd.data0;
cmd.data0 = slice;
@@ -2238,12 +2250,16 @@ static int myri10ge_get_txrx(struct myri10ge_priv *mgp, int slice)
status = 0;
if (slice == 0 || (mgp->dev->real_num_tx_queues > 1)) {
cmd.data0 = slice;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_OFFSET,
&cmd, 0);
ss->tx.lanai = (struct mcp_kreq_ether_send __iomem *)
(mgp->sram + cmd.data0);
}
cmd.data0 = slice;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SMALL_RX_OFFSET,
&cmd, 0);
ss->rx_small.lanai = (struct mcp_kreq_ether_recv __iomem *)
@@ -2312,6 +2328,7 @@ static int myri10ge_open(struct net_device *dev)
if (mgp->num_slices > 1) {
cmd.data0 = mgp->num_slices;
cmd.data1 = MXGEFW_SLICE_INTR_MODE_ONE_PER_SLICE;
+ cmd.data2 = 0;
if (mgp->dev->real_num_tx_queues > 1)
cmd.data1 |= MXGEFW_SLICE_ENABLE_MULTIPLE_TX_QUEUES;
status = myri10ge_send_cmd(mgp, MXGEFW_CMD_ENABLE_RSS_QUEUES,
@@ -2414,6 +2431,8 @@ static int myri10ge_open(struct net_device *dev)
/* now give firmware buffers sizes, and MTU */
cmd.data0 = dev->mtu + ETH_HLEN + VLAN_HLEN;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
status = myri10ge_send_cmd(mgp, MXGEFW_CMD_SET_MTU, &cmd, 0);
cmd.data0 = mgp->small_bytes;
status |=
@@ -2472,7 +2491,6 @@ static int myri10ge_open(struct net_device *dev)
static int myri10ge_close(struct net_device *dev)
{
struct myri10ge_priv *mgp = netdev_priv(dev);
- struct myri10ge_cmd cmd;
int status, old_down_cnt;
int i;
@@ -2491,8 +2509,13 @@ static int myri10ge_close(struct net_device *dev)
netif_tx_stop_all_queues(dev);
if (mgp->rebooted == 0) {
+ struct myri10ge_cmd cmd;
+
old_down_cnt = mgp->down_cnt;
mb();
+ cmd.data0 = 0;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
status =
myri10ge_send_cmd(mgp, MXGEFW_CMD_ETHERNET_DOWN, &cmd, 0);
if (status)
@@ -2956,6 +2979,9 @@ static void myri10ge_set_multicast_list(struct net_device *dev)
/* Disable multicast filtering */
+ cmd.data0 = 0;
+ cmd.data1 = 0;
+ cmd.data2 = 0;
err = myri10ge_send_cmd(mgp, MXGEFW_ENABLE_ALLMULTI, &cmd, 1);
if (err != 0) {
netdev_err(dev, "Failed MXGEFW_ENABLE_ALLMULTI, error status: %d\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 339/844] nfc: nxp-nci: remove interrupt trigger type
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (337 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 338/844] myri10ge: avoid uninitialized variable use Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 340/844] hisi_acc_vfio_pci: resolve duplicate migration states Sasha Levin
` (513 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Carl Lee, Jakub Kicinski, Sasha Levin
From: Carl Lee <carl.lee@amd.com>
[ Upstream commit 57be33f85e369ce9f69f61eaa34734e0d3bd47a7 ]
For NXP NCI devices (e.g. PN7150), the interrupt is level-triggered and
active high, not edge-triggered.
Using IRQF_TRIGGER_RISING in the driver can cause interrupts to fail
to trigger correctly.
Remove IRQF_TRIGGER_RISING and rely on the IRQ trigger type configured
via Device Tree.
Signed-off-by: Carl Lee <carl.lee@amd.com>
Link: https://patch.msgid.link/20260205-fc-nxp-nci-remove-interrupt-trigger-type-v2-1-79d2ed4a7e42@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nfc/nxp-nci/i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
index 049662ffdf972..6a5ce8ff91f0b 100644
--- a/drivers/nfc/nxp-nci/i2c.c
+++ b/drivers/nfc/nxp-nci/i2c.c
@@ -305,7 +305,7 @@ static int nxp_nci_i2c_probe(struct i2c_client *client)
r = request_threaded_irq(client->irq, NULL,
nxp_nci_i2c_irq_thread_fn,
- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ IRQF_ONESHOT,
NXP_NCI_I2C_DRIVER_NAME, phy);
if (r < 0)
nfc_err(&client->dev, "Unable to register IRQ handler\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 340/844] hisi_acc_vfio_pci: resolve duplicate migration states
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (338 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 339/844] nfc: nxp-nci: remove interrupt trigger type Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 341/844] RDMA/rtrs-clt: For conn rejection use actual err number Sasha Levin
` (512 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Longfang Liu, Alex Williamson, Sasha Levin
From: Longfang Liu <liulongfang@huawei.com>
[ Upstream commit 8c6ac1730a977234dff74cc1753b4a953f59be7b ]
In special scenarios involving duplicate migrations, after the
first migration is completed, if the original VF device is used
again and then migrated to another destination, the state indicating
data migration completion for the VF device is not reset.
This results in the second migration to the destination being skipped
without performing data migration.
After the modification, it ensures that a complete data migration
is performed after the subsequent migration.
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Link: https://lore.kernel.org/r/20260122020205.2884497-4-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
index d1e8053640a98..8a05fb91929fb 100644
--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
@@ -1570,6 +1570,7 @@ static int hisi_acc_vfio_pci_open_device(struct vfio_device *core_vdev)
}
hisi_acc_vdev->mig_state = VFIO_DEVICE_STATE_RUNNING;
hisi_acc_vdev->dev_opened = true;
+ hisi_acc_vdev->match_done = 0;
mutex_unlock(&hisi_acc_vdev->open_mutex);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 341/844] RDMA/rtrs-clt: For conn rejection use actual err number
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (339 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 340/844] hisi_acc_vfio_pci: resolve duplicate migration states Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 342/844] hisi_acc_vfio_pci: fix the queue parameter anomaly issue Sasha Levin
` (511 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Md Haris Iqbal, Grzegorz Prajsner, Jack Wang, Leon Romanovsky,
Sasha Levin
From: Md Haris Iqbal <haris.iqbal@ionos.com>
[ Upstream commit fc290630702b530c2969061e7ef0d869a5b6dc4f ]
When the connection establishment request is rejected from the server
side, then the actual error number sent back should be used.
Signed-off-by: Md Haris Iqbal <haris.iqbal@ionos.com>
Link: https://patch.msgid.link/20260107161517.56357-10-haris.iqbal@ionos.com
Reviewed-by: Grzegorz Prajsner <grzegorz.prajsner@ionos.com>
Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index 2b397a544cb93..8fa1d72bd20a4 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -1923,7 +1923,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
struct rtrs_path *s = con->c.path;
const struct rtrs_msg_conn_rsp *msg;
const char *rej_msg;
- int status, errno;
+ int status, errno = -ECONNRESET;
u8 data_len;
status = ev->status;
@@ -1945,7 +1945,7 @@ static int rtrs_rdma_conn_rejected(struct rtrs_clt_con *con,
status, rej_msg);
}
- return -ECONNRESET;
+ return errno;
}
void rtrs_clt_close_conns(struct rtrs_clt_path *clt_path, bool wait)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 342/844] hisi_acc_vfio_pci: fix the queue parameter anomaly issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (340 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 341/844] RDMA/rtrs-clt: For conn rejection use actual err number Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 343/844] um: Preserve errno within signal handler Sasha Levin
` (510 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Longfang Liu, Alex Williamson, Sasha Levin
From: Longfang Liu <liulongfang@huawei.com>
[ Upstream commit c3cbc276c2a33b04fc78a86cdb2ddce094cb3614 ]
When the number of QPs initialized by the device, as read via vft, is zero,
it indicates either an abnormal device configuration or an abnormal read
result.
Returning 0 directly in this case would allow the live migration operation
to complete successfully, leading to incorrect parameter configuration after
migration and preventing the service from recovering normal functionality.
Therefore, in such situations, an error should be returned to roll back the
live migration operation.
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Link: https://lore.kernel.org/r/20260122020205.2884497-5-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
index 8a05fb91929fb..2b8ac97cef2d2 100644
--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
@@ -426,7 +426,7 @@ static int vf_qm_check_match(struct hisi_acc_vf_core_device *hisi_acc_vdev,
ret = qm_get_vft(vf_qm, &vf_qm->qp_base);
if (ret <= 0) {
dev_err(dev, "failed to get vft qp nums\n");
- return ret;
+ return ret < 0 ? ret : -EINVAL;
}
if (ret != vf_data->qp_num) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 343/844] um: Preserve errno within signal handler
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (341 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 342/844] hisi_acc_vfio_pci: fix the queue parameter anomaly issue Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 344/844] ata: libata: avoid long timeouts on hot-unplugged SATA DAS Sasha Levin
` (509 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tiwei Bie, Johannes Berg, Sasha Levin
From: Tiwei Bie <tiwei.btw@antgroup.com>
[ Upstream commit f68b2d5a907b53eed99cf2efcaaae116df73c298 ]
We rely on errno to determine whether a syscall has failed, so we
need to ensure that accessing errno is async-signal-safe. Currently,
we preserve the errno in sig_handler_common(), but it doesn't cover
every possible case. Let's do it in hard_handler() instead, which
is the signal handler we actually register.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20260106001228.1531146-2-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/os-Linux/signal.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index 327fb3c52fc79..de372b936a804 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -36,7 +36,6 @@ void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *, void *mc) =
static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
{
struct uml_pt_regs r;
- int save_errno = errno;
r.is_user = 0;
if (sig == SIGSEGV) {
@@ -50,8 +49,6 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
unblock_signals_trace();
(*sig_info[sig])(sig, si, &r, mc);
-
- errno = save_errno;
}
/*
@@ -207,8 +204,11 @@ static void hard_handler(int sig, siginfo_t *si, void *p)
{
ucontext_t *uc = p;
mcontext_t *mc = &uc->uc_mcontext;
+ int save_errno = errno;
(*handlers[sig])(sig, (struct siginfo *)si, mc);
+
+ errno = save_errno;
}
void set_handler(int sig)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 344/844] ata: libata: avoid long timeouts on hot-unplugged SATA DAS
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (342 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 343/844] um: Preserve errno within signal handler Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 345/844] hisi_acc_vfio_pci: update status after RAS error Sasha Levin
` (508 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Henry Tseng, Damien Le Moal, Sasha Levin
From: Henry Tseng <henrytseng@qnap.com>
[ Upstream commit 151cabd140322205e27dae5c4bbf261ede0056e3 ]
When a SATA DAS enclosure is connected behind a Thunderbolt PCIe
switch, hot-unplugging the whole enclosure causes pciehp to tear down
the PCI hierarchy before the SCSI layer issues SYNCHRONIZE CACHE and
START STOP UNIT for the disks.
libata still queues these commands and the AHCI driver tries to access
the HBA registers even though the PCI channel is already offline. This
results in a series of timeouts and error recovery attempts, e.g.:
[ 824.778346] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
[ 891.612720] ata8.00: qc timeout after 5000 msecs (cmd 0xec)
[ 902.876501] ata8.00: qc timeout after 10000 msecs (cmd 0xec)
[ 934.107998] ata8.00: qc timeout after 30000 msecs (cmd 0xec)
[ 936.206431] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
...
[ 1006.298356] ata1.00: qc timeout after 5000 msecs (cmd 0xec)
[ 1017.561926] ata1.00: qc timeout after 10000 msecs (cmd 0xec)
[ 1048.791790] ata1.00: qc timeout after 30000 msecs (cmd 0xec)
[ 1050.890035] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
With this patch applied, the same hot-unplug looks like:
[ 59.965496] pcieport 0000:00:07.0: pciehp: Slot(14): Link Down
[ 60.002502] sd 7:0:0:0: [sda] Synchronize Cache(10) failed:
Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
...
[ 60.103050] sd 0:0:0:0: [sdb] Synchronize Cache(10) failed:
Result: hostbyte=DID_BAD_TARGET driverbyte=DRIVER_OK
In this test setup with two disks, the hot-unplug sequence shrinks from
about 226 seconds (~3.8 minutes) between the Link Down event and the
last SYNCHRONIZE CACHE failure to under a second. Without this patch the
total delay grows roughly with the number of disks, because each disk
gets its own SYNCHRONIZE CACHE and qc timeout series.
If the underlying PCI device is already gone, these commands cannot
succeed anyway. Avoid issuing them by introducing
ata_adapter_is_online(), which checks pci_channel_offline() for
PCI-based hosts. It is used from ata_scsi_find_dev() to return NULL,
causing the SCSI layer to fail new commands with DID_BAD_TARGET
immediately, and from ata_qc_issue() to bail out before touching the
HBA registers.
Since such failures would otherwise trigger libata error handling,
ata_adapter_is_online() is also consulted from ata_scsi_port_error_handler().
When the adapter is offline, libata skips ap->ops->error_handler(ap) and
completes error handling using the existing path, rather than running
a full EH sequence against a dead adapter.
With this change, SYNCHRONIZE CACHE and START STOP UNIT commands
issued during hot-unplug fail quickly once the PCI channel is offline,
without qc timeout spam or long libata EH delays.
Suggested-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Henry Tseng <henrytseng@qnap.com>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 24 ++++++++++++++++++++++++
drivers/ata/libata-eh.c | 3 ++-
drivers/ata/libata-scsi.c | 3 +++
drivers/ata/libata.h | 1 +
4 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 50dfce8d8bba0..db74417db75d9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2359,6 +2359,24 @@ static bool ata_dev_check_adapter(struct ata_device *dev,
return false;
}
+bool ata_adapter_is_online(struct ata_port *ap)
+{
+ struct device *dev;
+
+ if (!ap || !ap->host)
+ return false;
+
+ dev = ap->host->dev;
+ if (!dev)
+ return false;
+
+ if (dev_is_pci(dev) &&
+ pci_channel_offline(to_pci_dev(dev)))
+ return false;
+
+ return true;
+}
+
static int ata_dev_config_ncq(struct ata_device *dev,
char *desc, size_t desc_sz)
{
@@ -5135,6 +5153,12 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
qc->flags |= ATA_QCFLAG_ACTIVE;
ap->qc_active |= 1ULL << qc->tag;
+ /* Make sure the device is still accessible. */
+ if (!ata_adapter_is_online(ap)) {
+ qc->err_mask |= AC_ERR_HOST_BUS;
+ goto sys_err;
+ }
+
/*
* We guarantee to LLDs that they will have at least one
* non-zero sg if the command is a data command.
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 258e657f3527c..b373cceb95d23 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -752,7 +752,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
spin_unlock_irqrestore(ap->lock, flags);
/* invoke EH, skip if unloading or suspended */
- if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)))
+ if (!(ap->pflags & (ATA_PFLAG_UNLOADING | ATA_PFLAG_SUSPENDED)) &&
+ ata_adapter_is_online(ap))
ap->ops->error_handler(ap);
else {
/* if unloading, commence suicide */
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 5f9abeb7b2a88..6b954efa9adb1 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3094,6 +3094,9 @@ ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
{
struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
+ if (!ata_adapter_is_online(ap))
+ return NULL;
+
if (unlikely(!dev || !ata_dev_enabled(dev)))
return NULL;
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index 60a675df61dc7..9b4e578ad07ec 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -94,6 +94,7 @@ extern int atapi_check_dma(struct ata_queued_cmd *qc);
extern void swap_buf_le16(u16 *buf, unsigned int buf_words);
extern bool ata_phys_link_online(struct ata_link *link);
extern bool ata_phys_link_offline(struct ata_link *link);
+bool ata_adapter_is_online(struct ata_port *ap);
extern void ata_dev_init(struct ata_device *dev);
extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp);
extern int sata_link_init_spd(struct ata_link *link);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 345/844] hisi_acc_vfio_pci: update status after RAS error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (343 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 344/844] ata: libata: avoid long timeouts on hot-unplugged SATA DAS Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 346/844] scsi: buslogic: Reduce stack usage Sasha Levin
` (507 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Longfang Liu, Alex Williamson, Sasha Levin
From: Longfang Liu <liulongfang@huawei.com>
[ Upstream commit 8be14dd48dfee0df91e511acceb4beeb2461a083 ]
After a RAS error occurs on the accelerator device, the accelerator
device will be reset. The live migration state will be abnormal
after reset, and the original state needs to be restored during
the reset process.
Therefore, reset processing needs to be performed in a live
migration scenario.
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Link: https://lore.kernel.org/r/20260122020205.2884497-3-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
index 2b8ac97cef2d2..e61df3fe0db99 100644
--- a/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
+++ b/drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
@@ -1215,8 +1215,7 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
if (hisi_acc_vdev->set_reset_flag)
clear_bit(QM_RESETTING, &qm->misc_ctl);
- if (hisi_acc_vdev->core_device.vdev.migration_flags !=
- VFIO_MIGRATION_STOP_COPY)
+ if (!hisi_acc_vdev->core_device.vdev.mig_ops)
return;
mutex_lock(&hisi_acc_vdev->state_mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 346/844] scsi: buslogic: Reduce stack usage
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (344 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 345/844] hisi_acc_vfio_pci: update status after RAS error Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 347/844] vhost: fix caching attributes of MMIO regions by setting them explicitly Sasha Levin
` (506 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Arnd Bergmann, Martin K. Petersen, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit e17f0d4cc006265dd92129db4bf9da3a2e4a4f66 ]
Some randconfig builds run into excessive stack usage with gcc-14 or
higher, which use __attribute__((cold)) where earlier versions did not do
that:
drivers/scsi/BusLogic.c: In function 'blogic_init':
drivers/scsi/BusLogic.c:2398:1: error: the frame size of 1680 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
The problem is that a lot of code gets inlined into blogic_init() here. Two
functions stick out, but they are a bit different:
- blogic_init_probeinfo_list() actually uses a few hundred bytes of kernel
stack, which is a problem in combination with other functions that also
do. Marking this one as noinline means that the stack slots get get
reused between function calls
- blogic_reportconfig() has a few large variables, but whenever it is not
inlined into its caller, the compiler is actually smart enough to reuse
stack slots for these automatically, so marking it as noinline saves
most of the stack space by itself.
The combination of both of these should avoid the problem entirely.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260203163321.2598593-1-arnd@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/BusLogic.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index a86d780d1ba40..026c3e617cb1c 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -920,7 +920,8 @@ static int __init blogic_init_fp_probeinfo(struct blogic_adapter *adapter)
a particular probe order.
*/
-static void __init blogic_init_probeinfo_list(struct blogic_adapter *adapter)
+static noinline_for_stack void __init
+blogic_init_probeinfo_list(struct blogic_adapter *adapter)
{
/*
If a PCI BIOS is present, interrogate it for MultiMaster and
@@ -1690,7 +1691,8 @@ static bool __init blogic_rdconfig(struct blogic_adapter *adapter)
blogic_reportconfig reports the configuration of Host Adapter.
*/
-static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
+static noinline_for_stack bool __init
+blogic_reportconfig(struct blogic_adapter *adapter)
{
unsigned short alltgt_mask = (1 << adapter->maxdev) - 1;
unsigned short sync_ok, fast_ok;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 347/844] vhost: fix caching attributes of MMIO regions by setting them explicitly
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (345 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 346/844] scsi: buslogic: Reduce stack usage Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 348/844] scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event Sasha Levin
` (505 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kommula Shiva Shankar, Jason Wang, Jason Gunthorpe,
Michael S. Tsirkin, Sasha Levin
From: Kommula Shiva Shankar <kshankar@marvell.com>
[ Upstream commit 5145b277309f3818e2db507f525d19ac3b910922 ]
Explicitly set non-cached caching attributes for MMIO regions.
Default write-back mode can cause CPU to cache device memory,
causing invalid reads and unpredictable behavior.
Invalid read and write issues were observed on ARM64 when mapping the
notification area to userspace via mmap.
Signed-off-by: Kommula Shiva Shankar <kshankar@marvell.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260102065703.656255-1-kshankar@marvell.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vdpa.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index 05a481e4c385a..b0179e8567aba 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1527,6 +1527,7 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
if (vma->vm_end - vma->vm_start != notify.size)
return -ENOTSUPP;
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP);
vma->vm_ops = &vhost_vdpa_vm_ops;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 348/844] scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (346 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 347/844] vhost: fix caching attributes of MMIO regions by setting them explicitly Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 349/844] riscv: vector: init vector context with proper vlenb Sasha Levin
` (504 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Keita Morisaki, Peter Wang, Martin K. Petersen, Sasha Levin
From: Keita Morisaki <keita.morisaki@tier4.jp>
[ Upstream commit 9672ed3de7d772ceddd713c769c05e832fc69bae ]
The ufs_mtk_clk_scale() trace event currently stores the address of the
name string directly via __field(const char *, name). This pointer may
become invalid after the module is unloaded, causing page faults when the
trace buffer is subsequently accessed.
This can occur because the MediaTek UFS driver can be configured as a
loadable module (tristate in Kconfig), meaning the name string passed to
the trace event may reside in module memory that becomes invalid after
module unload.
Fix this by using __string() and __assign_str() to copy the string contents
into the ring buffer instead of storing the pointer. This ensures the trace
data remains valid regardless of module state.
This change increases the memory usage for each ftrace entry by a few bytes
(clock names are typically 7-15 characters like "ufs_sel" or
"ufs_sel_max_src") compared to storing an 8-byte pointer.
Note that this change does not affect anything unless all of the following
conditions are met:
- CONFIG_SCSI_UFS_MEDIATEK is enabled
- ftrace tracing is enabled
- The ufs_mtk_clk_scale event is enabled in ftrace
Signed-off-by: Keita Morisaki <keita.morisaki@tier4.jp>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20260202024526.122515-1-keita.morisaki@tier4.jp
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-mediatek-trace.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/ufs/host/ufs-mediatek-trace.h b/drivers/ufs/host/ufs-mediatek-trace.h
index b5f2ec3140748..0df8ac843379a 100644
--- a/drivers/ufs/host/ufs-mediatek-trace.h
+++ b/drivers/ufs/host/ufs-mediatek-trace.h
@@ -33,19 +33,19 @@ TRACE_EVENT(ufs_mtk_clk_scale,
TP_ARGS(name, scale_up, clk_rate),
TP_STRUCT__entry(
- __field(const char*, name)
+ __string(name, name)
__field(bool, scale_up)
__field(unsigned long, clk_rate)
),
TP_fast_assign(
- __entry->name = name;
+ __assign_str(name);
__entry->scale_up = scale_up;
__entry->clk_rate = clk_rate;
),
TP_printk("ufs: clk (%s) scaled %s @ %lu",
- __entry->name,
+ __get_str(name),
__entry->scale_up ? "up" : "down",
__entry->clk_rate)
);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 349/844] riscv: vector: init vector context with proper vlenb
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (347 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 348/844] scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 350/844] tracing: Fix false sharing in hwlat get_sample() Sasha Levin
` (503 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sergey Matyukevich, Andy Chiu, Paul Walmsley, Sasha Levin
From: Sergey Matyukevich <geomatsi@gmail.com>
[ Upstream commit ef3ff40346db8476a9ef7269fc9d1837e7243c40 ]
The vstate in thread_struct is zeroed when the vector context is
initialized. That includes read-only register vlenb, which holds
the vector register length in bytes. Zeroed state persists until
mstatus.VS becomes 'dirty' and a context switch saves the actual
hardware values.
This can expose the zero vlenb value to the user-space in early
debug scenarios, e.g. when ptrace attaches to a traced process
early, before any vector instruction except the first one was
executed.
Fix this by specifying proper vlenb on vector context init.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Reviewed-by: Andy Chiu <andybnac@gmail.com>
Tested-by: Andy Chiu <andybnac@gmail.com>
Link: https://patch.msgid.link/20251214163537.1054292-3-geomatsi@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/vector.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/riscv/kernel/vector.c b/arch/riscv/kernel/vector.c
index 3ed071dab9d83..b112166d51e9f 100644
--- a/arch/riscv/kernel/vector.c
+++ b/arch/riscv/kernel/vector.c
@@ -111,8 +111,8 @@ bool insn_is_vector(u32 insn_buf)
return false;
}
-static int riscv_v_thread_zalloc(struct kmem_cache *cache,
- struct __riscv_v_ext_state *ctx)
+static int riscv_v_thread_ctx_alloc(struct kmem_cache *cache,
+ struct __riscv_v_ext_state *ctx)
{
void *datap;
@@ -122,13 +122,15 @@ static int riscv_v_thread_zalloc(struct kmem_cache *cache,
ctx->datap = datap;
memset(ctx, 0, offsetof(struct __riscv_v_ext_state, datap));
+ ctx->vlenb = riscv_v_vsize / 32;
+
return 0;
}
void riscv_v_thread_alloc(struct task_struct *tsk)
{
#ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE
- riscv_v_thread_zalloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
+ riscv_v_thread_ctx_alloc(riscv_v_kernel_cachep, &tsk->thread.kernel_vstate);
#endif
}
@@ -214,12 +216,14 @@ bool riscv_v_first_use_handler(struct pt_regs *regs)
* context where VS has been off. So, try to allocate the user's V
* context and resume execution.
*/
- if (riscv_v_thread_zalloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
+ if (riscv_v_thread_ctx_alloc(riscv_v_user_cachep, ¤t->thread.vstate)) {
force_sig(SIGBUS);
return true;
}
+
riscv_v_vstate_on(regs);
riscv_v_vstate_set_restore(current, regs);
+
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 350/844] tracing: Fix false sharing in hwlat get_sample()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (348 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 349/844] riscv: vector: init vector context with proper vlenb Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 351/844] remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized Sasha Levin
` (502 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Colin Lord, Masami Hiramatsu, Mathieu Desnoyers,
Steven Rostedt (Google), Sasha Levin
From: Colin Lord <clord@mykolab.com>
[ Upstream commit f743435f988cb0cf1f521035aee857851b25e06d ]
The get_sample() function in the hwlat tracer assumes the caller holds
hwlat_data.lock, but this is not actually happening. The result is
unprotected data access to hwlat_data, and in per-cpu mode can result in
false sharing which may show up as false positive latency events.
The specific case of false sharing observed was primarily between
hwlat_data.sample_width and hwlat_data.count. These are separated by
just 8B and are therefore likely to share a cache line. When one thread
modifies count, the cache line is in a modified state so when other
threads read sample_width in the main latency detection loop, they fetch
the modified cache line. On some systems, the fetch itself may be slow
enough to count as a latency event, which could set up a self
reinforcing cycle of latency events as each event increments count which
then causes more latency events, continuing the cycle.
The other result of the unprotected data access is that hwlat_data.count
can end up with duplicate or missed values, which was observed on some
systems in testing.
Convert hwlat_data.count to atomic64_t so it can be safely modified
without locking, and prevent false sharing by pulling sample_width into
a local variable.
One system this was tested on was a dual socket server with 32 CPUs on
each numa node. With settings of 1us threshold, 1000us width, and
2000us window, this change reduced the number of latency events from
500 per second down to approximately 1 event per minute. Some machines
tested did not exhibit measurable latency from the false sharing.
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/20260210074810.6328-1-clord@mykolab.com
Signed-off-by: Colin Lord <clord@mykolab.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_hwlat.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
index 2f7b94e98317c..3fe274b84f1c2 100644
--- a/kernel/trace/trace_hwlat.c
+++ b/kernel/trace/trace_hwlat.c
@@ -102,9 +102,9 @@ struct hwlat_sample {
/* keep the global state somewhere. */
static struct hwlat_data {
- struct mutex lock; /* protect changes */
+ struct mutex lock; /* protect changes */
- u64 count; /* total since reset */
+ atomic64_t count; /* total since reset */
u64 sample_window; /* total sampling window (on+off) */
u64 sample_width; /* active sampling portion of window */
@@ -193,8 +193,7 @@ void trace_hwlat_callback(bool enter)
* get_sample - sample the CPU TSC and look for likely hardware latencies
*
* Used to repeatedly capture the CPU TSC (or similar), looking for potential
- * hardware-induced latency. Called with interrupts disabled and with
- * hwlat_data.lock held.
+ * hardware-induced latency. Called with interrupts disabled.
*/
static int get_sample(void)
{
@@ -204,6 +203,7 @@ static int get_sample(void)
time_type start, t1, t2, last_t2;
s64 diff, outer_diff, total, last_total = 0;
u64 sample = 0;
+ u64 sample_width = READ_ONCE(hwlat_data.sample_width);
u64 thresh = tracing_thresh;
u64 outer_sample = 0;
int ret = -1;
@@ -267,7 +267,7 @@ static int get_sample(void)
if (diff > sample)
sample = diff; /* only want highest value */
- } while (total <= hwlat_data.sample_width);
+ } while (total <= sample_width);
barrier(); /* finish the above in the view for NMIs */
trace_hwlat_callback_enabled = false;
@@ -285,8 +285,7 @@ static int get_sample(void)
if (kdata->nmi_total_ts)
do_div(kdata->nmi_total_ts, NSEC_PER_USEC);
- hwlat_data.count++;
- s.seqnum = hwlat_data.count;
+ s.seqnum = atomic64_inc_return(&hwlat_data.count);
s.duration = sample;
s.outer_duration = outer_sample;
s.nmi_total_ts = kdata->nmi_total_ts;
@@ -832,7 +831,7 @@ static int hwlat_tracer_init(struct trace_array *tr)
hwlat_trace = tr;
- hwlat_data.count = 0;
+ atomic64_set(&hwlat_data.count, 0);
tr->max_latency = 0;
save_tracing_thresh = tracing_thresh;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 351/844] remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (349 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 350/844] tracing: Fix false sharing in hwlat get_sample() Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 352/844] mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() Sasha Levin
` (501 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Iuliana Prodan, Mathieu Poirier, Sasha Levin
From: Iuliana Prodan <iuliana.prodan@nxp.com>
[ Upstream commit d62e0e92e589c53c4320ed5914af5fe103f5ce7e ]
Firmwares that do not use mailbox communication (e.g., the hello_world
sample) leave priv->tx_ch as NULL. The current suspend logic
unconditionally sends RP_MBOX_SUSPEND_SYSTEM, which is invalid without
an initialized TX channel.
Detect the no_mailboxes case early and skip sending the suspend
message. Instead, proceed directly to the runtime PM suspend path,
which is the correct behavior for firmwares that cannot respond to
mailbox requests.
Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Link: https://lore.kernel.org/r/20251204122825.756106-1-iuliana.prodan@oss.nxp.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/imx_dsp_rproc.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/remoteproc/imx_dsp_rproc.c b/drivers/remoteproc/imx_dsp_rproc.c
index 5a9a8fa031f6d..9e4f50e0e822d 100644
--- a/drivers/remoteproc/imx_dsp_rproc.c
+++ b/drivers/remoteproc/imx_dsp_rproc.c
@@ -1260,6 +1260,15 @@ static int imx_dsp_suspend(struct device *dev)
if (rproc->state != RPROC_RUNNING)
goto out;
+ /*
+ * No channel available for sending messages;
+ * indicates no mailboxes present, so trigger PM runtime suspend
+ */
+ if (!priv->tx_ch) {
+ dev_dbg(dev, "No initialized mbox tx channel, suspend directly.\n");
+ goto out;
+ }
+
reinit_completion(&priv->pm_comp);
/* Tell DSP that suspend is happening */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 352/844] mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (350 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 351/844] remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 353/844] mailbox: pcc: Remove spurious IRQF_ONESHOT usage Sasha Levin
` (500 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Valentina Fernandez, Conor Dooley, Jassi Brar, Sasha Levin
From: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
[ Upstream commit f7c330a8c83c9b0332fd524097eaf3e69148164d ]
The cluster_cfg array is dynamically allocated to hold per-CPU
configuration structures, with its size based on the number of online
CPUs. Previously, this array was indexed using hartid, which may be
non-contiguous or exceed the bounds of the array, leading to
out-of-bounds access.
Switch to using cpuid as the index, as it is guaranteed to be within
the valid range provided by for_each_online_cpu().
Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-mchp-ipc-sbi.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
index a6e52009a4245..d444491a584e8 100644
--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
@@ -180,20 +180,20 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data)
/* Find out the hart that originated the irq */
for_each_online_cpu(i) {
hartid = cpuid_to_hartid_map(i);
- if (irq == ipc->cluster_cfg[hartid].irq)
+ if (irq == ipc->cluster_cfg[i].irq)
break;
}
status_msg.cluster = hartid;
- memcpy(ipc->cluster_cfg[hartid].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
+ memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
- ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[hartid].buf_base_addr);
+ ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr);
if (ret < 0) {
dev_err_ratelimited(ipc->dev, "could not get IHC irq status ret=%d\n", ret);
return IRQ_HANDLED;
}
- memcpy(&status_msg, ipc->cluster_cfg[hartid].buf_base, sizeof(struct mchp_ipc_status));
+ memcpy(&status_msg, ipc->cluster_cfg[i].buf_base, sizeof(struct mchp_ipc_status));
/*
* Iterate over each bit set in the IHC interrupt status register (IRQ_STATUS) to identify
@@ -385,21 +385,21 @@ static int mchp_ipc_get_cluster_aggr_irq(struct mchp_ipc_sbi_mbox *ipc)
if (ret <= 0)
continue;
- ipc->cluster_cfg[hartid].irq = ret;
- ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[hartid].irq,
+ ipc->cluster_cfg[cpuid].irq = ret;
+ ret = devm_request_irq(ipc->dev, ipc->cluster_cfg[cpuid].irq,
mchp_ipc_cluster_aggr_isr, IRQF_SHARED,
"miv-ihc-irq", ipc);
if (ret)
return ret;
- ipc->cluster_cfg[hartid].buf_base = devm_kmalloc(ipc->dev,
- sizeof(struct mchp_ipc_status),
- GFP_KERNEL);
+ ipc->cluster_cfg[cpuid].buf_base = devm_kmalloc(ipc->dev,
+ sizeof(struct mchp_ipc_status),
+ GFP_KERNEL);
- if (!ipc->cluster_cfg[hartid].buf_base)
+ if (!ipc->cluster_cfg[cpuid].buf_base)
return -ENOMEM;
- ipc->cluster_cfg[hartid].buf_base_addr = __pa(ipc->cluster_cfg[hartid].buf_base);
+ ipc->cluster_cfg[cpuid].buf_base_addr = __pa(ipc->cluster_cfg[cpuid].buf_base);
irq_found = true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 353/844] mailbox: pcc: Remove spurious IRQF_ONESHOT usage
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (351 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 352/844] mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 354/844] mailbox: imx: Skip the suspend flag for i.MX7ULP Sasha Levin
` (499 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mark Brown, Aishwarya TCV, Sudeep Holla, Jassi Brar, Sasha Levin
From: Mark Brown <broonie@kernel.org>
[ Upstream commit 673327028cd61db68a1e0c708be2e302c082adf9 ]
The PCC code currently specifies IRQF_ONESHOT if the interrupt could
potentially be shared but doesn't actually use request_threaded_irq() and
the interrupt handler does not use IRQ_WAKE_THREAD so IRQF_ONESHOT is
never relevant. Since commit aef30c8d569c ("genirq: Warn about using
IRQF_ONESHOT without a threaded handler") specifying it has resulted in a
WARN_ON(), fix this by removing IRQF_ONESHOT.
Reported-by: Aishwarya TCV <Aishwarya.TCV@arm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/pcc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 0e0a66359d4c3..713022aed2e2f 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -459,7 +459,7 @@ static int pcc_startup(struct mbox_chan *chan)
if (pchan->plat_irq > 0) {
irqflags = pcc_chan_plat_irq_can_be_shared(pchan) ?
- IRQF_SHARED | IRQF_ONESHOT : 0;
+ IRQF_SHARED : 0;
rc = devm_request_irq(chan->mbox->dev, pchan->plat_irq, pcc_mbox_irq,
irqflags, MBOX_IRQ_NAME, chan);
if (unlikely(rc)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 354/844] mailbox: imx: Skip the suspend flag for i.MX7ULP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (352 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 353/844] mailbox: pcc: Remove spurious IRQF_ONESHOT usage Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 355/844] mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warnings Sasha Levin
` (498 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jacky Bai, Peng Fan, Jassi Brar, Sasha Levin
From: Jacky Bai <ping.bai@nxp.com>
[ Upstream commit 673b570825ace0dcb2ac0c676080559d505c6f40 ]
In current imx-mailbox driver, the MU IRQ is configured with
'IRQF_NO_SUSPEND' flag set. So during linux suspend/resume flow,
the MU IRQ is always enabled. With commit 892cb524ae8a ("mailbox: imx:
fix wakeup failure from freeze mode"), if the MU IRQ is triggered after
the priv->suspended flag has been set, the system suspend will be
aborted.
On i.MX7ULP platform, certain drivers that depend on rpmsg may need
to send rpmsg request and receive an acknowledgment from the remote
core during the late_suspend stage. Early suspend abort is not
expected, and the i.MX7ULP already has additional hardware and
software to make sure the system can be wakeup from freeze mode
correctly when MU IRQ is trigger.
Skip the 'suspend' flag handling logic on i.MX7ULP to avoid the
early abort when doing suspend.
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/imx-mailbox.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c
index 6778afc64a048..003f9236c35e0 100644
--- a/drivers/mailbox/imx-mailbox.c
+++ b/drivers/mailbox/imx-mailbox.c
@@ -122,6 +122,7 @@ struct imx_mu_dcfg {
u32 xRR; /* Receive Register0 */
u32 xSR[IMX_MU_xSR_MAX]; /* Status Registers */
u32 xCR[IMX_MU_xCR_MAX]; /* Control Registers */
+ bool skip_suspend_flag;
};
#define IMX_MU_xSR_GIPn(type, x) (type & IMX_MU_V2 ? BIT(x) : BIT(28 + (3 - (x))))
@@ -988,6 +989,7 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx7ulp = {
.xRR = 0x40,
.xSR = {0x60, 0x60, 0x60, 0x60},
.xCR = {0x64, 0x64, 0x64, 0x64, 0x64},
+ .skip_suspend_flag = true,
};
static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
@@ -1071,7 +1073,8 @@ static int __maybe_unused imx_mu_suspend_noirq(struct device *dev)
priv->xcr[i] = imx_mu_read(priv, priv->dcfg->xCR[i]);
}
- priv->suspend = true;
+ if (!priv->dcfg->skip_suspend_flag)
+ priv->suspend = true;
return 0;
}
@@ -1094,7 +1097,8 @@ static int __maybe_unused imx_mu_resume_noirq(struct device *dev)
imx_mu_write(priv, priv->xcr[i], priv->dcfg->xCR[i]);
}
- priv->suspend = false;
+ if (!priv->dcfg->skip_suspend_flag)
+ priv->suspend = false;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 355/844] mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warnings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (353 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 354/844] mailbox: imx: Skip the suspend flag for i.MX7ULP Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 356/844] mailbox: sprd: mask interrupts that are not handled Sasha Levin
` (497 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Valentina Fernandez, kernel test robot, Dan Carpenter, Jassi Brar,
Sasha Levin
From: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
[ Upstream commit bc4d17e495cd3b02bcb2e10f575763a5ff31f80b ]
Fix uninitialized symbol 'hartid' warning in mchp_ipc_cluster_aggr_isr()
by introducing a 'found' flag to track whether the IRQ matches any
online hart. If no match is found, return IRQ_NONE.
Also fix other smatch warnings by removing dead code in
mchp_ipc_startup() and by returning -ENODEV in dev_err_probe() if the
Microchip SBI extension is not found.
Fixes below smatch warnings:
drivers/mailbox/mailbox-mchp-ipc-sbi.c:187 mchp_ipc_cluster_aggr_isr() error: uninitialized symbol 'hartid'.
drivers/mailbox/mailbox-mchp-ipc-sbi.c:324 mchp_ipc_startup() warn: ignoring unreachable code.
drivers/mailbox/mailbox-mchp-ipc-sbi.c:422 mchp_ipc_probe() warn: passing zero to 'dev_err_probe'
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202512171533.CDLdScMY-lkp@intel.com/
Signed-off-by: Valentina Fernandez <valentina.fernandezalanis@microchip.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-mchp-ipc-sbi.c | 21 +++++++++------------
1 file changed, 9 insertions(+), 12 deletions(-)
diff --git a/drivers/mailbox/mailbox-mchp-ipc-sbi.c b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
index d444491a584e8..b87bf2fb4b9b9 100644
--- a/drivers/mailbox/mailbox-mchp-ipc-sbi.c
+++ b/drivers/mailbox/mailbox-mchp-ipc-sbi.c
@@ -174,17 +174,21 @@ static irqreturn_t mchp_ipc_cluster_aggr_isr(int irq, void *data)
struct mchp_ipc_msg ipc_msg;
struct mchp_ipc_status status_msg;
int ret;
- unsigned long hartid;
u32 i, chan_index, chan_id;
+ bool found = false;
/* Find out the hart that originated the irq */
for_each_online_cpu(i) {
- hartid = cpuid_to_hartid_map(i);
- if (irq == ipc->cluster_cfg[i].irq)
+ if (irq == ipc->cluster_cfg[i].irq) {
+ found = true;
break;
+ }
}
- status_msg.cluster = hartid;
+ if (unlikely(!found))
+ return IRQ_NONE;
+
+ status_msg.cluster = cpuid_to_hartid_map(i);
memcpy(ipc->cluster_cfg[i].buf_base, &status_msg, sizeof(struct mchp_ipc_status));
ret = mchp_ipc_sbi_send(SBI_EXT_IPC_STATUS, ipc->cluster_cfg[i].buf_base_addr);
@@ -321,13 +325,6 @@ static int mchp_ipc_startup(struct mbox_chan *chan)
goto fail_free_buf_msg_rx;
}
- if (ret) {
- dev_err(ipc->dev, "failed to register interrupt(s)\n");
- goto fail_free_buf_msg_rx;
- }
-
- return ret;
-
fail_free_buf_msg_rx:
kfree(chan_info->msg_buf_rx);
fail_free_buf_msg_tx:
@@ -419,7 +416,7 @@ static int mchp_ipc_probe(struct platform_device *pdev)
ret = sbi_probe_extension(SBI_EXT_MICROCHIP_TECHNOLOGY);
if (ret <= 0)
- return dev_err_probe(dev, ret, "Microchip SBI extension not detected\n");
+ return dev_err_probe(dev, -ENODEV, "Microchip SBI extension not detected\n");
ipc = devm_kzalloc(dev, sizeof(*ipc), GFP_KERNEL);
if (!ipc)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 356/844] mailbox: sprd: mask interrupts that are not handled
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (354 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 355/844] mailbox: mchp-ipc-sbi: fix uninitialized symbol and other smatch warnings Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 357/844] remoteproc: mediatek: Break lock dependency to `prepare_lock` Sasha Levin
` (496 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Otto Pflüger, Jassi Brar, Sasha Levin
From: Otto Pflüger <otto.pflueger@abscue.de>
[ Upstream commit 75df94d05fc03fd9d861eaf79ce10fbb7a548bd8 ]
To reduce the amount of spurious interrupts, disable the interrupts that
are not handled in this driver.
Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/sprd-mailbox.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
index ee8539dfcef54..c1a5fe6cc8771 100644
--- a/drivers/mailbox/sprd-mailbox.c
+++ b/drivers/mailbox/sprd-mailbox.c
@@ -243,21 +243,19 @@ static int sprd_mbox_startup(struct mbox_chan *chan)
/* Select outbox FIFO mode and reset the outbox FIFO status */
writel(0x0, priv->outbox_base + SPRD_MBOX_FIFO_RST);
- /* Enable inbox FIFO overflow and delivery interrupt */
- val = readl(priv->inbox_base + SPRD_MBOX_IRQ_MSK);
- val &= ~(SPRD_INBOX_FIFO_OVERFLOW_IRQ | SPRD_INBOX_FIFO_DELIVER_IRQ);
+ /* Enable inbox FIFO delivery interrupt */
+ val = SPRD_INBOX_FIFO_IRQ_MASK;
+ val &= ~SPRD_INBOX_FIFO_DELIVER_IRQ;
writel(val, priv->inbox_base + SPRD_MBOX_IRQ_MSK);
/* Enable outbox FIFO not empty interrupt */
- val = readl(priv->outbox_base + SPRD_MBOX_IRQ_MSK);
+ val = SPRD_OUTBOX_FIFO_IRQ_MASK;
val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
writel(val, priv->outbox_base + SPRD_MBOX_IRQ_MSK);
/* Enable supplementary outbox as the fundamental one */
if (priv->supp_base) {
writel(0x0, priv->supp_base + SPRD_MBOX_FIFO_RST);
- val = readl(priv->supp_base + SPRD_MBOX_IRQ_MSK);
- val &= ~SPRD_OUTBOX_FIFO_NOT_EMPTY_IRQ;
writel(val, priv->supp_base + SPRD_MBOX_IRQ_MSK);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 357/844] remoteproc: mediatek: Break lock dependency to `prepare_lock`
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (355 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 356/844] mailbox: sprd: mask interrupts that are not handled Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 358/844] mailbox: sprd: clear delivery flag before handling TX done Sasha Levin
` (495 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tzung-Bi Shih, Chen-Yu Tsai, Mathieu Poirier, Sasha Levin
From: Tzung-Bi Shih <tzungbi@kernel.org>
[ Upstream commit d935187cfb27fc4168f78f3959aef4eafaae76bb ]
A potential circular locking dependency (ABBA deadlock) exists between
`ec_dev->lock` and the clock framework's `prepare_lock`.
The first order (A -> B) occurs when scp_ipi_send() is called while
`ec_dev->lock` is held (e.g., within cros_ec_cmd_xfer()):
1. cros_ec_cmd_xfer() acquires `ec_dev->lock` and calls scp_ipi_send().
2. scp_ipi_send() calls clk_prepare_enable(), which acquires
`prepare_lock`.
See #0 in the following example calling trace.
(Lock Order: `ec_dev->lock` -> `prepare_lock`)
The reverse order (B -> A) is more complex and has been observed
(learned) by lockdep. It involves the clock prepare operation
triggering power domain changes, which then propagates through sysfs
and power supply uevents, eventually calling back into the ChromeOS EC
driver and attempting to acquire `ec_dev->lock`:
1. Something calls clk_prepare(), which acquires `prepare_lock`. It
then triggers genpd operations like genpd_runtime_resume(), which
takes `&genpd->mlock`.
2. Power domain changes can trigger regulator changes; regulator
changes can then trigger device link changes; device link changes
can then trigger sysfs changes. Eventually, power_supply_uevent()
is called.
3. This leads to calls like cros_usbpd_charger_get_prop(), which calls
cros_ec_cmd_xfer_status(), which then attempts to acquire
`ec_dev->lock`.
See #1 ~ #6 in the following example calling trace.
(Lock Order: `prepare_lock` -> `&genpd->mlock` -> ... -> `&ec_dev->lock`)
Move the clk_prepare()/clk_unprepare() operations for `scp->clk` to the
remoteproc prepare()/unprepare() callbacks. This ensures `prepare_lock`
is only acquired in prepare()/unprepare() callbacks. Since
`ec_dev->lock` is not involved in the callbacks, the dependency loop is
broken.
This means the clock is always "prepared" when the SCP is running. The
prolonged "prepared time" for the clock should be acceptable as SCP is
designed to be a very power efficient processor. The power consumption
impact can be negligible.
A simplified calling trace reported by lockdep:
> -> #6 (&ec_dev->lock)
> cros_ec_cmd_xfer
> cros_ec_cmd_xfer_status
> cros_usbpd_charger_get_port_status
> cros_usbpd_charger_get_prop
> power_supply_get_property
> power_supply_show_property
> power_supply_uevent
> dev_uevent
> uevent_show
> dev_attr_show
> sysfs_kf_seq_show
> kernfs_seq_show
> -> #5 (kn->active#2)
> kernfs_drain
> __kernfs_remove
> kernfs_remove_by_name_ns
> sysfs_remove_file_ns
> device_del
> __device_link_del
> device_links_driver_bound
> -> #4 (device_links_lock)
> device_link_remove
> _regulator_put
> regulator_put
> -> #3 (regulator_list_mutex)
> regulator_lock_dependent
> regulator_disable
> scpsys_power_off
> _genpd_power_off
> genpd_power_off
> -> #2 (&genpd->mlock/1)
> genpd_add_subdomain
> pm_genpd_add_subdomain
> scpsys_add_subdomain
> scpsys_probe
> -> #1 (&genpd->mlock)
> genpd_runtime_resume
> __rpm_callback
> rpm_callback
> rpm_resume
> __pm_runtime_resume
> clk_core_prepare
> clk_prepare
> -> #0 (prepare_lock)
> clk_prepare
> scp_ipi_send
> scp_send_ipi
> mtk_rpmsg_send
> rpmsg_send
> cros_ec_pkt_xfer_rpmsg
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Tested-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20260112110755.2435899-1-tzungbi@kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/mtk_scp.c | 39 +++++++++++++++++++++++---------
drivers/remoteproc/mtk_scp_ipi.c | 4 ++--
2 files changed, 30 insertions(+), 13 deletions(-)
diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
index db8fd045468d9..98d00bd5200cc 100644
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c
@@ -283,7 +283,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
struct mtk_scp *scp = priv;
int ret;
- ret = clk_prepare_enable(scp->clk);
+ ret = clk_enable(scp->clk);
if (ret) {
dev_err(scp->dev, "failed to enable clocks\n");
return IRQ_NONE;
@@ -291,7 +291,7 @@ static irqreturn_t scp_irq_handler(int irq, void *priv)
scp->data->scp_irq_handler(scp);
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
return IRQ_HANDLED;
}
@@ -665,7 +665,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
struct device *dev = scp->dev;
int ret;
- ret = clk_prepare_enable(scp->clk);
+ ret = clk_enable(scp->clk);
if (ret) {
dev_err(dev, "failed to enable clocks\n");
return ret;
@@ -680,7 +680,7 @@ static int scp_load(struct rproc *rproc, const struct firmware *fw)
ret = scp_elf_load_segments(rproc, fw);
leave:
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
return ret;
}
@@ -691,14 +691,14 @@ static int scp_parse_fw(struct rproc *rproc, const struct firmware *fw)
struct device *dev = scp->dev;
int ret;
- ret = clk_prepare_enable(scp->clk);
+ ret = clk_enable(scp->clk);
if (ret) {
dev_err(dev, "failed to enable clocks\n");
return ret;
}
ret = scp_ipi_init(scp, fw);
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
return ret;
}
@@ -709,7 +709,7 @@ static int scp_start(struct rproc *rproc)
struct scp_run *run = &scp->run;
int ret;
- ret = clk_prepare_enable(scp->clk);
+ ret = clk_enable(scp->clk);
if (ret) {
dev_err(dev, "failed to enable clocks\n");
return ret;
@@ -734,14 +734,14 @@ static int scp_start(struct rproc *rproc)
goto stop;
}
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
dev_info(dev, "SCP is ready. FW version %s\n", run->fw_ver);
return 0;
stop:
scp->data->scp_reset_assert(scp);
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
return ret;
}
@@ -909,7 +909,7 @@ static int scp_stop(struct rproc *rproc)
struct mtk_scp *scp = rproc->priv;
int ret;
- ret = clk_prepare_enable(scp->clk);
+ ret = clk_enable(scp->clk);
if (ret) {
dev_err(scp->dev, "failed to enable clocks\n");
return ret;
@@ -917,12 +917,29 @@ static int scp_stop(struct rproc *rproc)
scp->data->scp_reset_assert(scp);
scp->data->scp_stop(scp);
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
return 0;
}
+static int scp_prepare(struct rproc *rproc)
+{
+ struct mtk_scp *scp = rproc->priv;
+
+ return clk_prepare(scp->clk);
+}
+
+static int scp_unprepare(struct rproc *rproc)
+{
+ struct mtk_scp *scp = rproc->priv;
+
+ clk_unprepare(scp->clk);
+ return 0;
+}
+
static const struct rproc_ops scp_ops = {
+ .prepare = scp_prepare,
+ .unprepare = scp_unprepare,
.start = scp_start,
.stop = scp_stop,
.load = scp_load,
diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c
index c068227e251e7..7a37e273b3af8 100644
--- a/drivers/remoteproc/mtk_scp_ipi.c
+++ b/drivers/remoteproc/mtk_scp_ipi.c
@@ -171,7 +171,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
WARN_ON(len > scp_sizes->ipi_share_buffer_size) || WARN_ON(!buf))
return -EINVAL;
- ret = clk_prepare_enable(scp->clk);
+ ret = clk_enable(scp->clk);
if (ret) {
dev_err(scp->dev, "failed to enable clock\n");
return ret;
@@ -211,7 +211,7 @@ int scp_ipi_send(struct mtk_scp *scp, u32 id, void *buf, unsigned int len,
unlock_mutex:
mutex_unlock(&scp->send_lock);
- clk_disable_unprepare(scp->clk);
+ clk_disable(scp->clk);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 358/844] mailbox: sprd: clear delivery flag before handling TX done
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (356 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 357/844] remoteproc: mediatek: Break lock dependency to `prepare_lock` Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 359/844] clk: amlogic: remove potentially unsafe flags from S4 video clocks Sasha Levin
` (494 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Otto Pflüger, Jassi Brar, Sasha Levin
From: Otto Pflüger <otto.pflueger@abscue.de>
[ Upstream commit c77661d60d4223bf2ff10d409beb0c3b2021183b ]
If there are any pending messages in the mailbox queue, they are sent
as soon as a TX done event arrives from the driver. This may trigger a
new delivery interrupt while the previous one is still being handled.
If the delivery status is cleared after this, the interrupt is lost.
To prevent this from happening, clear the delivery status immediately
after checking it and before any new messages are sent.
Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/sprd-mailbox.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
index c1a5fe6cc8771..46d0c34177ab9 100644
--- a/drivers/mailbox/sprd-mailbox.c
+++ b/drivers/mailbox/sprd-mailbox.c
@@ -166,6 +166,11 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
return IRQ_NONE;
}
+ /* Clear FIFO delivery and overflow status first */
+ writel(fifo_sts &
+ (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
+ priv->inbox_base + SPRD_MBOX_FIFO_RST);
+
while (send_sts) {
id = __ffs(send_sts);
send_sts &= (send_sts - 1);
@@ -181,11 +186,6 @@ static irqreturn_t sprd_mbox_inbox_isr(int irq, void *data)
mbox_chan_txdone(chan, 0);
}
- /* Clear FIFO delivery and overflow status */
- writel(fifo_sts &
- (SPRD_INBOX_FIFO_DELIVER_MASK | SPRD_INBOX_FIFO_OVERLOW_MASK),
- priv->inbox_base + SPRD_MBOX_FIFO_RST);
-
/* Clear irq status */
writel(SPRD_MBOX_IRQ_CLR, priv->inbox_base + SPRD_MBOX_IRQ_STS);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 359/844] clk: amlogic: remove potentially unsafe flags from S4 video clocks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (357 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 358/844] mailbox: sprd: clear delivery flag before handling TX done Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 360/844] clk: renesas: rzg2l: Deassert reset on assert timeout Sasha Levin
` (493 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Chuan Liu, Jerome Brunet, Sasha Levin
From: Chuan Liu <chuan.liu@amlogic.com>
[ Upstream commit 4aca7e92023cac5018b4053bae324450f884c937 ]
The video clocks enci, encp, vdac and hdmitx share the same clock
source. Adding CLK_SET_RATE_PARENT to the mux may unintentionally change
the shared parent clock, which could affect other video clocks.
Signed-off-by: Chuan Liu <chuan.liu@amlogic.com>
Link: https://lore.kernel.org/r/20250919-add_video_clk-v6-3-fe223161fb3f@amlogic.com
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/meson/s4-peripherals.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/clk/meson/s4-peripherals.c b/drivers/clk/meson/s4-peripherals.c
index 6d69b132d1e1f..bab4f5700de47 100644
--- a/drivers/clk/meson/s4-peripherals.c
+++ b/drivers/clk/meson/s4-peripherals.c
@@ -1106,7 +1106,6 @@ static struct clk_regmap s4_cts_enci_sel = {
.ops = &clk_regmap_mux_ops,
.parent_hws = s4_cts_parents,
.num_parents = ARRAY_SIZE(s4_cts_parents),
- .flags = CLK_SET_RATE_PARENT,
},
};
@@ -1122,7 +1121,6 @@ static struct clk_regmap s4_cts_encp_sel = {
.ops = &clk_regmap_mux_ops,
.parent_hws = s4_cts_parents,
.num_parents = ARRAY_SIZE(s4_cts_parents),
- .flags = CLK_SET_RATE_PARENT,
},
};
@@ -1138,7 +1136,6 @@ static struct clk_regmap s4_cts_vdac_sel = {
.ops = &clk_regmap_mux_ops,
.parent_hws = s4_cts_parents,
.num_parents = ARRAY_SIZE(s4_cts_parents),
- .flags = CLK_SET_RATE_PARENT,
},
};
@@ -1169,7 +1166,6 @@ static struct clk_regmap s4_hdmi_tx_sel = {
.ops = &clk_regmap_mux_ops,
.parent_hws = s4_hdmi_tx_parents,
.num_parents = ARRAY_SIZE(s4_hdmi_tx_parents),
- .flags = CLK_SET_RATE_PARENT,
},
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 360/844] clk: renesas: rzg2l: Deassert reset on assert timeout
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (358 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 359/844] clk: amlogic: remove potentially unsafe flags from S4 video clocks Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 361/844] clk: microchip: core: correct return value on *_get_parent() Sasha Levin
` (492 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Biju Das, Geert Uytterhoeven, Sasha Levin
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit 0b0201f259e1158a875c5fd01adf318ae5d32352 ]
If the assert() fails due to timeout error, set the reset register bit
back to deasserted state. This change is needed especially for handling
assert error in suspend() callback that expect the device to be in
operational state in case of failure.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260108123433.104464-2-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/rzg2l-cpg.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
index 64d1ef6e4c943..c20ea1212b360 100644
--- a/drivers/clk/renesas/rzg2l-cpg.c
+++ b/drivers/clk/renesas/rzg2l-cpg.c
@@ -1647,6 +1647,7 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
u32 mask = BIT(info->resets[id].bit);
s8 monbit = info->resets[id].monbit;
u32 value = mask << 16;
+ u32 mon;
int ret;
dev_dbg(rcdev->dev, "%s id:%ld offset:0x%x\n",
@@ -1667,10 +1668,10 @@ static int __rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
return 0;
}
- ret = readl_poll_timeout_atomic(priv->base + reg, value,
- assert == !!(value & mask), 10, 200);
- if (ret && !assert) {
- value = mask << 16;
+ ret = readl_poll_timeout_atomic(priv->base + reg, mon,
+ assert == !!(mon & mask), 10, 200);
+ if (ret) {
+ value ^= mask;
writel(value, priv->base + CLK_RST_R(info->resets[id].off));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 361/844] clk: microchip: core: correct return value on *_get_parent()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (359 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 360/844] clk: renesas: rzg2l: Deassert reset on assert timeout Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 362/844] HID: i2c-hid: Add FocalTech FT8112 Sasha Levin
` (491 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Brian Masney, kernel test robot, Dan Carpenter, Claudiu Beznea,
Sasha Levin
From: Brian Masney <bmasney@redhat.com>
[ Upstream commit 5df96d141cccb37f0c3112a22fc1112ea48e9246 ]
roclk_get_parent() and sclk_get_parent() has the possibility of
returning -EINVAL, however the framework expects this call to always
succeed since the return value is unsigned.
If there is no parent map defined, then the current value programmed in
the hardware is used. Let's use that same value in the case where
-EINVAL is currently returned.
This index is only used by clk_core_get_parent_by_index(), and it
validates that it doesn't overflow the number of available parents.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202512050233.R9hAWsJN-lkp@intel.com/
Signed-off-by: Brian Masney <bmasney@redhat.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Link: https://lore.kernel.org/r/20251205-clk-microchip-fixes-v3-2-a02190705e47@redhat.com
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/microchip/clk-core.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
diff --git a/drivers/clk/microchip/clk-core.c b/drivers/clk/microchip/clk-core.c
index a0163441dfe5c..82f62731fc0ed 100644
--- a/drivers/clk/microchip/clk-core.c
+++ b/drivers/clk/microchip/clk-core.c
@@ -283,14 +283,13 @@ static u8 roclk_get_parent(struct clk_hw *hw)
v = (readl(refo->ctrl_reg) >> REFO_SEL_SHIFT) & REFO_SEL_MASK;
- if (!refo->parent_map)
- return v;
-
- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
- if (refo->parent_map[i] == v)
- return i;
+ if (refo->parent_map) {
+ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+ if (refo->parent_map[i] == v)
+ return i;
+ }
- return -EINVAL;
+ return v;
}
static unsigned long roclk_calc_rate(unsigned long parent_rate,
@@ -817,13 +816,13 @@ static u8 sclk_get_parent(struct clk_hw *hw)
v = (readl(sclk->mux_reg) >> OSC_CUR_SHIFT) & OSC_CUR_MASK;
- if (!sclk->parent_map)
- return v;
+ if (sclk->parent_map) {
+ for (i = 0; i < clk_hw_get_num_parents(hw); i++)
+ if (sclk->parent_map[i] == v)
+ return i;
+ }
- for (i = 0; i < clk_hw_get_num_parents(hw); i++)
- if (sclk->parent_map[i] == v)
- return i;
- return -EINVAL;
+ return v;
}
static int sclk_set_parent(struct clk_hw *hw, u8 index)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 362/844] HID: i2c-hid: Add FocalTech FT8112
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (360 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 361/844] clk: microchip: core: correct return value on *_get_parent() Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 363/844] m68k: nommu: fix memmove() with differently aligned src and dest for 68000 Sasha Levin
` (490 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Daniel Peng, Jiri Kosina, Douglas Anderson, Dmitry Torokhov,
Sasha Levin
From: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
[ Upstream commit 3d9586f1f90c9101b1abf5b0e9d70ca45f5f16db ]
Information for touchscreen model HKO/RB116AS01-2 as below:
- HID :FTSC1000
- slave address:0X38
- Interface:HID over I2C
- Touch control lC:FT8112
- I2C ID: PNP0C50
Signed-off-by: Daniel Peng <Daniel_Peng@pegatron.corp-partner.google.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251117094041.300083-2-Daniel_Peng@pegatron.corp-partner.google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/i2c-hid/i2c-hid-of-elan.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
index 0215f217f6d86..b81fcc6ff49ee 100644
--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
@@ -168,6 +168,13 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
.power_after_backlight = true,
};
+static const struct elan_i2c_hid_chip_data focaltech_ft8112_chip_data = {
+ .post_power_delay_ms = 10,
+ .post_gpio_reset_on_delay_ms = 150,
+ .hid_descriptor_address = 0x0001,
+ .main_supply_name = "vcc33",
+};
+
static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = {
.post_power_delay_ms = 1,
.post_gpio_reset_on_delay_ms = 200,
@@ -191,6 +198,7 @@ static const struct elan_i2c_hid_chip_data ilitek_ili2901_chip_data = {
static const struct of_device_id elan_i2c_hid_of_match[] = {
{ .compatible = "elan,ekth6915", .data = &elan_ekth6915_chip_data },
{ .compatible = "elan,ekth6a12nay", .data = &elan_ekth6a12nay_chip_data },
+ { .compatible = "focaltech,ft8112", .data = &focaltech_ft8112_chip_data },
{ .compatible = "ilitek,ili9882t", .data = &ilitek_ili9882t_chip_data },
{ .compatible = "ilitek,ili2901", .data = &ilitek_ili2901_chip_data },
{ }
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 363/844] m68k: nommu: fix memmove() with differently aligned src and dest for 68000
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (361 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 362/844] HID: i2c-hid: Add FocalTech FT8112 Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 364/844] 9p/xen: protect xen_9pfs_front_free against concurrent calls Sasha Levin
` (489 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Daniel Palmer, Greg Ungerer, Sasha Levin
From: Daniel Palmer <daniel@thingy.jp>
[ Upstream commit 590fe2f46c8698bb758f9002cb247ca10ce95569 ]
68000 has different alignment needs to 68020+.
memcpy() checks if the destination is aligned and does a smaller copy
to fix the alignment and then critically for 68000 it checks if the
source is still unaligned and if it is reverts to smaller copies.
memmove() does not currently do the second part and malfunctions if
one of the pointers is aligned and the other isn't.
This is apparently getting triggered by printk. If I put breakpoints
into the new checks added by this commit the first hit looks like this:
memmove (n=205, src=0x2f3971 <printk_shared_pbufs+205>, dest=0x2f3980 <printk_shared_pbufs+220>) at arch/m68k/lib/memmove.c:82
Signed-off-by: Daniel Palmer <daniel@thingy.jp>
Signed-off-by: Greg Ungerer <gerg@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/lib/memmove.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/arch/m68k/lib/memmove.c b/arch/m68k/lib/memmove.c
index 6519f7f349f66..e33f00b02e4c0 100644
--- a/arch/m68k/lib/memmove.c
+++ b/arch/m68k/lib/memmove.c
@@ -24,6 +24,15 @@ void *memmove(void *dest, const void *src, size_t n)
src = csrc;
n--;
}
+#if defined(CONFIG_M68000)
+ if ((long)src & 1) {
+ char *cdest = dest;
+ const char *csrc = src;
+ for (; n; n--)
+ *cdest++ = *csrc++;
+ return xdest;
+ }
+#endif
if (n > 2 && (long)dest & 2) {
short *sdest = dest;
const short *ssrc = src;
@@ -66,6 +75,15 @@ void *memmove(void *dest, const void *src, size_t n)
src = csrc;
n--;
}
+#if defined(CONFIG_M68000)
+ if ((long)src & 1) {
+ char *cdest = dest;
+ const char *csrc = src;
+ for (; n; n--)
+ *--cdest = *--csrc;
+ return xdest;
+ }
+#endif
if (n > 2 && (long)dest & 2) {
short *sdest = dest;
const short *ssrc = src;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 364/844] 9p/xen: protect xen_9pfs_front_free against concurrent calls
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (362 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 363/844] m68k: nommu: fix memmove() with differently aligned src and dest for 68000 Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 365/844] dmaengine: stm32-dma3: use module_platform_driver Sasha Levin
` (488 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Stefano Stabellini, Dominique Martinet, Sasha Levin
From: Stefano Stabellini <stefano.stabellini@amd.com>
[ Upstream commit ce8ded2e61f47747e31eeefb44dc24a2160a7e32 ]
The xenwatch thread can race with other back-end change notifications
and call xen_9pfs_front_free() twice, hitting the observed general
protection fault due to a double-free. Guard the teardown path so only
one caller can release the front-end state at a time, preventing the
crash.
This is a fix for the following double-free:
[ 27.052347] Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[ 27.052357] CPU: 0 UID: 0 PID: 32 Comm: xenwatch Not tainted 6.18.0-02087-g51ab33fc0a8b-dirty #60 PREEMPT(none)
[ 27.052363] RIP: e030:xen_9pfs_front_free+0x1d/0x150
[ 27.052368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 41 55 41 54 55 48 89 fd 48 c7 c7 48 d0 92 85 53 e8 cb cb 05 00 48 8b 45 08 48 8b 55 00 <48> 3b 28 0f 85 f9 28 35 fe 48 3b 6a 08 0f 85 ef 28 35 fe 48 89 42
[ 27.052377] RSP: e02b:ffffc9004016fdd0 EFLAGS: 00010246
[ 27.052381] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88800d66e400 RCX: 0000000000000000
[ 27.052385] RDX: 6b6b6b6b6b6b6b6b RSI: 0000000000000000 RDI: 0000000000000000
[ 27.052389] RBP: ffff88800a887040 R08: 0000000000000000 R09: 0000000000000000
[ 27.052393] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888009e46b68
[ 27.052397] R13: 0000000000000200 R14: 0000000000000000 R15: ffff88800a887040
[ 27.052404] FS: 0000000000000000(0000) GS:ffff88808ca57000(0000) knlGS:0000000000000000
[ 27.052408] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 27.052412] CR2: 00007f9714004360 CR3: 0000000004834000 CR4: 0000000000050660
[ 27.052418] Call Trace:
[ 27.052420] <TASK>
[ 27.052422] xen_9pfs_front_changed+0x5d5/0x720
[ 27.052426] ? xenbus_otherend_changed+0x72/0x140
[ 27.052430] ? __pfx_xenwatch_thread+0x10/0x10
[ 27.052434] xenwatch_thread+0x94/0x1c0
[ 27.052438] ? __pfx_autoremove_wake_function+0x10/0x10
[ 27.052442] kthread+0xf8/0x240
[ 27.052445] ? __pfx_kthread+0x10/0x10
[ 27.052449] ? __pfx_kthread+0x10/0x10
[ 27.052452] ret_from_fork+0x16b/0x1a0
[ 27.052456] ? __pfx_kthread+0x10/0x10
[ 27.052459] ret_from_fork_asm+0x1a/0x30
[ 27.052463] </TASK>
[ 27.052465] Modules linked in:
[ 27.052471] ---[ end trace 0000000000000000 ]---
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Message-ID: <20260129230348.2390470-1-stefano.stabellini@amd.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/9p/trans_xen.c | 85 ++++++++++++++++++++++++----------------------
1 file changed, 44 insertions(+), 41 deletions(-)
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 12f752a923324..9bbfc20744f69 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -277,45 +277,52 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
{
int i, j;
- write_lock(&xen_9pfs_lock);
- list_del(&priv->list);
- write_unlock(&xen_9pfs_lock);
-
- for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
- struct xen_9pfs_dataring *ring = &priv->rings[i];
-
- cancel_work_sync(&ring->work);
-
- if (!priv->rings[i].intf)
- break;
- if (priv->rings[i].irq > 0)
- unbind_from_irqhandler(priv->rings[i].irq, ring);
- if (priv->rings[i].data.in) {
- for (j = 0;
- j < (1 << priv->rings[i].intf->ring_order);
- j++) {
- grant_ref_t ref;
-
- ref = priv->rings[i].intf->ref[j];
- gnttab_end_foreign_access(ref, NULL);
- }
- free_pages_exact(priv->rings[i].data.in,
+ if (priv->rings) {
+ for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
+ struct xen_9pfs_dataring *ring = &priv->rings[i];
+
+ cancel_work_sync(&ring->work);
+
+ if (!priv->rings[i].intf)
+ break;
+ if (priv->rings[i].irq > 0)
+ unbind_from_irqhandler(priv->rings[i].irq, ring);
+ if (priv->rings[i].data.in) {
+ for (j = 0;
+ j < (1 << priv->rings[i].intf->ring_order);
+ j++) {
+ grant_ref_t ref;
+
+ ref = priv->rings[i].intf->ref[j];
+ gnttab_end_foreign_access(ref, NULL);
+ }
+ free_pages_exact(priv->rings[i].data.in,
1UL << (priv->rings[i].intf->ring_order +
XEN_PAGE_SHIFT));
+ }
+ gnttab_end_foreign_access(priv->rings[i].ref, NULL);
+ free_page((unsigned long)priv->rings[i].intf);
}
- gnttab_end_foreign_access(priv->rings[i].ref, NULL);
- free_page((unsigned long)priv->rings[i].intf);
+ kfree(priv->rings);
}
- kfree(priv->rings);
kfree(priv->tag);
kfree(priv);
}
static void xen_9pfs_front_remove(struct xenbus_device *dev)
{
- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
+ struct xen_9pfs_front_priv *priv;
+ write_lock(&xen_9pfs_lock);
+ priv = dev_get_drvdata(&dev->dev);
+ if (priv == NULL) {
+ write_unlock(&xen_9pfs_lock);
+ return;
+ }
dev_set_drvdata(&dev->dev, NULL);
+ list_del(&priv->list);
+ write_unlock(&xen_9pfs_lock);
+
xen_9pfs_front_free(priv);
}
@@ -382,7 +389,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
{
int ret, i;
struct xenbus_transaction xbt;
- struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
+ struct xen_9pfs_front_priv *priv;
char *versions, *v;
unsigned int max_rings, max_ring_order, len = 0;
@@ -410,6 +417,10 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order))
p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2;
+ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
+ priv->dev = dev;
priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings),
GFP_KERNEL);
if (!priv->rings) {
@@ -468,6 +479,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
goto error;
}
+ write_lock(&xen_9pfs_lock);
+ dev_set_drvdata(&dev->dev, priv);
+ list_add_tail(&priv->list, &xen_9pfs_devs);
+ write_unlock(&xen_9pfs_lock);
+
xenbus_switch_state(dev, XenbusStateInitialised);
return 0;
@@ -482,19 +498,6 @@ static int xen_9pfs_front_init(struct xenbus_device *dev)
static int xen_9pfs_front_probe(struct xenbus_device *dev,
const struct xenbus_device_id *id)
{
- struct xen_9pfs_front_priv *priv = NULL;
-
- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
- if (!priv)
- return -ENOMEM;
-
- priv->dev = dev;
- dev_set_drvdata(&dev->dev, priv);
-
- write_lock(&xen_9pfs_lock);
- list_add_tail(&priv->list, &xen_9pfs_devs);
- write_unlock(&xen_9pfs_lock);
-
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 365/844] dmaengine: stm32-dma3: use module_platform_driver
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (363 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 364/844] 9p/xen: protect xen_9pfs_front_free against concurrent calls Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 366/844] soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) Sasha Levin
` (487 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Amelie Delaunay, Eugen Hristev, Vinod Koul, Sasha Levin
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
[ Upstream commit 0d41ed4ea496fabbb4dc21171e32d9a924c2a661 ]
Without module_platform_driver(), stm32-dma3 doesn't have a
module_exit procedure. Once stm32-dma3 module is inserted, it
can't be removed, marked busy.
Use module_platform_driver() instead of subsys_initcall() to register
(insmod) and unregister (rmmod) stm32-dma3 driver.
Reviewed-by: Eugen Hristev <eugen.hristev@linaro.org>
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://patch.msgid.link/20251121-dma3_improv-v2-1-76a207b13ea6@foss.st.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/stm32/stm32-dma3.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/dma/stm32/stm32-dma3.c b/drivers/dma/stm32/stm32-dma3.c
index 50e7106c5cb73..9500164c8f688 100644
--- a/drivers/dma/stm32/stm32-dma3.c
+++ b/drivers/dma/stm32/stm32-dma3.c
@@ -1914,12 +1914,7 @@ static struct platform_driver stm32_dma3_driver = {
},
};
-static int __init stm32_dma3_init(void)
-{
- return platform_driver_register(&stm32_dma3_driver);
-}
-
-subsys_initcall(stm32_dma3_init);
+module_platform_driver(stm32_dma3_driver);
MODULE_DESCRIPTION("STM32 DMA3 controller driver");
MODULE_AUTHOR("Amelie Delaunay <amelie.delaunay@foss.st.com>");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 366/844] soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (364 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 365/844] dmaengine: stm32-dma3: use module_platform_driver Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 367/844] soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list Sasha Levin
` (486 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Kai Vehmanen, Bard Liao, Vinod Koul, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 59946373755d71dbd7614ba235e0093159f80b69 ]
Avell B.ON is an OEM re-branded NUC15 'Bishop County' LAPBC510 and
LAPBC710.
Link: https://github.com/thesofproject/linux/issues/5529
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20251215130947.31385-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/dmi-quirks.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
index 91ab97a456fa9..5854218e1a274 100644
--- a/drivers/soundwire/dmi-quirks.c
+++ b/drivers/soundwire/dmi-quirks.c
@@ -122,6 +122,17 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
},
.driver_data = (void *)intel_tgl_bios,
},
+ {
+ /*
+ * quirk used for Avell B.ON (OEM rebrand of NUC15 'Bishop County'
+ * LAPBC510 and LAPBC710)
+ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Avell High Performance"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "B.ON"),
+ },
+ .driver_data = (void *)intel_tgl_bios,
+ },
{
/* quirk used for NUC15 'Rooks County' LAPRC510 and LAPRC710 skews */
.matches = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 367/844] soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (365 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 366/844] soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 368/844] staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure Sasha Levin
` (485 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Maciej Strozek, Bard Liao, Charles Keepax, Vinod Koul,
Sasha Levin
From: Maciej Strozek <mstrozek@opensource.cirrus.com>
[ Upstream commit f87e5575a6bd1925cd55f500b61b661724372e5f ]
Add cs42l45 to the wake_capable_list because it can generate jack events
whilst the bus is stopped.
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20251215151729.3911077-1-ckeepax@opensource.cirrus.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soundwire/intel_auxdevice.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soundwire/intel_auxdevice.c b/drivers/soundwire/intel_auxdevice.c
index 6df2601fff909..8752b0e3ce74c 100644
--- a/drivers/soundwire/intel_auxdevice.c
+++ b/drivers/soundwire/intel_auxdevice.c
@@ -52,6 +52,7 @@ struct wake_capable_part {
static struct wake_capable_part wake_capable_list[] = {
{0x01fa, 0x4243},
+ {0x01fa, 0x4245},
{0x025d, 0x5682},
{0x025d, 0x700},
{0x025d, 0x711},
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 368/844] staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (366 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 367/844] soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 369/844] serial: 8250_dw: handle clock enable errors in runtime_resume Sasha Levin
` (484 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Liang Jie, fanggeng, Greg Kroah-Hartman, Sasha Levin
From: Liang Jie <liangjie@lixiang.com>
[ Upstream commit 618b4aec12faabc7579a6b0df046842d798a4c7c ]
The return value of sdio_alloc_irq() was not stored in status.
If sdio_alloc_irq() fails after rtw_drv_register_netdev() succeeds,
status remains _SUCCESS and the error path skips resource cleanup,
while rtw_drv_init() still returns success.
Store the return value of sdio_alloc_irq() in status and reuse the
existing error handling which relies on status.
Reviewed-by: fanggeng <fanggeng@lixiang.com>
Signed-off-by: Liang Jie <liangjie@lixiang.com>
Link: https://patch.msgid.link/20251208092730.262499-1-buaajxlj@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index 1d0239eef114b..dc787954126fd 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -377,7 +377,8 @@ static int rtw_drv_init(
if (status != _SUCCESS)
goto free_if1;
- if (sdio_alloc_irq(dvobj) != _SUCCESS)
+ status = sdio_alloc_irq(dvobj);
+ if (status != _SUCCESS)
goto free_if1;
status = _SUCCESS;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 369/844] serial: 8250_dw: handle clock enable errors in runtime_resume
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (367 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 368/844] staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 370/844] usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs Sasha Levin
` (483 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Artem Shimko, Greg Kroah-Hartman, Sasha Levin
From: Artem Shimko <a.shimko.dev@gmail.com>
[ Upstream commit d31228143a489ba6ba797896a07541ce06828c09 ]
Add error checking for clk_prepare_enable() calls in
dw8250_runtime_resume(). Currently if either clock fails to enable,
the function returns success while leaving clocks in inconsistent state.
This change implements comprehensive error handling by checking the return
values of both clk_prepare_enable() calls. If the second clock enable
operation fails after the first clock has already been successfully
enabled, the code now properly cleans up by disabling and unpreparing
the first clock before returning. The error code is then propagated to
the caller, ensuring that clock enable failures are properly reported
rather than being silently ignored.
Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
Link: https://patch.msgid.link/20251104145433.2316165-2-a.shimko.dev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_dw.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 27af83f0ff463..0f8207652efe6 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -741,11 +741,18 @@ static int dw8250_runtime_suspend(struct device *dev)
static int dw8250_runtime_resume(struct device *dev)
{
+ int ret;
struct dw8250_data *data = dev_get_drvdata(dev);
- clk_prepare_enable(data->pclk);
+ ret = clk_prepare_enable(data->pclk);
+ if (ret)
+ return ret;
- clk_prepare_enable(data->clk);
+ ret = clk_prepare_enable(data->clk);
+ if (ret) {
+ clk_disable_unprepare(data->pclk);
+ return ret;
+ }
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 370/844] usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (368 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 369/844] serial: 8250_dw: handle clock enable errors in runtime_resume Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 371/844] tty: vt/keyboard: Split apart vt_do_diacrit() Sasha Levin
` (482 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Benson Leung, Heikki Krogerus, Greg Kroah-Hartman, Sasha Levin
From: Benson Leung <bleung@chromium.org>
[ Upstream commit 6811e0a08bdce6b2767414caf17fda24c2e4e032 ]
ucsi_psy_get_voltage_max and ucsi_psy_get_current_max are calculated
using whichever pdo is in the last position of the src_pdos array, presuming
it to be a fixed pdo, so the pdo_fixed_voltage or pdo_max_current
helpers are used on that last pdo.
However, non-Fixed PDOs such as Battery PDOs, Augmented PDOs (used for AVS and
for PPS) may exist, and are always at the end of the array if they do.
In the event one of these more advanced chargers are attached the helpers for
fixed return mangled values.
Here's an example case of a Google Pixel Flex Dual Port 67W USB-C Fast Charger
with PPS support:
POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
POWER_SUPPLY_TYPE=USB
POWER_SUPPLY_CHARGE_TYPE=Standard
POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
POWER_SUPPLY_ONLINE=1
POWER_SUPPLY_VOLTAGE_MIN=5000000
POWER_SUPPLY_VOLTAGE_MAX=13400000
POWER_SUPPLY_VOLTAGE_NOW=20000000
POWER_SUPPLY_CURRENT_MAX=5790000
POWER_SUPPLY_CURRENT_NOW=3250000
Voltage Max is reading as 13.4V, but that's an incorrect decode of the PPS
APDO in the last position. Same goes for CURRENT_MAX. 5.79A is incorrect.
Instead, enumerate through the src_pdos and filter just for Fixed PDOs for
now, and find the one with the highest voltage and current respectively.
After, from the same charger:
POWER_SUPPLY_NAME=ucsi-source-psy-cros_ec_ucsi.4.auto2
POWER_SUPPLY_TYPE=USB
POWER_SUPPLY_CHARGE_TYPE=Standard
POWER_SUPPLY_USB_TYPE=C [PD] PD_PPS PD_DRP
POWER_SUPPLY_ONLINE=1
POWER_SUPPLY_VOLTAGE_MIN=5000000
POWER_SUPPLY_VOLTAGE_MAX=20000000
POWER_SUPPLY_VOLTAGE_NOW=20000000
POWER_SUPPLY_CURRENT_MAX=4000000
POWER_SUPPLY_CURRENT_NOW=3250000
Signed-off-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20251208174918.289394-3-bleung@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/ucsi/psy.c | 30 ++++++++++++++++++++----------
1 file changed, 20 insertions(+), 10 deletions(-)
diff --git a/drivers/usb/typec/ucsi/psy.c b/drivers/usb/typec/ucsi/psy.c
index 3abe9370ffaaf..62160c4191718 100644
--- a/drivers/usb/typec/ucsi/psy.c
+++ b/drivers/usb/typec/ucsi/psy.c
@@ -112,15 +112,20 @@ static int ucsi_psy_get_voltage_max(struct ucsi_connector *con,
union power_supply_propval *val)
{
u32 pdo;
+ int max_voltage = 0;
switch (UCSI_CONSTAT(con, PWR_OPMODE)) {
case UCSI_CONSTAT_PWR_OPMODE_PD:
- if (con->num_pdos > 0) {
- pdo = con->src_pdos[con->num_pdos - 1];
- val->intval = pdo_fixed_voltage(pdo) * 1000;
- } else {
- val->intval = 0;
+ for (int i = 0; i < con->num_pdos; i++) {
+ int pdo_voltage = 0;
+
+ pdo = con->src_pdos[i];
+ if (pdo_type(pdo) == PDO_TYPE_FIXED)
+ pdo_voltage = pdo_fixed_voltage(pdo) * 1000;
+ max_voltage = (pdo_voltage > max_voltage) ? pdo_voltage
+ : max_voltage;
}
+ val->intval = max_voltage;
break;
case UCSI_CONSTAT_PWR_OPMODE_TYPEC3_0:
case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
@@ -168,6 +173,7 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
union power_supply_propval *val)
{
u32 pdo;
+ int max_current = 0;
if (!UCSI_CONSTAT(con, CONNECTED)) {
val->intval = 0;
@@ -176,12 +182,16 @@ static int ucsi_psy_get_current_max(struct ucsi_connector *con,
switch (UCSI_CONSTAT(con, PWR_OPMODE)) {
case UCSI_CONSTAT_PWR_OPMODE_PD:
- if (con->num_pdos > 0) {
- pdo = con->src_pdos[con->num_pdos - 1];
- val->intval = pdo_max_current(pdo) * 1000;
- } else {
- val->intval = 0;
+ for (int i = 0; i < con->num_pdos; i++) {
+ int pdo_current = 0;
+
+ pdo = con->src_pdos[i];
+ if (pdo_type(pdo) == PDO_TYPE_FIXED)
+ pdo_current = pdo_max_current(pdo) * 1000;
+ max_current = (pdo_current > max_current) ? pdo_current
+ : max_current;
}
+ val->intval = max_current;
break;
case UCSI_CONSTAT_PWR_OPMODE_TYPEC1_5:
val->intval = UCSI_TYPEC_1_5_CURRENT * 1000;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 371/844] tty: vt/keyboard: Split apart vt_do_diacrit()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (369 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 370/844] usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 372/844] serial: rsci: Add set_rtrg() callback Sasha Levin
` (481 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, kernel test robot, Greg Kroah-Hartman,
Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 0a76a17238f805b231d97b118232a5185bbb7a18 ]
After commit bfb24564b5fd ("tty: vt/keyboard: use __free()"), builds
using asm goto for put_user() and get_user() with a version of clang
older than 17 error with:
drivers/tty/vt/keyboard.c:1709:7: error: cannot jump from this asm goto statement to one of its possible targets
if (put_user(asize, &a->kb_cnt))
^
...
arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm'
asm goto( \
^
drivers/tty/vt/keyboard.c:1687:7: note: possible target of asm goto statement
if (put_user(asize, &a->kb_cnt))
^
...
arch/arm64/include/asm/uaccess.h:342:2: note: expanded from macro '__raw_put_user'
__rpu_failed: \
^
drivers/tty/vt/keyboard.c:1697:23: note: jump exits scope of variable with __attribute__((cleanup))
void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
^
drivers/tty/vt/keyboard.c:1671:33: note: jump bypasses initialization of variable with __attribute__((cleanup))
struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
^
Prior to a fix to clang's scope checker in clang 17 [1], all labels in a
function were validated as potential targets of all asm gotos in a
function, regardless of whether they actually were a target of an asm
goto call, resulting in false positive errors about skipping over
variables marked with the cleanup attribute.
To workaround this error, split up the bodies of the case statements in
vt_do_diacrit() into their own functions so that the scope checker does
not trip up on the multiple instances of __free().
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202509091702.Oc7eCRDw-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202511241835.EA8lShgH-lkp@intel.com/
Link: https://github.com/llvm/llvm-project/commit/f023f5cdb2e6c19026f04a15b5a935c041835d14 [1]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20251125-tty-vt-keyboard-wa-clang-scope-check-error-v1-1-f5a5ea55c578@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/vt/keyboard.c | 221 ++++++++++++++++++++------------------
1 file changed, 115 insertions(+), 106 deletions(-)
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index d65fc60dd7bed..3538d54d6a6ac 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1649,134 +1649,143 @@ int __init kbd_init(void)
/* Ioctl support code */
-/**
- * vt_do_diacrit - diacritical table updates
- * @cmd: ioctl request
- * @udp: pointer to user data for ioctl
- * @perm: permissions check computed by caller
- *
- * Update the diacritical tables atomically and safely. Lock them
- * against simultaneous keypresses
- */
-int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
+static int vt_do_kdgkbdiacr(void __user *udp)
{
- int asize;
-
- switch (cmd) {
- case KDGKBDIACR:
- {
- struct kbdiacrs __user *a = udp;
- int i;
+ struct kbdiacrs __user *a = udp;
+ int i, asize;
- struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
- GFP_KERNEL);
- if (!dia)
- return -ENOMEM;
+ struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr),
+ GFP_KERNEL);
+ if (!dia)
+ return -ENOMEM;
- /* Lock the diacriticals table, make a copy and then
- copy it after we unlock */
- scoped_guard(spinlock_irqsave, &kbd_event_lock) {
- asize = accent_table_size;
- for (i = 0; i < asize; i++) {
- dia[i].diacr = conv_uni_to_8bit(accent_table[i].diacr);
- dia[i].base = conv_uni_to_8bit(accent_table[i].base);
- dia[i].result = conv_uni_to_8bit(accent_table[i].result);
- }
+ /* Lock the diacriticals table, make a copy and then
+ copy it after we unlock */
+ scoped_guard(spinlock_irqsave, &kbd_event_lock) {
+ asize = accent_table_size;
+ for (i = 0; i < asize; i++) {
+ dia[i].diacr = conv_uni_to_8bit(accent_table[i].diacr);
+ dia[i].base = conv_uni_to_8bit(accent_table[i].base);
+ dia[i].result = conv_uni_to_8bit(accent_table[i].result);
}
-
- if (put_user(asize, &a->kb_cnt))
- return -EFAULT;
- if (copy_to_user(a->kbdiacr, dia, asize * sizeof(struct kbdiacr)))
- return -EFAULT;
- return 0;
}
- case KDGKBDIACRUC:
- {
- struct kbdiacrsuc __user *a = udp;
- void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
- GFP_KERNEL);
- if (buf == NULL)
- return -ENOMEM;
+ if (put_user(asize, &a->kb_cnt))
+ return -EFAULT;
+ if (copy_to_user(a->kbdiacr, dia, asize * sizeof(struct kbdiacr)))
+ return -EFAULT;
+ return 0;
+}
- /* Lock the diacriticals table, make a copy and then
- copy it after we unlock */
- scoped_guard(spinlock_irqsave, &kbd_event_lock) {
- asize = accent_table_size;
- memcpy(buf, accent_table, asize * sizeof(struct kbdiacruc));
- }
+static int vt_do_kdgkbdiacruc(void __user *udp)
+{
+ struct kbdiacrsuc __user *a = udp;
+ int asize;
- if (put_user(asize, &a->kb_cnt))
- return -EFAULT;
- if (copy_to_user(a->kbdiacruc, buf, asize * sizeof(struct kbdiacruc)))
- return -EFAULT;
+ void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc),
+ GFP_KERNEL);
+ if (buf == NULL)
+ return -ENOMEM;
- return 0;
+ /* Lock the diacriticals table, make a copy and then
+ copy it after we unlock */
+ scoped_guard(spinlock_irqsave, &kbd_event_lock) {
+ asize = accent_table_size;
+ memcpy(buf, accent_table, asize * sizeof(struct kbdiacruc));
}
- case KDSKBDIACR:
- {
- struct kbdiacrs __user *a = udp;
- struct kbdiacr __free(kfree) *dia = NULL;
- unsigned int ct;
- int i;
+ if (put_user(asize, &a->kb_cnt))
+ return -EFAULT;
+ if (copy_to_user(a->kbdiacruc, buf, asize * sizeof(struct kbdiacruc)))
+ return -EFAULT;
- if (!perm)
- return -EPERM;
- if (get_user(ct, &a->kb_cnt))
- return -EFAULT;
- if (ct >= MAX_DIACR)
- return -EINVAL;
+ return 0;
+}
- if (ct) {
- dia = memdup_array_user(a->kbdiacr,
- ct, sizeof(struct kbdiacr));
- if (IS_ERR(dia))
- return PTR_ERR(dia);
- }
+static int vt_do_kdskbdiacr(void __user *udp, int perm)
+{
+ struct kbdiacrs __user *a = udp;
+ struct kbdiacr __free(kfree) *dia = NULL;
+ unsigned int ct;
+ int i;
- guard(spinlock_irqsave)(&kbd_event_lock);
- accent_table_size = ct;
- for (i = 0; i < ct; i++) {
- accent_table[i].diacr =
- conv_8bit_to_uni(dia[i].diacr);
- accent_table[i].base =
- conv_8bit_to_uni(dia[i].base);
- accent_table[i].result =
- conv_8bit_to_uni(dia[i].result);
- }
+ if (!perm)
+ return -EPERM;
+ if (get_user(ct, &a->kb_cnt))
+ return -EFAULT;
+ if (ct >= MAX_DIACR)
+ return -EINVAL;
- return 0;
+ if (ct) {
+ dia = memdup_array_user(a->kbdiacr,
+ ct, sizeof(struct kbdiacr));
+ if (IS_ERR(dia))
+ return PTR_ERR(dia);
}
- case KDSKBDIACRUC:
- {
- struct kbdiacrsuc __user *a = udp;
- unsigned int ct;
- void __free(kfree) *buf = NULL;
+ guard(spinlock_irqsave)(&kbd_event_lock);
+ accent_table_size = ct;
+ for (i = 0; i < ct; i++) {
+ accent_table[i].diacr =
+ conv_8bit_to_uni(dia[i].diacr);
+ accent_table[i].base =
+ conv_8bit_to_uni(dia[i].base);
+ accent_table[i].result =
+ conv_8bit_to_uni(dia[i].result);
+ }
- if (!perm)
- return -EPERM;
+ return 0;
+}
- if (get_user(ct, &a->kb_cnt))
- return -EFAULT;
+static int vt_do_kdskbdiacruc(void __user *udp, int perm)
+{
+ struct kbdiacrsuc __user *a = udp;
+ unsigned int ct;
+ void __free(kfree) *buf = NULL;
- if (ct >= MAX_DIACR)
- return -EINVAL;
+ if (!perm)
+ return -EPERM;
- if (ct) {
- buf = memdup_array_user(a->kbdiacruc,
- ct, sizeof(struct kbdiacruc));
- if (IS_ERR(buf))
- return PTR_ERR(buf);
- }
- guard(spinlock_irqsave)(&kbd_event_lock);
- if (ct)
- memcpy(accent_table, buf,
- ct * sizeof(struct kbdiacruc));
- accent_table_size = ct;
- return 0;
+ if (get_user(ct, &a->kb_cnt))
+ return -EFAULT;
+
+ if (ct >= MAX_DIACR)
+ return -EINVAL;
+
+ if (ct) {
+ buf = memdup_array_user(a->kbdiacruc,
+ ct, sizeof(struct kbdiacruc));
+ if (IS_ERR(buf))
+ return PTR_ERR(buf);
}
+ guard(spinlock_irqsave)(&kbd_event_lock);
+ if (ct)
+ memcpy(accent_table, buf,
+ ct * sizeof(struct kbdiacruc));
+ accent_table_size = ct;
+ return 0;
+}
+
+/**
+ * vt_do_diacrit - diacritical table updates
+ * @cmd: ioctl request
+ * @udp: pointer to user data for ioctl
+ * @perm: permissions check computed by caller
+ *
+ * Update the diacritical tables atomically and safely. Lock them
+ * against simultaneous keypresses
+ */
+int vt_do_diacrit(unsigned int cmd, void __user *udp, int perm)
+{
+ switch (cmd) {
+ case KDGKBDIACR:
+ return vt_do_kdgkbdiacr(udp);
+ case KDGKBDIACRUC:
+ return vt_do_kdgkbdiacruc(udp);
+ case KDSKBDIACR:
+ return vt_do_kdskbdiacr(udp, perm);
+ case KDSKBDIACRUC:
+ return vt_do_kdskbdiacruc(udp, perm);
}
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 372/844] serial: rsci: Add set_rtrg() callback
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (370 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 371/844] tty: vt/keyboard: Split apart vt_do_diacrit() Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 373/844] fpga: of-fpga-region: Fail if any bridge is missing Sasha Levin
` (480 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Biju Das, Lad Prabhakar, Greg Kroah-Hartman, Sasha Levin
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit b346e5d7dbf6696176417923c49838a1beb1d785 ]
The rtrg variable is populated in sci_init_single() for RZ/T2H. Add
set_rtrg() callback for setting the rtrg value.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20251129164325.209213-4-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/rsci.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/tty/serial/rsci.c b/drivers/tty/serial/rsci.c
index b3c48dc1e07db..0533a4bb1d03c 100644
--- a/drivers/tty/serial/rsci.c
+++ b/drivers/tty/serial/rsci.c
@@ -151,6 +151,22 @@ static void rsci_start_rx(struct uart_port *port)
rsci_serial_out(port, CCR0, ctrl);
}
+static int rsci_scif_set_rtrg(struct uart_port *port, int rx_trig)
+{
+ u32 fcr = rsci_serial_in(port, FCR);
+
+ if (rx_trig >= port->fifosize)
+ rx_trig = port->fifosize - 1;
+ else if (rx_trig < 1)
+ rx_trig = 0;
+
+ fcr &= ~FCR_RTRG4_0;
+ fcr |= field_prep(FCR_RTRG4_0, rx_trig);
+ rsci_serial_out(port, FCR, fcr);
+
+ return rx_trig;
+}
+
static void rsci_set_termios(struct uart_port *port, struct ktermios *termios,
const struct ktermios *old)
{
@@ -454,6 +470,7 @@ static const struct sci_port_ops rsci_port_ops = {
.poll_put_char = rsci_poll_put_char,
.prepare_console_write = rsci_prepare_console_write,
.suspend_regs_size = rsci_suspend_regs_size,
+ .set_rtrg = rsci_scif_set_rtrg,
.shutdown_complete = rsci_shutdown_complete,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 373/844] fpga: of-fpga-region: Fail if any bridge is missing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (371 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 372/844] serial: rsci: Add set_rtrg() callback Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 374/844] most: core: fix resource leak in most_register_interface error paths Sasha Levin
` (479 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Romain Gantois, Xu Yilun, Xu Yilun, Sasha Levin
From: Romain Gantois <romain.gantois@bootlin.com>
[ Upstream commit c141c8221bc5089de915d9f26044df892c343c7e ]
When parsing the region bridge list from the "fpga-bridges" device tree
property, the of-fpga-region driver will silently ignore bridges which fail
to be obtained, for example due to a missing bridge driver or invalid
phandle.
This can lead to hardware issues if a region bridge stays coupled when
partial programming is performed.
Fail if any of the bridges specified in "fpga-bridges" cannot be obtained.
Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://lore.kernel.org/r/20251127-of-fpga-region-fail-if-bridges-not-found-v1-1-ca674f8d07eb@bootlin.com
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/fpga/of-fpga-region.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
index 43db4bb77138a..caa091224dc54 100644
--- a/drivers/fpga/of-fpga-region.c
+++ b/drivers/fpga/of-fpga-region.c
@@ -83,7 +83,7 @@ static struct fpga_manager *of_fpga_region_get_mgr(struct device_node *np)
* done with the bridges.
*
* Return: 0 for success (even if there are no bridges specified)
- * or -EBUSY if any of the bridges are in use.
+ * or an error code if any of the bridges are not available.
*/
static int of_fpga_region_get_bridges(struct fpga_region *region)
{
@@ -130,10 +130,10 @@ static int of_fpga_region_get_bridges(struct fpga_region *region)
®ion->bridge_list);
of_node_put(br);
- /* If any of the bridges are in use, give up */
- if (ret == -EBUSY) {
+ /* If any of the bridges are not available, give up */
+ if (ret) {
fpga_bridges_put(®ion->bridge_list);
- return -EBUSY;
+ return ret;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 374/844] most: core: fix resource leak in most_register_interface error paths
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (372 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 373/844] fpga: of-fpga-region: Fail if any bridge is missing Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-03-02 7:08 ` Jiri Slaby
2026-02-28 17:24 ` [PATCH 6.19 375/844] dmaengine: sun6i: Choose appropriate burst length under maxburst Sasha Levin
` (478 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Navaneeth K, Abdun Nihaal, Dan Carpenter, Greg Kroah-Hartman,
Sasha Levin
From: Navaneeth K <knavaneeth786@gmail.com>
[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ]
The function most_register_interface() did not correctly release resources
if it failed early (before registering the device). In these cases, it
returned an error code immediately, leaking the memory allocated for the
interface.
Fix this by initializing the device early via device_initialize() and
calling put_device() on all error paths.
The most_register_interface() is expected to call put_device() on
error which frees the resources allocated in the caller. The
put_device() either calls release_mdev() or dim2_release(),
depending on the caller.
Switch to using device_add() instead of device_register() to handle
the split initialization.
Acked-by: Abdun Nihaal <abdun.nihaal@gmail.com>
Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20251127165337.19172-1-knavaneeth786@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/most/core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/most/core.c b/drivers/most/core.c
index da319d108ea1d..6277e6702ca8c 100644
--- a/drivers/most/core.c
+++ b/drivers/most/core.c
@@ -1286,15 +1286,19 @@ int most_register_interface(struct most_interface *iface)
!iface->poison_channel || (iface->num_channels > MAX_CHANNELS))
return -EINVAL;
+ device_initialize(iface->dev);
+
id = ida_alloc(&mdev_id, GFP_KERNEL);
if (id < 0) {
dev_err(iface->dev, "Failed to allocate device ID\n");
+ put_device(iface->dev);
return id;
}
iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL);
if (!iface->p) {
ida_free(&mdev_id, id);
+ put_device(iface->dev);
return -ENOMEM;
}
@@ -1304,7 +1308,7 @@ int most_register_interface(struct most_interface *iface)
iface->dev->bus = &mostbus;
iface->dev->groups = interface_attr_groups;
dev_set_drvdata(iface->dev, iface);
- if (device_register(iface->dev)) {
+ if (device_add(iface->dev)) {
dev_err(iface->dev, "Failed to register interface device\n");
kfree(iface->p);
put_device(iface->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 374/844] most: core: fix resource leak in most_register_interface error paths
2026-02-28 17:24 ` [PATCH 6.19 374/844] most: core: fix resource leak in most_register_interface error paths Sasha Levin
@ 2026-03-02 7:08 ` Jiri Slaby
2026-03-02 14:00 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Jiri Slaby @ 2026-03-02 7:08 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Navaneeth K, Abdun Nihaal, Dan Carpenter, Greg Kroah-Hartman
On 28. 02. 26, 18:24, Sasha Levin wrote:
> From: Navaneeth K <knavaneeth786@gmail.com>
>
> [ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ]
This one is fixed by:
2c198c272f9c most: core: fix leak on early registration failure
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 374/844] most: core: fix resource leak in most_register_interface error paths
2026-03-02 7:08 ` Jiri Slaby
@ 2026-03-02 14:00 ` Sasha Levin
0 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-03-02 14:00 UTC (permalink / raw)
To: Jiri Slaby
Cc: linux-kernel, stable, Navaneeth K, Abdun Nihaal, Dan Carpenter,
Greg Kroah-Hartman
On Mon, Mar 02, 2026 at 08:08:20AM +0100, Jiri Slaby wrote:
>On 28. 02. 26, 18:24, Sasha Levin wrote:
>>From: Navaneeth K <knavaneeth786@gmail.com>
>>
>>[ Upstream commit 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 ]
>
>This one is fixed by:
>2c198c272f9c most: core: fix leak on early registration failure
Queued up, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* [PATCH 6.19 375/844] dmaengine: sun6i: Choose appropriate burst length under maxburst
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (373 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 374/844] most: core: fix resource leak in most_register_interface error paths Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 376/844] dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings Sasha Levin
` (477 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chen-Yu Tsai, Jernej Skrabec, Vinod Koul, Sasha Levin
From: Chen-Yu Tsai <wens@kernel.org>
[ Upstream commit 7178c3586ab42693b28bb81014320a7783e5c435 ]
maxburst, as provided by the client, specifies the largest amount of
data that is allowed to be transferred in one burst. This limit is
normally provided to avoid a data burst overflowing the target FIFO.
It does not mean that the DMA engine can only do bursts in that size.
Let the driver pick the largest supported burst length within the
given limit. This lets the driver work correctly with some clients that
give a large maxburst value. In particular, the 8250_dw driver will give
a quarter of the UART's FIFO size as maxburst. On some systems the FIFO
size is 256 bytes, giving a maxburst of 64 bytes, while the hardware
only supports bursts of up to 16 bytes.
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20251221080450.1813479-1-wens@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sun6i-dma.c | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 2215ff877bf7d..f9d876deb1f05 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -583,6 +583,22 @@ static irqreturn_t sun6i_dma_interrupt(int irq, void *dev_id)
return ret;
}
+static u32 find_burst_size(const u32 burst_lengths, u32 maxburst)
+{
+ if (!maxburst)
+ return 1;
+
+ if (BIT(maxburst) & burst_lengths)
+ return maxburst;
+
+ /* Hardware only does power-of-two bursts. */
+ for (u32 burst = rounddown_pow_of_two(maxburst); burst > 0; burst /= 2)
+ if (BIT(burst) & burst_lengths)
+ return burst;
+
+ return 1;
+}
+
static int set_config(struct sun6i_dma_dev *sdev,
struct dma_slave_config *sconfig,
enum dma_transfer_direction direction,
@@ -616,15 +632,13 @@ static int set_config(struct sun6i_dma_dev *sdev,
return -EINVAL;
if (!(BIT(dst_addr_width) & sdev->slave.dst_addr_widths))
return -EINVAL;
- if (!(BIT(src_maxburst) & sdev->cfg->src_burst_lengths))
- return -EINVAL;
- if (!(BIT(dst_maxburst) & sdev->cfg->dst_burst_lengths))
- return -EINVAL;
src_width = convert_buswidth(src_addr_width);
dst_width = convert_buswidth(dst_addr_width);
- dst_burst = convert_burst(dst_maxburst);
- src_burst = convert_burst(src_maxburst);
+ src_burst = find_burst_size(sdev->cfg->src_burst_lengths, src_maxburst);
+ dst_burst = find_burst_size(sdev->cfg->dst_burst_lengths, dst_maxburst);
+ dst_burst = convert_burst(dst_burst);
+ src_burst = convert_burst(src_burst);
*p_cfg = DMA_CHAN_CFG_SRC_WIDTH(src_width) |
DMA_CHAN_CFG_DST_WIDTH(dst_width);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 376/844] dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (374 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 375/844] dmaengine: sun6i: Choose appropriate burst length under maxburst Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 377/844] phy: ti: phy-j721e-wiz: restore mux selection during resume Sasha Levin
` (476 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Clément Le Goffic, Clément Le Goffic, Amelie Delaunay,
Vinod Koul, Sasha Levin
From: Clément Le Goffic <clement.legoffic@foss.st.com>
[ Upstream commit aaf3bc0265744adbc2d364964ef409cf118d193d ]
m2m_hw_period is initialized only when chan_config->m2m_hw is true. This
triggers a warning:
‘m2m_hw_period’ may be used uninitialized [-Wmaybe-uninitialized]
Although m2m_hw_period is only used when chan_config->m2m_hw is true and
ignored otherwise, initialize it unconditionally to 0.
ccr is initialized by stm32_mdma_set_xfer_param() when the sg list is not
empty. This triggers a warning:
‘ccr’ may be used uninitialized [-Wmaybe-uninitialized]
Indeed, it could be used uninitialized if the sg list is empty. Initialize
it to 0.
Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://patch.msgid.link/20251217-mdma_warnings_fix-v2-1-340200e0bb55@foss.st.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/stm32/stm32-mdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/stm32/stm32-mdma.c b/drivers/dma/stm32/stm32-mdma.c
index 080c1c725216c..b87d41b234df1 100644
--- a/drivers/dma/stm32/stm32-mdma.c
+++ b/drivers/dma/stm32/stm32-mdma.c
@@ -731,7 +731,7 @@ static int stm32_mdma_setup_xfer(struct stm32_mdma_chan *chan,
struct stm32_mdma_chan_config *chan_config = &chan->chan_config;
struct scatterlist *sg;
dma_addr_t src_addr, dst_addr;
- u32 m2m_hw_period, ccr, ctcr, ctbr;
+ u32 m2m_hw_period = 0, ccr = 0, ctcr, ctbr;
int i, ret = 0;
if (chan_config->m2m_hw)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 377/844] phy: ti: phy-j721e-wiz: restore mux selection during resume
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (375 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 376/844] dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 378/844] phy: cadence-torrent: restore parent clock for refclk " Sasha Levin
` (475 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Thomas Richard (TI.com), Vinod Koul, Sasha Levin
From: "Thomas Richard (TI.com)" <thomas.richard@bootlin.com>
[ Upstream commit 53f6240e88c9e8715e09fc19942f13450db4cb33 ]
While suspend and resume mux selection was getting lost. So save and
restore these values in suspend and resume operations.
Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
Link: https://patch.msgid.link/20251216-phy-ti-phy-j721e-wiz-resume-restore-mux-sel-v1-1-771d564db966@bootlin.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/ti/phy-j721e-wiz.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c
index a8b440c6c46bb..ba31b0a1f7f79 100644
--- a/drivers/phy/ti/phy-j721e-wiz.c
+++ b/drivers/phy/ti/phy-j721e-wiz.c
@@ -393,6 +393,7 @@ struct wiz {
struct clk *output_clks[WIZ_MAX_OUTPUT_CLOCKS];
struct clk_onecell_data clk_data;
const struct wiz_data *data;
+ int mux_sel_status[WIZ_MUX_NUM_CLOCKS];
};
static int wiz_reset(struct wiz *wiz)
@@ -1654,11 +1655,25 @@ static void wiz_remove(struct platform_device *pdev)
pm_runtime_disable(dev);
}
+static int wiz_suspend_noirq(struct device *dev)
+{
+ struct wiz *wiz = dev_get_drvdata(dev);
+ int i;
+
+ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
+ regmap_field_read(wiz->mux_sel_field[i], &wiz->mux_sel_status[i]);
+
+ return 0;
+}
+
static int wiz_resume_noirq(struct device *dev)
{
struct device_node *node = dev->of_node;
struct wiz *wiz = dev_get_drvdata(dev);
- int ret;
+ int ret, i;
+
+ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++)
+ regmap_field_write(wiz->mux_sel_field[i], wiz->mux_sel_status[i]);
/* Enable supplemental Control override if available */
if (wiz->sup_legacy_clk_override)
@@ -1680,7 +1695,7 @@ static int wiz_resume_noirq(struct device *dev)
return ret;
}
-static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, NULL, wiz_resume_noirq);
+static DEFINE_NOIRQ_DEV_PM_OPS(wiz_pm_ops, wiz_suspend_noirq, wiz_resume_noirq);
static struct platform_driver wiz_driver = {
.probe = wiz_probe,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 378/844] phy: cadence-torrent: restore parent clock for refclk during resume
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (376 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 377/844] phy: ti: phy-j721e-wiz: restore mux selection during resume Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 379/844] misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() Sasha Levin
` (474 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Richard (TI.com), Neil Armstrong, Vinod Koul, Sasha Levin
From: "Thomas Richard (TI.com)" <thomas.richard@bootlin.com>
[ Upstream commit 434e1a0ee145d0389b192252be4c993f86cf1134 ]
While suspend and resume, parent clock config for refclk was getting lost.
So save and restore it in suspend and resume operations.
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
Link: https://patch.msgid.link/20251216-phy-cadence-torrent-resume-restore-refclk-parent-v3-1-8a7ed84b47e3@bootlin.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/cadence/phy-cadence-torrent.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c
index 37fa4bad6bd72..877f22177c699 100644
--- a/drivers/phy/cadence/phy-cadence-torrent.c
+++ b/drivers/phy/cadence/phy-cadence-torrent.c
@@ -397,6 +397,7 @@ struct cdns_torrent_refclk_driver {
struct clk_hw hw;
struct regmap_field *cmn_fields[REFCLK_OUT_NUM_CMN_CONFIG];
struct clk_init_data clk_data;
+ u8 parent_index;
};
#define to_cdns_torrent_refclk_driver(_hw) \
@@ -3326,11 +3327,29 @@ static const struct cdns_torrent_vals sgmii_qsgmii_xcvr_diag_ln_vals = {
.num_regs = ARRAY_SIZE(sgmii_qsgmii_xcvr_diag_ln_regs),
};
+static void cdns_torrent_refclk_driver_suspend(struct cdns_torrent_phy *cdns_phy)
+{
+ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
+ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
+
+ refclk_driver->parent_index = cdns_torrent_refclk_driver_get_parent(hw);
+}
+
+static int cdns_torrent_refclk_driver_resume(struct cdns_torrent_phy *cdns_phy)
+{
+ struct clk_hw *hw = cdns_phy->clk_hw_data->hws[CDNS_TORRENT_REFCLK_DRIVER];
+ struct cdns_torrent_refclk_driver *refclk_driver = to_cdns_torrent_refclk_driver(hw);
+
+ return cdns_torrent_refclk_driver_set_parent(hw, refclk_driver->parent_index);
+}
+
static int cdns_torrent_phy_suspend_noirq(struct device *dev)
{
struct cdns_torrent_phy *cdns_phy = dev_get_drvdata(dev);
int i;
+ cdns_torrent_refclk_driver_suspend(cdns_phy);
+
reset_control_assert(cdns_phy->phy_rst);
reset_control_assert(cdns_phy->apb_rst);
for (i = 0; i < cdns_phy->nsubnodes; i++)
@@ -3352,6 +3371,10 @@ static int cdns_torrent_phy_resume_noirq(struct device *dev)
int node = cdns_phy->nsubnodes;
int ret, i;
+ ret = cdns_torrent_refclk_driver_resume(cdns_phy);
+ if (ret)
+ return ret;
+
ret = cdns_torrent_clk(cdns_phy);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 379/844] misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (377 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 378/844] phy: cadence-torrent: restore parent clock for refclk " Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 380/844] pinctrl: mediatek: make devm allocations safer and clearer in mtk_eint_do_init() Sasha Levin
` (473 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tuo Li, Scott Branden, Greg Kroah-Hartman, Sasha Levin
From: Tuo Li <islituo@gmail.com>
[ Upstream commit ba75ecb97d3f4e95d59002c13afb6519205be6cb ]
In the function bcm_vk_read(), the pointer entry is checked, indicating
that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
following code may cause null-pointer dereferences:
struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
set_msg_id(&tmp_msg, entry->usr_msg_id);
tmp_msg.size = entry->to_h_blks - 1;
To prevent these possible null-pointer dereferences, copy to_h_msg,
usr_msg_id, and to_h_blks from iter into temporary variables, and return
these temporary variables to the application instead of accessing them
through a potentially NULL entry.
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Scott Branden <scott.branden@broadcom.com>
Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
index 1f42d1d5a630a..665a3888708ac 100644
--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
+++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
struct device *dev = &vk->pdev->dev;
struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
struct bcm_vk_wkent *entry = NULL, *iter;
+ struct vk_msg_blk tmp_msg;
+ u32 tmp_usr_msg_id;
+ u32 tmp_blks;
u32 q_num;
u32 rsp_length;
@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
entry = iter;
} else {
/* buffer not big enough */
+ tmp_msg = iter->to_h_msg[0];
+ tmp_usr_msg_id = iter->usr_msg_id;
+ tmp_blks = iter->to_h_blks;
rc = -EMSGSIZE;
}
goto read_loop_exit;
@@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
bcm_vk_free_wkent(dev, entry);
} else if (rc == -EMSGSIZE) {
- struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
-
/*
* in this case, return just the first block, so
* that app knows what size it is looking for.
*/
- set_msg_id(&tmp_msg, entry->usr_msg_id);
- tmp_msg.size = entry->to_h_blks - 1;
+ set_msg_id(&tmp_msg, tmp_usr_msg_id);
+ tmp_msg.size = tmp_blks - 1;
if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
rc = -EFAULT;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 380/844] pinctrl: mediatek: make devm allocations safer and clearer in mtk_eint_do_init()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (378 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 379/844] misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 381/844] misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 Sasha Levin
` (472 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Liang Jie, fanggeng, Linus Walleij, Sasha Levin
From: Liang Jie <liangjie@lixiang.com>
[ Upstream commit 255b721c96046d4c57fa2268e4c72607868ce91f ]
mtk_eint_do_init() allocates several pointer arrays which are then
populated in a per-instance loop and freed on error. The arrays are
currently allocated with devm_kmalloc(), so their entries are left
uninitialised until the per-instance allocations succeed.
On a failure in the middle of the loop, the error path iterates over
the full nbase range and calls devm_kfree() on each element. For
indices which were never initialised, the corresponding array entries
contain stack garbage. If any of those happen to be non-zero,
devm_kfree() will pass them to devres_destroy(), which will WARN
because there is no matching devm_kmalloc() resource for such bogus
pointers.
Improve the robustness and readability by:
- Using devm_kcalloc() for the pointer arrays so that all entries
start as NULL, ensuring that only genuinely initialised elements
may be freed and preventing spurious WARN_ON()s in the error path.
- Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms,
avoiding hard-coded element types and making the code more resilient
to future type changes.
- Dropping the redundant NULL checks before devm_kfree(), as
devm_kfree() safely handles NULL pointers.
The functional behaviour in the successful initialisation path remains
unchanged, while the error handling becomes simpler and less
error-prone.
Reviewed-by: fanggeng <fanggeng@lixiang.com>
Signed-off-by: Liang Jie <liangjie@lixiang.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/mtk-eint.c | 29 +++++++++++++++++------------
1 file changed, 17 insertions(+), 12 deletions(-)
diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index c8c5097c11c4d..2a3c04eedc5f3 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -544,24 +544,32 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
}
}
- eint->pin_list = devm_kmalloc(eint->dev, eint->nbase * sizeof(u16 *), GFP_KERNEL);
+ eint->pin_list = devm_kcalloc(eint->dev, eint->nbase,
+ sizeof(*eint->pin_list), GFP_KERNEL);
if (!eint->pin_list)
goto err_pin_list;
- eint->wake_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
+ eint->wake_mask = devm_kcalloc(eint->dev, eint->nbase,
+ sizeof(*eint->wake_mask), GFP_KERNEL);
if (!eint->wake_mask)
goto err_wake_mask;
- eint->cur_mask = devm_kmalloc(eint->dev, eint->nbase * sizeof(u32 *), GFP_KERNEL);
+ eint->cur_mask = devm_kcalloc(eint->dev, eint->nbase,
+ sizeof(*eint->cur_mask), GFP_KERNEL);
if (!eint->cur_mask)
goto err_cur_mask;
for (i = 0; i < eint->nbase; i++) {
- eint->pin_list[i] = devm_kzalloc(eint->dev, eint->base_pin_num[i] * sizeof(u16),
+ eint->pin_list[i] = devm_kzalloc(eint->dev,
+ eint->base_pin_num[i] * sizeof(**eint->pin_list),
GFP_KERNEL);
port = DIV_ROUND_UP(eint->base_pin_num[i], 32);
- eint->wake_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
- eint->cur_mask[i] = devm_kzalloc(eint->dev, port * sizeof(u32), GFP_KERNEL);
+ eint->wake_mask[i] = devm_kzalloc(eint->dev,
+ port * sizeof(**eint->wake_mask),
+ GFP_KERNEL);
+ eint->cur_mask[i] = devm_kzalloc(eint->dev,
+ port * sizeof(**eint->cur_mask),
+ GFP_KERNEL);
if (!eint->pin_list[i] || !eint->wake_mask[i] || !eint->cur_mask[i])
goto err_eint;
}
@@ -597,12 +605,9 @@ int mtk_eint_do_init(struct mtk_eint *eint, struct mtk_eint_pin *eint_pin)
err_eint:
for (i = 0; i < eint->nbase; i++) {
- if (eint->cur_mask[i])
- devm_kfree(eint->dev, eint->cur_mask[i]);
- if (eint->wake_mask[i])
- devm_kfree(eint->dev, eint->wake_mask[i]);
- if (eint->pin_list[i])
- devm_kfree(eint->dev, eint->pin_list[i]);
+ devm_kfree(eint->dev, eint->cur_mask[i]);
+ devm_kfree(eint->dev, eint->wake_mask[i]);
+ devm_kfree(eint->dev, eint->pin_list[i]);
}
devm_kfree(eint->dev, eint->cur_mask);
err_cur_mask:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 381/844] misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (379 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 380/844] pinctrl: mediatek: make devm allocations safer and clearer in mtk_eint_do_init() Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 382/844] misc: ti_fpc202: fix a potential memory leak in probe function Sasha Levin
` (471 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Markus Perkins, Greg Kroah-Hartman, Sasha Levin
From: Markus Perkins <markus@notsyncing.net>
[ Upstream commit b54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b ]
commit 14374fbb3f06 ("misc: eeprom_93xx46: Add new 93c56 and 93c66
compatible strings") added support for 93xx56 and 93xx66 eeproms, but
didn't take into account that the write enable/disable + erase all
commands are hardcoded for the 6-bit address of the 93xx46.
This commit fixes the command word generation by increasing the number
of shifts as the address field grows, keeping the command intact.
Also, the check for 8-bit or 16-bit mode is no longer required as this
is already taken into account in the edev->addrlen field.
Signed-off-by: Markus Perkins <markus@notsyncing.net>
Link: https://patch.msgid.link/20251202104823.429869-3-markus@notsyncing.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/eeprom/eeprom_93xx46.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index 9cae6f530679b..5230e910a1d11 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -45,6 +45,7 @@ struct eeprom_93xx46_platform_data {
#define OP_START 0x4
#define OP_WRITE (OP_START | 0x1)
#define OP_READ (OP_START | 0x2)
+/* The following addresses are offset for the 1K EEPROM variant in 16-bit mode */
#define ADDR_EWDS 0x00
#define ADDR_ERAL 0x20
#define ADDR_EWEN 0x30
@@ -191,10 +192,7 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
bits = edev->addrlen + 3;
cmd_addr = OP_START << edev->addrlen;
- if (edev->pdata->flags & EE_ADDR8)
- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << 1;
- else
- cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS);
+ cmd_addr |= (is_on ? ADDR_EWEN : ADDR_EWDS) << (edev->addrlen - 6);
if (has_quirk_instruction_length(edev)) {
cmd_addr <<= 2;
@@ -328,10 +326,7 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
bits = edev->addrlen + 3;
cmd_addr = OP_START << edev->addrlen;
- if (edev->pdata->flags & EE_ADDR8)
- cmd_addr |= ADDR_ERAL << 1;
- else
- cmd_addr |= ADDR_ERAL;
+ cmd_addr |= ADDR_ERAL << (edev->addrlen - 6);
if (has_quirk_instruction_length(edev)) {
cmd_addr <<= 2;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 382/844] misc: ti_fpc202: fix a potential memory leak in probe function
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (380 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 381/844] misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 383/844] pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function GPIOs Sasha Levin
` (470 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Felix Gu, Romain Gantois, Greg Kroah-Hartman, Sasha Levin
From: Felix Gu <gu_0233@qq.com>
[ Upstream commit dad9f13d967b4e53e8eaf5f9c690f8e778ad9802 ]
Use for_each_child_of_node_scoped() to simplify the code and ensure the
device node reference is automatically released when the loop scope
ends.
Signed-off-by: Felix Gu <gu_0233@qq.com>
Reviewed-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://patch.msgid.link/tencent_FA1AC670F5CF49873F88A44424F866994A08@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/ti_fpc202.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/misc/ti_fpc202.c b/drivers/misc/ti_fpc202.c
index 7964e46c74482..8eb2b5ac98506 100644
--- a/drivers/misc/ti_fpc202.c
+++ b/drivers/misc/ti_fpc202.c
@@ -309,7 +309,6 @@ static void fpc202_remove_port(struct fpc202_priv *priv, int port_id)
static int fpc202_probe(struct i2c_client *client)
{
struct device *dev = &client->dev;
- struct device_node *i2c_handle;
struct fpc202_priv *priv;
int ret, port_id;
@@ -357,7 +356,7 @@ static int fpc202_probe(struct i2c_client *client)
bitmap_zero(priv->probed_ports, FPC202_NUM_PORTS);
- for_each_child_of_node(dev->of_node, i2c_handle) {
+ for_each_child_of_node_scoped(dev->of_node, i2c_handle) {
ret = of_property_read_u32(i2c_handle, "reg", &port_id);
if (ret) {
if (ret == -EINVAL)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 383/844] pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function GPIOs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (381 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 382/844] misc: ti_fpc202: fix a potential memory leak in probe function Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 384/844] iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270 Sasha Levin
` (469 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Cosmin Tanislav, Geert Uytterhoeven, Sasha Levin
From: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
[ Upstream commit 49b039a61a314c18074c15a7047705399e1240e6 ]
Setting up an IRQ would normally be done in the .activate() and
.deactivate() ops of the IRQ domain, but for hierarchical IRQ domains
the .activate() and .deactivate() ops are overridden in the
gpiochip_hierarchy_setup_domain_ops() function.
As such, activating and deactivating need to be done in the .translate()
and .free() ops of the IRQ domain.
For RZ/T2H and RZ/N2H, interrupts go through the pin controller, into
the ICU, which level-translates them and forwards them to the GIC.
To use a GPIO as an interrupt it needs to be put into peripheral
function mode 0, which will connect it to the IRQ lines of the ICU.
The IRQ chip .child_to_parent_hwirq() callback is called as part of the
IRQ fwspec parsing logic (as part of irq_create_of_mapping()) which
happens before the IRQ is requested (as part of gpiochip_lock_as_irq()).
gpiochip_lock_as_irq() calls gpiod_get_direction() if the
.get_direction() callback is provided to ensure that the GPIO line is
set up as input.
In our case, IRQ function is separate from GPIO, and both cannot be true
at the same time.
Return GPIO_LINE_DIRECTION_IN even if pin is in IRQ function to allow
this setup to work.
Hold the spinlock to ensure atomicity between reading the PMC register
(which determines whether the pin is in GPIO mode or not) and reading
the function of the pin when it is not in GPIO mode.
Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251205150234.2958140-3-cosmin-gabriel.tanislav.xa@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzt2h.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzt2h.c b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
index 4826ff91cd906..40df706210119 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzt2h.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzt2h.c
@@ -51,6 +51,7 @@
#define PFC_MASK GENMASK_ULL(5, 0)
#define PFC_PIN_MASK(pin) (PFC_MASK << ((pin) * 8))
+#define PFC_FUNC_INTERRUPT 0
/*
* Use 16 lower bits [15:0] for pin identifier
@@ -486,6 +487,7 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
struct rzt2h_pinctrl *pctrl = gpiochip_get_data(chip);
u8 port = RZT2H_PIN_ID_TO_PORT(offset);
u8 bit = RZT2H_PIN_ID_TO_PIN(offset);
+ u64 reg64;
u16 reg;
int ret;
@@ -493,8 +495,25 @@ static int rzt2h_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
if (ret)
return ret;
- if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit))
+ guard(spinlock_irqsave)(&pctrl->lock);
+
+ if (rzt2h_pinctrl_readb(pctrl, port, PMC(port)) & BIT(bit)) {
+ /*
+ * When a GPIO is being requested as an IRQ, the pinctrl
+ * framework expects to be able to read the GPIO's direction.
+ * IRQ function is separate from GPIO, and enabling it takes the
+ * pin out of GPIO mode.
+ * At this point, .child_to_parent_hwirq() has already been
+ * called to enable the IRQ function.
+ * Default to input direction for IRQ function.
+ */
+ reg64 = rzt2h_pinctrl_readq(pctrl, port, PFC(port));
+ reg64 = (reg64 >> (bit * 8)) & PFC_MASK;
+ if (reg64 == PFC_FUNC_INTERRUPT)
+ return GPIO_LINE_DIRECTION_IN;
+
return -EINVAL;
+ }
reg = rzt2h_pinctrl_readw(pctrl, port, PM(port));
reg = (reg >> (bit * 2)) & PM_MASK;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 384/844] iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (382 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 383/844] pinctrl: renesas: rzt2h: Allow .get_direction() for IRQ function GPIOs Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 385/844] usb: gadget: f_fs: fix DMA-BUF OUT queues Sasha Levin
` (468 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Derek J. Clark, Andy Shevchenko, Jonathan Cameron, Sasha Levin
From: "Derek J. Clark" <derekjohn.clark@gmail.com>
[ Upstream commit f69b5ac682dbc61e6aca806c22ce2ae74d598e45 ]
Currently BMI260 & BMI270 devices do not automatically load this
driver. To fix this, add missing MODULE_DEVICE_TABLE for the i2c,
acpi, and of device tables so the driver will load when the hardware
is detected.
Tested on my OneXPlayer F1 Pro.
Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/bmi270/bmi270_i2c.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/iio/imu/bmi270/bmi270_i2c.c b/drivers/iio/imu/bmi270/bmi270_i2c.c
index b909a421ad017..b92da4e0776fa 100644
--- a/drivers/iio/imu/bmi270/bmi270_i2c.c
+++ b/drivers/iio/imu/bmi270/bmi270_i2c.c
@@ -37,6 +37,7 @@ static const struct i2c_device_id bmi270_i2c_id[] = {
{ "bmi270", (kernel_ulong_t)&bmi270_chip_info },
{ }
};
+MODULE_DEVICE_TABLE(i2c, bmi270_i2c_id);
static const struct acpi_device_id bmi270_acpi_match[] = {
/* GPD Win Mini, Aya Neo AIR Pro, OXP Mini Pro, etc. */
@@ -45,12 +46,14 @@ static const struct acpi_device_id bmi270_acpi_match[] = {
{ "BMI0260", (kernel_ulong_t)&bmi260_chip_info },
{ }
};
+MODULE_DEVICE_TABLE(acpi, bmi270_acpi_match);
static const struct of_device_id bmi270_of_match[] = {
{ .compatible = "bosch,bmi260", .data = &bmi260_chip_info },
{ .compatible = "bosch,bmi270", .data = &bmi270_chip_info },
{ }
};
+MODULE_DEVICE_TABLE(of, bmi270_of_match);
static struct i2c_driver bmi270_i2c_driver = {
.driver = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 385/844] usb: gadget: f_fs: fix DMA-BUF OUT queues
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (383 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 384/844] iio: bmi270_i2c: Add MODULE_DEVICE_TABLE for BMI260/270 Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:24 ` [PATCH 6.19 386/844] usb: gadget: f_fs: Fix ioctl error handling Sasha Levin
` (467 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sam Day, David Heidelberg, Greg Kroah-Hartman, Sasha Levin
From: Sam Day <me@samcday.com>
[ Upstream commit 0145e7acd29855dfba4a2f387d455b5d9a520f0e ]
Currently, DMA_FROM_DEVICE is used when attaching DMABUFs to IN
endpoints and DMA_TO_DEVICE for OUT endpoints. This is inverted from
how it should be.
The result is IOMMU read-only mappings placed on OUT queues,
triggering arm-smmu write faults.
Put differently, OUT endpoints flow data from host -> gadget, meaning
the UDC peripheral needs to have write access to the buffer to fill it
with the incoming data.
This commit flips the directions and updates the implicit-sync helpers
so IN endpoints act as readers and OUT endpoints as writers.
Signed-off-by: Sam Day <me@samcday.com>
Tested-by: David Heidelberg <david@ixit.cz> # OnePlus 6T on sdm845-next-20251119
Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-2-e51633891a81@samcday.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_fs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index fa467a40949d2..928f51fddc64e 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1509,7 +1509,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd)
goto err_dmabuf_detach;
}
- dir = epfile->in ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+ dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
err = ffs_dma_resv_lock(dmabuf, nonblock);
if (err)
@@ -1639,7 +1639,7 @@ static int ffs_dmabuf_transfer(struct file *file,
/* Make sure we don't have writers */
timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS);
retl = dma_resv_wait_timeout(dmabuf->resv,
- dma_resv_usage_rw(epfile->in),
+ dma_resv_usage_rw(!epfile->in),
true, timeout);
if (retl == 0)
retl = -EBUSY;
@@ -1684,7 +1684,7 @@ static int ffs_dmabuf_transfer(struct file *file,
dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
&priv->lock, priv->context, seqno);
- resv_dir = epfile->in ? DMA_RESV_USAGE_WRITE : DMA_RESV_USAGE_READ;
+ resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;
dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir);
dma_resv_unlock(dmabuf->resv);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 386/844] usb: gadget: f_fs: Fix ioctl error handling
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (384 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 385/844] usb: gadget: f_fs: fix DMA-BUF OUT queues Sasha Levin
@ 2026-02-28 17:24 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 387/844] usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() Sasha Levin
` (466 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:24 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sam Day, Greg Kroah-Hartman, Sasha Levin
From: Sam Day <me@samcday.com>
[ Upstream commit 8e4c1d06183c25022f6b0002a5cab84979ca6337 ]
When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently
falling through when copy_from_user fails.
However, this fallthrough isn't being checked properly, so the handler
continues executing further than it should. It then tries the secondary
dispatch where it ultimately gives up and returns -ENOTTY.
The end result is invalid ioctl invocations will yield a -ENOTTY rather
than an -EFAULT.
It's a common pattern elsewhere in the kernel code to directly return
-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do
the same and fix this issue.
Signed-off-by: Sam Day <me@samcday.com>
Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_fs.c | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 928f51fddc64e..e75d5d8b5ac91 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1744,10 +1744,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
{
int fd;
- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
- ret = -EFAULT;
- break;
- }
+ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
+ return -EFAULT;
return ffs_dmabuf_attach(file, fd);
}
@@ -1755,10 +1753,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
{
int fd;
- if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
- ret = -EFAULT;
- break;
- }
+ if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
+ return -EFAULT;
return ffs_dmabuf_detach(file, fd);
}
@@ -1766,10 +1762,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
{
struct usb_ffs_dmabuf_transfer_req req;
- if (copy_from_user(&req, (void __user *)value, sizeof(req))) {
- ret = -EFAULT;
- break;
- }
+ if (copy_from_user(&req, (void __user *)value, sizeof(req)))
+ return -EFAULT;
return ffs_dmabuf_transfer(file, &req);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 387/844] usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (385 preceding siblings ...)
2026-02-28 17:24 ` [PATCH 6.19 386/844] usb: gadget: f_fs: Fix ioctl error handling Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 388/844] staging: rtl8723bs: fix memory leak on failure path Sasha Levin
` (465 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mario Peter, Xu Yang, Peter Chen, Greg Kroah-Hartman, Sasha Levin
From: Mario Peter <mario.peter@leica-geosystems.com>
[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ]
The ChipIdea UDC driver can encounter "not page aligned sg buffer"
errors when a USB device is reconnected after being disconnected
during an active transfer. This occurs because _ep_nuke() returns
requests to the gadget layer without properly unmapping DMA buffers
or cleaning up scatter-gather bounce buffers.
Root cause:
When a disconnect happens during a multi-segment DMA transfer, the
request's num_mapped_sgs field and sgt.sgl pointer remain set with
stale values. The request is returned to the gadget driver with status
-ESHUTDOWN but still has active DMA state. If the gadget driver reuses
this request on reconnect without reinitializing it, the stale DMA
state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero
num_mapped_sgs) and attempt to use freed/invalid DMA addresses,
leading to alignment errors and potential memory corruption.
The normal completion path via _hardware_dequeue() properly calls
usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before
returning the request. The _ep_nuke() path must do the same cleanup
to ensure requests are returned in a clean, reusable state.
Fix:
Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror
the cleanup sequence in _hardware_dequeue():
- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set
- Call sglist_do_debounce() with copy=false if bounce buffer exists
This ensures that when requests are returned due to endpoint shutdown,
they don't retain stale DMA mappings. The 'false' parameter to
sglist_do_debounce() prevents copying data back (appropriate for
shutdown path where transfer was aborted).
Signed-off-by: Mario Peter <mario.peter@leica-geosystems.com>
Reviewed-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/chipidea/udc.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 64a421ae0f05b..c8d931d9d4330 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -931,6 +931,13 @@ __acquires(hwep->lock)
list_del_init(&hwreq->queue);
hwreq->req.status = -ESHUTDOWN;
+ /* Unmap DMA and clean up bounce buffers before giving back */
+ usb_gadget_unmap_request_by_dev(hwep->ci->dev->parent,
+ &hwreq->req, hwep->dir);
+
+ if (hwreq->sgt.sgl)
+ sglist_do_debounce(hwreq, false);
+
if (hwreq->req.complete != NULL) {
spin_unlock(hwep->lock);
usb_gadget_giveback_request(&hwep->ep, &hwreq->req);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 388/844] staging: rtl8723bs: fix memory leak on failure path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (386 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 387/844] usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 389/844] serial: 8250: 8250_omap.c: Add support for handling UART error conditions Sasha Levin
` (464 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Diksha Kumari, Mukesh Kumar Chaurasiya, Greg Kroah-Hartman,
Sasha Levin
From: Diksha Kumari <dikshakdevgan@gmail.com>
[ Upstream commit abe850d82c8cb72d28700673678724e779b1826e ]
cfg80211_inform_bss_frame() may return NULL on failure. In that case,
the allocated buffer 'buf' is not freed and the function returns early,
leading to potential memory leak.
Fix this by ensuring that 'buf' is freed on both success and failure paths.
Signed-off-by: Diksha Kumari <dikshakdevgan@gmail.com>
Reviewed-by: Mukesh Kumar Chaurasiya <mkchauras@linux.ibm.com>
Link: https://patch.msgid.link/20260113091712.7071-1-dikshakdevgan@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 60edeae1cffe7..476ab055e53e5 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -315,9 +315,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl
len, notify_signal, GFP_ATOMIC);
if (unlikely(!bss))
- goto exit;
+ goto free_buf;
cfg80211_put_bss(wiphy, bss);
+free_buf:
kfree(buf);
exit:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 389/844] serial: 8250: 8250_omap.c: Add support for handling UART error conditions
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (387 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 388/844] staging: rtl8723bs: fix memory leak on failure path Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 390/844] serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done Sasha Levin
` (463 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Moteen Shah, Greg Kroah-Hartman, Sasha Levin
From: Moteen Shah <m-shah@ti.com>
[ Upstream commit 623b07b370e9963122d167e04fdc1dc713ebfbaf ]
The DMA IRQ handler does not accounts for the overrun(OE) or any other
errors being reported by the IP before triggering a DMA transaction which
leads to the interrupts not being handled resulting into an IRQ storm.
The way to handle OE is to:
1. Reset the RX FIFO.
2. Read the UART_RESUME register, which clears the internal flag
Earlier, the driver issued DMA transations even in case of OE which shouldn't
be done according to the OE handling mechanism mentioned above, as we are
resetting the FIFO's, refer section: "12.1.6.4.8.1.3.6 Overrun During
Receive" [0].
[0] https://www.ti.com/lit/pdf/spruiu1
Signed-off-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260112081829.63049-2-m-shah@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 9e49ef48b851b..e26bae0a6488f 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -100,6 +100,9 @@
#define OMAP_UART_REV_52 0x0502
#define OMAP_UART_REV_63 0x0603
+/* Resume register */
+#define UART_OMAP_RESUME 0x0B
+
/* Interrupt Enable Register 2 */
#define UART_OMAP_IER2 0x1B
#define UART_OMAP_IER2_RHR_IT_DIS BIT(2)
@@ -119,7 +122,6 @@
/* Timeout low and High */
#define UART_OMAP_TO_L 0x26
#define UART_OMAP_TO_H 0x27
-
struct omap8250_priv {
void __iomem *membase;
int line;
@@ -1256,6 +1258,20 @@ static u16 omap_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir, u16 status
return status;
}
+static void am654_8250_handle_uart_errors(struct uart_8250_port *up, u8 iir, u16 status)
+{
+ if (status & UART_LSR_OE) {
+ serial8250_clear_and_reinit_fifos(up);
+ serial_in(up, UART_LSR);
+ serial_in(up, UART_OMAP_RESUME);
+ } else {
+ if (status & (UART_LSR_FE | UART_LSR_PE | UART_LSR_BI))
+ serial_in(up, UART_RX);
+ if (iir & UART_IIR_XOFF)
+ serial_in(up, UART_IIR);
+ }
+}
+
static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
u16 status)
{
@@ -1266,7 +1282,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
* Queue a new transfer if FIFO has data.
*/
if ((status & (UART_LSR_DR | UART_LSR_BI)) &&
- (up->ier & UART_IER_RDI)) {
+ (up->ier & UART_IER_RDI) && !(status & UART_LSR_OE)) {
+ am654_8250_handle_uart_errors(up, iir, status);
omap_8250_rx_dma(up);
serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);
} else if ((iir & 0x3f) == UART_IIR_RX_TIMEOUT) {
@@ -1282,6 +1299,8 @@ static void am654_8250_handle_rx_dma(struct uart_8250_port *up, u8 iir,
serial_out(up, UART_OMAP_EFR2, 0x0);
up->ier |= UART_IER_RLSI | UART_IER_RDI;
serial_out(up, UART_IER, up->ier);
+ } else {
+ am654_8250_handle_uart_errors(up, iir, status);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 390/844] serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (388 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 389/844] serial: 8250: 8250_omap.c: Add support for handling UART error conditions Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 391/844] fix it87_wdt early reboot by reporting running timer Sasha Levin
` (462 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Moteen Shah, Greg Kroah-Hartman, Sasha Levin
From: Moteen Shah <m-shah@ti.com>
[ Upstream commit a5fd8945a478ff9be14812693891d7c9b4185a50 ]
Clear rx_running flag only after DMA teardown polling completes. In the
previous implementation the flag was being cleared while hardware teardown
was still in progress, creating a mismatch between software state
(flag = 0, "ready") and hardware state (still terminating).
Signed-off-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/20260112081829.63049-3-m-shah@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e26bae0a6488f..272bc07c9a6b5 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -931,7 +931,6 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
goto out;
cookie = dma->rx_cookie;
- dma->rx_running = 0;
/* Re-enable RX FIFO interrupt now that transfer is complete */
if (priv->habit & UART_HAS_RHR_IT_DIS) {
@@ -965,6 +964,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
goto out;
ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+ dma->rx_running = 0;
p->port.icount.rx += ret;
p->port.icount.buf_overrun += count - ret;
out:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 391/844] fix it87_wdt early reboot by reporting running timer
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (389 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 390/844] serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 392/844] binder: don't use %pK through printk Sasha Levin
` (461 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: René Rebe, Guenter Roeck, Wim Van Sebroeck, Sasha Levin
From: René Rebe <rene@exactco.de>
[ Upstream commit 88b2ab346436f799b99894a3e9518a3ffa344524 ]
Some products, such as the Ugreen DXP4800 Plus NAS, ship with the it87
wdt enabled by the firmware and a broken BIOS option that does not
allow to change the time or turn it off. As this makes installing
Linux rather difficult, change the it87_wdt to report it running to
the watchdog core.
Signed-off-by: René Rebe <rene@exactco.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/it87_wdt.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
index 3b8488c86a2f3..1d9f8591f38d8 100644
--- a/drivers/watchdog/it87_wdt.c
+++ b/drivers/watchdog/it87_wdt.c
@@ -188,6 +188,12 @@ static void _wdt_update_timeout(unsigned int t)
superio_outb(t >> 8, WDTVALMSB);
}
+/* Internal function, should be called after superio_select(GPIO) */
+static bool _wdt_running(void)
+{
+ return superio_inb(WDTVALLSB) || (max_units > 255 && superio_inb(WDTVALMSB));
+}
+
static int wdt_update_timeout(unsigned int t)
{
int ret;
@@ -374,6 +380,12 @@ static int __init it87_wdt_init(void)
}
}
+ /* wdt already left running by firmware? */
+ if (_wdt_running()) {
+ pr_info("Left running by firmware.\n");
+ set_bit(WDOG_HW_RUNNING, &wdt_dev.status);
+ }
+
superio_exit();
if (timeout < 1 || timeout > max_units * 60) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 392/844] binder: don't use %pK through printk
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (390 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 391/844] fix it87_wdt early reboot by reporting running timer Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 393/844] watchdog: imx7ulp_wdt: handle the nowayout option Sasha Levin
` (460 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Weißschuh, Carlos Llamas, Alice Ryhl,
Greg Kroah-Hartman, Sasha Levin
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 56d21267663bad91e8b10121224ec46366a7937e ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log. Since commit ad67b74d2469 ("printk: hash
addresses printed with %p") the regular %p has been improved to avoid
this issue. Furthermore, restricted pointers ("%pK") were never meant
to be used through printk(). They can still unintentionally leak raw
pointers or acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
There are still a few users of %pK left, but these use it through
seq_file, for which its usage is safe.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/android/binder.c | 2 +-
drivers/android/binder_alloc.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index b356c9b882544..33e4dad0915bb 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -4523,7 +4523,7 @@ static int binder_thread_write(struct binder_proc *proc,
}
}
binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
+ "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
proc->pid, thread->pid, (u64)cookie,
death);
if (death == NULL) {
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 979c96b74cad3..d5ed64543bbf4 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -81,7 +81,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc,
new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
- "%d: add free buffer, size %zd, at %pK\n",
+ "%d: add free buffer, size %zd, at %p\n",
alloc->pid, new_buffer_size, new_buffer);
while (*p) {
@@ -572,7 +572,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
}
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
- "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
+ "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
alloc->pid, size, buffer, buffer_size);
/*
@@ -748,7 +748,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
ALIGN(buffer->extra_buffers_size, sizeof(void *));
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
- "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
+ "%d: binder_free_buf %p size %zd buffer_size %zd\n",
alloc->pid, buffer, size, buffer_size);
BUG_ON(buffer->free);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 393/844] watchdog: imx7ulp_wdt: handle the nowayout option
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (391 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 392/844] binder: don't use %pK through printk Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 394/844] watchdog: rzv2h_wdt: Discard pm_runtime_put() return value Sasha Levin
` (459 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oleksandr Suvorov, Guenter Roeck, Frank Li, Wim Van Sebroeck,
Sasha Levin
From: Oleksandr Suvorov <cryosay@gmail.com>
[ Upstream commit d303d37ef5cf86c8c3b2daefd2a7d7fd8ca1ec14 ]
The module parameter `nowayout` indicates whether the watchdog should ever
be allowed to stop, but the driver currently ignores this option.
Pass the `nowayout` parameter to the watchdog core by setting the
WDOG_NO_WAY_OUT flag accordingly.
Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/imx7ulp_wdt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/watchdog/imx7ulp_wdt.c b/drivers/watchdog/imx7ulp_wdt.c
index 0f13a30533574..03479110453ce 100644
--- a/drivers/watchdog/imx7ulp_wdt.c
+++ b/drivers/watchdog/imx7ulp_wdt.c
@@ -346,6 +346,7 @@ static int imx7ulp_wdt_probe(struct platform_device *pdev)
watchdog_stop_on_reboot(wdog);
watchdog_stop_on_unregister(wdog);
watchdog_set_drvdata(wdog, imx7ulp_wdt);
+ watchdog_set_nowayout(wdog, nowayout);
imx7ulp_wdt->hw = of_device_get_match_data(dev);
ret = imx7ulp_wdt_init(imx7ulp_wdt, wdog->timeout * imx7ulp_wdt->hw->wdog_clock_rate);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 394/844] watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (392 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 393/844] watchdog: imx7ulp_wdt: handle the nowayout option Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 395/844] phy: mvebu-cp110-utmi: fix dr_mode property read from dts Sasha Levin
` (458 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Rafael J. Wysocki, Guenter Roeck, Wim Van Sebroeck, Sasha Levin
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
[ Upstream commit 2dea984a74265a67e3210f818416a83b87f70200 ]
Failing device probe due to pm_runtime_put() returning an error is not
particularly useful.
Returning an error code from pm_runtime_put() merely means that it has
not queued up a work item to check whether or not the device can be
suspended and there are many perfectly valid situations in which that
can happen, like after writing "on" to the devices' runtime PM "control"
attribute in sysfs for one example. It also happens when the kernel is
configured with CONFIG_PM unset.
Accordingly, update rzt2h_wdt_wdtdcr_init() to simply discard the return
value of pm_runtime_put() and return success to the caller after
invoking that function.
This will facilitate a planned change of the pm_runtime_put() return
type to void in the future.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/rzv2h_wdt.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/watchdog/rzv2h_wdt.c b/drivers/watchdog/rzv2h_wdt.c
index a694786837e11..f9bb4ef3d327b 100644
--- a/drivers/watchdog/rzv2h_wdt.c
+++ b/drivers/watchdog/rzv2h_wdt.c
@@ -270,9 +270,7 @@ static int rzt2h_wdt_wdtdcr_init(struct platform_device *pdev,
rzt2h_wdt_wdtdcr_count_stop(priv);
- ret = pm_runtime_put(&pdev->dev);
- if (ret < 0)
- return ret;
+ pm_runtime_put(&pdev->dev);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 395/844] phy: mvebu-cp110-utmi: fix dr_mode property read from dts
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (393 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 394/844] watchdog: rzv2h_wdt: Discard pm_runtime_put() return value Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 396/844] phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature Sasha Levin
` (457 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Aleksandar Gerasimovski, Vinod Koul, Sasha Levin
From: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
[ Upstream commit e2ce913452ab56b3330539cc443b97b7ea8c3a1a ]
The problem with the current implementation is that it does not consider
that the USB controller can have multiple PHY handles with different
arguments count, as for example we have in our cn9131 based platform:
"phys = <&cp0_comphy1 0>, <&cp0_utmi0>;".
In such case calling "of_usb_get_dr_mode_by_phy" with -1 (no phy-cells)
leads to not proper phy detection, taking the "marvell,cp110-utmi-phy"
dts definition we can call the "of_usb_get_dr_mode_by_phy" with 0
(#phy-cells = <0>) and safely look for that phy.
Signed-off-by: Aleksandar Gerasimovski <aleksandar.gerasimovski@belden.com>
Link: https://patch.msgid.link/20260106150643.922110-1-aleksandar.gerasimovski@belden.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/marvell/phy-mvebu-cp110-utmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
index 59903f86b13f5..dd3e515a8e865 100644
--- a/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
+++ b/drivers/phy/marvell/phy-mvebu-cp110-utmi.c
@@ -338,7 +338,7 @@ static int mvebu_cp110_utmi_phy_probe(struct platform_device *pdev)
return -ENOMEM;
}
- port->dr_mode = of_usb_get_dr_mode_by_phy(child, -1);
+ port->dr_mode = of_usb_get_dr_mode_by_phy(child, 0);
if ((port->dr_mode != USB_DR_MODE_HOST) &&
(port->dr_mode != USB_DR_MODE_PERIPHERAL)) {
dev_err(&pdev->dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 396/844] phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (394 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 395/844] phy: mvebu-cp110-utmi: fix dr_mode property read from dts Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 397/844] Revert "mfd: da9052-spi: Change read-mask to write-mask" Sasha Levin
` (456 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Xu Yang, Frank Li, Vinod Koul, Sasha Levin
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 27ee0869d77b2cb404770ac49bdceae3aedf658b ]
Disabling PHYs in runtime usually causes the client with external abort
exception or similar issue due to lack of API to notify clients about PHY
removal. This patch removes the possibility to unbind i.MX PHY drivers in
runtime.
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260120111712.3159782-1-xu.yang_2@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
index 91b3e62743d3a..b30d01f345d20 100644
--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
@@ -730,6 +730,7 @@ static struct platform_driver imx8mq_usb_phy_driver = {
.driver = {
.name = "imx8mq-usb-phy",
.of_match_table = imx8mq_usb_phy_of_match,
+ .suppress_bind_attrs = true,
}
};
module_platform_driver(imx8mq_usb_phy_driver);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 397/844] Revert "mfd: da9052-spi: Change read-mask to write-mask"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (395 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 396/844] phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 398/844] mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs Sasha Levin
` (455 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Marcus Folkesson, Lee Jones, Sasha Levin
From: Marcus Folkesson <marcus.folkesson@gmail.com>
[ Upstream commit 12daa9c1954542bf98bb942fb2dadf19de79a44b ]
This reverts commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed.
Almost every register in this chip can be customized via OTP
memory. Somehow the value for R19, which decide if the flag is set
on read or write operation, seems to have been overwritten for the chip
the original patch were written for.
Revert the change to follow the default behavior.
Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Link: https://patch.msgid.link/20251124-da9052-revert-v1-1-fbeb2c894002@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/da9052-spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
index 80fc5c0cac2fb..be5f2b34e18ae 100644
--- a/drivers/mfd/da9052-spi.c
+++ b/drivers/mfd/da9052-spi.c
@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
spi_set_drvdata(spi, da9052);
config = da9052_regmap_config;
- config.write_flag_mask = 1;
+ config.read_flag_mask = 1;
config.reg_bits = 7;
config.pad_bits = 1;
config.val_bits = 8;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 398/844] mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (396 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 397/844] Revert "mfd: da9052-spi: Change read-mask to write-mask" Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 399/844] iio: Use IRQF_NO_THREAD Sasha Levin
` (454 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilpo Järvinen, Andy Shevchenko, Lee Jones, Sasha Levin
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit cefd793fa17de708d043adab50e7f96f414b0f1d ]
Add Intel Nova Lake-S LPSS PCI IDs.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260113172151.48062-1-ilpo.jarvinen@linux.intel.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
index 8d92c895d3aef..713a5bfb1a3c2 100644
--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -437,6 +437,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
{ PCI_VDEVICE(INTEL, 0x5ac4), (kernel_ulong_t)&bxt_spi_info },
{ PCI_VDEVICE(INTEL, 0x5ac6), (kernel_ulong_t)&bxt_spi_info },
{ PCI_VDEVICE(INTEL, 0x5aee), (kernel_ulong_t)&bxt_uart_info },
+ /* NVL-S */
+ { PCI_VDEVICE(INTEL, 0x6e28), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x6e29), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x6e2a), (kernel_ulong_t)&tgl_spi_info },
+ { PCI_VDEVICE(INTEL, 0x6e2b), (kernel_ulong_t)&tgl_spi_info },
+ { PCI_VDEVICE(INTEL, 0x6e4c), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x6e4d), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x6e4e), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x6e4f), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x6e5c), (kernel_ulong_t)&bxt_uart_info },
+ { PCI_VDEVICE(INTEL, 0x6e5e), (kernel_ulong_t)&tgl_spi_info },
+ { PCI_VDEVICE(INTEL, 0x6e7a), (kernel_ulong_t)&ehl_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x6e7b), (kernel_ulong_t)&ehl_i2c_info },
/* ARL-H */
{ PCI_VDEVICE(INTEL, 0x7725), (kernel_ulong_t)&bxt_uart_info },
{ PCI_VDEVICE(INTEL, 0x7726), (kernel_ulong_t)&bxt_uart_info },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 399/844] iio: Use IRQF_NO_THREAD
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (397 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 398/844] mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 400/844] iio: magnetometer: Remove IRQF_ONESHOT Sasha Levin
` (453 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Andrzej Siewior, Andy Shevchenko, Jonathan Cameron,
Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 04d390af97f2c28166f7ddfe1a6bda622e3a4766 ]
The interrupt handler iio_trigger_generic_data_rdy_poll() will invoke
other interrupt handler and this supposed to happen from within the
hardirq.
Use IRQF_NO_THREAD to forbid forced-threading.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/bma180.c | 5 +++--
drivers/iio/adc/ad7766.c | 2 +-
drivers/iio/gyro/itg3200_buffer.c | 8 +++-----
drivers/iio/light/si1145.c | 2 +-
4 files changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index 8925f5279e627..7bc6761f51354 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -986,8 +986,9 @@ static int bma180_probe(struct i2c_client *client)
}
ret = devm_request_irq(dev, client->irq,
- iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING,
- "bma180_event", data->trig);
+ iio_trigger_generic_data_rdy_poll,
+ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
+ "bma180_event", data->trig);
if (ret) {
dev_err(dev, "unable to request IRQ\n");
goto err_trigger_free;
diff --git a/drivers/iio/adc/ad7766.c b/drivers/iio/adc/ad7766.c
index 4d570383ef025..1e6bfe8765ab3 100644
--- a/drivers/iio/adc/ad7766.c
+++ b/drivers/iio/adc/ad7766.c
@@ -261,7 +261,7 @@ static int ad7766_probe(struct spi_device *spi)
* don't enable the interrupt to avoid extra load on the system
*/
ret = devm_request_irq(&spi->dev, spi->irq, ad7766_irq,
- IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
+ IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN | IRQF_NO_THREAD,
dev_name(&spi->dev),
ad7766->trig);
if (ret < 0)
diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c
index a624400a239cb..cf97adfa97274 100644
--- a/drivers/iio/gyro/itg3200_buffer.c
+++ b/drivers/iio/gyro/itg3200_buffer.c
@@ -118,11 +118,9 @@ int itg3200_probe_trigger(struct iio_dev *indio_dev)
if (!st->trig)
return -ENOMEM;
- ret = request_irq(st->i2c->irq,
- &iio_trigger_generic_data_rdy_poll,
- IRQF_TRIGGER_RISING,
- "itg3200_data_rdy",
- st->trig);
+ ret = request_irq(st->i2c->irq, &iio_trigger_generic_data_rdy_poll,
+ IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
+ "itg3200_data_rdy", st->trig);
if (ret)
goto error_free_trig;
diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c
index f8eb251eca8dc..ef0abc4499b74 100644
--- a/drivers/iio/light/si1145.c
+++ b/drivers/iio/light/si1145.c
@@ -1248,7 +1248,7 @@ static int si1145_probe_trigger(struct iio_dev *indio_dev)
ret = devm_request_irq(&client->dev, client->irq,
iio_trigger_generic_data_rdy_poll,
- IRQF_TRIGGER_FALLING,
+ IRQF_TRIGGER_FALLING | IRQF_NO_THREAD,
"si1145_irq",
trig);
if (ret < 0) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 400/844] iio: magnetometer: Remove IRQF_ONESHOT
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (398 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 399/844] iio: Use IRQF_NO_THREAD Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 401/844] MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE Sasha Levin
` (452 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Andrzej Siewior, Geert Uytterhoeven, Andy Shevchenko,
Nuno Sá, Jonathan Cameron, Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit a54e9440925e6617c98669066b4753c4cdcea8a0 ]
Passing IRQF_ONESHOT ensures that the interrupt source is masked until
the secondary (threaded) handler is done. If only a primary handler is
used then the flag makes no sense because the interrupt can not fire
(again) while its handler is running.
The flag also disallows force-threading of the primary handler and the
irq-core will warn about this.
The force-threading functionality is required on PREEMPT_RT because the
handler is using locks with can sleep on PREEMPT_RT.
Remove IRQF_ONESHOT from irqflags.
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/magnetometer/ak8975.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index 3fd0171e5d69b..d30315ad85ded 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -581,7 +581,7 @@ static int ak8975_setup_irq(struct ak8975_data *data)
irq = gpiod_to_irq(data->eoc_gpiod);
rc = devm_request_irq(&client->dev, irq, ak8975_irq_handler,
- IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ IRQF_TRIGGER_RISING,
dev_name(&client->dev), data);
if (rc < 0) {
dev_err(&client->dev, "irq %d request failed: %d\n", irq, rc);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 401/844] MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (399 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 400/844] iio: magnetometer: Remove IRQF_ONESHOT Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 402/844] block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova Sasha Levin
` (451 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: John Garry, Huacai Chen, Thomas Bogendoerfer, Sasha Levin
From: John Garry <john.g.garry@oracle.com>
[ Upstream commit d55d3fe2d1470ac5b6e93efe7998b728013c9fc8 ]
The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which
is a valid index - so add a check for this.
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/mach-loongson64/topology.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/include/asm/mach-loongson64/topology.h b/arch/mips/include/asm/mach-loongson64/topology.h
index 3414a1fd17835..89bb4deab98a6 100644
--- a/arch/mips/include/asm/mach-loongson64/topology.h
+++ b/arch/mips/include/asm/mach-loongson64/topology.h
@@ -7,7 +7,7 @@
#define cpu_to_node(cpu) (cpu_logical_map(cpu) >> 2)
extern cpumask_t __node_cpumask[];
-#define cpumask_of_node(node) (&__node_cpumask[node])
+#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &__node_cpumask[node])
struct pci_bus;
extern int pcibus_to_node(struct pci_bus *);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 402/844] block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (400 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 401/844] MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 403/844] fs: ntfs3: check return value of indx_find to avoid infinite loop Sasha Levin
` (450 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chaitanya Kulkarni, Christoph Hellwig, Jens Axboe, Sasha Levin
From: Chaitanya Kulkarni <kch@nvidia.com>
[ Upstream commit 81e7223b1a2d63b655ee72577c8579f968d037e3 ]
When dma_iova_link() fails partway through mapping a request's bvec
list, the function breaks out of the loop without cleaning up
already mapped segments. Similarly, if dma_iova_sync() fails after
linking all segments, no cleanup is performed.
This leaves partial IOVA mappings in place. The completion path
attempts to unmap the full expected size via dma_iova_destroy() or
nvme_unmap_data(), but only a partial size was actually mapped,
leading to incorrect unmap operations.
Add an out_unlink error path that calls dma_iova_destroy() to clean
up partial mappings before returning failure. The dma_iova_destroy()
function handles both partial unlink and IOVA space freeing. It
correctly handles the mapped_len == 0 case (first dma_iova_link()
failure) by only freeing the IOVA allocation without attempting to
unmap.
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq-dma.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/block/blk-mq-dma.c b/block/blk-mq-dma.c
index fb018fffffdcc..feead1934301a 100644
--- a/block/blk-mq-dma.c
+++ b/block/blk-mq-dma.c
@@ -126,17 +126,20 @@ static bool blk_rq_dma_map_iova(struct request *req, struct device *dma_dev,
error = dma_iova_link(dma_dev, state, vec->paddr, mapped,
vec->len, dir, attrs);
if (error)
- break;
+ goto out_unlink;
mapped += vec->len;
} while (blk_map_iter_next(req, &iter->iter, vec));
error = dma_iova_sync(dma_dev, state, 0, mapped);
- if (error) {
- iter->status = errno_to_blk_status(error);
- return false;
- }
+ if (error)
+ goto out_unlink;
return true;
+
+out_unlink:
+ dma_iova_destroy(dma_dev, state, mapped, dir, attrs);
+ iter->status = errno_to_blk_status(error);
+ return false;
}
static inline void blk_rq_map_iter_init(struct request *rq,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 403/844] fs: ntfs3: check return value of indx_find to avoid infinite loop
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (401 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 402/844] block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 404/844] fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata Sasha Levin
` (449 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jaehun Gou, Seunghun Han, Jihoon Kwon, Konstantin Komarov,
Sasha Levin
From: Jaehun Gou <p22gone@gmail.com>
[ Upstream commit 1732053c8a6b360e2d5afb1b34fe9779398b072c ]
We found an infinite loop bug in the ntfs3 file system that can lead to a
Denial-of-Service (DoS) condition.
A malformed dentry in the ntfs3 filesystem can cause the kernel to hang
during the lookup operations. By setting the HAS_SUB_NODE flag in an
INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the
VCN pointer, an attacker can cause the indx_find() function to repeatedly
read the same block, allocating 4 KB of memory each time. The kernel lacks
VCN loop detection and depth limits, causing memory exhaustion and an OOM
crash.
This patch adds a return value check for fnd_push() to prevent a memory
exhaustion vulnerability caused by infinite loops. When the index exceeds the
size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find()
function checks this return value and stops processing, preventing further
memory allocation.
Co-developed-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/index.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 7157cfd70fdcb..75b94beac1613 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1190,7 +1190,12 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni,
return -EINVAL;
}
- fnd_push(fnd, node, e);
+ err = fnd_push(fnd, node, e);
+
+ if (err) {
+ put_indx_node(node);
+ return err;
+ }
}
*entry = e;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 404/844] fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (402 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 403/844] fs: ntfs3: check return value of indx_find to avoid infinite loop Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 405/844] fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST Sasha Levin
` (448 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jaehun Gou, Seunghun Han, Jihoon Kwon, Konstantin Komarov,
Sasha Levin
From: Jaehun Gou <p22gone@gmail.com>
[ Upstream commit 4b90f16e4bb5607fb35e7802eb67874038da4640 ]
We found an infinite loop bug in the ntfs3 file system that can lead to a
Denial-of-Service (DoS) condition.
A malformed NTFS image can cause an infinite loop when an attribute header
indicates an empty run list, while directory entries reference it as
containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way
to represent an empty run list, and run_unpack() correctly handles this by
checking if evcn + 1 equals svcn and returning early without parsing any run
data. However, this creates a problem when there is metadata inconsistency,
where the attribute header claims to be empty (evcn=-1) but the caller
expects to read actual data. When run_unpack() immediately returns success
upon seeing this condition, it leaves the runs_tree uninitialized with
run->runs as a NULL. The calling function attr_load_runs_range() assumes
that a successful return means that the runs were loaded and sets clen to 0,
expecting the next run_lookup_entry() call to succeed. Because runs_tree
remains uninitialized, run_lookup_entry() continues to fail, and the loop
increments vcn by zero (vcn += 0), leading to an infinite loop.
This patch adds a retry counter to detect when run_lookup_entry() fails
consecutively after attr_load_runs_vcn(). If the run is still not found on
the second attempt, it indicates corrupted metadata and returns -EINVAL,
preventing the Denial-of-Service (DoS) vulnerability.
Co-developed-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrib.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 980ae9157248d..c45880ab23912 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1354,19 +1354,28 @@ int attr_load_runs_range(struct ntfs_inode *ni, enum ATTR_TYPE type,
CLST vcn;
CLST vcn_last = (to - 1) >> cluster_bits;
CLST lcn, clen;
- int err;
+ int err = 0;
+ int retry = 0;
for (vcn = from >> cluster_bits; vcn <= vcn_last; vcn += clen) {
if (!run_lookup_entry(run, vcn, &lcn, &clen, NULL)) {
+ if (retry != 0) { /* Next run_lookup_entry(vcn) also failed. */
+ err = -EINVAL;
+ break;
+ }
err = attr_load_runs_vcn(ni, type, name, name_len, run,
vcn);
if (err)
- return err;
+ break;
+
clen = 0; /* Next run_lookup_entry(vcn) must be success. */
+ retry++;
}
+ else
+ retry = 0;
}
- return 0;
+ return err;
}
#ifdef CONFIG_NTFS3_LZX_XPRESS
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 405/844] fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (403 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 404/844] fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 406/844] fs/ntfs3: handle attr_set_size() errors when truncating files Sasha Levin
` (447 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jaehun Gou, Seunghun Han, Jihoon Kwon, Konstantin Komarov,
Sasha Levin
From: Jaehun Gou <p22gone@gmail.com>
[ Upstream commit 06909b2549d631a47fcda249d34be26f7ca1711d ]
We found an infinite loop bug in the ntfs3 file system that can lead to a
Denial-of-Service (DoS) condition.
A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
indicates a zero data size while the driver allocates memory for it.
When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
to zero, it still allocates memory because of al_aligned(0). This creates an
inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
list exists and enumerates only the primary MFT record. When it finds
ATTR_LIST, the code reloads it and restarts the enumeration, repeating
indefinitely. The mount operation never completes, hanging the kernel thread.
This patch adds validation to ensure that data_size is non-zero before memory
allocation. When a zero-sized ATTR_LIST is detected, the function returns
-EINVAL, preventing a DoS vulnerability.
Co-developed-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrlist.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
index a4d74bed74fab..098bd7e8c3d64 100644
--- a/fs/ntfs3/attrlist.c
+++ b/fs/ntfs3/attrlist.c
@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
if (!attr->non_res) {
lsize = le32_to_cpu(attr->res.data_size);
+ if (!lsize) {
+ err = -EINVAL;
+ goto out;
+ }
+
/* attr is resident: lsize < record_size (1K or 4K) */
le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
if (!le) {
@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
u16 run_off = le16_to_cpu(attr->nres.run_off);
lsize = le64_to_cpu(attr->nres.data_size);
+ if (!lsize) {
+ err = -EINVAL;
+ goto out;
+ }
run_init(&ni->attr_list.run);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 406/844] fs/ntfs3: handle attr_set_size() errors when truncating files
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (404 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 405/844] fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 407/844] fs/ntfs3: drop preallocated clusters for sparse and compressed files Sasha Levin
` (446 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Konstantin Komarov, Sasha Levin
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 576248a34b927e93b2fd3fff7df735ba73ad7d01 ]
If attr_set_size() fails while truncating down, the error is silently
ignored and the inode may be left in an inconsistent state.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/file.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index 5120bd7851694..13d014b878f6c 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -505,8 +505,8 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
{
struct super_block *sb = inode->i_sb;
struct ntfs_inode *ni = ntfs_i(inode);
- int err, dirty = 0;
u64 new_valid;
+ int err;
if (!S_ISREG(inode->i_mode))
return 0;
@@ -522,7 +522,6 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
}
new_valid = ntfs_up_block(sb, min_t(u64, ni->i_valid, new_size));
-
truncate_setsize(inode, new_size);
ni_lock(ni);
@@ -536,20 +535,19 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
ni->i_valid = new_valid;
ni_unlock(ni);
+ if (unlikely(err))
+ return err;
ni->std_fa |= FILE_ATTRIBUTE_ARCHIVE;
inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
if (!IS_DIRSYNC(inode)) {
- dirty = 1;
+ mark_inode_dirty(inode);
} else {
err = ntfs_sync_inode(inode);
if (err)
return err;
}
- if (dirty)
- mark_inode_dirty(inode);
-
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 407/844] fs/ntfs3: drop preallocated clusters for sparse and compressed files
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (405 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 406/844] fs/ntfs3: handle attr_set_size() errors when truncating files Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 408/844] ntfs3: fix circular locking dependency in run_unpack_ex Sasha Levin
` (445 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Konstantin Komarov, Sasha Levin
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 3a6aba7f3cf2b46816e08548c254d98de9c74eba ]
Do not keep preallocated clusters for sparsed and compressed files.
Preserving preallocation in these cases causes fsx failures when running
with sparse files and preallocation enabled.
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/attrib.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index c45880ab23912..0cd15a0983fee 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -448,8 +448,10 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type,
is_ext = is_attr_ext(attr_b);
align = sbi->cluster_size;
- if (is_ext)
+ if (is_ext) {
align <<= attr_b->nres.c_unit;
+ keep_prealloc = false;
+ }
old_valid = le64_to_cpu(attr_b->nres.valid_size);
old_size = le64_to_cpu(attr_b->nres.data_size);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 408/844] ntfs3: fix circular locking dependency in run_unpack_ex
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (406 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 407/844] fs/ntfs3: drop preallocated clusters for sparse and compressed files Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 409/844] fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() Sasha Levin
` (444 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Szymon Wilczek, syzbot+d27edf9f96ae85939222, Konstantin Komarov,
Sasha Levin
From: Szymon Wilczek <swilczek.lx@gmail.com>
[ Upstream commit 08ce2fee1b869ecbfbd94e0eb2630e52203a2e03 ]
Syzbot reported a circular locking dependency between wnd->rw_lock
(sbi->used.bitmap) and ni->file.run_lock.
The deadlock scenario:
1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.
2. run_unpack_ex() takes wnd->rw_lock then tries to acquire
ni->file.run_lock inside ntfs_refresh_zone().
This creates an AB-BA deadlock.
Fix this by using down_read_trylock() instead of down_read() when
acquiring run_lock in run_unpack_ex(). If the lock is contended,
skip ntfs_refresh_zone() - the MFT zone will be refreshed on the
next MFT operation. This breaks the circular dependency since we
never block waiting for run_lock while holding wnd->rw_lock.
Reported-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
Tested-by: syzbot+d27edf9f96ae85939222@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d27edf9f96ae85939222
Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/run.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
index 395b204925258..dc59cad4fa376 100644
--- a/fs/ntfs3/run.c
+++ b/fs/ntfs3/run.c
@@ -1131,11 +1131,14 @@ int run_unpack_ex(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
struct rw_semaphore *lock =
is_mounted(sbi) ? &sbi->mft.ni->file.run_lock :
NULL;
- if (lock)
- down_read(lock);
- ntfs_refresh_zone(sbi);
- if (lock)
- up_read(lock);
+ if (lock) {
+ if (down_read_trylock(lock)) {
+ ntfs_refresh_zone(sbi);
+ up_read(lock);
+ }
+ } else {
+ ntfs_refresh_zone(sbi);
+ }
}
up_write(&wnd->rw_lock);
if (err)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 409/844] fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (407 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 408/844] ntfs3: fix circular locking dependency in run_unpack_ex Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 410/844] ceph: supply snapshot context in ceph_uninline_data() Sasha Levin
` (443 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Konstantin Komarov, kernel test robot, Dan Carpenter, Sasha Levin
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit c5226b96c08a010ebef5fdf4c90572bcd89e4299 ]
When ntfs_read_run_nb_ra() is invoked with run == NULL the code later
assumes run is valid and may call run_get_entry(NULL, ...), and also
uses clen/idx without initializing them. Smatch reported uninitialized
variable warnings and this can lead to undefined behaviour. This patch
fixes it.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202512230646.v5hrYXL0-lkp@intel.com/
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fsntfs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index bd67ba7b50153..ea5b673462c35 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -1252,6 +1252,12 @@ int ntfs_read_run_nb(struct ntfs_sb_info *sbi, const struct runs_tree *run,
} while (len32);
+ if (!run) {
+ err = -EINVAL;
+ goto out;
+ }
+
+ /* Get next fragment to read. */
vcn_next = vcn + clen;
if (!run_get_entry(run, ++idx, &vcn, &lcn, &clen) ||
vcn != vcn_next) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 410/844] ceph: supply snapshot context in ceph_uninline_data()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (408 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 409/844] fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 411/844] libceph: define and enforce CEPH_MAX_KEY_LEN Sasha Levin
` (442 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: ethanwu, Viacheslav Dubeyko, Ilya Dryomov, Sasha Levin
From: ethanwu <ethanwu@synology.com>
[ Upstream commit 305ff6b3a03c230d3c07b61457e961406d979693 ]
The ceph_uninline_data function was missing proper snapshot context
handling for its OSD write operations. Both CEPH_OSD_OP_CREATE and
CEPH_OSD_OP_WRITE requests were passing NULL instead of the appropriate
snapshot context, which could lead to unnecessary object clone.
Reproducer:
../src/vstart.sh --new -x --localhost --bluestore
// turn on cephfs inline data
./bin/ceph fs set a inline_data true --yes-i-really-really-mean-it
// allow fs_a client to take snapshot
./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
// mount cephfs with fuse, since kernel cephfs doesn't support inline write
ceph-fuse --id fs_a -m 127.0.0.1:40318 --conf ceph.conf -d /mnt/mycephfs/
// bump snapshot seq
mkdir /mnt/mycephfs/.snap/snap1
echo "foo" > /mnt/mycephfs/test
// umount and mount it again using kernel cephfs client
umount /mnt/mycephfs
mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
echo "bar" >> /mnt/mycephfs/test
./bin/rados listsnaps -p cephfs.a.data $(printf "%x\n" $(stat -c %i /mnt/mycephfs/test)).00000000
will see this object does unnecessary clone
1000000000a.00000000 (seq:2):
cloneid snaps size overlap
2 2 4 []
head - 8
but it's expected to see
10000000000.00000000 (seq:2):
cloneid snaps size overlap
head - 8
since there's no snapshot between these 2 writes
clone happened because the first osd request CEPH_OSD_OP_CREATE doesn't
pass snap context so object is created with snap seq 0, but later data
writeback is equipped with snapshot context.
snap.seq(1) > object snap seq(0), so osd does object clone.
This fix properly acquiring the snapshot context before performing
write operations.
Signed-off-by: ethanwu <ethanwu@synology.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/addr.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 63b75d2142102..faecd9025ee9c 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -2199,6 +2199,7 @@ int ceph_uninline_data(struct file *file)
struct ceph_osd_request *req = NULL;
struct ceph_cap_flush *prealloc_cf = NULL;
struct folio *folio = NULL;
+ struct ceph_snap_context *snapc = NULL;
u64 inline_version = CEPH_INLINE_NONE;
struct page *pages[1];
int err = 0;
@@ -2226,6 +2227,24 @@ int ceph_uninline_data(struct file *file)
if (inline_version == 1) /* initial version, no data */
goto out_uninline;
+ down_read(&fsc->mdsc->snap_rwsem);
+ spin_lock(&ci->i_ceph_lock);
+ if (__ceph_have_pending_cap_snap(ci)) {
+ struct ceph_cap_snap *capsnap =
+ list_last_entry(&ci->i_cap_snaps,
+ struct ceph_cap_snap,
+ ci_item);
+ snapc = ceph_get_snap_context(capsnap->context);
+ } else {
+ if (!ci->i_head_snapc) {
+ ci->i_head_snapc = ceph_get_snap_context(
+ ci->i_snap_realm->cached_context);
+ }
+ snapc = ceph_get_snap_context(ci->i_head_snapc);
+ }
+ spin_unlock(&ci->i_ceph_lock);
+ up_read(&fsc->mdsc->snap_rwsem);
+
folio = read_mapping_folio(inode->i_mapping, 0, file);
if (IS_ERR(folio)) {
err = PTR_ERR(folio);
@@ -2241,7 +2260,7 @@ int ceph_uninline_data(struct file *file)
req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
ceph_vino(inode), 0, &len, 0, 1,
CEPH_OSD_OP_CREATE, CEPH_OSD_FLAG_WRITE,
- NULL, 0, 0, false);
+ snapc, 0, 0, false);
if (IS_ERR(req)) {
err = PTR_ERR(req);
goto out_unlock;
@@ -2257,7 +2276,7 @@ int ceph_uninline_data(struct file *file)
req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
ceph_vino(inode), 0, &len, 1, 3,
CEPH_OSD_OP_WRITE, CEPH_OSD_FLAG_WRITE,
- NULL, ci->i_truncate_seq,
+ snapc, ci->i_truncate_seq,
ci->i_truncate_size, false);
if (IS_ERR(req)) {
err = PTR_ERR(req);
@@ -2320,6 +2339,7 @@ int ceph_uninline_data(struct file *file)
folio_put(folio);
}
out:
+ ceph_put_snap_context(snapc);
ceph_free_cap_flush(prealloc_cf);
doutc(cl, "%llx.%llx inline_version %llu = %d\n",
ceph_vinop(inode), inline_version, err);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 411/844] libceph: define and enforce CEPH_MAX_KEY_LEN
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (409 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 410/844] ceph: supply snapshot context in ceph_uninline_data() Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 412/844] thermal: int340x: Fix sysfs group leak on DLVR registration failure Sasha Levin
` (441 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ilya Dryomov, Sasha Levin
From: Ilya Dryomov <idryomov@gmail.com>
[ Upstream commit ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf ]
When decoding the key, verify that the key material would fit into
a fixed-size buffer in process_auth_done() and generally has a sane
length.
The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
with no key material which is a) not universal since CEPH_CRYPTO_NONE
has to be excluded and b) doesn't provide much value since a smaller
than needed key is just as invalid as no key -- this has to be handled
elsewhere anyway.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ceph/crypto.c | 8 +++++---
net/ceph/crypto.h | 2 +-
net/ceph/messenger_v2.c | 2 +-
3 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 01b2ce1e8fc06..5601732cf4faa 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -37,9 +37,6 @@ static int set_secret(struct ceph_crypto_key *key, void *buf)
return -ENOTSUPP;
}
- if (!key->len)
- return -EINVAL;
-
key->key = kmemdup(buf, key->len, GFP_NOIO);
if (!key->key) {
ret = -ENOMEM;
@@ -83,6 +80,11 @@ int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
ceph_decode_copy(p, &key->created, sizeof(key->created));
key->len = ceph_decode_16(p);
ceph_decode_need(p, end, key->len, bad);
+ if (key->len > CEPH_MAX_KEY_LEN) {
+ pr_err("secret too big %d\n", key->len);
+ return -EINVAL;
+ }
+
ret = set_secret(key, *p);
memzero_explicit(*p, key->len);
*p += key->len;
diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
index 23de29fc613cf..a20bad6d1e964 100644
--- a/net/ceph/crypto.h
+++ b/net/ceph/crypto.h
@@ -5,7 +5,7 @@
#include <linux/ceph/types.h>
#include <linux/ceph/buffer.h>
-#define CEPH_KEY_LEN 16
+#define CEPH_MAX_KEY_LEN 16
#define CEPH_MAX_CON_SECRET_LEN 64
/*
diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
index c9d50c0dcd33a..31e042dc1b3f2 100644
--- a/net/ceph/messenger_v2.c
+++ b/net/ceph/messenger_v2.c
@@ -2360,7 +2360,7 @@ static int process_auth_reply_more(struct ceph_connection *con,
*/
static int process_auth_done(struct ceph_connection *con, void *p, void *end)
{
- u8 session_key_buf[CEPH_KEY_LEN + 16];
+ u8 session_key_buf[CEPH_MAX_KEY_LEN + 16];
u8 con_secret_buf[CEPH_MAX_CON_SECRET_LEN + 16];
u8 *session_key = PTR_ALIGN(&session_key_buf[0], 16);
u8 *con_secret = PTR_ALIGN(&con_secret_buf[0], 16);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 412/844] thermal: int340x: Fix sysfs group leak on DLVR registration failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (410 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 411/844] libceph: define and enforce CEPH_MAX_KEY_LEN Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 413/844] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 Sasha Levin
` (440 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kaushlendra Kumar, Srinivas Pandruvada, Rafael J. Wysocki,
Sasha Levin
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ]
When DLVR sysfs group creation fails in proc_thermal_rfim_add(),
the function returns immediately without cleaning up the FIVR group
that may have been created earlier.
Add proper error unwinding to remove the FIVR group before returning
failure.
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../thermal/intel/int340x_thermal/processor_thermal_rfim.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
index 589a3a71f0c4c..ba88d878c998d 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.c
@@ -466,8 +466,11 @@ int proc_thermal_rfim_add(struct pci_dev *pdev, struct proc_thermal_device *proc
break;
}
ret = sysfs_create_group(&pdev->dev.kobj, &dlvr_attribute_group);
- if (ret)
+ if (ret) {
+ if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_FIVR)
+ sysfs_remove_group(&pdev->dev.kobj, &fivr_attribute_group);
return ret;
+ }
}
if (proc_priv->mmio_feature_mask & PROC_THERMAL_FEATURE_DVFS) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 413/844] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (411 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 412/844] thermal: int340x: Fix sysfs group leak on DLVR registration failure Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 414/844] include: uapi: netfilter_bridge.h: Cover for musl libc Sasha Levin
` (439 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Yauhen Kharuzhy, Rafael J. Wysocki, Sasha Levin
From: Yauhen Kharuzhy <jekhor@gmail.com>
[ Upstream commit a8c975302868c716afef0f50467bebbd069a35b8 ]
The PWM2 on YB1-X90 tablets is used for keyboard backlight control but
it is disabled in the ACPI DSDT table. Add it to the override_status_ids
list to allow keyboard function control driver
(drivers/platform/x86/lenovo/yogabook.c) to use it.
Signed-off-by: Yauhen Kharuzhy <jekhor@gmail.com>
Link: https://patch.msgid.link/20260211222242.4101162-1-jekhor@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/x86/utils.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
index 4ee30c2897a2b..418951639f511 100644
--- a/drivers/acpi/x86/utils.c
+++ b/drivers/acpi/x86/utils.c
@@ -81,6 +81,18 @@ static const struct override_status_id override_status_ids[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "Mipad2"),
}),
+ /*
+ * Lenovo Yoga Book uses PWM2 for touch keyboard backlight control.
+ * It needs to be enabled only for the Android device version (YB1-X90*
+ * aka YETI-11); the Windows version (YB1-X91*) uses ACPI control
+ * methods.
+ */
+ PRESENT_ENTRY_HID("80862289", "2", INTEL_ATOM_AIRMONT, {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
+ }),
+
/*
* The INT0002 device is necessary to clear wakeup interrupt sources
* on Cherry Trail devices, without it we get nobody cared IRQ msgs.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 414/844] include: uapi: netfilter_bridge.h: Cover for musl libc
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (412 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 413/844] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 415/844] ARM: 9467/1: mm: Don't use %pK through printk Sasha Levin
` (438 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Phil Sutter, Alyssa Ross, Florian Westphal, Sasha Levin
From: Phil Sutter <phil@nwl.cc>
[ Upstream commit 4edd4ba71ce0df015303dba75ea9d20d1a217546 ]
Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
zero. To avoid struct redefinition errors, user space is therefore
supposed to include netinet/if_ether.h before (or instead of)
linux/if_ether.h. To relieve them from this burden, include the libc
header here if not building for kernel space.
Reported-by: Alyssa Ross <hi@alyssa.is>
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/netfilter_bridge.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h
index 1610fdbab98df..ad520d3e9df8f 100644
--- a/include/uapi/linux/netfilter_bridge.h
+++ b/include/uapi/linux/netfilter_bridge.h
@@ -5,6 +5,10 @@
/* bridge-specific defines for netfilter.
*/
+#ifndef __KERNEL__
+#include <netinet/if_ether.h> /* for __UAPI_DEF_ETHHDR if defined */
+#endif
+
#include <linux/in.h>
#include <linux/netfilter.h>
#include <linux/if_ether.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 415/844] ARM: 9467/1: mm: Don't use %pK through printk
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (413 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 414/844] include: uapi: netfilter_bridge.h: Cover for musl libc Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 416/844] drm/amd/display: Fix writeback on DCN 3.2+ Sasha Levin
` (437 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Weissschuh, Russell King (Oracle), Sasha Levin
From: Thomas Weissschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 012ea376a5948b025f260aa45d2a6ec5d96674ea ]
Restricted pointers ("%pK") were never meant to be used
through printk(). They can acquire sleeping locks in atomic contexts.
Switch to %px over the more secure %p as this usage is a debugging aid,
gated behind CONFIG_DEBUG_VIRTUAL and used by WARN().
Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mm/physaddr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mm/physaddr.c b/arch/arm/mm/physaddr.c
index 3f263c840ebc4..1a37ebfacbba9 100644
--- a/arch/arm/mm/physaddr.c
+++ b/arch/arm/mm/physaddr.c
@@ -38,7 +38,7 @@ static inline bool __virt_addr_valid(unsigned long x)
phys_addr_t __virt_to_phys(unsigned long x)
{
WARN(!__virt_addr_valid(x),
- "virt_to_phys used for non-linear address: %pK (%pS)\n",
+ "virt_to_phys used for non-linear address: %px (%pS)\n",
(void *)x, (void *)x);
return __virt_to_phys_nodebug(x);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 416/844] drm/amd/display: Fix writeback on DCN 3.2+
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (414 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 415/844] ARM: 9467/1: mm: Don't use %pK through printk Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 417/844] drm/amdgpu: Skip vcn poison irq release on VF Sasha Levin
` (436 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alex Hung, Harry Wentland, Wayne Lin, Dan Wheeler, Alex Deucher,
Sasha Levin
From: Alex Hung <alex.hung@amd.com>
[ Upstream commit 9ef84a307582a92ef055ef0bd3db10fd8ac75960 ]
[WHAT]
1. Set no scaling for writeback as they are hardcoded in DCN3.2+.
2. Set no fast plane update for writeback commits.
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 209a6e5c713ca..150cc3fc7b2a9 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -10648,10 +10648,10 @@ static void dm_set_writeback(struct amdgpu_display_manager *dm,
wb_info->dwb_params.capture_rate = dwb_capture_rate_0;
- wb_info->dwb_params.scaler_taps.h_taps = 4;
- wb_info->dwb_params.scaler_taps.v_taps = 4;
- wb_info->dwb_params.scaler_taps.h_taps_c = 2;
- wb_info->dwb_params.scaler_taps.v_taps_c = 2;
+ wb_info->dwb_params.scaler_taps.h_taps = 1;
+ wb_info->dwb_params.scaler_taps.v_taps = 1;
+ wb_info->dwb_params.scaler_taps.h_taps_c = 1;
+ wb_info->dwb_params.scaler_taps.v_taps_c = 1;
wb_info->dwb_params.subsample_position = DWB_INTERSTITIAL_SUBSAMPLING;
wb_info->mcif_buf_params.luma_pitch = afb->base.pitches[0];
@@ -11667,6 +11667,8 @@ static bool should_reset_plane(struct drm_atomic_state *state,
struct drm_crtc_state *old_crtc_state, *new_crtc_state;
struct dm_crtc_state *old_dm_crtc_state, *new_dm_crtc_state;
struct amdgpu_device *adev = drm_to_adev(plane->dev);
+ struct drm_connector_state *new_con_state;
+ struct drm_connector *connector;
int i;
/*
@@ -11677,6 +11679,15 @@ static bool should_reset_plane(struct drm_atomic_state *state,
state->allow_modeset)
return true;
+ /* Check for writeback commit */
+ for_each_new_connector_in_state(state, connector, new_con_state, i) {
+ if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK)
+ continue;
+
+ if (new_con_state->writeback_job)
+ return true;
+ }
+
if (amdgpu_in_reset(adev) && state->allow_modeset)
return true;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 417/844] drm/amdgpu: Skip vcn poison irq release on VF
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (415 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 416/844] drm/amd/display: Fix writeback on DCN 3.2+ Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 418/844] mshv: Ignore second stats page map result failure Sasha Levin
` (435 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Lijo Lazar, Mangesh Gadre, Alex Deucher, Sasha Levin
From: Lijo Lazar <lijo.lazar@amd.com>
[ Upstream commit 8980be03b3f9a4b58197ef95d3b37efa41a25331 ]
VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid
call trace during deinitialization.
[ 71.913601] [drm] clean up the vf2pf work item
[ 71.915088] ------------[ cut here ]------------
[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]
[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd
[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu
[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014
[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]
[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00
[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246
[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000
[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000
[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000
[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000
[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0
[ 71.915800] PKRU: 55555554
[ 71.915802] Call Trace:
[ 71.915805] <TASK>
[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
index cebee453871c1..006a154511971 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
@@ -521,7 +521,9 @@ static int vcn_v2_5_hw_fini(struct amdgpu_ip_block *ip_block)
RREG32_SOC15(VCN, i, mmUVD_STATUS)))
vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
+ /* VF doesn't enable interrupt operations for RAS */
+ if (!amdgpu_sriov_vf(adev) &&
+ amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
amdgpu_irq_put(adev, &vinst->ras_poison_irq, 0);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 418/844] mshv: Ignore second stats page map result failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (416 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 417/844] drm/amdgpu: Skip vcn poison irq release on VF Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 419/844] x86/hyperv: Move hv crash init after hypercall pg setup Sasha Levin
` (434 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Purna Pavan Chandra Aekkaladevi, Nuno Das Neves,
Stanislav Kinsburskii, Michael Kelley, Wei Liu, Sasha Levin
From: Purna Pavan Chandra Aekkaladevi <paekkaladevi@linux.microsoft.com>
[ Upstream commit 7538b80e5a4b473b73428d13b3a47ceaad9a8a7c ]
Older versions of the hypervisor do not have a concept of separate SELF
and PARENT stats areas. In this case, mapping the HV_STATS_AREA_SELF page
is sufficient - it's the only page and it contains all available stats.
Mapping HV_STATS_AREA_PARENT returns HV_STATUS_INVALID_PARAMETER which
currently causes module init to fail on older hypevisor versions.
Detect this case and gracefully fall back to populating
stats_pages[HV_STATS_AREA_PARENT] with the already-mapped SELF page.
Add comments to clarify the behavior, including a clarification of why
this isn't needed for hv_call_map_stats_page2() which always supports
PARENT and SELF areas.
Signed-off-by: Purna Pavan Chandra Aekkaladevi <paekkaladevi@linux.microsoft.com>
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Reviewed-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Acked-by: Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hv/mshv_root_hv_call.c | 52 +++++++++++++++++++++++++++++++---
drivers/hv/mshv_root_main.c | 3 ++
2 files changed, 51 insertions(+), 4 deletions(-)
diff --git a/drivers/hv/mshv_root_hv_call.c b/drivers/hv/mshv_root_hv_call.c
index 598eaff4ff299..1f93b94d7580c 100644
--- a/drivers/hv/mshv_root_hv_call.c
+++ b/drivers/hv/mshv_root_hv_call.c
@@ -813,6 +813,13 @@ hv_call_notify_port_ring_empty(u32 sint_index)
return hv_result_to_errno(status);
}
+/*
+ * Equivalent of hv_call_map_stats_page() for cases when the caller provides
+ * the map location.
+ *
+ * NOTE: This is a newer hypercall that always supports SELF and PARENT stats
+ * areas, unlike hv_call_map_stats_page().
+ */
static int hv_call_map_stats_page2(enum hv_stats_object_type type,
const union hv_stats_object_identity *identity,
u64 map_location)
@@ -855,6 +862,34 @@ static int hv_call_map_stats_page2(enum hv_stats_object_type type,
return ret;
}
+static int
+hv_stats_get_area_type(enum hv_stats_object_type type,
+ const union hv_stats_object_identity *identity)
+{
+ switch (type) {
+ case HV_STATS_OBJECT_HYPERVISOR:
+ return identity->hv.stats_area_type;
+ case HV_STATS_OBJECT_LOGICAL_PROCESSOR:
+ return identity->lp.stats_area_type;
+ case HV_STATS_OBJECT_PARTITION:
+ return identity->partition.stats_area_type;
+ case HV_STATS_OBJECT_VP:
+ return identity->vp.stats_area_type;
+ }
+
+ return -EINVAL;
+}
+
+/*
+ * Map a stats page, where the page location is provided by the hypervisor.
+ *
+ * NOTE: The concept of separate SELF and PARENT stats areas does not exist on
+ * older hypervisor versions. All the available stats information can be found
+ * on the SELF page. When attempting to map the PARENT area on a hypervisor
+ * that doesn't support it, return "success" but with a NULL address. The
+ * caller should check for this case and instead fallback to the SELF area
+ * alone.
+ */
static int hv_call_map_stats_page(enum hv_stats_object_type type,
const union hv_stats_object_identity *identity,
void **addr)
@@ -863,7 +898,7 @@ static int hv_call_map_stats_page(enum hv_stats_object_type type,
struct hv_input_map_stats_page *input;
struct hv_output_map_stats_page *output;
u64 status, pfn;
- int ret = 0;
+ int hv_status, ret = 0;
do {
local_irq_save(flags);
@@ -878,11 +913,20 @@ static int hv_call_map_stats_page(enum hv_stats_object_type type,
pfn = output->map_location;
local_irq_restore(flags);
- if (hv_result(status) != HV_STATUS_INSUFFICIENT_MEMORY) {
- ret = hv_result_to_errno(status);
+
+ hv_status = hv_result(status);
+ if (hv_status != HV_STATUS_INSUFFICIENT_MEMORY) {
if (hv_result_success(status))
break;
- return ret;
+
+ if (hv_stats_get_area_type(type, identity) == HV_STATS_AREA_PARENT &&
+ hv_status == HV_STATUS_INVALID_PARAMETER) {
+ *addr = NULL;
+ return 0;
+ }
+
+ hv_status_debug(status, "\n");
+ return hv_result_to_errno(status);
}
ret = hv_call_deposit_pages(NUMA_NO_NODE,
diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index 681b58154d5ea..d3e8a66443ad6 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -993,6 +993,9 @@ static int mshv_vp_stats_map(u64 partition_id, u32 vp_index,
if (err)
goto unmap_self;
+ if (!stats_pages[HV_STATS_AREA_PARENT])
+ stats_pages[HV_STATS_AREA_PARENT] = stats_pages[HV_STATS_AREA_SELF];
+
return 0;
unmap_self:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 419/844] x86/hyperv: Move hv crash init after hypercall pg setup
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (417 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 418/844] mshv: Ignore second stats page map result failure Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 420/844] mshv: clear eventfd counter on irqfd shutdown Sasha Levin
` (433 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Mukesh R, Wei Liu, Sasha Levin
From: Mukesh R <mrathor@linux.microsoft.com>
[ Upstream commit c3a6ae7ea2d3f507cbddb5818ccc65b9d84d6dc7 ]
hv_root_crash_init() is not setting up the hypervisor crash collection
for baremetal cases because when it's called, hypervisor page is not
setup.
Fix is simple, just move the crash init call after the hypercall
page setup.
Signed-off-by: Mukesh Rathor <mrathor@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/hyperv/hv_init.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 14de43f4bc6c1..7f3301bd081ec 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -558,7 +558,6 @@ void __init hyperv_init(void)
memunmap(src);
hv_remap_tsc_clocksource();
- hv_root_crash_init();
hv_sleep_notifiers_register();
} else {
hypercall_msr.guest_physical_address = vmalloc_to_pfn(hv_hypercall_pg);
@@ -567,6 +566,9 @@ void __init hyperv_init(void)
hv_set_hypercall_pg(hv_hypercall_pg);
+ if (hv_root_partition()) /* after set hypercall pg */
+ hv_root_crash_init();
+
skip_hypercall_pg_init:
/*
* hyperv_init() is called before LAPIC is initialized: see
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 420/844] mshv: clear eventfd counter on irqfd shutdown
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (418 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 419/844] x86/hyperv: Move hv crash init after hypercall pg setup Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 421/844] ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type Sasha Levin
` (432 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Carlos López, Wei Liu, Sasha Levin
From: Carlos López <clopez@suse.de>
[ Upstream commit 2b4246153e2184e3a3b4edc8cc35337d7a2455a6 ]
While unhooking from the irqfd waitqueue, clear the internal eventfd
counter by using eventfd_ctx_remove_wait_queue() instead of
remove_wait_queue(), preventing potential spurious interrupts. This
removes the need to store a pointer into the workqueue, as the eventfd
already keeps track of it.
This mimicks what other similar subsystems do on their equivalent paths
with their irqfds (KVM, Xen, ACRN support, etc).
Signed-off-by: Carlos López <clopez@suse.de>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hv/mshv_eventfd.c | 5 ++---
drivers/hv/mshv_eventfd.h | 1 -
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/hv/mshv_eventfd.c b/drivers/hv/mshv_eventfd.c
index 6d176ed8ae516..188923fce40b4 100644
--- a/drivers/hv/mshv_eventfd.c
+++ b/drivers/hv/mshv_eventfd.c
@@ -248,12 +248,13 @@ static void mshv_irqfd_shutdown(struct work_struct *work)
{
struct mshv_irqfd *irqfd =
container_of(work, struct mshv_irqfd, irqfd_shutdown);
+ u64 cnt;
/*
* Synchronize with the wait-queue and unhook ourselves to prevent
* further events.
*/
- remove_wait_queue(irqfd->irqfd_wqh, &irqfd->irqfd_wait);
+ eventfd_ctx_remove_wait_queue(irqfd->irqfd_eventfd_ctx, &irqfd->irqfd_wait, &cnt);
if (irqfd->irqfd_resampler) {
mshv_irqfd_resampler_shutdown(irqfd);
@@ -372,8 +373,6 @@ static void mshv_irqfd_queue_proc(struct file *file, wait_queue_head_t *wqh,
struct mshv_irqfd *irqfd =
container_of(polltbl, struct mshv_irqfd, irqfd_polltbl);
- irqfd->irqfd_wqh = wqh;
-
/*
* TODO: Ensure there isn't already an exclusive, priority waiter, e.g.
* that the irqfd isn't already bound to another partition. Only the
diff --git a/drivers/hv/mshv_eventfd.h b/drivers/hv/mshv_eventfd.h
index 332e7670a3442..464c6b81ab336 100644
--- a/drivers/hv/mshv_eventfd.h
+++ b/drivers/hv/mshv_eventfd.h
@@ -32,7 +32,6 @@ struct mshv_irqfd {
struct mshv_lapic_irq irqfd_lapic_irq;
struct hlist_node irqfd_hnode;
poll_table irqfd_polltbl;
- wait_queue_head_t *irqfd_wqh;
wait_queue_entry_t irqfd_wait;
struct work_struct irqfd_shutdown;
struct mshv_irqfd_resampler *irqfd_resampler;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 421/844] ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (419 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 420/844] mshv: clear eventfd counter on irqfd shutdown Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 422/844] regulator: core: Remove regulator supply_name length limit Sasha Levin
` (431 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jack Yu, Mark Brown, Sasha Levin
From: Jack Yu <jack.yu@realtek.com>
[ Upstream commit 5578da7d957fbaf91f6c39ba2363c2d2e4273183 ]
Add related HP-JD settings to fix issue of fail to detect
OMTP jack type.
Signed-off-by: Jack Yu <jack.yu@realtek.com>
Link: https://patch.msgid.link/20260210074335.2337830-1-jack.yu@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt721-sdca.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/rt721-sdca.c b/sound/soc/codecs/rt721-sdca.c
index 8233532a1752a..35960c2252249 100644
--- a/sound/soc/codecs/rt721-sdca.c
+++ b/sound/soc/codecs/rt721-sdca.c
@@ -245,12 +245,12 @@ static void rt721_sdca_jack_preset(struct rt721_sdca_priv *rt721)
regmap_write(rt721->mbq_regmap, 0x5b10007, 0x2000);
regmap_write(rt721->mbq_regmap, 0x5B10017, 0x1b0f);
rt_sdca_index_write(rt721->mbq_regmap, RT721_CBJ_CTRL,
- RT721_CBJ_A0_GAT_CTRL1, 0x2a02);
+ RT721_CBJ_A0_GAT_CTRL1, 0x2205);
rt_sdca_index_write(rt721->mbq_regmap, RT721_CAP_PORT_CTRL,
RT721_HP_AMP_2CH_CAL4, 0xa105);
rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
RT721_UAJ_TOP_TCON14, 0x3b33);
- regmap_write(rt721->mbq_regmap, 0x310400, 0x3023);
+ regmap_write(rt721->mbq_regmap, 0x310400, 0x3043);
rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
RT721_UAJ_TOP_TCON14, 0x3f33);
rt_sdca_index_write(rt721->mbq_regmap, RT721_VENDOR_ANA_CTL,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 422/844] regulator: core: Remove regulator supply_name length limit
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (420 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 421/844] ASoC: rt721-sdca: Fix issue of fail to detect OMTP jack type Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 423/844] ALSA: hda/tas2781: Ignore reset check for SPI device Sasha Levin
` (430 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bjorn Andersson, Mark Brown, Sasha Levin
From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
[ Upstream commit e243cdd87b911ce9968b62e4ab2b680dfadc4341 ]
When creating the regulator object, associated with a consumer device,
the supply_name is string formatted into a statically sized buffer on
the stack, then strdup()'ed onto the heap.
Not only is the dance on the stack unnecessary, but when the device's
name is long we might not fit the constructed supply_name in the fixed
64 byte buffer on the stack.
One such case can be seen on the Qualcomm Rb3Gen2 board, where we find a
PCIe controller, with a PCIe switch, with a USB controller, with a USB
hub, consuming a regulator. In this example the dev->kobj.name itself is
62 characters long.
Drop the temporary buffer on the stack and kasprintf() the string
directly on the heap, both to simplify the code, and to remove the
length limitation.
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Link: https://patch.msgid.link/20260211-regulator-supply-name-length-v1-1-3875541c1576@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 12 +-----------
1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 8ee33b777f6ce..838bbdcdede9a 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1949,8 +1949,6 @@ static const struct file_operations constraint_flags_fops = {
#endif
};
-#define REG_STR_SIZE 64
-
static void link_and_create_debugfs(struct regulator *regulator, struct regulator_dev *rdev,
struct device *dev)
{
@@ -1998,15 +1996,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
lockdep_assert_held_once(&rdev->mutex.base);
if (dev) {
- char buf[REG_STR_SIZE];
- int size;
-
- size = snprintf(buf, REG_STR_SIZE, "%s-%s",
- dev->kobj.name, supply_name);
- if (size >= REG_STR_SIZE)
- return NULL;
-
- supply_name = kstrdup(buf, GFP_KERNEL);
+ supply_name = kasprintf(GFP_KERNEL, "%s-%s", dev->kobj.name, supply_name);
if (supply_name == NULL)
return NULL;
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 423/844] ALSA: hda/tas2781: Ignore reset check for SPI device
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (421 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 422/844] regulator: core: Remove regulator supply_name length limit Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 424/844] drm/amd/display: Fix system resume lag issue Sasha Levin
` (429 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Baojun Xu, Takashi Iwai, Sasha Levin
From: Baojun Xu <baojun.xu@ti.com>
[ Upstream commit 908ef80e31e4d3bd953a0088fe57640cd9ae7b3e ]
In the SPI driver probe, the device should be in the default state, so the
device status check is not necessary. It should be forced to do the
firmware download as I2C device.
Signed-off-by: Baojun Xu <baojun.xu@ti.com>
Link: https://patch.msgid.link/20260211030946.2330-1-baojun.xu@ti.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../hda/codecs/side-codecs/tas2781_hda_spi.c | 20 +++++++------------
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
index b9a55672bf15d..488e35dac9524 100644
--- a/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_spi.c
@@ -634,7 +634,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
struct tasdevice_priv *tas_priv = context;
struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev);
struct hda_codec *codec = tas_priv->codec;
- int ret, val;
+ int ret;
pm_runtime_get_sync(tas_priv->dev);
guard(mutex)(&tas_priv->codec_lock);
@@ -673,20 +673,14 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
tas_priv->rcabin.profile_cfg_id = 0;
tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
- ret = tasdevice_spi_dev_read(tas_priv, tas_priv->index,
- TAS2781_REG_CLK_CONFIG, &val);
- if (ret < 0)
- goto out;
- if (val == TAS2781_REG_CLK_CONFIG_RESET) {
- ret = tasdevice_prmg_load(tas_priv, 0);
- if (ret < 0) {
- dev_err(tas_priv->dev, "FW download failed = %d\n",
- ret);
- goto out;
- }
- tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
+ ret = tasdevice_prmg_load(tas_priv, 0);
+ if (ret < 0) {
+ dev_err(tas_priv->dev, "FW download failed = %d\n", ret);
+ goto out;
}
+ tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
+
if (tas_priv->fmw->nr_programs > 0)
tas_priv->tasdevice[tas_priv->index].cur_prog = 0;
if (tas_priv->fmw->nr_configurations > 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 424/844] drm/amd/display: Fix system resume lag issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (422 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 423/844] ALSA: hda/tas2781: Ignore reset check for SPI device Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 425/844] drm/amd/display: Avoid updating surface with the same surface under MPO Sasha Levin
` (428 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tom Chung, Nicholas Kazlauskas, Wayne Lin, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Tom Chung <chiahsuan.chung@amd.com>
[ Upstream commit 64c94cd9be2e188ed07efeafa6a109bce638c967 ]
[Why]
System will try to apply idle power optimizations setting during
system resume. But system power state is still in D3 state, and
it will cause the idle power optimizations command not actually
to be sent to DMUB and cause some platforms to go into IPS.
[How]
Set power state to D0 first before calling the
dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false)
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 150cc3fc7b2a9..b6eee94861477 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3468,7 +3468,17 @@ static int dm_resume(struct amdgpu_ip_block *ip_block)
struct dc_commit_streams_params commit_params = {};
if (dm->dc->caps.ips_support) {
+ if (!amdgpu_in_reset(adev))
+ mutex_lock(&dm->dc_lock);
+
+ /* Need to set POWER_STATE_D0 first or it will not execute
+ * idle_power_optimizations command to DMUB.
+ */
+ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D0);
dc_dmub_srv_apply_idle_power_optimizations(dm->dc, false);
+
+ if (!amdgpu_in_reset(adev))
+ mutex_unlock(&dm->dc_lock);
}
if (amdgpu_in_reset(adev)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 425/844] drm/amd/display: Avoid updating surface with the same surface under MPO
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (423 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 424/844] drm/amd/display: Fix system resume lag issue Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 426/844] drm/amdgpu: return when ras table checksum is error Sasha Levin
` (427 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wayne Lin, Harry Wentland, Tom Chung, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Wayne Lin <Wayne.Lin@amd.com>
[ Upstream commit 1a38ded4bc8ac09fd029ec656b1e2c98cc0d238c ]
[Why & How]
Although it's dummy updates of surface update for committing stream
updates, we should not have dummy_updates[j].surface all indicating
to the same surface under multiple surfaces case. Otherwise,
copy_surface_update_to_plane() in update_planes_and_stream_state()
will update to the same surface only.
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b6eee94861477..e84ec4365ca6b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -10961,7 +10961,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)
continue;
}
for (j = 0; j < status->plane_count; j++)
- dummy_updates[j].surface = status->plane_states[0];
+ dummy_updates[j].surface = status->plane_states[j];
sort(dummy_updates, status->plane_count,
sizeof(*dummy_updates), dm_plane_layer_index_cmp, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 426/844] drm/amdgpu: return when ras table checksum is error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (424 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 425/844] drm/amd/display: Avoid updating surface with the same surface under MPO Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 427/844] drm/amdgpu: Adjust usleep_range in fence wait Sasha Levin
` (426 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Gangliang Xie, Tao Zhou, Kent Russell, Alex Deucher, Sasha Levin
From: Gangliang Xie <ganglxie@amd.com>
[ Upstream commit 044f8d3b1fac6ac89c560f61415000e6bdab3a03 ]
end the function flow when ras table checksum is error
Signed-off-by: Gangliang Xie <ganglxie@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index 64dd7a81bff5f..710a8fe79fccd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -1701,10 +1701,12 @@ int amdgpu_ras_eeprom_check(struct amdgpu_ras_eeprom_control *control)
}
res = __verify_ras_table_checksum(control);
- if (res)
+ if (res) {
dev_err(adev->dev,
"RAS table incorrect checksum or error:%d\n",
res);
+ return -EINVAL;
+ }
/* Warn if we are at 90% of the threshold or above
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 427/844] drm/amdgpu: Adjust usleep_range in fence wait
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (425 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 426/844] drm/amdgpu: return when ras table checksum is error Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 428/844] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA Sasha Levin
` (425 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ce Sun, Lijo Lazar, Alex Deucher, Sasha Levin
From: Ce Sun <cesun102@amd.com>
[ Upstream commit 3ee1c72606bd2842f0f377fd4b118362af0323ae ]
Tune the sleep interval in the PSP fence wait loop from 10-100us to
60-100us.This adjustment results in an overall wait window of 1.2s
(60us * 20000 iterations) to 2 seconds (100us * 20000 iterations),
which guarantees that we can retrieve the correct fence value
Signed-off-by: Ce Sun <cesun102@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 0b10497d487c3..81bdd6aaad2a1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -726,7 +726,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
ras_intr = amdgpu_ras_intr_triggered();
if (ras_intr)
break;
- usleep_range(10, 100);
+ usleep_range(60, 100);
amdgpu_device_invalidate_hdp(psp->adev, NULL);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 428/844] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (426 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 427/844] drm/amdgpu: Adjust usleep_range in fence wait Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 429/844] ALSA: usb-audio: Update the number of packets properly at receiving Sasha Levin
` (424 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Erik Sanjaya, Takashi Iwai, Sasha Levin
From: Erik Sanjaya <sirreidlos@gmail.com>
[ Upstream commit 91062e119b4eafde553c894ca072cd615a6dae2e ]
The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41
amplifiers over SPI. The existing quirk for this model only configured
the amplifiers, leaving the headset microphone on the combo jack
non-functional.
Introduce a new fixup that configures pin 0x19 as headset mic input
and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker
functionality.
Similar to the fix done for the UM3406HA in commit 018f659753fd
("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14").
Signed-off-by: Erik Sanjaya <sirreidlos@gmail.com>
Link: https://patch.msgid.link/20260217102112.20651-1-sirreidlos@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/realtek/alc269.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
index c11312aa5ca76..36053042ca772 100644
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -3886,6 +3886,7 @@ enum {
ALC294_FIXUP_ASUS_MIC,
ALC294_FIXUP_ASUS_HEADSET_MIC,
ALC294_FIXUP_ASUS_I2C_HEADSET_MIC,
+ ALC294_FIXUP_ASUS_SPI_HEADSET_MIC,
ALC294_FIXUP_ASUS_SPK,
ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE,
@@ -5236,6 +5237,15 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC287_FIXUP_CS35L41_I2C_2
},
+ [ALC294_FIXUP_ASUS_SPI_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x04a11020 }, /* use as headset mic */
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC245_FIXUP_CS35L41_SPI_2
+ },
[ALC294_FIXUP_ASUS_SPK] = {
.type = HDA_FIXUP_VERBS,
.v.verbs = (const struct hda_verb[]) {
@@ -7189,7 +7199,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
- SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC294_FIXUP_ASUS_SPI_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION),
SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 429/844] ALSA: usb-audio: Update the number of packets properly at receiving
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (427 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 428/844] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 430/844] drm/amd/display: set enable_legacy_fast_update to false for DCN36 Sasha Levin
` (423 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Takashi Iwai, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit cf044e44190234a41a788de1cdbb6c21f4a52e1e ]
At receiving the packets from the implicit feedback source, we didn't
update ctx->packets field but only the ctx->packet_size[] data.
In exceptional cases, this might lead to unexpectedly superfluous data
transfer (although this won't happen usually due to the nature of USB
isochronous transfer). Fix it to update the field properly.
Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/endpoint.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 8f9313857ee9d..27ade2aa16f5a 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -481,6 +481,7 @@ int snd_usb_queue_pending_output_urbs(struct snd_usb_endpoint *ep,
/* copy over the length information */
if (implicit_fb) {
+ ctx->packets = packet->packets;
for (i = 0; i < packet->packets; i++)
ctx->packet_size[i] = packet->packet_size[i];
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 430/844] drm/amd/display: set enable_legacy_fast_update to false for DCN36
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (428 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 429/844] ALSA: usb-audio: Update the number of packets properly at receiving Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 431/844] drm/amdgpu: Add HAINAN clock adjustment Sasha Levin
` (422 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: YiLing Chen, Nicholas Kazlauskas, Tom Chung, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: YiLing Chen <yi-lchen@amd.com>
[ Upstream commit d0728aee5090853d0b9982757f5fb1b13e2e2b27 ]
[Why/How]
Align the default value of the flag with DCN35/351.
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: YiLing Chen <yi-lchen@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
index 6469d5fe2e6d4..a1132102afde4 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
@@ -769,7 +769,7 @@ static const struct dc_debug_options debug_defaults_drv = {
};
static const struct dc_check_config config_defaults = {
- .enable_legacy_fast_update = true,
+ .enable_legacy_fast_update = false,
};
static const struct dc_panel_config panel_config_defaults = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 431/844] drm/amdgpu: Add HAINAN clock adjustment
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (429 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 430/844] drm/amd/display: set enable_legacy_fast_update to false for DCN36 Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 432/844] drm/amd/display: bypass post csc for additional color spaces in dal Sasha Levin
` (421 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: decce6, Alex Deucher, Sasha Levin
From: decce6 <decce6@proton.me>
[ Upstream commit 49fe2c57bdc0acff9d2551ae337270b6fd8119d9 ]
This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
patch is for amdgpu.
Signed-off-by: decce6 <decce6@proton.me>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 695432d3045ff..2d8d86efe2e73 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3464,6 +3464,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
max_sclk = 60000;
max_mclk = 80000;
}
+ if ((adev->pdev->device == 0x666f) &&
+ (adev->pdev->revision == 0x00)) {
+ max_sclk = 80000;
+ max_mclk = 95000;
+ }
} else if (adev->asic_type == CHIP_OLAND) {
if ((adev->pdev->revision == 0xC7) ||
(adev->pdev->revision == 0x80) ||
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 432/844] drm/amd/display: bypass post csc for additional color spaces in dal
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (430 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 431/844] drm/amdgpu: Add HAINAN clock adjustment Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 433/844] spi: spidev: fix lock inversion between spi_lock and buf_lock Sasha Levin
` (420 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Clay King, Aric Cyr, Tom Chung, Alex Deucher, Sasha Levin
From: Clay King <clayking@amd.com>
[ Upstream commit 7d9ec9dc20ecdb1661f4538cd9112cd3d6a5f15a ]
[Why]
For RGB BT2020 full and limited color spaces, overlay adjustments were
applied twice (once by MM and once by DAL). This results in incorrect
colours and a noticeable difference between mpo and non-mpo cases.
[How]
Add RGB BT2020 full and limited color spaces to list that bypasses post
csc adjustment.
Reviewed-by: Aric Cyr <aric.cyr@amd.com>
Signed-off-by: Clay King <clayking@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c | 21 ++++++++++++++++---
.../drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h | 4 ++++
.../amd/display/dc/dpp/dcn401/dcn401_dpp.c | 6 +++---
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
index ef4a161171814..c7923531da83d 100644
--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.c
@@ -376,10 +376,10 @@ void dpp3_cnv_setup (
tbl_entry.color_space = input_color_space;
- if (color_space >= COLOR_SPACE_YCBCR601)
- select = INPUT_CSC_SELECT_ICSC;
- else
+ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
select = INPUT_CSC_SELECT_BYPASS;
+ else
+ select = INPUT_CSC_SELECT_ICSC;
dpp3_program_post_csc(dpp_base, color_space, select,
&tbl_entry);
@@ -1541,3 +1541,18 @@ bool dpp3_construct(
return true;
}
+bool dpp3_should_bypass_post_csc_for_colorspace(enum dc_color_space dc_color_space)
+{
+ switch (dc_color_space) {
+ case COLOR_SPACE_UNKNOWN:
+ case COLOR_SPACE_SRGB:
+ case COLOR_SPACE_XR_RGB:
+ case COLOR_SPACE_SRGB_LIMITED:
+ case COLOR_SPACE_MSREF_SCRGB:
+ case COLOR_SPACE_2020_RGB_FULLRANGE:
+ case COLOR_SPACE_2020_RGB_LIMITEDRANGE:
+ return true;
+ default:
+ return false;
+ }
+}
diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
index d4a70b4379eaf..6a61b99d6a798 100644
--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
+++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn30/dcn30_dpp.h
@@ -644,4 +644,8 @@ void dpp3_program_cm_dealpha(
void dpp3_cm_get_gamut_remap(struct dpp *dpp_base,
struct dpp_grph_csc_adjustment *adjust);
+
+bool dpp3_should_bypass_post_csc_for_colorspace(
+ enum dc_color_space dc_color_space);
+
#endif /* __DC_HWSS_DCN30_H__ */
diff --git a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
index 96c2c853de42c..2d6a646462e21 100644
--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp.c
@@ -206,10 +206,10 @@ void dpp401_dpp_setup(
tbl_entry.color_space = input_color_space;
- if (color_space >= COLOR_SPACE_YCBCR601)
- select = INPUT_CSC_SELECT_ICSC;
- else
+ if (dpp3_should_bypass_post_csc_for_colorspace(color_space))
select = INPUT_CSC_SELECT_BYPASS;
+ else
+ select = INPUT_CSC_SELECT_ICSC;
dpp3_program_post_csc(dpp_base, color_space, select,
&tbl_entry);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 433/844] spi: spidev: fix lock inversion between spi_lock and buf_lock
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (431 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 432/844] drm/amd/display: bypass post csc for additional color spaces in dal Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 434/844] drm/radeon: Add HAINAN clock adjustment Sasha Levin
` (419 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Fabian Godehardt, Mark Brown, Sasha Levin
From: Fabian Godehardt <fg@emlix.com>
[ Upstream commit 40534d19ed2afb880ecf202dab26a8e7a5808d16 ]
The spidev driver previously used two mutexes, spi_lock and buf_lock,
but acquired them in different orders depending on the code path:
write()/read(): buf_lock -> spi_lock
ioctl(): spi_lock -> buf_lock
This AB-BA locking pattern triggers lockdep warnings and can
cause real deadlocks:
WARNING: possible circular locking dependency detected
spidev_ioctl() -> mutex_lock(&spidev->buf_lock)
spidev_sync_write() -> mutex_lock(&spidev->spi_lock)
*** DEADLOCK ***
The issue is reproducible with a simple userspace program that
performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
separate threads on the same spidev file descriptor.
Fix this by simplifying the locking model and removing the lock
inversion entirely. spidev_sync() no longer performs any locking,
and all callers serialize access using spi_lock.
buf_lock is removed since its functionality is fully covered by
spi_lock, eliminating the possibility of lock ordering issues.
This removes the lock inversion and prevents deadlocks without
changing userspace ABI or behaviour.
Signed-off-by: Fabian Godehardt <fg@emlix.com>
Link: https://patch.msgid.link/20260211072616.489522-1-fg@emlix.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spidev.c | 63 ++++++++++++++++----------------------------
1 file changed, 22 insertions(+), 41 deletions(-)
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 9a0160f6dc3dc..f28528ed1c24e 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -74,7 +74,6 @@ struct spidev_data {
struct list_head device_entry;
/* TX/RX buffers are NULL unless this device is open (users > 0) */
- struct mutex buf_lock;
unsigned users;
u8 *tx_buffer;
u8 *rx_buffer;
@@ -102,24 +101,6 @@ spidev_sync_unlocked(struct spi_device *spi, struct spi_message *message)
return status;
}
-static ssize_t
-spidev_sync(struct spidev_data *spidev, struct spi_message *message)
-{
- ssize_t status;
- struct spi_device *spi;
-
- mutex_lock(&spidev->spi_lock);
- spi = spidev->spi;
-
- if (spi == NULL)
- status = -ESHUTDOWN;
- else
- status = spidev_sync_unlocked(spi, message);
-
- mutex_unlock(&spidev->spi_lock);
- return status;
-}
-
static inline ssize_t
spidev_sync_write(struct spidev_data *spidev, size_t len)
{
@@ -132,7 +113,8 @@ spidev_sync_write(struct spidev_data *spidev, size_t len)
spi_message_init(&m);
spi_message_add_tail(&t, &m);
- return spidev_sync(spidev, &m);
+
+ return spidev_sync_unlocked(spidev->spi, &m);
}
static inline ssize_t
@@ -147,7 +129,8 @@ spidev_sync_read(struct spidev_data *spidev, size_t len)
spi_message_init(&m);
spi_message_add_tail(&t, &m);
- return spidev_sync(spidev, &m);
+
+ return spidev_sync_unlocked(spidev->spi, &m);
}
/*-------------------------------------------------------------------------*/
@@ -157,7 +140,7 @@ static ssize_t
spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
{
struct spidev_data *spidev;
- ssize_t status;
+ ssize_t status = -ESHUTDOWN;
/* chipselect only toggles at start or end of operation */
if (count > bufsiz)
@@ -165,7 +148,11 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
spidev = filp->private_data;
- mutex_lock(&spidev->buf_lock);
+ mutex_lock(&spidev->spi_lock);
+
+ if (spidev->spi == NULL)
+ goto err_spi_removed;
+
status = spidev_sync_read(spidev, count);
if (status > 0) {
unsigned long missing;
@@ -176,7 +163,9 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
else
status = status - missing;
}
- mutex_unlock(&spidev->buf_lock);
+
+err_spi_removed:
+ mutex_unlock(&spidev->spi_lock);
return status;
}
@@ -187,7 +176,7 @@ spidev_write(struct file *filp, const char __user *buf,
size_t count, loff_t *f_pos)
{
struct spidev_data *spidev;
- ssize_t status;
+ ssize_t status = -ESHUTDOWN;
unsigned long missing;
/* chipselect only toggles at start or end of operation */
@@ -196,13 +185,19 @@ spidev_write(struct file *filp, const char __user *buf,
spidev = filp->private_data;
- mutex_lock(&spidev->buf_lock);
+ mutex_lock(&spidev->spi_lock);
+
+ if (spidev->spi == NULL)
+ goto err_spi_removed;
+
missing = copy_from_user(spidev->tx_buffer, buf, count);
if (missing == 0)
status = spidev_sync_write(spidev, count);
else
status = -EFAULT;
- mutex_unlock(&spidev->buf_lock);
+
+err_spi_removed:
+ mutex_unlock(&spidev->spi_lock);
return status;
}
@@ -379,14 +374,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
ctlr = spi->controller;
- /* use the buffer lock here for triple duty:
- * - prevent I/O (from us) so calling spi_setup() is safe;
- * - prevent concurrent SPI_IOC_WR_* from morphing
- * data fields while SPI_IOC_RD_* reads them;
- * - SPI_IOC_MESSAGE needs the buffer locked "normally".
- */
- mutex_lock(&spidev->buf_lock);
-
switch (cmd) {
/* read requests */
case SPI_IOC_RD_MODE:
@@ -510,7 +497,6 @@ spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
break;
}
- mutex_unlock(&spidev->buf_lock);
spi_dev_put(spi);
mutex_unlock(&spidev->spi_lock);
return retval;
@@ -541,9 +527,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
return -ESHUTDOWN;
}
- /* SPI_IOC_MESSAGE needs the buffer locked "normally" */
- mutex_lock(&spidev->buf_lock);
-
/* Check message and copy into scratch area */
ioc = spidev_get_ioc_message(cmd, u_ioc, &n_ioc);
if (IS_ERR(ioc)) {
@@ -564,7 +547,6 @@ spidev_compat_ioc_message(struct file *filp, unsigned int cmd,
kfree(ioc);
done:
- mutex_unlock(&spidev->buf_lock);
spi_dev_put(spi);
mutex_unlock(&spidev->spi_lock);
return retval;
@@ -802,7 +784,6 @@ static int spidev_probe(struct spi_device *spi)
/* Initialize the driver data */
spidev->spi = spi;
mutex_init(&spidev->spi_lock);
- mutex_init(&spidev->buf_lock);
INIT_LIST_HEAD(&spidev->device_entry);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 434/844] drm/radeon: Add HAINAN clock adjustment
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (432 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 433/844] spi: spidev: fix lock inversion between spi_lock and buf_lock Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 435/844] ALSA: usb-audio: Add sanity check for OOB writes at silencing Sasha Levin
` (418 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: decce6, Alex Deucher, Sasha Levin
From: decce6 <decce6@proton.me>
[ Upstream commit 908d318f23d6b5d625bea093c5fc056238cdb7ff ]
This patch limits the clock speeds of the AMD Radeon R5 M420 GPU from
850/1000MHz (core/memory) to 800/950 MHz, making it work stably. This
patch is for radeon.
Signed-off-by: decce6 <decce6@proton.me>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/si_dpm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 9deb91970d4df..f12227145ef08 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2925,6 +2925,11 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
max_sclk = 60000;
max_mclk = 80000;
}
+ if ((rdev->pdev->device == 0x666f) &&
+ (rdev->pdev->revision == 0x00)) {
+ max_sclk = 80000;
+ max_mclk = 95000;
+ }
} else if (rdev->family == CHIP_OLAND) {
if ((rdev->pdev->revision == 0xC7) ||
(rdev->pdev->revision == 0x80) ||
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 435/844] ALSA: usb-audio: Add sanity check for OOB writes at silencing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (433 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 434/844] drm/radeon: Add HAINAN clock adjustment Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 436/844] btrfs: replace BUG() with error handling in __btrfs_balance() Sasha Levin
` (417 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Takashi Iwai, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit fba2105a157fffcf19825e4eea498346738c9948 ]
At silencing the playback URB packets in the implicit fb mode before
the actual playback, we blindly assume that the received packets fit
with the buffer size. But when the setup in the capture stream
differs from the playback stream (e.g. due to the USB core limitation
of max packet size), such an inconsistency may lead to OOB writes to
the buffer, resulting in a crash.
For addressing it, add a sanity check of the transfer buffer size at
prepare_silent_urb(), and stop the data copy if the received data
overflows. Also, report back the transfer error properly from there,
too.
Note that this doesn't fix the root cause of the playback error
itself, but this merely covers the kernel Oops.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/endpoint.c | 39 ++++++++++++++++++++++-----------------
1 file changed, 22 insertions(+), 17 deletions(-)
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 27ade2aa16f5a..1eaf52d1ae9c7 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip)
return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH;
}
-static void prepare_silent_urb(struct snd_usb_endpoint *ep,
- struct snd_urb_ctx *ctx)
+static int prepare_silent_urb(struct snd_usb_endpoint *ep,
+ struct snd_urb_ctx *ctx)
{
struct urb *urb = ctx->urb;
unsigned int offs = 0;
@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep,
extra = sizeof(packet_length);
for (i = 0; i < ctx->packets; ++i) {
- unsigned int offset;
- unsigned int length;
- int counts;
-
- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
- length = counts * ep->stride; /* number of silent bytes */
- offset = offs * ep->stride + extra * i;
- urb->iso_frame_desc[i].offset = offset;
+ int length;
+
+ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0);
+ if (length < 0)
+ return length;
+ length *= ep->stride; /* number of silent bytes */
+ if (offs + length + extra > ctx->buffer_size)
+ break;
+ urb->iso_frame_desc[i].offset = offs;
urb->iso_frame_desc[i].length = length + extra;
if (extra) {
packet_length = cpu_to_le32(length);
- memcpy(urb->transfer_buffer + offset,
+ memcpy(urb->transfer_buffer + offs,
&packet_length, sizeof(packet_length));
+ offs += extra;
}
- memset(urb->transfer_buffer + offset + extra,
+ memset(urb->transfer_buffer + offs,
ep->silence_value, length);
- offs += counts;
+ offs += length;
}
- urb->number_of_packets = ctx->packets;
- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra;
+ if (!offs)
+ return -EPIPE;
+
+ urb->number_of_packets = i;
+ urb->transfer_buffer_length = offs;
ctx->queued = 0;
+ return 0;
}
/*
@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep,
if (data_subs && ep->prepare_data_urb)
return ep->prepare_data_urb(data_subs, urb, in_stream_lock);
/* no data provider, so send silence */
- prepare_silent_urb(ep, ctx);
- break;
+ return prepare_silent_urb(ep, ctx);
case SND_USB_ENDPOINT_TYPE_SYNC:
if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 436/844] btrfs: replace BUG() with error handling in __btrfs_balance()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (434 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 435/844] ALSA: usb-audio: Add sanity check for OOB writes at silencing Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 437/844] btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() Sasha Levin
` (416 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Adarsh Das, Qu Wenruo, David Sterba, Sasha Levin
From: Adarsh Das <adarshdas950@gmail.com>
[ Upstream commit be6324a809dbda76d5fdb23720ad9b20e5c1905c ]
We search with offset (u64)-1 which should never match exactly.
Previously this was handled with BUG(). Now logs an error
and return -EUCLEAN.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/volumes.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 99e167a697ba8..1cbe7c6a2889c 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4234,8 +4234,14 @@ static int __btrfs_balance(struct btrfs_fs_info *fs_info)
* this shouldn't happen, it means the last relocate
* failed
*/
- if (ret == 0)
- BUG(); /* FIXME break ? */
+ if (unlikely(ret == 0)) {
+ btrfs_err(fs_info,
+ "unexpected exact match of CHUNK_ITEM in chunk tree, offset 0x%llx",
+ key.offset);
+ mutex_unlock(&fs_info->reclaim_bgs_lock);
+ ret = -EUCLEAN;
+ goto error;
+ }
ret = btrfs_previous_item(chunk_root, path, 0,
BTRFS_CHUNK_ITEM_KEY);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 437/844] btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (435 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 436/844] btrfs: replace BUG() with error handling in __btrfs_balance() Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 438/844] ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models Sasha Levin
` (415 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Qu Wenruo, Christoph Hellwig, David Sterba, Sasha Levin
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3 ]
[BUG]
There is a bug report that when btrfs hits ENOSPC error in a critical
path, btrfs flips RO (this part is expected, although the ENOSPC bug
still needs to be addressed).
The problem is after the RO flip, if there is a read repair pending, we
can hit the ASSERT() inside btrfs_repair_io_failure() like the following:
BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1
------------[ cut here ]------------
BTRFS: Transaction aborted (error -28)
WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844
Modules linked in: kvm_intel kvm irqbypass
[...]
---[ end trace 0000000000000000 ]---
BTRFS info (device vdc state EA): 2 enospc errors during balance
BTRFS info (device vdc state EA): balance: ended with status: -30
BTRFS error (device vdc state EA): parent transid verify failed on logical 30556160 mirror 2 wanted 8 found 6
BTRFS error (device vdc state EA): bdev /dev/nvme0n1 errs: wr 0, rd 0, flush 0, corrupt 10, gen 0
[...]
assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938
------------[ cut here ]------------
assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) :: 0, in fs/btrfs/bio.c:938
kernel BUG at fs/btrfs/bio.c:938!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 868 Comm: kworker/u8:13 Tainted: G W N 6.19.0-rc6+ #4788 PREEMPT(full)
Tainted: [W]=WARN, [N]=TEST
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
Workqueue: btrfs-endio simple_end_io_work
RIP: 0010:btrfs_repair_io_failure.cold+0xb2/0x120
RSP: 0000:ffffc90001d2bcf0 EFLAGS: 00010246
RAX: 0000000000000051 RBX: 0000000000001000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8305cf42 RDI: 00000000ffffffff
RBP: 0000000000000002 R08: 00000000fffeffff R09: ffffffff837fa988
R10: ffffffff8327a9e0 R11: 6f69747265737361 R12: ffff88813018d310
R13: ffff888168b8a000 R14: ffffc90001d2bd90 R15: ffff88810a169000
FS: 0000000000000000(0000) GS:ffff8885e752c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
------------[ cut here ]------------
[CAUSE]
The cause of -ENOSPC error during the test case btrfs/124 is still
unknown, although it's known that we still have cases where metadata can
be over-committed but can not be fulfilled correctly, thus if we hit
such ENOSPC error inside a critical path, we have no choice but abort
the current transaction.
This will mark the fs read-only.
The problem is inside the btrfs_repair_io_failure() path that we require
the fs not to be mount read-only. This is normally fine, but if we are
doing a read-repair meanwhile the fs flips RO due to a critical error,
we can enter btrfs_repair_io_failure() with super block set to
read-only, thus triggering the above crash.
[FIX]
Just replace the ASSERT() with a proper return if the fs is already
read-only.
Reported-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/linux-btrfs/20260126045555.GB31641@lst.de/
Tested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/bio.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c
index e4d382d3a7aea..1de1b408c6a6d 100644
--- a/fs/btrfs/bio.c
+++ b/fs/btrfs/bio.c
@@ -934,7 +934,6 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 fileoff,
struct bio *bio = NULL;
int ret = 0;
- ASSERT(!(fs_info->sb->s_flags & SB_RDONLY));
BUG_ON(!mirror_num);
/* Basic alignment checks. */
@@ -946,6 +945,13 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 fileoff,
ASSERT(step <= length);
ASSERT(is_power_of_2(step));
+ /*
+ * The fs either mounted RO or hit critical errors, no need
+ * to continue repairing.
+ */
+ if (unlikely(sb_rdonly(fs_info->sb)))
+ return 0;
+
if (btrfs_repair_one_zone(fs_info, logical))
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 438/844] ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (436 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 437/844] btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 439/844] ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Sasha Levin
` (414 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vijendar Mukunda, Mario Limonciello (AMD), Mark Brown,
Sasha Levin
From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
[ Upstream commit 3acf517e1ae05ef66561b7a2782690387ce46e21 ]
This patch adds a quirk to include the codec amplifier function for Lenovo
models listed in the quirk table.
Note: In these models, the RT722 codec amplifier is excluded, and an
external amplifier is used instead.
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20260218104734.3641481-3-Vijendar.Mukunda@amd.com
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/sound/soc/amd/acp/acp-sdw-legacy-mach.c b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
index fae94b9edd5a3..4f92de33a71a0 100644
--- a/sound/soc/amd/acp/acp-sdw-legacy-mach.c
+++ b/sound/soc/amd/acp/acp-sdw-legacy-mach.c
@@ -95,6 +95,22 @@ static const struct dmi_system_id soc_sdw_quirk_table[] = {
},
.driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
},
+ {
+ .callback = soc_sdw_quirk_cb,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YW"),
+ },
+ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
+ },
+ {
+ .callback = soc_sdw_quirk_cb,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "21YX"),
+ },
+ .driver_data = (void *)(ASOC_SDW_CODEC_SPKR),
+ },
{}
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 439/844] ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (437 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 438/844] ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 440/844] arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) Sasha Levin
` (413 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Aaron Erhardt, Werner Sembach, Takashi Iwai, Sasha Levin
From: Aaron Erhardt <aer@tuxedocomputers.com>
[ Upstream commit d649c58bcad8fb9b749e3837136a201632fa109d ]
Depending on the timing during boot, the BIOS might report wrong pin
capabilities, which can lead to HDMI audio being disabled. Therefore,
force HDMI audio connection on TUXEDO InfinityBook S 14 Gen6.
Signed-off-by: Aaron Erhardt <aer@tuxedocomputers.com>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://patch.msgid.link/20260218213234.429686-1-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/hda/codecs/hdmi/hdmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/hda/codecs/hdmi/hdmi.c b/sound/hda/codecs/hdmi/hdmi.c
index 111c9b5335afc..c2e3adc7b3c00 100644
--- a/sound/hda/codecs/hdmi/hdmi.c
+++ b/sound/hda/codecs/hdmi/hdmi.c
@@ -1557,6 +1557,7 @@ static const struct snd_pci_quirk force_connect_list[] = {
SND_PCI_QUIRK(0x1043, 0x86ae, "ASUS", 1), /* Z170 PRO */
SND_PCI_QUIRK(0x1043, 0x86c7, "ASUS", 1), /* Z170M PLUS */
SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1),
+ SND_PCI_QUIRK(0x1558, 0x14a1, "TUXEDO InfinityBook S 14 Gen6", 1),
SND_PCI_QUIRK(0x8086, 0x2060, "Intel NUC5CPYB", 1),
SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1),
{}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 440/844] arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (438 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 439/844] ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 441/844] drm/amd/display: Remove conditional for shaper 3DLUT power-on Sasha Levin
` (412 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Arnd Bergmann, Catalin Marinas, Dev Jain, Will Deacon,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 729a2e8e9ac47099a967567389cc9d73ef4194ca ]
gcc-16 warns about an instance that older compilers did not:
arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_clear':
arch/arm64/mm/hugetlbpage.c:369:57: error: parameter 'addr' set but not used [-Werror=unused-but-set-parameter=]
The issue here is that __pte_clear() does not actually use its second
argument, but when CONFIG_ARM64_CONTPTE is enabled it still gets
updated.
Replace the macro with an inline function to let the compiler see
the argument getting passed down.
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Dev Jain <dev.jain@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 64d5f1d9cce96..5ab5fe3bef25e 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -179,8 +179,6 @@ static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
__pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))
#define pte_none(pte) (!pte_val(pte))
-#define __pte_clear(mm, addr, ptep) \
- __set_pte(ptep, __pte(0))
#define pte_page(pte) (pfn_to_page(pte_pfn(pte)))
/*
@@ -1320,6 +1318,13 @@ static inline bool pud_user_accessible_page(pud_t pud)
/*
* Atomic pte/pmd modifications.
*/
+
+static inline void __pte_clear(struct mm_struct *mm,
+ unsigned long addr, pte_t *ptep)
+{
+ __set_pte(ptep, __pte(0));
+}
+
static inline int __ptep_test_and_clear_young(struct vm_area_struct *vma,
unsigned long address,
pte_t *ptep)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 441/844] drm/amd/display: Remove conditional for shaper 3DLUT power-on
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (439 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 440/844] arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 442/844] drm/amdgpu: avoid sdma ring reset in sriov Sasha Levin
` (411 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alex Hung, Aurabindo Pillai, Ray Wu, Daniel Wheeler, Alex Deucher,
Sasha Levin
From: Alex Hung <alex.hung@amd.com>
[ Upstream commit 1b38a87b8f8020e8ef4563e7752a64182b5a39b9 ]
[Why]
Shaper programming has high chance to fail on first time after
power-on or reboot. This can be verified by running IGT's kms_colorop.
[How]
Always power on the shaper and 3DLUT before programming by
removing the debug flag of low power mode.
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
index 83bbbf34bcac7..badcef027b846 100644
--- a/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
+++ b/drivers/gpu/drm/amd/display/dc/mpc/dcn32/dcn32_mpc.c
@@ -724,8 +724,7 @@ bool mpc32_program_shaper(
return false;
}
- if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc)
- mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
+ mpc32_power_on_shaper_3dlut(mpc, mpcc_id, true);
current_mode = mpc32_get_shaper_current(mpc, mpcc_id);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 442/844] drm/amdgpu: avoid sdma ring reset in sriov
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (440 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 441/844] drm/amd/display: Remove conditional for shaper 3DLUT power-on Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 443/844] rtc: zynqmp: correct frequency value Sasha Levin
` (410 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Victor Zhao, Alex Deucher, Sasha Levin
From: Victor Zhao <Victor.Zhao@amd.com>
[ Upstream commit 5cc7bbd9f1b74d9fe2f7ac08d6ba0477e8d2d65f ]
sdma ring reset is not supported in SRIOV. kfd driver does not check
reset mask, and could queue sdma ring reset during unmap_queues_cpsch.
Avoid the ring reset for sriov.
Signed-off-by: Victor Zhao <Victor.Zhao@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
index 8b8a04138711c..321310ba2c08e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c
@@ -558,6 +558,9 @@ int amdgpu_sdma_reset_engine(struct amdgpu_device *adev, uint32_t instance_id,
struct amdgpu_ring *gfx_ring = &sdma_instance->ring;
struct amdgpu_ring *page_ring = &sdma_instance->page;
+ if (amdgpu_sriov_vf(adev))
+ return -EOPNOTSUPP;
+
mutex_lock(&sdma_instance->engine_reset_mutex);
if (!caller_handles_kernel_queues) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 443/844] rtc: zynqmp: correct frequency value
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (441 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 442/844] drm/amdgpu: avoid sdma ring reset in sriov Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 444/844] ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Sasha Levin
` (409 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tomas Melin, Harini T, Michal Simek, Alexandre Belloni,
Sasha Levin
From: Tomas Melin <tomas.melin@vaisala.com>
[ Upstream commit 2724fb4d429cbb724dcb6fa17953040918ebe3a2 ]
Fix calibration value in case a clock reference is provided.
The actual calibration value written into register is
frequency - 1.
Reviewed-by: Harini T <harini.t@amd.com>
Tested-by: Harini T <harini.t@amd.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260122-zynqmp-rtc-updates-v4-1-d4edb966b499@vaisala.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-zynqmp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/rtc/rtc-zynqmp.c b/drivers/rtc/rtc-zynqmp.c
index 3baa2b481d9f2..856bc1678e7d3 100644
--- a/drivers/rtc/rtc-zynqmp.c
+++ b/drivers/rtc/rtc-zynqmp.c
@@ -345,7 +345,10 @@ static int xlnx_rtc_probe(struct platform_device *pdev)
&xrtcdev->freq);
if (ret)
xrtcdev->freq = RTC_CALIB_DEF;
+ } else {
+ xrtcdev->freq--;
}
+
ret = readl(xrtcdev->reg_base + RTC_CALIB_RD);
if (!ret)
writel(xrtcdev->freq, (xrtcdev->reg_base + RTC_CALIB_WR));
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 444/844] ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (442 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 443/844] rtc: zynqmp: correct frequency value Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 445/844] ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Sasha Levin
` (408 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Maciej Grochowski, Jon Mason, Sasha Levin
From: Maciej Grochowski <Maciej.Grochowski@sony.com>
[ Upstream commit c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface ]
Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.
Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
index f851397b65d6e..f15ebab138144 100644
--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -1314,6 +1314,12 @@ static void switchtec_ntb_init_shared(struct switchtec_ntb *sndev)
for (i = 0; i < sndev->nr_lut_mw; i++) {
int idx = sndev->nr_direct_mw + i;
+ if (idx >= MAX_MWS) {
+ dev_err(&sndev->stdev->dev,
+ "Total number of MW cannot be bigger than %d", MAX_MWS);
+ break;
+ }
+
sndev->self_shared->mw_sizes[idx] = LUT_SIZE;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 445/844] ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (443 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 444/844] ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:25 ` [PATCH 6.19 446/844] iommu/amd: serialize sequence allocation under concurrent TLB invalidations Sasha Levin
` (407 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Maciej Grochowski, Jon Mason, Sasha Levin
From: Maciej Grochowski <Maciej.Grochowski@sony.com>
[ Upstream commit 186615f8855a0be4ee7d3fcd09a8ecc10e783b08 ]
Number of MW LUTs depends on NTB configuration and can be set to zero,
in such scenario rounddown_pow_of_two will cause undefined behaviour and
should not be performed.
This patch ensures that rounddown_pow_of_two is called on valid value.
Signed-off-by: Maciej Grochowski <Maciej.Grochowski@sony.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
index f15ebab138144..0536521fa6ccc 100644
--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
@@ -1202,7 +1202,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
sndev->mmio_self_ctrl);
sndev->nr_lut_mw = ioread16(&sndev->mmio_self_ctrl->lut_table_entries);
- sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
+ if (sndev->nr_lut_mw)
+ sndev->nr_lut_mw = rounddown_pow_of_two(sndev->nr_lut_mw);
dev_dbg(&sndev->stdev->dev, "MWs: %d direct, %d lut\n",
sndev->nr_direct_mw, sndev->nr_lut_mw);
@@ -1212,7 +1213,8 @@ static void switchtec_ntb_init_mw(struct switchtec_ntb *sndev)
sndev->peer_nr_lut_mw =
ioread16(&sndev->mmio_peer_ctrl->lut_table_entries);
- sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
+ if (sndev->peer_nr_lut_mw)
+ sndev->peer_nr_lut_mw = rounddown_pow_of_two(sndev->peer_nr_lut_mw);
dev_dbg(&sndev->stdev->dev, "Peer MWs: %d direct, %d lut\n",
sndev->peer_nr_direct_mw, sndev->peer_nr_lut_mw);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 446/844] iommu/amd: serialize sequence allocation under concurrent TLB invalidations
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (444 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 445/844] ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Sasha Levin
@ 2026-02-28 17:25 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 447/844] xfrm6: fix uninitialized saddr in xfrm6_get_saddr() Sasha Levin
` (406 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:25 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ankit Soni, Srikanth Aithal, Vasant Hegde, Joerg Roedel,
Sasha Levin
From: Ankit Soni <Ankit.Soni@amd.com>
[ Upstream commit 9e249c48412828e807afddc21527eb734dc9bd3d ]
With concurrent TLB invalidations, completion wait randomly gets timed out
because cmd_sem_val was incremented outside the IOMMU spinlock, allowing
CMD_COMPL_WAIT commands to be queued out of sequence and breaking the
ordering assumption in wait_on_sem().
Move the cmd_sem_val increment under iommu->lock so completion sequence
allocation is serialized with command queuing.
And remove the unnecessary return.
Fixes: d2a0cac10597 ("iommu/amd: move wait_on_sem() out of spinlock")
Tested-by: Srikanth Aithal <sraithal@amd.com>
Reported-by: Srikanth Aithal <sraithal@amd.com>
Signed-off-by: Ankit Soni <Ankit.Soni@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/amd_iommu_types.h | 2 +-
drivers/iommu/amd/init.c | 2 +-
drivers/iommu/amd/iommu.c | 18 ++++++++++++------
3 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index 320733e7d8b42..3b09da3ffb74f 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -706,7 +706,7 @@ struct amd_iommu {
u32 flags;
volatile u64 *cmd_sem;
- atomic64_t cmd_sem_val;
+ u64 cmd_sem_val;
/*
* Track physical address to directly use it in build_completion_wait()
* and avoid adding any special checks and handling for kdump.
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 62a7a718acf8f..58d6f5ae155f2 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -1877,7 +1877,7 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h,
iommu->pci_seg = pci_seg;
raw_spin_lock_init(&iommu->lock);
- atomic64_set(&iommu->cmd_sem_val, 0);
+ iommu->cmd_sem_val = 0;
/* Add IOMMU to internal data structures */
list_add_tail(&iommu->list, &amd_iommu_list);
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index c5f7e003d01c9..e216b5a13d49d 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -1417,6 +1417,12 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
return iommu_queue_command_sync(iommu, cmd, true);
}
+static u64 get_cmdsem_val(struct amd_iommu *iommu)
+{
+ lockdep_assert_held(&iommu->lock);
+ return ++iommu->cmd_sem_val;
+}
+
/*
* This function queues a completion wait command into the command
* buffer of an IOMMU
@@ -1431,11 +1437,11 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
if (!iommu->need_sync)
return 0;
- data = atomic64_inc_return(&iommu->cmd_sem_val);
- build_completion_wait(&cmd, iommu, data);
-
raw_spin_lock_irqsave(&iommu->lock, flags);
+ data = get_cmdsem_val(iommu);
+ build_completion_wait(&cmd, iommu, data);
+
ret = __iommu_queue_command_sync(iommu, &cmd, false);
raw_spin_unlock_irqrestore(&iommu->lock, flags);
@@ -3113,10 +3119,11 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
return;
build_inv_irt(&cmd, devid);
- data = atomic64_inc_return(&iommu->cmd_sem_val);
- build_completion_wait(&cmd2, iommu, data);
raw_spin_lock_irqsave(&iommu->lock, flags);
+ data = get_cmdsem_val(iommu);
+ build_completion_wait(&cmd2, iommu, data);
+
ret = __iommu_queue_command_sync(iommu, &cmd, true);
if (ret)
goto out_err;
@@ -3130,7 +3137,6 @@ static void iommu_flush_irt_and_complete(struct amd_iommu *iommu, u16 devid)
out_err:
raw_spin_unlock_irqrestore(&iommu->lock, flags);
- return;
}
static inline u8 iommu_get_int_tablen(struct iommu_dev_data *dev_data)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 447/844] xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (445 preceding siblings ...)
2026-02-28 17:25 ` [PATCH 6.19 446/844] iommu/amd: serialize sequence allocation under concurrent TLB invalidations Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 448/844] xfrm: skip templates check for packet offload tunnel mode Sasha Levin
` (405 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jiayuan Chen, syzbot+e136d86d34b42399a8b1, Jiayuan Chen,
Simon Horman, Steffen Klassert, Sasha Levin
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit 1799d8abeabc68ec05679292aaf6cba93b343c05 ]
xfrm6_get_saddr() does not check the return value of
ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable
source address (returns -EADDRNOTAVAIL), saddr->in6 is left
uninitialized, but xfrm6_get_saddr() still returns 0 (success).
This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized
address in xfrm_state_find(), triggering KMSAN warning:
=====================================================
BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940
xfrm_state_find+0x2424/0xa940
xfrm_resolve_and_create_bundle+0x906/0x5a20
xfrm_lookup_with_ifid+0xcc0/0x3770
xfrm_lookup_route+0x63/0x2b0
ip_route_output_flow+0x1ce/0x270
udp_sendmsg+0x2ce1/0x3400
inet_sendmsg+0x1ef/0x2a0
__sock_sendmsg+0x278/0x3d0
__sys_sendto+0x593/0x720
__x64_sys_sendto+0x130/0x200
x64_sys_call+0x332b/0x3e70
do_syscall_64+0xd3/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable tmp.i.i created at:
xfrm_resolve_and_create_bundle+0x3e3/0x5a20
xfrm_lookup_with_ifid+0xcc0/0x3770
=====================================================
Fix by checking the return value of ipv6_dev_get_saddr() and propagating
the error.
Fixes: a1e59abf8249 ("[XFRM]: Fix wildcard as tunnel source")
Reported-by: syzbot+e136d86d34b42399a8b1@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68bf1024.a70a0220.7a912.02c2.GAE@google.com/T/
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/xfrm6_policy.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 1f19b6f14484c..125ea9a5b8a08 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -57,6 +57,7 @@ static int xfrm6_get_saddr(xfrm_address_t *saddr,
struct dst_entry *dst;
struct net_device *dev;
struct inet6_dev *idev;
+ int err;
dst = xfrm6_dst_lookup(params);
if (IS_ERR(dst))
@@ -68,9 +69,11 @@ static int xfrm6_get_saddr(xfrm_address_t *saddr,
return -EHOSTUNREACH;
}
dev = idev->dev;
- ipv6_dev_get_saddr(dev_net(dev), dev, ¶ms->daddr->in6, 0,
- &saddr->in6);
+ err = ipv6_dev_get_saddr(dev_net(dev), dev, ¶ms->daddr->in6, 0,
+ &saddr->in6);
dst_release(dst);
+ if (err)
+ return -EHOSTUNREACH;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 448/844] xfrm: skip templates check for packet offload tunnel mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (446 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 447/844] xfrm6: fix uninitialized saddr in xfrm6_get_saddr() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 449/844] ipmi: ipmb: initialise event handler read bytes Sasha Levin
` (404 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Leon Romanovsky, Jianbo Liu, Cosmin Ratiu, Tariq Toukan,
Simon Horman, Steffen Klassert, Sasha Levin
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit 0a4524bc69882a4ddb235bb6b279597721bda197 ]
In packet offload, hardware is responsible to check templates. The
result of its operation is forwarded through secpath by relevant
drivers. That secpath is actually removed in __xfrm_policy_check2().
In case packet is forwarded, this secpath is reset in RX, but pushed
again to TX where policy is rechecked again against dummy secpath
in xfrm_policy_ok().
Such situation causes to unexpected XfrmInTmplMismatch increase.
As a solution, simply skip template mismatch check.
Fixes: 600258d555f0 ("xfrm: delete intermediate secpath entry in packet offload mode")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_policy.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 62486f8669752..5428185196a1f 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3801,8 +3801,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
struct xfrm_tmpl *tp[XFRM_MAX_DEPTH];
struct xfrm_tmpl *stp[XFRM_MAX_DEPTH];
struct xfrm_tmpl **tpp = tp;
+ int i, k = 0;
int ti = 0;
- int i, k;
sp = skb_sec_path(skb);
if (!sp)
@@ -3828,6 +3828,12 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
tpp = stp;
}
+ if (pol->xdo.type == XFRM_DEV_OFFLOAD_PACKET && sp == &dummy)
+ /* This policy template was already checked by HW
+ * and secpath was removed in __xfrm_policy_check2.
+ */
+ goto out;
+
/* For each tunnel xfrm, find the first matching tmpl.
* For each tmpl before that, find corresponding xfrm.
* Order is _important_. Later we will implement
@@ -3837,7 +3843,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
* verified to allow them to be skipped in future policy
* checks (e.g. nested tunnels).
*/
- for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
+ for (i = xfrm_nr - 1; i >= 0; i--) {
k = xfrm_policy_ok(tpp[i], sp, k, family, if_id);
if (k < 0) {
if (k < -1)
@@ -3853,6 +3859,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
goto reject;
}
+out:
xfrm_pols_put(pols, npols);
sp->verified_cnt = k;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 449/844] ipmi: ipmb: initialise event handler read bytes
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (447 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 448/844] xfrm: skip templates check for packet offload tunnel mode Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 450/844] xfrm: always flush state and policy upon NETDEV_UNREGISTER event Sasha Levin
` (403 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Matt Johnston, Corey Minyard, Sasha Levin
From: Matt Johnston <matt@codeconstruct.com.au>
[ Upstream commit 9f235ccecd03c436cb1683eac16b12f119e54aa9 ]
IPMB doesn't use i2c reads, but the handler needs to set a value.
Otherwise an i2c read will return an uninitialised value from the bus
driver.
Fixes: 63c4eb347164 ("ipmi:ipmb: Add initial support for IPMI over IPMB")
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Message-ID: <20260113-ipmb-read-init-v1-1-a9cbce7b94e3@codeconstruct.com.au>
Signed-off-by: Corey Minyard <corey@minyard.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/ipmi/ipmi_ipmb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/char/ipmi/ipmi_ipmb.c b/drivers/char/ipmi/ipmi_ipmb.c
index 3a51e58b24875..28818952a7a4b 100644
--- a/drivers/char/ipmi/ipmi_ipmb.c
+++ b/drivers/char/ipmi/ipmi_ipmb.c
@@ -202,11 +202,16 @@ static int ipmi_ipmb_slave_cb(struct i2c_client *client,
break;
case I2C_SLAVE_READ_REQUESTED:
+ *val = 0xff;
+ ipmi_ipmb_check_msg_done(iidev);
+ break;
+
case I2C_SLAVE_STOP:
ipmi_ipmb_check_msg_done(iidev);
break;
case I2C_SLAVE_READ_PROCESSED:
+ *val = 0xff;
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 450/844] xfrm: always flush state and policy upon NETDEV_UNREGISTER event
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (448 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 449/844] ipmi: ipmb: initialise event handler read bytes Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 451/844] writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK Sasha Levin
` (402 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tetsuo Handa, syzbot+881d65229ca4f9ae8c84, Sabrina Dubroca,
Steffen Klassert, Sasha Levin
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit 4efa91a28576054aae0e6dad9cba8fed8293aef8 ]
syzbot is reporting that "struct xfrm_state" refcount is leaking.
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff888052f24618 has 1/1 users at
__netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4412 [inline]
xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592
___sys_sendmsg+0x134/0x1d0 net/socket.c:2646
__sys_sendmsg+0x16d/0x220 net/socket.c:2678
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware
offloading API") implemented xfrm_dev_unregister() as no-op despite
xfrm_dev_state_add() from xfrm_state_construct() acquires a reference
to "struct net_device".
I guess that that commit expected that NETDEV_DOWN event is fired before
NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add()
is called only if (dev->features & NETIF_F_HW_ESP) != 0.
Sabrina Dubroca identified steps to reproduce the same symptoms as below.
echo 0 > /sys/bus/netdevsim/new_device
dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/)
ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \
spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \
offload crypto dev $dev dir out
ethtool -K $dev esp-hw-offload off
echo 0 > /sys/bus/netdevsim/del_device
Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after
xfrm_dev_state_add() acquired a reference to "struct net_device".
Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit
when acquiring a reference to "struct net_device".
Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device")
re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that
commit for unknown reason chose to share xfrm_dev_down() between the
NETDEV_DOWN event and the NETDEV_UNREGISTER event.
I guess that that commit missed the behavior in the previous paragraph.
Therefore, we need to re-introduce xfrm_dev_unregister() in order to
release the reference to "struct net_device" by unconditionally flushing
state and policy.
Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API")
Cc: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_device.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 52ae0e034d29e..550457e4c4f01 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -544,6 +544,14 @@ static int xfrm_dev_down(struct net_device *dev)
return NOTIFY_DONE;
}
+static int xfrm_dev_unregister(struct net_device *dev)
+{
+ xfrm_dev_state_flush(dev_net(dev), dev, true);
+ xfrm_dev_policy_flush(dev_net(dev), dev, true);
+
+ return NOTIFY_DONE;
+}
+
static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
@@ -556,8 +564,10 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void
return xfrm_api_check(dev);
case NETDEV_DOWN:
- case NETDEV_UNREGISTER:
return xfrm_dev_down(dev);
+
+ case NETDEV_UNREGISTER:
+ return xfrm_dev_unregister(dev);
}
return NOTIFY_DONE;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 451/844] writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (449 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 450/844] xfrm: always flush state and policy upon NETDEV_UNREGISTER event Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 452/844] tcp: fix potential race in tcp_v6_syn_recv_sock() Sasha Levin
` (401 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Huacai Chen, Jan Kara, Christian Brauner, Sasha Levin
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 9eed043d10f17301c1b5141e16bb98a85a8fd07e ]
Recent changes of fs-writeback cause such warnings if DETECT_HUNG_TASK
is not enabled:
INFO: The task sync:1342 has been waiting for writeback completion for more than 1 seconds.
The reason is sysctl_hung_task_timeout_secs is 0 when DETECT_HUNG_TASK
is not enabled, then it causes the warning message even if the writeback
lasts for only one second.
Guard the wakeup and logging with "#ifdef CONFIG_DETECT_HUNG_TASK" can
eliminate the warning messages. But on the other hand, it is possible
that sysctl_hung_task_timeout_secs be also 0 when DETECT_HUNG_TASK is
enabled. So let's just check the value of sysctl_hung_task_timeout_secs
to decide whether do wakeup and logging.
Fixes: 1888635532fb ("writeback: Wake up waiting tasks when finishing the writeback of a chunk.")
Fixes: d6e621590764 ("writeback: Add logging for slow writeback (exceeds sysctl_hung_task_timeout_secs)")
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20260203094014.2273240-1-chenhuacai@loongson.cn
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fs-writeback.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 5444fc706ac7d..79b02ac66ac6d 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -198,10 +198,11 @@ static void wb_queue_work(struct bdi_writeback *wb,
static bool wb_wait_for_completion_cb(struct wb_completion *done)
{
+ unsigned long timeout = sysctl_hung_task_timeout_secs;
unsigned long waited_secs = (jiffies - done->wait_start) / HZ;
done->progress_stamp = jiffies;
- if (waited_secs > sysctl_hung_task_timeout_secs)
+ if (timeout && (waited_secs > timeout))
pr_info("INFO: The task %s:%d has been waiting for writeback "
"completion for more than %lu seconds.",
current->comm, current->pid, waited_secs);
@@ -1944,6 +1945,7 @@ static long writeback_sb_inodes(struct super_block *sb,
.range_end = LLONG_MAX,
};
unsigned long start_time = jiffies;
+ unsigned long timeout = sysctl_hung_task_timeout_secs;
long write_chunk;
long total_wrote = 0; /* count both pages and inodes */
unsigned long dirtied_before = jiffies;
@@ -2030,9 +2032,8 @@ static long writeback_sb_inodes(struct super_block *sb,
__writeback_single_inode(inode, &wbc);
/* Report progress to inform the hung task detector of the progress. */
- if (work->done && work->done->progress_stamp &&
- (jiffies - work->done->progress_stamp) > HZ *
- sysctl_hung_task_timeout_secs / 2)
+ if (work->done && work->done->progress_stamp && timeout &&
+ (jiffies - work->done->progress_stamp) > HZ * timeout / 2)
wake_up_all(work->done->waitq);
wbc_detach_inode(&wbc);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 452/844] tcp: fix potential race in tcp_v6_syn_recv_sock()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (450 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 451/844] writeback: Fix wakeup and logging timeouts for !DETECT_HUNG_TASK Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 453/844] psp: use sk->sk_hash in psp_write_headers() Sasha Levin
` (400 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, syzbot+937b5bbb6a815b3e5d0b, Kuniyuki Iwashima,
Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae ]
Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.
After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.
Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.
Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.
This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/inet_connection_sock.h | 4 +-
include/net/tcp.h | 4 +-
net/ipv4/syncookies.c | 2 +-
net/ipv4/tcp_fastopen.c | 2 +-
net/ipv4/tcp_ipv4.c | 8 ++-
net/ipv4/tcp_minisocks.c | 2 +-
net/ipv6/tcp_ipv6.c | 98 +++++++++++++-----------------
net/mptcp/subflow.c | 6 +-
net/smc/af_smc.c | 6 +-
9 files changed, 66 insertions(+), 66 deletions(-)
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index ecb362025c4e5..5cb3056d6ddc7 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -42,7 +42,9 @@ struct inet_connection_sock_af_ops {
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req);
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk));
u16 net_header_len;
int (*setsockopt)(struct sock *sk, int level, int optname,
sockptr_t optval, unsigned int optlen);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e0a5cf2f78181..279ddb923e656 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -533,7 +533,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req);
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk));
int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb);
int tcp_v4_connect(struct sock *sk, struct sockaddr_unsized *uaddr, int addr_len);
int tcp_connect(struct sock *sk);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 569befcf021ba..061751aabc8e1 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -203,7 +203,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
bool own_req;
child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
- NULL, &own_req);
+ NULL, &own_req, NULL);
if (child) {
refcount_set(&req->rsk_refcnt, 1);
sock_rps_save_rxhash(child, skb);
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 7d945a527daf0..444306af444ae 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -247,7 +247,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
bool own_req;
child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
- NULL, &own_req);
+ NULL, &own_req, NULL);
if (!child)
return NULL;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index f8a9596e8f4d4..e4e7bc8782ab6 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1706,7 +1706,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct inet_request_sock *ireq;
bool found_dup_sk = false;
@@ -1758,6 +1760,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
}
sk_setup_caps(newsk, dst);
+#if IS_ENABLED(CONFIG_IPV6)
+ if (opt_child_init)
+ opt_child_init(newsk, sk);
+#endif
tcp_ca_openreq_child(newsk, dst);
tcp_sync_mss(newsk, dst_mtu(dst));
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 9776c921d1bb4..0742a41687ffc 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -909,7 +909,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
* socket is created, wait for troubles.
*/
child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
- req, &own_req);
+ req, &own_req, NULL);
if (!child)
goto listen_overflow;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4ae664b05fa91..9df81f85ec982 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1310,11 +1310,48 @@ static void tcp_v6_restore_cb(struct sk_buff *skb)
sizeof(struct inet6_skb_parm));
}
+/* Called from tcp_v4_syn_recv_sock() for v6_mapped children. */
+static void tcp_v6_mapped_child_init(struct sock *newsk, const struct sock *sk)
+{
+ struct inet_sock *newinet = inet_sk(newsk);
+ struct ipv6_pinfo *newnp;
+
+ newinet->pinet6 = newnp = tcp_inet6_sk(newsk);
+ newinet->ipv6_fl_list = NULL;
+
+ memcpy(newnp, tcp_inet6_sk(sk), sizeof(struct ipv6_pinfo));
+
+ newnp->saddr = newsk->sk_v6_rcv_saddr;
+
+ inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
+ if (sk_is_mptcp(newsk))
+ mptcpv6_handle_mapped(newsk, true);
+ newsk->sk_backlog_rcv = tcp_v4_do_rcv;
+#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
+ tcp_sk(newsk)->af_specific = &tcp_sock_ipv6_mapped_specific;
+#endif
+
+ newnp->ipv6_mc_list = NULL;
+ newnp->ipv6_ac_list = NULL;
+ newnp->pktoptions = NULL;
+ newnp->opt = NULL;
+
+ /* tcp_v4_syn_recv_sock() has initialized newinet->mc_{index,ttl} */
+ newnp->mcast_oif = newinet->mc_index;
+ newnp->mcast_hops = newinet->mc_ttl;
+
+ newnp->rcv_flowinfo = 0;
+ if (inet6_test_bit(REPFLOW, sk))
+ newnp->flow_label = 0;
+}
+
static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct inet_request_sock *ireq;
struct ipv6_pinfo *newnp;
@@ -1330,61 +1367,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
#endif
struct flowi6 fl6;
- if (skb->protocol == htons(ETH_P_IP)) {
- /*
- * v6 mapped
- */
-
- newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
- req_unhash, own_req);
-
- if (!newsk)
- return NULL;
-
- newinet = inet_sk(newsk);
- newinet->pinet6 = tcp_inet6_sk(newsk);
- newinet->ipv6_fl_list = NULL;
-
- newnp = tcp_inet6_sk(newsk);
- newtp = tcp_sk(newsk);
-
- memcpy(newnp, np, sizeof(struct ipv6_pinfo));
-
- newnp->saddr = newsk->sk_v6_rcv_saddr;
-
- inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
- if (sk_is_mptcp(newsk))
- mptcpv6_handle_mapped(newsk, true);
- newsk->sk_backlog_rcv = tcp_v4_do_rcv;
-#if defined(CONFIG_TCP_MD5SIG) || defined(CONFIG_TCP_AO)
- newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
-#endif
-
- newnp->ipv6_mc_list = NULL;
- newnp->ipv6_ac_list = NULL;
- newnp->pktoptions = NULL;
- newnp->opt = NULL;
- newnp->mcast_oif = inet_iif(skb);
- newnp->mcast_hops = ip_hdr(skb)->ttl;
- newnp->rcv_flowinfo = 0;
- if (inet6_test_bit(REPFLOW, sk))
- newnp->flow_label = 0;
-
- /*
- * No need to charge this sock to the relevant IPv6 refcnt debug socks count
- * here, tcp_create_openreq_child now does this for us, see the comment in
- * that function for the gory details. -acme
- */
-
- /* It is tricky place. Until this moment IPv4 tcp
- worked with IPv6 icsk.icsk_af_ops.
- Sync it now.
- */
- tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
-
- return newsk;
- }
-
+ if (skb->protocol == htons(ETH_P_IP))
+ return tcp_v4_syn_recv_sock(sk, skb, req, dst,
+ req_unhash, own_req,
+ tcp_v6_mapped_child_init);
ireq = inet_rsk(req);
if (sk_acceptq_is_full(sk))
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 96d54cb2cd93f..b11d0bf006c19 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -810,7 +810,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk);
struct mptcp_subflow_request_sock *subflow_req;
@@ -857,7 +859,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
create_child:
child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
- req_unhash, own_req);
+ req_unhash, own_req, opt_child_init);
if (child && *own_req) {
struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child);
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index d8201eb3ac5f3..18c56b0d7ad53 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -124,7 +124,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
struct request_sock *req,
struct dst_entry *dst,
struct request_sock *req_unhash,
- bool *own_req)
+ bool *own_req,
+ void (*opt_child_init)(struct sock *newsk,
+ const struct sock *sk))
{
struct smc_sock *smc;
struct sock *child;
@@ -142,7 +144,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
/* passthrough to original syn recv sock fct */
child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
- own_req);
+ own_req, opt_child_init);
/* child must not inherit smc or its ops */
if (child) {
rcu_assign_sk_user_data(child, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 453/844] psp: use sk->sk_hash in psp_write_headers()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (451 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 452/844] tcp: fix potential race in tcp_v6_syn_recv_sock() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 454/844] espintcp: Fix race condition in espintcp_close() Sasha Levin
` (399 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, Daniel Zahka, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f891007ab1c77436950d10e09eae54507f1865ff ]
udp_flow_src_port() is indirectly using sk->sk_txhash as a base,
because __tcp_transmit_skb() uses skb_set_hash_from_sk().
This is problematic because this field can change over the
lifetime of a TCP flow, thanks to calls to sk_rethink_txhash().
Problem is that some NIC might (ab)use the PSP UDP source port in their
RSS computation, and PSP packets for a given flow could jump
from one queue to another.
In order to avoid surprises, it is safer to let Protective Load
Balancing (PLB) get its entropy from the IPv6 flowlabel,
and change psp_write_headers() to use sk->sk_hash which
does not change for the duration of the flow.
We might add a sysctl to select the behavior, if there
is a need for it.
Fixes: fc724515741a ("psp: provide encapsulation helper for drivers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-By: Daniel Zahka <daniel.zahka@gmail.com>
Link: https://patch.msgid.link/20260218141337.999945-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/psp/psp_main.c | 39 ++++++++++++++++++++++++++++++++++++++-
1 file changed, 38 insertions(+), 1 deletion(-)
diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index a8534124f6266..066222eb56c4a 100644
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -166,9 +166,46 @@ static void psp_write_headers(struct net *net, struct sk_buff *skb, __be32 spi,
{
struct udphdr *uh = udp_hdr(skb);
struct psphdr *psph = (struct psphdr *)(uh + 1);
+ const struct sock *sk = skb->sk;
uh->dest = htons(PSP_DEFAULT_UDP_PORT);
- uh->source = udp_flow_src_port(net, skb, 0, 0, false);
+
+ /* A bit of theory: Selection of the source port.
+ *
+ * We need some entropy, so that multiple flows use different
+ * source ports for better RSS spreading at the receiver.
+ *
+ * We also need that all packets belonging to one TCP flow
+ * use the same source port through their duration,
+ * so that all these packets land in the same receive queue.
+ *
+ * udp_flow_src_port() is using sk_txhash, inherited from
+ * skb_set_hash_from_sk() call in __tcp_transmit_skb().
+ * This field is subject to reshuffling, thanks to
+ * sk_rethink_txhash() calls in various TCP functions.
+ *
+ * Instead, use sk->sk_hash which is constant through
+ * the whole flow duration.
+ */
+ if (likely(sk)) {
+ u32 hash = sk->sk_hash;
+ int min, max;
+
+ /* These operations are cheap, no need to cache the result
+ * in another socket field.
+ */
+ inet_get_local_port_range(net, &min, &max);
+ /* Since this is being sent on the wire obfuscate hash a bit
+ * to minimize possibility that any useful information to an
+ * attacker is leaked. Only upper 16 bits are relevant in the
+ * computation for 16 bit port value because we use a
+ * reciprocal divide.
+ */
+ hash ^= hash << 16;
+ uh->source = htons((((u64)hash * (max - min)) >> 32) + min);
+ } else {
+ uh->source = udp_flow_src_port(net, skb, 0, 0, false);
+ }
uh->check = 0;
uh->len = htons(udp_len);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 454/844] espintcp: Fix race condition in espintcp_close()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (452 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 453/844] psp: use sk->sk_hash in psp_write_headers() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 455/844] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode Sasha Levin
` (398 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hyunwoo Kim, Simon Horman, Jakub Kicinski, Sasha Levin
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit e1512c1db9e8794d8d130addd2615ec27231d994 ]
This issue was discovered during a code audit.
After cancel_work_sync() is called from espintcp_close(),
espintcp_tx_work() can still be scheduled from paths such as
the Delayed ACK handler or ksoftirqd.
As a result, the espintcp_tx_work() worker may dereference a
freed espintcp ctx or sk.
The following is a simple race scenario:
cpu0 cpu1
espintcp_close()
cancel_work_sync(&ctx->work);
espintcp_write_space()
schedule_work(&ctx->work);
To prevent this race condition, cancel_work_sync() is
replaced with disable_work_sync().
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/aZSie7rEdh9Nu0eM@v4bel
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/espintcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index bf744ac9d5a73..8709df716e98e 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -536,7 +536,7 @@ static void espintcp_close(struct sock *sk, long timeout)
sk->sk_prot = &tcp_prot;
barrier();
- cancel_work_sync(&ctx->work);
+ disable_work_sync(&ctx->work);
strp_done(&ctx->strp);
skb_queue_purge(&ctx->out_queue);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 455/844] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (453 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 454/844] espintcp: Fix race condition in espintcp_close() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 456/844] net: usb: lan78xx: scan all MDIO addresses on LAN7801 Sasha Levin
` (397 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ziyi Guo, Paolo Abeni, Jakub Kicinski, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ]
kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls
netif_stop_queue() and netif_wake_queue(). These are TX queue flow
control functions unrelated to RX multicast configuration.
The premature netif_wake_queue() can re-enable TX while tx_urb is still
in-flight, leading to a double usb_submit_urb() on the same URB:
kaweth_start_xmit() {
netif_stop_queue();
usb_submit_urb(kaweth->tx_urb);
}
kaweth_set_rx_mode() {
netif_stop_queue();
netif_wake_queue(); // wakes TX queue before URB is done
}
kaweth_start_xmit() {
netif_stop_queue();
usb_submit_urb(kaweth->tx_urb); // URB submitted while active
}
This triggers the WARN in usb_submit_urb():
"URB submitted while active"
This is a similar class of bug fixed in rtl8150 by
- commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast").
Also kaweth_set_rx_mode() is already functionally broken, the
real set_rx_mode action is performed by kaweth_async_set_rx_mode(),
which in turn is not a no-op only at ndo_open() time.
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/kaweth.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index c9efb7df892ec..e01d14f6c3667 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -765,7 +765,6 @@ static void kaweth_set_rx_mode(struct net_device *net)
netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap);
- netif_stop_queue(net);
if (net->flags & IFF_PROMISC) {
packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS;
@@ -775,7 +774,6 @@ static void kaweth_set_rx_mode(struct net_device *net)
}
kaweth->packet_filter_bitmap = packet_filter_bitmap;
- netif_wake_queue(net);
}
/****************************************************************
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 456/844] net: usb: lan78xx: scan all MDIO addresses on LAN7801
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (454 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 455/844] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 457/844] proc: Fix pointer error dereference Sasha Levin
` (396 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Martin Pålsson, Jakub Kicinski, Sasha Levin
From: Martin Pålsson <martin@poleshift.se>
[ Upstream commit f1e2f0ce704e4a14e3f367d3b97d3dd2d8e183b7 ]
The LAN7801 is designed exclusively for external PHYs (unlike the
LAN7800/LAN7850 which have internal PHYs), but lan78xx_mdio_init()
restricts PHY scanning to MDIO addresses 0-7 by setting phy_mask to
~(0xFF). This prevents discovery of external PHYs wired to addresses
outside that range.
One such case is the DP83TC814 100BASE-T1 PHY, which is typically
configured at MDIO address 10 via PHYAD bootstrap pins and goes
undetected with the current mask.
Remove the restrictive phy_mask assignment for the LAN7801 so that the
default mask of 0 applies, allowing all 32 MDIO addresses to be
scanned during bus registration.
Fixes: 02dc1f3d613d ("lan78xx: add LAN7801 MAC only support")
Signed-off-by: Martin Pålsson <martin@poleshift.se>
Link: https://patch.msgid.link/0110019c6f388aff-98d99cf0-4425-4fff-b16b-dea5ad8fafe0-000000@eu-north-1.amazonses.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/lan78xx.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 00397a8073934..065588c9cfa65 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2094,8 +2094,6 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev)
dev->mdiobus->phy_mask = ~(1 << 1);
break;
case ID_REV_CHIP_ID_7801_:
- /* scan thru PHYAD[2..0] */
- dev->mdiobus->phy_mask = ~(0xFF);
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 457/844] proc: Fix pointer error dereference
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (455 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 456/844] net: usb: lan78xx: scan all MDIO addresses on LAN7801 Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 458/844] net: phy: qcom: qca807x: normalize return value of gpio_get Sasha Levin
` (395 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ethan Tidmore, Christian Brauner, Sasha Levin
From: Ethan Tidmore <ethantidmore06@gmail.com>
[ Upstream commit f6a495484a27150fb85f943e1a7464da88c2a797 ]
The function try_lookup_noperm() can return an error pointer. Add check
for error pointer.
Detected by Smatch:
fs/proc/base.c:2148 proc_fill_cache() error:
'child' dereferencing possible ERR_PTR()
Fixes: 1df98b8bbcca ("proc_fill_cache(): clean up, get rid of pointless find_inode_number() use")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260219221001.1117135-1-ethantidmore06@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/proc/base.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 4eec684baca9f..4c863d17dfb4c 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2128,6 +2128,9 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx,
ino_t ino = 1;
child = try_lookup_noperm(&qname, dir);
+ if (IS_ERR(child))
+ goto end_instantiate;
+
if (!child) {
DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
child = d_alloc_parallel(dir, &qname, &wq);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 458/844] net: phy: qcom: qca807x: normalize return value of gpio_get
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (456 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 457/844] proc: Fix pointer error dereference Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 459/844] net: ethernet: xscale: Check for PTP support properly Sasha Levin
` (394 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dmitry Torokhov, Bartosz Golaszewski, Linus Walleij,
Jakub Kicinski, Sasha Levin
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[ Upstream commit 2bb995e6155cb4f254574598cbd6fe1dcc99766a ]
The GPIO get callback is expected to return 0 or 1 (or a negative error
code). Ensure that the value returned by qca807x_gpio_get() is
normalized to the [0, 1] range.
Fixes: 86ef402d805d ("gpiolib: sanitize the return value of gpio_chip::get()")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/aZZeyr2ysqqk2GqA@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/qcom/qca807x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/phy/qcom/qca807x.c b/drivers/net/phy/qcom/qca807x.c
index 1be8295a95cb5..511cde345e089 100644
--- a/drivers/net/phy/qcom/qca807x.c
+++ b/drivers/net/phy/qcom/qca807x.c
@@ -375,7 +375,7 @@ static int qca807x_gpio_get(struct gpio_chip *gc, unsigned int offset)
reg = QCA807X_MMD7_LED_FORCE_CTRL(offset);
val = phy_read_mmd(priv->phy, MDIO_MMD_AN, reg);
- return FIELD_GET(QCA807X_GPIO_FORCE_MODE_MASK, val);
+ return !!FIELD_GET(QCA807X_GPIO_FORCE_MODE_MASK, val);
}
static int qca807x_gpio_set(struct gpio_chip *gc, unsigned int offset, int value)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 459/844] net: ethernet: xscale: Check for PTP support properly
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (457 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 458/844] net: phy: qcom: qca807x: normalize return value of gpio_get Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 460/844] udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb() Sasha Levin
` (393 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Linus Walleij, Jakub Kicinski, Sasha Levin
From: Linus Walleij <linusw@kernel.org>
[ Upstream commit 594163ea88a03bdb412063af50fc7177ef3cbeae ]
In ixp4xx_get_ts_info() ixp46x_ptp_find() is called
unconditionally despite this feature only existing on
ixp46x, leading to the following splat from tcpdump:
root@OpenWrt:~# tcpdump -vv -X -i eth0
(...)
Unable to handle kernel NULL pointer dereference at virtual address
00000238 when read
(...)
Call trace:
ptp_clock_index from ixp46x_ptp_find+0x1c/0x38
ixp46x_ptp_find from ixp4xx_get_ts_info+0x4c/0x64
ixp4xx_get_ts_info from __ethtool_get_ts_info+0x90/0x108
__ethtool_get_ts_info from __dev_ethtool+0xa00/0x2648
__dev_ethtool from dev_ethtool+0x160/0x234
dev_ethtool from dev_ioctl+0x2cc/0x460
dev_ioctl from sock_ioctl+0x1ec/0x524
sock_ioctl from sys_ioctl+0x51c/0xa94
sys_ioctl from ret_fast_syscall+0x0/0x44
(...)
Segmentation fault
Check for ixp46x in ixp46x_ptp_find() before trying to set up
PTP to avoid this.
To avoid altering the returned error code from ixp4xx_hwtstamp_set()
which before this patch was -EOPNOTSUPP, we return -EOPNOTSUPP
from ixp4xx_hwtstamp_set() if ixp46x_ptp_find() fails no matter
the error code. The helper function ixp46x_ptp_find() helper
returns -ENODEV.
Fixes: 9055a2f59162 ("ixp4xx_eth: make ptp support a platform driver")
Signed-off-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260219-ixp4xx-fix-ethernet-v3-1-f235ccc3cd46@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/xscale/ixp4xx_eth.c | 5 +----
drivers/net/ethernet/xscale/ptp_ixp46x.c | 3 +++
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index e1e7f65553e76..b0faa0f1780d0 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -403,15 +403,12 @@ static int ixp4xx_hwtstamp_set(struct net_device *netdev,
int ret;
int ch;
- if (!cpu_is_ixp46x())
- return -EOPNOTSUPP;
-
if (!netif_running(netdev))
return -EINVAL;
ret = ixp46x_ptp_find(&port->timesync_regs, &port->phc_index);
if (ret)
- return ret;
+ return -EOPNOTSUPP;
ch = PORT2CHANNEL(port);
regs = port->timesync_regs;
diff --git a/drivers/net/ethernet/xscale/ptp_ixp46x.c b/drivers/net/ethernet/xscale/ptp_ixp46x.c
index 94203eb46e6b0..93c64db22a696 100644
--- a/drivers/net/ethernet/xscale/ptp_ixp46x.c
+++ b/drivers/net/ethernet/xscale/ptp_ixp46x.c
@@ -232,6 +232,9 @@ static struct ixp_clock ixp_clock;
int ixp46x_ptp_find(struct ixp46x_ts_regs *__iomem *regs, int *phc_index)
{
+ if (!cpu_is_ixp46x())
+ return -ENODEV;
+
*regs = ixp_clock.regs;
*phc_index = ptp_clock_index(ixp_clock.ptp_clock);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 460/844] udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb().
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (458 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 459/844] net: ethernet: xscale: Check for PTP support properly Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 461/844] bnxt_en: Fix RSS context delete logic Sasha Levin
` (392 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kuniyuki Iwashima, syzbot, Jakub Kicinski, Sasha Levin
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 470c7ca2b4c3e3a51feeb952b7f97a775b5c49cd ]
syzbot reported null-ptr-deref of udp_sk(sk)->udp_prod_queue. [0]
Since the cited commit, udp_lib_init_sock() can fail, as can
udp_init_sock() and udpv6_init_sock().
Let's handle the error in udplite_sk_init() and udplitev6_sk_init().
[0]:
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in __udp_enqueue_schedule_skb+0x151/0x1480 net/ipv4/udp.c:1719
Read of size 4 at addr 0000000000000008 by task syz.2.18/2944
CPU: 1 UID: 0 PID: 2944 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPTLAZY
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<IRQ>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
kasan_report+0xa2/0xe0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
instrument_atomic_read include/linux/instrumented.h:82 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
__udp_enqueue_schedule_skb+0x151/0x1480 net/ipv4/udp.c:1719
__udpv6_queue_rcv_skb net/ipv6/udp.c:795 [inline]
udpv6_queue_rcv_one_skb+0xa2e/0x1ad0 net/ipv6/udp.c:906
udp6_unicast_rcv_skb+0x227/0x380 net/ipv6/udp.c:1064
ip6_protocol_deliver_rcu+0xe17/0x1540 net/ipv6/ip6_input.c:438
ip6_input_finish+0x191/0x350 net/ipv6/ip6_input.c:489
NF_HOOK+0x354/0x3f0 include/linux/netfilter.h:318
ip6_input+0x16c/0x2b0 net/ipv6/ip6_input.c:500
NF_HOOK+0x354/0x3f0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6149 [inline]
__netif_receive_skb+0xd3/0x370 net/core/dev.c:6262
process_backlog+0x4d6/0x1160 net/core/dev.c:6614
__napi_poll+0xae/0x320 net/core/dev.c:7678
napi_poll net/core/dev.c:7741 [inline]
net_rx_action+0x60d/0xdc0 net/core/dev.c:7893
handle_softirqs+0x209/0x8d0 kernel/softirq.c:622
do_softirq+0x52/0x90 kernel/softirq.c:523
</IRQ>
<TASK>
__local_bh_enable_ip+0xe7/0x120 kernel/softirq.c:450
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]
__dev_queue_xmit+0x109c/0x2dc0 net/core/dev.c:4856
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x158/0x4e0 net/ipv6/ip6_output.c:219
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x342/0x580 net/ipv6/ip6_output.c:246
ip6_send_skb+0x1d7/0x3c0 net/ipv6/ip6_output.c:1984
udp_v6_send_skb+0x9a5/0x1770 net/ipv6/udp.c:1442
udp_v6_push_pending_frames+0xa2/0x140 net/ipv6/udp.c:1469
udpv6_sendmsg+0xfe0/0x2830 net/ipv6/udp.c:1759
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0xe5/0x270 net/socket.c:742
__sys_sendto+0x3eb/0x580 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0xf20 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f67b4d9c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f67b5c98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f67b5015fa0 RCX: 00007f67b4d9c629
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f67b4e32b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000040000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f67b5016038 R14: 00007f67b5015fa0 R15: 00007ffe3cb66dd8
</TASK>
Fixes: b650bf0977d3 ("udp: remove busylock and add per NUMA queues")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260219173142.310741-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/udplite.c | 3 +--
net/ipv6/udplite.c | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index d3e621a11a1aa..826e9e79eb19c 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -20,10 +20,9 @@ EXPORT_SYMBOL(udplite_table);
/* Designate sk as UDP-Lite socket */
static int udplite_sk_init(struct sock *sk)
{
- udp_init_sock(sk);
pr_warn_once("UDP-Lite is deprecated and scheduled to be removed in 2025, "
"please contact the netdev mailing list\n");
- return 0;
+ return udp_init_sock(sk);
}
static int udplite_rcv(struct sk_buff *skb)
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 2cec542437f74..e867721cda4d3 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -16,10 +16,9 @@
static int udplitev6_sk_init(struct sock *sk)
{
- udpv6_init_sock(sk);
pr_warn_once("UDP-Lite is deprecated and scheduled to be removed in 2025, "
"please contact the netdev mailing list\n");
- return 0;
+ return udpv6_init_sock(sk);
}
static int udplitev6_rcv(struct sk_buff *skb)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 461/844] bnxt_en: Fix RSS context delete logic
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (459 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 460/844] udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 462/844] bnxt_en: Fix deleting of Ntuple filters Sasha Levin
` (391 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pavan Chebbi, Jakub Kicinski, Andy Gospodarek, Michael Chan,
Jakub Kicinski, Sasha Levin
From: Pavan Chebbi <pavan.chebbi@broadcom.com>
[ Upstream commit e123d9302d223767bd910bfbcfe607bae909f8ac ]
We need to free the corresponding RSS context VNIC
in FW everytime an RSS context is deleted in driver.
Commit 667ac333dbb7 added a check to delete the VNIC
in FW only when netif_running() is true to help delete
RSS contexts with interface down.
Having that condition will make the driver leak VNICs
in FW whenever close() happens with active RSS contexts.
On the subsequent open(), as part of RSS context restoration,
we will end up trying to create extra VNICs for which we
did not make any reservation. FW can fail this request,
thereby making us lose active RSS contexts.
Suppose an RSS context is deleted already and we try to
process a delete request again, then the HWRM functions
will check for validity of the request and they simply
return if the resource is already freed. So, even for
delete-when-down cases, netif_running() check is not
necessary.
Remove the netif_running() condition check when deleting
an RSS context.
Reported-by: Jakub Kicinski <kicinski@meta.com>
Fixes: 667ac333dbb7 ("eth: bnxt: allow deleting RSS contexts when the device is down")
Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260219185313.2682148-2-michael.chan@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 8419d1eb4035d..64832289e18d0 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -10827,12 +10827,10 @@ void bnxt_del_one_rss_ctx(struct bnxt *bp, struct bnxt_rss_ctx *rss_ctx,
struct bnxt_ntuple_filter *ntp_fltr;
int i;
- if (netif_running(bp->dev)) {
- bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic);
- for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) {
- if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID)
- bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i);
- }
+ bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic);
+ for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) {
+ if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID)
+ bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i);
}
if (!all)
return;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 462/844] bnxt_en: Fix deleting of Ntuple filters
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (460 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 461/844] bnxt_en: Fix RSS context delete logic Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 463/844] ovpn: tcp - fix packet extraction from stream Sasha Levin
` (390 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pavan Chebbi, Michael Chan, Jakub Kicinski, Sasha Levin
From: Pavan Chebbi <pavan.chebbi@broadcom.com>
[ Upstream commit c1bbd9900d65ac65b9fce9f129e3369a04871570 ]
Ntuple filters can be deleted when the interface
is down. The current code blindly sends the filter
delete command to FW. When the interface is down, all
the VNICs are deleted in the FW. When the VNIC is
freed in the FW, all the associated filters are also
freed. We need not send the free command explicitly.
Sending such command will generate FW error in the
dmesg.
In order to fix this, we can safely return from
bnxt_hwrm_cfa_ntuple_filter_free() when BNXT_STATE_OPEN
is not true which confirms the VNICs have been deleted.
Fixes: 8336a974f37d ("bnxt_en: Save user configured filters in a lookup list")
Suggested-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/20260219185313.2682148-3-michael.chan@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 64832289e18d0..c4657bb3acc18 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6212,6 +6212,9 @@ int bnxt_hwrm_cfa_ntuple_filter_free(struct bnxt *bp,
int rc;
set_bit(BNXT_FLTR_FW_DELETED, &fltr->base.state);
+ if (!test_bit(BNXT_STATE_OPEN, &bp->state))
+ return 0;
+
rc = hwrm_req_init(bp, req, HWRM_CFA_NTUPLE_FILTER_FREE);
if (rc)
return rc;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 463/844] ovpn: tcp - fix packet extraction from stream
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (461 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 462/844] bnxt_en: Fix deleting of Ntuple filters Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 464/844] ksmbd: fix signededness bug in smb_direct_prepare_negotiation() Sasha Levin
` (389 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ralf Lici, Antonio Quartulli, Sabrina Dubroca, David S. Miller,
Sasha Levin
From: Ralf Lici <ralf@mandelbit.com>
[ Upstream commit d4f687fbbce45b5e88438e89b5e26c0c15847992 ]
When processing TCP stream data in ovpn_tcp_recv, we receive large
cloned skbs from __strp_rcv that may contain multiple coalesced packets.
The current implementation has two bugs:
1. Header offset overflow: Using pskb_pull with large offsets on
coalesced skbs causes skb->data - skb->head to exceed the u16 storage
of skb->network_header. This causes skb_reset_network_header to fail
on the inner decapsulated packet, resulting in packet drops.
2. Unaligned protocol headers: Extracting packets from arbitrary
positions within the coalesced TCP stream provides no alignment
guarantees for the packet data causing performance penalties on
architectures without efficient unaligned access. Additionally,
openvpn's 2-byte length prefix on TCP packets causes the subsequent
4-byte opcode and packet ID fields to be inherently misaligned.
Fix both issues by allocating a new skb for each openvpn packet and
using skb_copy_bits to extract only the packet content into the new
buffer, skipping the 2-byte length prefix. Also, check the length before
invoking the function that performs the allocation to avoid creating an
invalid skb.
If the packet has to be forwarded to userspace the 2-byte prefix can be
pushed to the head safely, without misalignment.
As a side effect, this approach also avoids the expensive linearization
that pskb_pull triggers on cloned skbs with page fragments. In testing,
this resulted in TCP throughput improvements of up to 74%.
Fixes: 11851cbd60ea ("ovpn: implement TCP transport")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ovpn/tcp.c | 53 ++++++++++++++++++++++++++++--------------
1 file changed, 36 insertions(+), 17 deletions(-)
diff --git a/drivers/net/ovpn/tcp.c b/drivers/net/ovpn/tcp.c
index ec2bbc28c1966..5499c1572f3e2 100644
--- a/drivers/net/ovpn/tcp.c
+++ b/drivers/net/ovpn/tcp.c
@@ -70,37 +70,56 @@ static void ovpn_tcp_to_userspace(struct ovpn_peer *peer, struct sock *sk,
peer->tcp.sk_cb.sk_data_ready(sk);
}
-static void ovpn_tcp_rcv(struct strparser *strp, struct sk_buff *skb)
+static struct sk_buff *ovpn_tcp_skb_packet(const struct ovpn_peer *peer,
+ struct sk_buff *orig_skb,
+ const int pkt_len, const int pkt_off)
{
- struct ovpn_peer *peer = container_of(strp, struct ovpn_peer, tcp.strp);
- struct strp_msg *msg = strp_msg(skb);
- size_t pkt_len = msg->full_len - 2;
- size_t off = msg->offset + 2;
- u8 opcode;
+ struct sk_buff *ovpn_skb;
+ int err;
- /* ensure skb->data points to the beginning of the openvpn packet */
- if (!pskb_pull(skb, off)) {
- net_warn_ratelimited("%s: packet too small for peer %u\n",
- netdev_name(peer->ovpn->dev), peer->id);
+ /* create a new skb with only the content of the current packet */
+ ovpn_skb = netdev_alloc_skb(peer->ovpn->dev, pkt_len);
+ if (unlikely(!ovpn_skb))
goto err;
- }
- /* strparser does not trim the skb for us, therefore we do it now */
- if (pskb_trim(skb, pkt_len) != 0) {
- net_warn_ratelimited("%s: trimming skb failed for peer %u\n",
+ skb_copy_header(ovpn_skb, orig_skb);
+ err = skb_copy_bits(orig_skb, pkt_off, skb_put(ovpn_skb, pkt_len),
+ pkt_len);
+ if (unlikely(err)) {
+ net_warn_ratelimited("%s: skb_copy_bits failed for peer %u\n",
netdev_name(peer->ovpn->dev), peer->id);
+ kfree_skb(ovpn_skb);
goto err;
}
- /* we need the first 4 bytes of data to be accessible
+ consume_skb(orig_skb);
+ return ovpn_skb;
+err:
+ kfree_skb(orig_skb);
+ return NULL;
+}
+
+static void ovpn_tcp_rcv(struct strparser *strp, struct sk_buff *skb)
+{
+ struct ovpn_peer *peer = container_of(strp, struct ovpn_peer, tcp.strp);
+ struct strp_msg *msg = strp_msg(skb);
+ int pkt_len = msg->full_len - 2;
+ u8 opcode;
+
+ /* we need at least 4 bytes of data in the packet
* to extract the opcode and the key ID later on
*/
- if (!pskb_may_pull(skb, OVPN_OPCODE_SIZE)) {
+ if (unlikely(pkt_len < OVPN_OPCODE_SIZE)) {
net_warn_ratelimited("%s: packet too small to fetch opcode for peer %u\n",
netdev_name(peer->ovpn->dev), peer->id);
goto err;
}
+ /* extract the packet into a new skb */
+ skb = ovpn_tcp_skb_packet(peer, skb, pkt_len, msg->offset + 2);
+ if (unlikely(!skb))
+ goto err;
+
/* DATA_V2 packets are handled in kernel, the rest goes to user space */
opcode = ovpn_opcode_from_skb(skb, 0);
if (unlikely(opcode != OVPN_DATA_V2)) {
@@ -113,7 +132,7 @@ static void ovpn_tcp_rcv(struct strparser *strp, struct sk_buff *skb)
/* The packet size header must be there when sending the packet
* to userspace, therefore we put it back
*/
- skb_push(skb, 2);
+ *(__be16 *)__skb_push(skb, sizeof(u16)) = htons(pkt_len);
ovpn_tcp_to_userspace(peer, strp->sk, skb);
return;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 464/844] ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (462 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 463/844] ovpn: tcp - fix packet extraction from stream Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 465/844] dma-mapping: avoid random addr value print out on error path Sasha Levin
` (388 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicholas Carlini, Stefan Metzmacher, Namjae Jeon, Steve French,
Sasha Levin
From: Nicholas Carlini <nicholas@carlini.com>
[ Upstream commit 6b4f875aac344cdd52a1f34cc70ed2f874a65757 ]
smb_direct_prepare_negotiation() casts an unsigned __u32 value
from sp->max_recv_size and req->preferred_send_size to a signed
int before computing min_t(int, ...). A maliciously provided
preferred_send_size of 0x80000000 will return as smaller than
max_recv_size, and then be used to set the maximum allowed
alowed receive size for the next message.
By sending a second message with a large value (>1420 bytes)
the attacker can then achieve a heap buffer overflow.
This fix replaces min_t(int, ...) with min_t(u32)
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Nicholas Carlini <nicholas@carlini.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/transport_rdma.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index c94068b78a1d2..dcc7a6c20d6f8 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -2527,9 +2527,9 @@ static int smb_direct_prepare(struct ksmbd_transport *t)
goto put;
req = (struct smbdirect_negotiate_req *)recvmsg->packet;
- sp->max_recv_size = min_t(int, sp->max_recv_size,
+ sp->max_recv_size = min_t(u32, sp->max_recv_size,
le32_to_cpu(req->preferred_send_size));
- sp->max_send_size = min_t(int, sp->max_send_size,
+ sp->max_send_size = min_t(u32, sp->max_send_size,
le32_to_cpu(req->max_receive_size));
sp->max_fragmented_send_size =
le32_to_cpu(req->max_fragmented_size);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 465/844] dma-mapping: avoid random addr value print out on error path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (463 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 464/844] ksmbd: fix signededness bug in smb_direct_prepare_negotiation() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 466/844] sparc: Fix page alignment in dma mapping Sasha Levin
` (387 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jiri Pirko, Marek Szyprowski, Sasha Levin
From: Jiri Pirko <jiri@nvidia.com>
[ Upstream commit 47322c469d4a63ac45b705ca83680671ff71c975 ]
dma_addr is unitialized in dma_direct_map_phys() when swiotlb is forced
and DMA_ATTR_MMIO is set which leads to random value print out in
warning. Fix that by just returning DMA_MAPPING_ERROR.
Fixes: e53d29f957b3 ("dma-mapping: convert dma_direct_*map_page to be phys_addr_t based")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260209153809.250835-2-jiri@resnulli.us
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/dma/direct.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/dma/direct.h b/kernel/dma/direct.h
index da2fadf45bcd6..62f0d9d0ba02e 100644
--- a/kernel/dma/direct.h
+++ b/kernel/dma/direct.h
@@ -88,7 +88,7 @@ static inline dma_addr_t dma_direct_map_phys(struct device *dev,
if (is_swiotlb_force_bounce(dev)) {
if (attrs & DMA_ATTR_MMIO)
- goto err_overflow;
+ return DMA_MAPPING_ERROR;
return swiotlb_map(dev, phys, size, dir, attrs);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 466/844] sparc: Fix page alignment in dma mapping
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (464 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 465/844] dma-mapping: avoid random addr value print out on error path Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 467/844] wifi: cfg80211: wext: fix IGTK key ID off-by-one Sasha Levin
` (386 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Stian Halseth, Marek Szyprowski, Nathaniel Roach, Han Gao,
Sasha Levin
From: Stian Halseth <stian@itx.no>
[ Upstream commit d5b5e8149af0f5efed58653cbebf1cb3258ce49a ]
'phys' may include an offset within the page, while previously used
'base_paddr' was already page-aligned. This caused incorrect DMA mapping
in dma_4u_map_phys and dma_4v_map_phys.
Fix both functions by masking 'phys' with IO_PAGE_MASK, covering both
generic SPARC code and sun4v.
Fixes: 38c0d0ebf520 ("sparc: Use physical address DMA mapping")
Reported-by: Stian Halseth <stian@itx.no>
Closes: https://github.com/sparclinux/issues/issues/75
Suggested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Stian Halseth <stian@itx.no>
Tested-by: Nathaniel Roach <nroach44@nroach44.id.au>
Tested-by: Han Gao <gaohan@iscas.ac.cn> # on SPARC Enterprise T5220
[mszyprow: adjusted commit description a bit]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260218120056.3366-2-stian@itx.no
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/kernel/iommu.c | 2 ++
arch/sparc/kernel/pci_sun4v.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
index 46ef88bc9c26e..7613ab0ffb89d 100644
--- a/arch/sparc/kernel/iommu.c
+++ b/arch/sparc/kernel/iommu.c
@@ -312,6 +312,8 @@ static dma_addr_t dma_4u_map_phys(struct device *dev, phys_addr_t phys,
if (direction != DMA_TO_DEVICE)
iopte_protection |= IOPTE_WRITE;
+ phys &= IO_PAGE_MASK;
+
for (i = 0; i < npages; i++, base++, phys += IO_PAGE_SIZE)
iopte_val(*base) = iopte_protection | phys;
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index 791f0a76665f6..58ca4148f86be 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -410,6 +410,8 @@ static dma_addr_t dma_4v_map_phys(struct device *dev, phys_addr_t phys,
iommu_batch_start(dev, prot, entry);
+ phys &= IO_PAGE_MASK;
+
for (i = 0; i < npages; i++, phys += IO_PAGE_SIZE) {
long err = iommu_batch_add(phys, mask);
if (unlikely(err < 0L))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 467/844] wifi: cfg80211: wext: fix IGTK key ID off-by-one
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (465 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 466/844] sparc: Fix page alignment in dma mapping Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 468/844] wifi: brcmfmac: Fix potential kernel oops when probe fails Sasha Levin
` (385 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Johannes Berg, Jouni Malinen, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit c8d7f21ead727485ebf965e2b4d42d4a4f0840f6 ]
The IGTK key ID must be 4 or 5, but the code checks against
key ID + 1, so must check against 5/6 rather than 4/5. Fix
that.
Reported-by: Jouni Malinen <j@w1.fi>
Fixes: 08645126dd24 ("cfg80211: implement wext key handling")
Link: https://patch.msgid.link/20260209181220.362205-2-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/wext-compat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 1241fda78a68c..680500fa57cfd 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -684,7 +684,7 @@ static int cfg80211_wext_siwencodeext(struct net_device *dev,
idx = erq->flags & IW_ENCODE_INDEX;
if (cipher == WLAN_CIPHER_SUITE_AES_CMAC) {
- if (idx < 4 || idx > 5) {
+ if (idx < 5 || idx > 6) {
idx = wdev->wext.default_mgmt_key;
if (idx < 0)
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 468/844] wifi: brcmfmac: Fix potential kernel oops when probe fails
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (466 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 467/844] wifi: cfg80211: wext: fix IGTK key ID off-by-one Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 469/844] Remove WARN_ALL_UNSEEDED_RANDOM kernel config option Sasha Levin
` (384 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Marek Szyprowski, Arend van Spriel, Johannes Berg, Sasha Levin
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 243307a0d1b0d01538e202c00454c28b21d4432e ]
When probe of the sdio brcmfmac device fails for some reasons (i.e.
missing firmware), the sdiodev->bus is set to error instead of NULL, thus
the cleanup later in brcmf_sdio_remove() tries to free resources via
invalid bus pointer. This happens because sdiodev->bus is set 2 times:
first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix
this by chaning the brcmf_sdio_probe() function to return the error code
and set sdio->bus only there.
Fixes: 0ff0843310b7 ("wifi: brcmfmac: Add optional lpo clock enable support")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Arend van Spriel<arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260203102133.1478331-1-m.szyprowski@samsung.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 +++----
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 2 +-
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index 6a3f187320fc4..13952dfeb3e30 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -951,11 +951,10 @@ int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
goto out;
/* try to attach to the target device */
- sdiodev->bus = brcmf_sdio_probe(sdiodev);
- if (IS_ERR(sdiodev->bus)) {
- ret = PTR_ERR(sdiodev->bus);
+ ret = brcmf_sdio_probe(sdiodev);
+ if (ret)
goto out;
- }
+
brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
out:
if (ret)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 8cf9d7e7c3f70..4e6ed02c15913 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4445,7 +4445,7 @@ brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus)
return fwreq;
}
-struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
{
int ret;
struct brcmf_sdio *bus;
@@ -4551,11 +4551,12 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
goto fail;
}
- return bus;
+ return 0;
fail:
brcmf_sdio_remove(bus);
- return ERR_PTR(ret);
+ sdiodev->bus = NULL;
+ return ret;
}
/* Detach and free everything */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
index 0d18ed15b4032..80180d5c6c879 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
@@ -358,7 +358,7 @@ void brcmf_sdiod_freezer_uncount(struct brcmf_sdio_dev *sdiodev);
int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev);
int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev);
-struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
void brcmf_sdio_remove(struct brcmf_sdio *bus);
void brcmf_sdio_isr(struct brcmf_sdio *bus, bool in_isr);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 469/844] Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (467 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 468/844] wifi: brcmfmac: Fix potential kernel oops when probe fails Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 470/844] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ Sasha Levin
` (383 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Linus Torvalds, Jason Donenfeld, Sasha Levin
From: Linus Torvalds <torvalds@linux-foundation.org>
[ Upstream commit 7dff99b354601dd01829e1511711846e04340a69 ]
This config option goes way back - it used to be an internal debug
option to random.c (at that point called DEBUG_RANDOM_BOOT), then was
renamed and exposed as a config option as CONFIG_WARN_UNSEEDED_RANDOM,
and then further renamed to the current CONFIG_WARN_ALL_UNSEEDED_RANDOM.
It was all done with the best of intentions: the more limited
rate-limited reports were reporting some cases, but if you wanted to see
all the gory details, you'd enable this "ALL" option.
However, it turns out - perhaps not surprisingly - that when people
don't care about and fix the first rate-limited cases, they most
certainly don't care about any others either, and so warning about all
of them isn't actually helping anything.
And the non-ratelimited reporting causes problems, where well-meaning
people enable debug options, but the excessive flood of messages that
nobody cares about will hide actual real information when things go
wrong.
I just got a kernel bug report (which had nothing to do with randomness)
where two thirds of the the truncated dmesg was just variations of
random: get_random_u32 called from __get_random_u32_below+0x10/0x70 with crng_init=0
and in the process early boot messages had been lost (in addition to
making the messages that _hadn't_ been lost harder to read).
The proper way to find these things for the hypothetical developer that
cares - if such a person exists - is almost certainly with boot time
tracing. That gives you the option to get call graphs etc too, which is
likely a requirement for fixing any problems anyway.
See Documentation/trace/boottime-trace.rst for that option.
And if we for some reason do want to re-introduce actual printing of
these things, it will need to have some uniqueness filtering rather than
this "just print it all" model.
Fixes: cc1e127bfa95 ("random: remove ratelimiting for in-kernel unseeded randomness")
Acked-by: Jason Donenfeld <Jason@zx2c4.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/random.c | 12 +-----------
kernel/configs/debug.config | 1 -
lib/Kconfig.debug | 27 ---------------------------
3 files changed, 1 insertion(+), 39 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index bab03c7c4194a..c36c76c2e88e0 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -96,8 +96,7 @@ static ATOMIC_NOTIFIER_HEAD(random_ready_notifier);
/* Control how we warn userspace. */
static struct ratelimit_state urandom_warning =
RATELIMIT_STATE_INIT_FLAGS("urandom_warning", HZ, 3, RATELIMIT_MSG_ON_RELEASE);
-static int ratelimit_disable __read_mostly =
- IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM);
+static int ratelimit_disable __read_mostly = 0;
module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
@@ -168,12 +167,6 @@ int __cold execute_with_initialized_rng(struct notifier_block *nb)
return ret;
}
-#define warn_unseeded_randomness() \
- if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \
- printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \
- __func__, (void *)_RET_IP_, crng_init)
-
-
/*********************************************************************
*
* Fast key erasure RNG, the "crng".
@@ -434,7 +427,6 @@ static void _get_random_bytes(void *buf, size_t len)
*/
void get_random_bytes(void *buf, size_t len)
{
- warn_unseeded_randomness();
_get_random_bytes(buf, len);
}
EXPORT_SYMBOL(get_random_bytes);
@@ -523,8 +515,6 @@ type get_random_ ##type(void) \
struct batch_ ##type *batch; \
unsigned long next_gen; \
\
- warn_unseeded_randomness(); \
- \
if (!crng_ready()) { \
_get_random_bytes(&ret, sizeof(ret)); \
return ret; \
diff --git a/kernel/configs/debug.config b/kernel/configs/debug.config
index 9f6ab7dabf672..0a6c1763d976e 100644
--- a/kernel/configs/debug.config
+++ b/kernel/configs/debug.config
@@ -29,7 +29,6 @@ CONFIG_SECTION_MISMATCH_WARN_ONLY=y
# CONFIG_UBSAN_ALIGNMENT is not set
# CONFIG_UBSAN_DIV_ZERO is not set
# CONFIG_UBSAN_TRAP is not set
-# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_FS_ALLOW_ALL=y
CONFIG_DEBUG_IRQFLAGS=y
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index cda3cf1fa302c..4bae3b389a9c5 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1687,33 +1687,6 @@ config STACKTRACE
It is also used by various kernel debugging features that require
stack trace generation.
-config WARN_ALL_UNSEEDED_RANDOM
- bool "Warn for all uses of unseeded randomness"
- default n
- help
- Some parts of the kernel contain bugs relating to their use of
- cryptographically secure random numbers before it's actually possible
- to generate those numbers securely. This setting ensures that these
- flaws don't go unnoticed, by enabling a message, should this ever
- occur. This will allow people with obscure setups to know when things
- are going wrong, so that they might contact developers about fixing
- it.
-
- Unfortunately, on some models of some architectures getting
- a fully seeded CRNG is extremely difficult, and so this can
- result in dmesg getting spammed for a surprisingly long
- time. This is really bad from a security perspective, and
- so architecture maintainers really need to do what they can
- to get the CRNG seeded sooner after the system is booted.
- However, since users cannot do anything actionable to
- address this, by default this option is disabled.
-
- Say Y here if you want to receive warnings for all uses of
- unseeded randomness. This will be of use primarily for
- those developers interested in improving the security of
- Linux kernels running on their architecture (or
- subarchitecture).
-
config DEBUG_KOBJECT
bool "kobject debugging"
depends on DEBUG_KERNEL
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 470/844] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (468 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 469/844] Remove WARN_ALL_UNSEEDED_RANDOM kernel config option Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 471/844] Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short Sasha Levin
` (382 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luiz Augusto von Dentz, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 7accb1c4321acb617faf934af59d928b0b047e2b ]
This fixes responding with an invalid result caused by checking the
wrong size of CID which should have been (cmd_len - sizeof(*req)) and
on top of it the wrong result was use L2CAP_CR_LE_INVALID_PARAMS which
is invalid/reserved for reconf when running test like L2CAP/ECFC/BI-03-C:
> ACL Data RX: Handle 64 flags 0x02 dlen 14
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6
MTU: 64
MPS: 64
Source CID: 64
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reserved (0x000c)
Result: Reconfiguration failed - one or more Destination CIDs invalid (0x0003)
Fiix L2CAP/ECFC/BI-04-C which expects L2CAP_RECONF_INVALID_MPS (0x0002)
when more than one channel gets its MPS reduced:
> ACL Data RX: Handle 64 flags 0x02 dlen 16
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 8
MTU: 264
MPS: 99
Source CID: 64
! Source CID: 65
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration successful (0x0000)
Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002)
Fix L2CAP/ECFC/BI-05-C when SCID is invalid (85 unconnected):
> ACL Data RX: Handle 64 flags 0x02 dlen 14
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6
MTU: 65
MPS: 64
! Source CID: 85
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration successful (0x0000)
Result: Reconfiguration failed - one or more Destination CIDs invalid (0x0003)
Fix L2CAP/ECFC/BI-06-C when MPS < L2CAP_ECRED_MIN_MPS (64):
> ACL Data RX: Handle 64 flags 0x02 dlen 14
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 2 len 6
MTU: 672
! MPS: 63
Source CID: 64
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002)
Result: Reconfiguration failed - other unacceptable parameters (0x0004)
Fix L2CAP/ECFC/BI-07-C when MPS reduced for more than one channel:
> ACL Data RX: Handle 64 flags 0x02 dlen 16
LE L2CAP: Enhanced Credit Reconfigure Request (0x19) ident 3 len 8
MTU: 84
! MPS: 71
Source CID: 64
! Source CID: 65
< ACL Data TX: Handle 64 flags 0x00 dlen 10
LE L2CAP: Enhanced Credit Reconfigure Respond (0x1a) ident 2 len 2
! Result: Reconfiguration successful (0x0000)
Result: Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time (0x0002)
Link: https://github.com/bluez/bluez/issues/1865
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/l2cap.h | 2 ++
net/bluetooth/l2cap_core.c | 63 +++++++++++++++++++++++++----------
2 files changed, 47 insertions(+), 18 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 00e182a22720a..9820ccc379f1c 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -493,6 +493,8 @@ struct l2cap_ecred_reconf_req {
#define L2CAP_RECONF_SUCCESS 0x0000
#define L2CAP_RECONF_INVALID_MTU 0x0001
#define L2CAP_RECONF_INVALID_MPS 0x0002
+#define L2CAP_RECONF_INVALID_CID 0x0003
+#define L2CAP_RECONF_INVALID_PARAMS 0x0004
struct l2cap_ecred_reconf_rsp {
__le16 result;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 07b493331fd78..e705b4a171dec 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5294,14 +5294,14 @@ static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
struct l2cap_ecred_reconf_req *req = (void *) data;
struct l2cap_ecred_reconf_rsp rsp;
u16 mtu, mps, result;
- struct l2cap_chan *chan;
+ struct l2cap_chan *chan[L2CAP_ECRED_MAX_CID] = {};
int i, num_scid;
if (!enable_ecred)
return -EINVAL;
- if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
- result = L2CAP_CR_LE_INVALID_PARAMS;
+ if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
+ result = L2CAP_RECONF_INVALID_CID;
goto respond;
}
@@ -5311,42 +5311,69 @@ static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
BT_DBG("mtu %u mps %u", mtu, mps);
if (mtu < L2CAP_ECRED_MIN_MTU) {
- result = L2CAP_RECONF_INVALID_MTU;
+ result = L2CAP_RECONF_INVALID_PARAMS;
goto respond;
}
if (mps < L2CAP_ECRED_MIN_MPS) {
- result = L2CAP_RECONF_INVALID_MPS;
+ result = L2CAP_RECONF_INVALID_PARAMS;
goto respond;
}
cmd_len -= sizeof(*req);
num_scid = cmd_len / sizeof(u16);
+
+ if (num_scid > L2CAP_ECRED_MAX_CID) {
+ result = L2CAP_RECONF_INVALID_PARAMS;
+ goto respond;
+ }
+
result = L2CAP_RECONF_SUCCESS;
+ /* Check if each SCID, MTU and MPS are valid */
for (i = 0; i < num_scid; i++) {
u16 scid;
scid = __le16_to_cpu(req->scid[i]);
- if (!scid)
- return -EPROTO;
+ if (!scid) {
+ result = L2CAP_RECONF_INVALID_CID;
+ goto respond;
+ }
- chan = __l2cap_get_chan_by_dcid(conn, scid);
- if (!chan)
- continue;
+ chan[i] = __l2cap_get_chan_by_dcid(conn, scid);
+ if (!chan[i]) {
+ result = L2CAP_RECONF_INVALID_CID;
+ goto respond;
+ }
- /* If the MTU value is decreased for any of the included
- * channels, then the receiver shall disconnect all
- * included channels.
+ /* The MTU field shall be greater than or equal to the greatest
+ * current MTU size of these channels.
*/
- if (chan->omtu > mtu) {
- BT_ERR("chan %p decreased MTU %u -> %u", chan,
- chan->omtu, mtu);
+ if (chan[i]->omtu > mtu) {
+ BT_ERR("chan %p decreased MTU %u -> %u", chan[i],
+ chan[i]->omtu, mtu);
result = L2CAP_RECONF_INVALID_MTU;
+ goto respond;
}
- chan->omtu = mtu;
- chan->remote_mps = mps;
+ /* If more than one channel is being configured, the MPS field
+ * shall be greater than or equal to the current MPS size of
+ * each of these channels. If only one channel is being
+ * configured, the MPS field may be less than the current MPS
+ * of that channel.
+ */
+ if (chan[i]->remote_mps >= mps && i) {
+ BT_ERR("chan %p decreased MPS %u -> %u", chan[i],
+ chan[i]->remote_mps, mps);
+ result = L2CAP_RECONF_INVALID_MPS;
+ goto respond;
+ }
+ }
+
+ /* Commit the new MTU and MPS values after checking they are valid */
+ for (i = 0; i < num_scid; i++) {
+ chan[i]->omtu = mtu;
+ chan[i]->remote_mps = mps;
}
respond:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 471/844] Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (469 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 470/844] Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 472/844] Bluetooth: hci_qca: Cleanup on all setup failures Sasha Levin
` (381 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luiz Augusto von Dentz, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit c28d2bff70444a85b3b86aaf241ece9408c7858c ]
Test L2CAP/ECFC/BV-26-C expect the response to L2CAP_ECRED_CONN_REQ with
and MTU value < L2CAP_ECRED_MIN_MTU (64) to be L2CAP_CR_LE_INVALID_PARAMS
rather than L2CAP_CR_LE_UNACCEPT_PARAMS.
Also fix not including the correct number of CIDs in the response since
the spec requires all CIDs being rejected to be included in the
response.
Link: https://github.com/bluez/bluez/issues/1868
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/l2cap.h | 6 +++---
net/bluetooth/l2cap_core.c | 14 ++++++++------
2 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 9820ccc379f1c..f08ed93bb6fa3 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -284,9 +284,9 @@ struct l2cap_conn_rsp {
#define L2CAP_CR_LE_BAD_KEY_SIZE 0x0007
#define L2CAP_CR_LE_ENCRYPTION 0x0008
#define L2CAP_CR_LE_INVALID_SCID 0x0009
-#define L2CAP_CR_LE_SCID_IN_USE 0X000A
-#define L2CAP_CR_LE_UNACCEPT_PARAMS 0X000B
-#define L2CAP_CR_LE_INVALID_PARAMS 0X000C
+#define L2CAP_CR_LE_SCID_IN_USE 0x000A
+#define L2CAP_CR_LE_UNACCEPT_PARAMS 0x000B
+#define L2CAP_CR_LE_INVALID_PARAMS 0x000C
/* connect/create channel status */
#define L2CAP_CS_NO_INFO 0x0000
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index e705b4a171dec..0b236e977d70e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5035,13 +5035,15 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
struct l2cap_chan *chan, *pchan;
u16 mtu, mps;
__le16 psm;
- u8 result, len = 0;
+ u8 result, rsp_len = 0;
int i, num_scid;
bool defer = false;
if (!enable_ecred)
return -EINVAL;
+ memset(pdu, 0, sizeof(*pdu));
+
if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
result = L2CAP_CR_LE_INVALID_PARAMS;
goto response;
@@ -5050,6 +5052,9 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
cmd_len -= sizeof(*req);
num_scid = cmd_len / sizeof(u16);
+ /* Always respond with the same number of scids as in the request */
+ rsp_len = cmd_len;
+
if (num_scid > L2CAP_ECRED_MAX_CID) {
result = L2CAP_CR_LE_INVALID_PARAMS;
goto response;
@@ -5059,7 +5064,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
mps = __le16_to_cpu(req->mps);
if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
- result = L2CAP_CR_LE_UNACCEPT_PARAMS;
+ result = L2CAP_CR_LE_INVALID_PARAMS;
goto response;
}
@@ -5079,8 +5084,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
- memset(pdu, 0, sizeof(*pdu));
-
/* Check if we have socket listening on psm */
pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
&conn->hcon->dst, LE_LINK);
@@ -5105,7 +5108,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
BT_DBG("scid[%d] 0x%4.4x", i, scid);
pdu->dcid[i] = 0x0000;
- len += sizeof(*pdu->dcid);
/* Check for valid dynamic CID range */
if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
@@ -5172,7 +5174,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
return 0;
l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
- sizeof(*pdu) + len, pdu);
+ sizeof(*pdu) + rsp_len, pdu);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 472/844] Bluetooth: hci_qca: Cleanup on all setup failures
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (470 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 471/844] Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 473/844] Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ Sasha Levin
` (380 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jinwang Li, Bartosz Golaszewski, Luiz Augusto von Dentz,
Sasha Levin
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
[ Upstream commit 5c4e9a8b18457ad28b57069ef0f14661e3192b2e ]
The setup process previously combined error handling and retry gating
under one condition. As a result, the final failed attempt exited
without performing cleanup.
Update the failure path to always perform power and port cleanup on
setup failure, and reopen the port only when retrying.
Fixes: 9e80587aba4c ("Bluetooth: hci_qca: Enhance retry logic in qca_setup")
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_qca.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index a3c217571c3c4..c0cc04995fc2f 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -2045,19 +2045,23 @@ static int qca_setup(struct hci_uart *hu)
}
out:
- if (ret && retries < MAX_INIT_RETRIES) {
- bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
+ if (ret) {
qca_power_shutdown(hu);
- if (hu->serdev) {
- serdev_device_close(hu->serdev);
- ret = serdev_device_open(hu->serdev);
- if (ret) {
- bt_dev_err(hdev, "failed to open port");
- return ret;
+
+ if (retries < MAX_INIT_RETRIES) {
+ bt_dev_warn(hdev, "Retry BT power ON:%d", retries);
+ if (hu->serdev) {
+ serdev_device_close(hu->serdev);
+ ret = serdev_device_open(hu->serdev);
+ if (ret) {
+ bt_dev_err(hdev, "failed to open port");
+ return ret;
+ }
}
+ retries++;
+ goto retry;
}
- retries++;
- goto retry;
+ return ret;
}
/* Setup bdaddr */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 473/844] Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (471 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 472/844] Bluetooth: hci_qca: Cleanup on all setup failures Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 474/844] Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ Sasha Levin
` (379 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luiz Augusto von Dentz, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 05761c2c2b5bfec85c47f60c903c461e9b56cf87 ]
Similar to 03dba9cea72f ("Bluetooth: L2CAP: Fix not responding with
L2CAP_CR_LE_ENCRYPTION") the result code L2CAP_CR_LE_ENCRYPTION shall
be used when BT_SECURITY_MEDIUM is set since that means security mode 2
which mean it doesn't require authentication which results in
qualification test L2CAP/ECFC/BV-32-C failing.
Link: https://github.com/bluez/bluez/issues/1871
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0b236e977d70e..a5038160675ea 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5096,7 +5096,8 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
SMP_ALLOW_STK)) {
- result = L2CAP_CR_LE_AUTHENTICATION;
+ result = pchan->sec_level == BT_SECURITY_MEDIUM ?
+ L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION;
goto unlock;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 474/844] Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (472 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 473/844] Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 475/844] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ Sasha Levin
` (378 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luiz Augusto von Dentz, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit a8d1d73c81d1e70d2aa49fdaf59d933bb783ffe5 ]
Upon receiving L2CAP_ECRED_CONN_REQ the given MTU shall be checked
against the suggested MTU of the listening socket as that is required
by the likes of PTS L2CAP/ECFC/BV-27-C test which expects
L2CAP_CR_LE_UNACCEPT_PARAMS if the MTU is lowers than socket omtu.
In order to be able to set chan->omtu the code now allows setting
setsockopt(BT_SNDMTU), but it is only allowed when connection has not
been stablished since there is no procedure to reconfigure the output
MTU.
Link: https://github.com/bluez/bluez/issues/1895
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 8 ++++++++
net/bluetooth/l2cap_sock.c | 15 +++++++++++----
2 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a5038160675ea..29af3f63e89ce 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5101,6 +5101,14 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
goto unlock;
}
+ /* Check if the listening channel has set an output MTU then the
+ * requested MTU shall be less than or equal to that value.
+ */
+ if (pchan->omtu && mtu < pchan->omtu) {
+ result = L2CAP_CR_LE_UNACCEPT_PARAMS;
+ goto unlock;
+ }
+
result = L2CAP_CR_LE_SUCCESS;
for (i = 0; i < num_scid; i++) {
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 9ee189c815d49..66ab2754594d6 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1029,10 +1029,17 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
- /* Setting is not supported as it's the remote side that
- * decides this.
- */
- err = -EPERM;
+ /* Only allow setting output MTU when not connected */
+ if (sk->sk_state == BT_CONNECTED) {
+ err = -EISCONN;
+ break;
+ }
+
+ err = copy_safe_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
+ if (err)
+ break;
+
+ chan->omtu = mtu;
break;
case BT_RCVMTU:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 475/844] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (473 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 474/844] Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 476/844] net: do not pass flow_id to set_rps_cpu() Sasha Levin
` (377 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Luiz Augusto von Dentz, Christian Eggers, Sasha Levin
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 138d7eca445ef37a0333425d269ee59900ca1104 ]
This adds a check for encryption key size upon receiving
L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which
expects L2CAP_CR_LE_BAD_KEY_SIZE.
Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/
Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tested-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 29af3f63e89ce..72a4bb1fee46a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4900,6 +4900,13 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
goto response_unlock;
}
+ /* Check if Key Size is sufficient for the security level */
+ if (!l2cap_check_enc_key_size(conn->hcon, pchan)) {
+ result = L2CAP_CR_LE_BAD_KEY_SIZE;
+ chan = NULL;
+ goto response_unlock;
+ }
+
/* Check for valid dynamic CID range */
if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
result = L2CAP_CR_LE_INVALID_SCID;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 476/844] net: do not pass flow_id to set_rps_cpu()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (474 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 475/844] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 477/844] tls: Fix race condition in tls_sw_cancel_work_tx() Sasha Levin
` (376 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Dumazet, Krishna Kumar, Kuniyuki Iwashima, Jakub Kicinski,
Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8a8a9fac9efa6423fd74938b940cb7d731780718 ]
Blamed commit made the assumption that the RPS table for each receive
queue would have the same size, and that it would not change.
Compute flow_id in set_rps_cpu(), do not assume we can use the value
computed by get_rps_cpu(). Otherwise we risk out-of-bound access
and/or crashes.
Fixes: 48aa30443e52 ("net: Cache hash and flow_id to avoid recalculation")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Krishna Kumar <krikku@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260220222605.3468081-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/dev.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index f5e4040e08399..60a26208cbd87 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4988,8 +4988,7 @@ static bool rps_flow_is_active(struct rps_dev_flow *rflow,
static struct rps_dev_flow *
set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
- struct rps_dev_flow *rflow, u16 next_cpu, u32 hash,
- u32 flow_id)
+ struct rps_dev_flow *rflow, u16 next_cpu, u32 hash)
{
if (next_cpu < nr_cpu_ids) {
u32 head;
@@ -5000,6 +4999,7 @@ set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
struct rps_dev_flow *tmp_rflow;
unsigned int tmp_cpu;
u16 rxq_index;
+ u32 flow_id;
int rc;
/* Should we steer this flow to a different hardware queue? */
@@ -5015,6 +5015,7 @@ set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
if (!flow_table)
goto out;
+ flow_id = rfs_slot(hash, flow_table);
tmp_rflow = &flow_table->flows[flow_id];
tmp_cpu = READ_ONCE(tmp_rflow->cpu);
@@ -5062,7 +5063,6 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
struct rps_dev_flow_table *flow_table;
struct rps_map *map;
int cpu = -1;
- u32 flow_id;
u32 tcpu;
u32 hash;
@@ -5109,8 +5109,7 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
/* OK, now we know there is a match,
* we can look at the local (per receive queue) flow table
*/
- flow_id = rfs_slot(hash, flow_table);
- rflow = &flow_table->flows[flow_id];
+ rflow = &flow_table->flows[rfs_slot(hash, flow_table)];
tcpu = rflow->cpu;
/*
@@ -5129,8 +5128,7 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
((int)(READ_ONCE(per_cpu(softnet_data, tcpu).input_queue_head) -
rflow->last_qtail)) >= 0)) {
tcpu = next_cpu;
- rflow = set_rps_cpu(dev, skb, rflow, next_cpu, hash,
- flow_id);
+ rflow = set_rps_cpu(dev, skb, rflow, next_cpu, hash);
}
if (tcpu < nr_cpu_ids && cpu_online(tcpu)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 477/844] tls: Fix race condition in tls_sw_cancel_work_tx()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (475 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 476/844] net: do not pass flow_id to set_rps_cpu() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 478/844] kcm: fix zero-frag skb in frag_list on partial sendmsg error Sasha Levin
` (375 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hyunwoo Kim, Simon Horman, Sabrina Dubroca, Jakub Kicinski,
Sasha Levin
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 7bb09315f93dce6acc54bf59e5a95ba7365c2be4 ]
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delayed_work(&tx_ctx->tx_work.work, 0);
To prevent this race condition, cancel_delayed_work_sync() is
replaced with disable_delayed_work_sync().
Fixes: f87e62d45e51 ("net/tls: remove close callback sock unlock/lock around TX work flush")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/aZgsFO6nfylfvLE7@v4bel
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_sw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 9937d4c810f2b..b1fa62de9dab5 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2533,7 +2533,7 @@ void tls_sw_cancel_work_tx(struct tls_context *tls_ctx)
set_bit(BIT_TX_CLOSING, &ctx->tx_bitmask);
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
- cancel_delayed_work_sync(&ctx->tx_work.work);
+ disable_delayed_work_sync(&ctx->tx_work.work);
}
void tls_sw_release_resources_tx(struct sock *sk)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 478/844] kcm: fix zero-frag skb in frag_list on partial sendmsg error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (476 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 477/844] tls: Fix race condition in tls_sw_cancel_work_tx() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 479/844] dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs Sasha Levin
` (374 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jiayuan Chen, syzbot+52624bdfbf2746d37d70, Jakub Kicinski,
Sasha Levin
From: Jiayuan Chen <jiayuan.chen@shopee.com>
[ Upstream commit ca220141fa8ebae09765a242076b2b77338106b0 ]
Syzkaller reported a warning in kcm_write_msgs() when processing a
message with a zero-fragment skb in the frag_list.
When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,
it allocates a new skb (tskb) and links it into the frag_list before
copying data. If the copy subsequently fails (e.g. -EFAULT from
user memory), tskb remains in the frag_list with zero fragments:
head skb (msg being assembled, NOT yet in sk_write_queue)
+-----------+
| frags[17] | (MAX_SKB_FRAGS, all filled with data)
| frag_list-+--> tskb
+-----------+ +----------+
| frags[0] | (empty! copy failed before filling)
+----------+
For SOCK_SEQPACKET with partial data already copied, the error path
saves this message via partial_message for later completion. For
SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a
subsequent zero-length write(fd, NULL, 0) completes the message and
queues it to sk_write_queue. kcm_write_msgs() then walks the
frag_list and hits:
WARN_ON(!skb_shinfo(skb)->nr_frags)
TCP has a similar pattern where skbs are enqueued before data copy
and cleaned up on failure via tcp_remove_empty_skb(). KCM was
missing the equivalent cleanup.
Fix this by tracking the predecessor skb (frag_prev) when allocating
a new frag_list entry. On error, if the tail skb has zero frags,
use frag_prev to unlink and free it in O(1) without walking the
singly-linked frag_list. frag_prev is safe to dereference because
the entire message chain is only held locally (or in kcm->seq_skb)
and is not added to sk_write_queue until MSG_EOR, so the send path
cannot free it underneath us.
Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log
if the condition is somehow hit repeatedly.
There are currently no KCM selftests in the kernel tree; a simple
reproducer is available at [1].
[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa
Reported-by: syzbot+52624bdfbf2746d37d70@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000269a1405a12fdc77@google.com/T/
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260219014256.370092-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/kcm/kcmsock.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 5dd7e0509a48f..3912e75079f5e 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -628,7 +628,7 @@ static int kcm_write_msgs(struct kcm_sock *kcm)
skb = txm->frag_skb;
}
- if (WARN_ON(!skb_shinfo(skb)->nr_frags) ||
+ if (WARN_ON_ONCE(!skb_shinfo(skb)->nr_frags) ||
WARN_ON_ONCE(!skb_frag_page(&skb_shinfo(skb)->frags[0]))) {
ret = -EINVAL;
goto out;
@@ -749,7 +749,7 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
{
struct sock *sk = sock->sk;
struct kcm_sock *kcm = kcm_sk(sk);
- struct sk_buff *skb = NULL, *head = NULL;
+ struct sk_buff *skb = NULL, *head = NULL, *frag_prev = NULL;
size_t copy, copied = 0;
long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
int eor = (sock->type == SOCK_DGRAM) ?
@@ -824,6 +824,7 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
else
skb->next = tskb;
+ frag_prev = skb;
skb = tskb;
skb->ip_summed = CHECKSUM_UNNECESSARY;
continue;
@@ -933,6 +934,22 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
out_error:
kcm_push(kcm);
+ /* When MAX_SKB_FRAGS was reached, a new skb was allocated and
+ * linked into the frag_list before data copy. If the copy
+ * subsequently failed, this skb has zero frags. Remove it from
+ * the frag_list to prevent kcm_write_msgs from later hitting
+ * WARN_ON(!skb_shinfo(skb)->nr_frags).
+ */
+ if (frag_prev && !skb_shinfo(skb)->nr_frags) {
+ if (head == frag_prev)
+ skb_shinfo(head)->frag_list = NULL;
+ else
+ frag_prev->next = NULL;
+ kfree_skb(skb);
+ /* Update skb as it may be saved in partial_message via goto */
+ skb = frag_prev;
+ }
+
if (sock->type == SOCK_SEQPACKET) {
/* Wrote some bytes before encountering an
* error, return partial success.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 479/844] dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (477 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 478/844] kcm: fix zero-frag skb in frag_list on partial sendmsg error Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 480/844] tipc: fix duplicate publication key in tipc_service_insert_publ() Sasha Levin
` (373 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ivan Vecera, Simon Horman, Jakub Kicinski, Sasha Levin
From: Ivan Vecera <ivecera@redhat.com>
[ Upstream commit 4cfe066a82cdf9e83e48b16000f55280efc98325 ]
The REF_PHASE_OFFSET_COMP register is 48-bit wide on most zl3073x chip
variants, but only 32-bit wide on chip IDs 0x0E30, 0x0E93..0x0E97 and
0x1F60. The driver unconditionally uses 48-bit read/write operations,
which on 32-bit variants causes reading 2 bytes past the register
boundary (corrupting the value) and writing 2 bytes into the adjacent
register.
Fix this by storing the chip ID in the device structure during probe
and adding a helper to detect the affected variants. Use the correct
register width for read/write operations and the matching sign extension
bit (31 vs 47) when interpreting the phase compensation value.
Fixes: 6287262f761e ("dpll: zl3073x: Add support to adjust phase")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260220155755.448185-1-ivecera@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dpll/zl3073x/core.c | 1 +
drivers/dpll/zl3073x/core.h | 28 ++++++++++++++++++++++++++++
drivers/dpll/zl3073x/dpll.c | 7 +++++--
drivers/dpll/zl3073x/ref.c | 25 ++++++++++++++++++++-----
drivers/dpll/zl3073x/regs.h | 1 +
5 files changed, 55 insertions(+), 7 deletions(-)
diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c
index 383e2397dd033..b20d4f24c0e94 100644
--- a/drivers/dpll/zl3073x/core.c
+++ b/drivers/dpll/zl3073x/core.c
@@ -1023,6 +1023,7 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev,
"Unknown or non-match chip ID: 0x%0x\n",
id);
}
+ zldev->chip_id = id;
/* Read revision, firmware version and custom config version */
rc = zl3073x_read_u16(zldev, ZL_REG_REVISION, &revision);
diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h
index 09bca2d0926d5..f6a792557ccd6 100644
--- a/drivers/dpll/zl3073x/core.h
+++ b/drivers/dpll/zl3073x/core.h
@@ -35,6 +35,7 @@ struct zl3073x_dpll;
* @dev: pointer to device
* @regmap: regmap to access device registers
* @multiop_lock: to serialize multiple register operations
+ * @chip_id: chip ID read from hardware
* @ref: array of input references' invariants
* @out: array of outs' invariants
* @synth: array of synths' invariants
@@ -48,6 +49,7 @@ struct zl3073x_dev {
struct device *dev;
struct regmap *regmap;
struct mutex multiop_lock;
+ u16 chip_id;
/* Invariants */
struct zl3073x_ref ref[ZL3073X_NUM_REFS];
@@ -144,6 +146,32 @@ int zl3073x_write_hwreg_seq(struct zl3073x_dev *zldev,
int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel);
+/**
+ * zl3073x_dev_is_ref_phase_comp_32bit - check ref phase comp register size
+ * @zldev: pointer to zl3073x device
+ *
+ * Some chip IDs have a 32-bit wide ref_phase_offset_comp register instead
+ * of the default 48-bit.
+ *
+ * Return: true if the register is 32-bit, false if 48-bit
+ */
+static inline bool
+zl3073x_dev_is_ref_phase_comp_32bit(struct zl3073x_dev *zldev)
+{
+ switch (zldev->chip_id) {
+ case 0x0E30:
+ case 0x0E93:
+ case 0x0E94:
+ case 0x0E95:
+ case 0x0E96:
+ case 0x0E97:
+ case 0x1F60:
+ return true;
+ default:
+ return false;
+ }
+}
+
static inline bool
zl3073x_is_n_pin(u8 id)
{
diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c
index a8001c9760382..d7194418d1568 100644
--- a/drivers/dpll/zl3073x/dpll.c
+++ b/drivers/dpll/zl3073x/dpll.c
@@ -459,8 +459,11 @@ zl3073x_dpll_input_pin_phase_adjust_get(const struct dpll_pin *dpll_pin,
ref_id = zl3073x_input_pin_ref_get(pin->id);
ref = zl3073x_ref_state_get(zldev, ref_id);
- /* Perform sign extension for 48bit signed value */
- phase_comp = sign_extend64(ref->phase_comp, 47);
+ /* Perform sign extension based on register width */
+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev))
+ phase_comp = sign_extend64(ref->phase_comp, 31);
+ else
+ phase_comp = sign_extend64(ref->phase_comp, 47);
/* Reverse two's complement negation applied during set and convert
* to 32bit signed int
diff --git a/drivers/dpll/zl3073x/ref.c b/drivers/dpll/zl3073x/ref.c
index aa2de13effa87..6b65e61039999 100644
--- a/drivers/dpll/zl3073x/ref.c
+++ b/drivers/dpll/zl3073x/ref.c
@@ -121,8 +121,16 @@ int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index)
return rc;
/* Read phase compensation register */
- rc = zl3073x_read_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP,
- &ref->phase_comp);
+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) {
+ u32 val;
+
+ rc = zl3073x_read_u32(zldev, ZL_REG_REF_PHASE_OFFSET_COMP_32,
+ &val);
+ ref->phase_comp = val;
+ } else {
+ rc = zl3073x_read_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP,
+ &ref->phase_comp);
+ }
if (rc)
return rc;
@@ -179,9 +187,16 @@ int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index,
if (!rc && dref->sync_ctrl != ref->sync_ctrl)
rc = zl3073x_write_u8(zldev, ZL_REG_REF_SYNC_CTRL,
ref->sync_ctrl);
- if (!rc && dref->phase_comp != ref->phase_comp)
- rc = zl3073x_write_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP,
- ref->phase_comp);
+ if (!rc && dref->phase_comp != ref->phase_comp) {
+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev))
+ rc = zl3073x_write_u32(zldev,
+ ZL_REG_REF_PHASE_OFFSET_COMP_32,
+ ref->phase_comp);
+ else
+ rc = zl3073x_write_u48(zldev,
+ ZL_REG_REF_PHASE_OFFSET_COMP,
+ ref->phase_comp);
+ }
if (rc)
return rc;
diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h
index d837bee72b178..5573d7188406b 100644
--- a/drivers/dpll/zl3073x/regs.h
+++ b/drivers/dpll/zl3073x/regs.h
@@ -194,6 +194,7 @@
#define ZL_REF_CONFIG_DIFF_EN BIT(2)
#define ZL_REG_REF_PHASE_OFFSET_COMP ZL_REG(10, 0x28, 6)
+#define ZL_REG_REF_PHASE_OFFSET_COMP_32 ZL_REG(10, 0x28, 4)
#define ZL_REG_REF_SYNC_CTRL ZL_REG(10, 0x2e, 1)
#define ZL_REF_SYNC_CTRL_MODE GENMASK(2, 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 480/844] tipc: fix duplicate publication key in tipc_service_insert_publ()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (478 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 479/844] dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 481/844] RDMA/core: Fix stale RoCE GIDs during netdev events at registration Sasha Levin
` (372 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tung Nguyen, Simon Horman, Jakub Kicinski, Sasha Levin
From: Tung Nguyen <tung.quang.nguyen@est.tech>
[ Upstream commit 3aa677625c8fad39989496c51bcff3872c1f16f1 ]
TIPC uses named table to store TIPC services represented by type and
instance. Each time an application calls TIPC API bind() to bind a
type/instance to a socket, an entry is created and inserted into the
named table. It looks like this:
named table:
key1, entry1 (type, instance ...)
key2, entry2 (type, instance ...)
In the above table, each entry represents a route for sending data
from one socket to the other. For all publications originated from
the same node, the key is UNIQUE to identify each entry.
It is calculated by this formula:
key = socket portid + number of bindings + 1 (1)
where:
- socket portid: unique and calculated by using linux kernel function
get_random_u32_below(). So, the value is randomized.
- number of bindings: the number of times a type/instance pair is bound
to a socket. This number is linearly increased,
starting from 0.
While the socket portid is unique and randomized by linux kernel, the
linear increment of "number of bindings" in formula (1) makes "key" not
unique anymore. For example:
- Socket 1 is created with its associated port number 20062001. Type 1000,
instance 1 is bound to socket 1:
key1: 20062001 + 0 + 1 = 20062002
Then, bind() is called a second time on Socket 1 to by the same type 1000,
instance 1:
key2: 20062001 + 1 + 1 = 20062003
Named table:
key1 (20062002), entry1 (1000, 1 ...)
key2 (20062003), entry2 (1000, 1 ...)
- Socket 2 is created with its associated port number 20062002. Type 1000,
instance 1 is bound to socket 2:
key3: 20062002 + 0 + 1 = 20062003
TIPC looks up the named table and finds out that key2 with the same value
already exists and rejects the insertion into the named table.
This leads to failure of bind() call from application on Socket 2 with error
message EINVAL "Invalid argument".
This commit fixes this issue by adding more port id checking to make sure
that the key is unique to publications originated from the same port id
and node.
Fixes: 218527fe27ad ("tipc: replace name table service range array with rb tree")
Signed-off-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260220050541.237962-1-tung.quang.nguyen@est.tech
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/name_table.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index e74940eab3a47..7f42fb6a8481f 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -348,7 +348,8 @@ static bool tipc_service_insert_publ(struct net *net,
/* Return if the publication already exists */
list_for_each_entry(_p, &sr->all_publ, all_publ) {
- if (_p->key == key && (!_p->sk.node || _p->sk.node == node)) {
+ if (_p->key == key && _p->sk.ref == p->sk.ref &&
+ (!_p->sk.node || _p->sk.node == node)) {
pr_debug("Failed to bind duplicate %u,%u,%u/%u:%u/%u\n",
p->sr.type, p->sr.lower, p->sr.upper,
node, p->sk.ref, key);
@@ -388,7 +389,8 @@ static struct publication *tipc_service_remove_publ(struct service_range *r,
u32 node = sk->node;
list_for_each_entry(p, &r->all_publ, all_publ) {
- if (p->key != key || (node && node != p->sk.node))
+ if (p->key != key || p->sk.ref != sk->ref ||
+ (node && node != p->sk.node))
continue;
list_del(&p->all_publ);
list_del(&p->local_publ);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 481/844] RDMA/core: Fix stale RoCE GIDs during netdev events at registration
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (479 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 480/844] tipc: fix duplicate publication key in tipc_service_insert_publ() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 482/844] RDMA/bng_re: Remove unnessary validity checks Sasha Levin
` (371 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jiri Pirko, syzbot+881d65229ca4f9ae8c84, Leon Romanovsky,
Sasha Levin
From: Jiri Pirko <jiri@nvidia.com>
[ Upstream commit 9af0feae8016ba58ad7ff784a903404986b395b1 ]
RoCE GID entries become stale when netdev properties change during the
IB device registration window. This is reproducible with a udev rule
that sets a MAC address when a VF netdev appears:
ACTION=="add", SUBSYSTEM=="net", KERNEL=="eth4", \
RUN+="/sbin/ip link set eth4 address 88:22:33:44:55:66"
After VF creation, show_gids displays GIDs derived from the original
random MAC rather than the configured one.
The root cause is a race between netdev event processing and device
registration:
CPU 0 (driver) CPU 1 (udev/workqueue)
────────────── ──────────────────────
ib_register_device()
ib_cache_setup_one()
gid_table_setup_one()
_gid_table_setup_one()
← GID table allocated
rdma_roce_rescan_device()
← GIDs populated with
OLD MAC
ip link set eth4 addr NEW_MAC
NETDEV_CHANGEADDR queued
netdevice_event_work_handler()
ib_enum_all_roce_netdevs()
← Iterates DEVICE_REGISTERED
← Device NOT marked yet, SKIP!
enable_device_and_get()
xa_set_mark(DEVICE_REGISTERED)
← Too late, event was lost
The netdev event handler uses ib_enum_all_roce_netdevs() which only
iterates devices marked DEVICE_REGISTERED. However, this mark is set
late in the registration process, after the GID cache is already
populated. Events arriving in this window are silently dropped.
Fix this by introducing a new xarray mark DEVICE_GID_UPDATES that is
set immediately after the GID table is allocated and initialized. Use
the new mark in ib_enum_all_roce_netdevs() function to iterate devices
instead of DEVICE_REGISTERED.
This is safe because:
- After _gid_table_setup_one(), all required structures exist (port_data,
immutable, cache.gid)
- The GID table mutex serializes concurrent access between the initial
rescan and event handlers
- Event handlers correctly update stale GIDs even when racing with rescan
- The mark is cleared in ib_cache_cleanup_one() before teardown
This also fixes similar races for IP address events (inetaddr_event,
inet6addr_event) which use the same enumeration path.
Fixes: 0df91bb67334 ("RDMA/devices: Use xarray to store the client_data")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260127093839.126291-1-jiri@resnulli.us
Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/cache.c | 13 +++++++++++
drivers/infiniband/core/core_priv.h | 3 +++
drivers/infiniband/core/device.c | 34 ++++++++++++++++++++++++++++-
3 files changed, 49 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 0fc1c5bce2f0d..78bc7d83edc65 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -927,6 +927,13 @@ static int gid_table_setup_one(struct ib_device *ib_dev)
if (err)
return err;
+ /*
+ * Mark the device as ready for GID cache updates. This allows netdev
+ * event handlers to update the GID cache even before the device is
+ * fully registered.
+ */
+ ib_device_enable_gid_updates(ib_dev);
+
rdma_roce_rescan_device(ib_dev);
return err;
@@ -1639,6 +1646,12 @@ void ib_cache_release_one(struct ib_device *device)
void ib_cache_cleanup_one(struct ib_device *device)
{
+ /*
+ * Clear the GID updates mark first to prevent event handlers from
+ * accessing the device while it's being torn down.
+ */
+ ib_device_disable_gid_updates(device);
+
/* The cleanup function waits for all in-progress workqueue
* elements and cleans up the GID cache. This function should be
* called after the device was removed from the devices list and
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 05102769a918a..a2c36666e6fcb 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -100,6 +100,9 @@ void ib_enum_all_roce_netdevs(roce_netdev_filter filter,
roce_netdev_callback cb,
void *cookie);
+void ib_device_enable_gid_updates(struct ib_device *device);
+void ib_device_disable_gid_updates(struct ib_device *device);
+
typedef int (*nldev_callback)(struct ib_device *device,
struct sk_buff *skb,
struct netlink_callback *cb,
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 1174ab7da6295..87eaefd3794bb 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -93,6 +93,7 @@ static struct workqueue_struct *ib_unreg_wq;
static DEFINE_XARRAY_FLAGS(devices, XA_FLAGS_ALLOC);
static DECLARE_RWSEM(devices_rwsem);
#define DEVICE_REGISTERED XA_MARK_1
+#define DEVICE_GID_UPDATES XA_MARK_2
static u32 highest_client_id;
#define CLIENT_REGISTERED XA_MARK_1
@@ -2441,11 +2442,42 @@ void ib_enum_all_roce_netdevs(roce_netdev_filter filter,
unsigned long index;
down_read(&devices_rwsem);
- xa_for_each_marked (&devices, index, dev, DEVICE_REGISTERED)
+ xa_for_each_marked(&devices, index, dev, DEVICE_GID_UPDATES)
ib_enum_roce_netdev(dev, filter, filter_cookie, cb, cookie);
up_read(&devices_rwsem);
}
+/**
+ * ib_device_enable_gid_updates - Mark device as ready for GID cache updates
+ * @device: Device to mark
+ *
+ * Called after GID table is allocated and initialized. After this mark is set,
+ * netdevice event handlers can update the device's GID cache. This allows
+ * events that arrive during device registration to be processed, avoiding
+ * stale GID entries when netdev properties change during the device
+ * registration process.
+ */
+void ib_device_enable_gid_updates(struct ib_device *device)
+{
+ down_write(&devices_rwsem);
+ xa_set_mark(&devices, device->index, DEVICE_GID_UPDATES);
+ up_write(&devices_rwsem);
+}
+
+/**
+ * ib_device_disable_gid_updates - Clear the GID updates mark
+ * @device: Device to unmark
+ *
+ * Called before GID table cleanup to prevent event handlers from accessing
+ * the device while it's being torn down.
+ */
+void ib_device_disable_gid_updates(struct ib_device *device)
+{
+ down_write(&devices_rwsem);
+ xa_clear_mark(&devices, device->index, DEVICE_GID_UPDATES);
+ up_write(&devices_rwsem);
+}
+
/*
* ib_enum_all_devs - enumerate all ib_devices
* @cb: Callback to call for each found ib_device
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 482/844] RDMA/bng_re: Remove unnessary validity checks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (480 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 481/844] RDMA/core: Fix stale RoCE GIDs during netdev events at registration Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 483/844] RDMA/bng_re: Unwind bng_re_dev_init properly Sasha Levin
` (370 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Siva Reddy Kallam, Simon Horman, kernel test robot, Dan Carpenter,
Leon Romanovsky, Sasha Levin
From: Siva Reddy Kallam <siva.kallam@broadcom.com>
[ Upstream commit 7a23af417d9dd57b4382356b2e7442e5d2bf5bea ]
Fix below smatch warning:
drivers/infiniband/hw/bng_re/bng_dev.c:113
bng_re_net_ring_free() warn: variable dereferenced before check 'rdev'
(see line 107)
current driver has unnessary validity checks. So, removing these
unnessary validity checks.
Fixes: 4f830cd8d7fe ("RDMA/bng_re: Add infrastructure for enabling Firmware channel")
Fixes: 745065770c2d ("RDMA/bng_re: Register and get the resources from bnge driver")
Fixes: 04e031ff6e60 ("RDMA/bng_re: Initialize the Firmware and Hardware")
Fixes: d0da769c19d0 ("RDMA/bng_re: Add Auxiliary interface")
Reported-by: Simon Horman <horms@kernel.org>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202601010413.sWadrQel-lkp@intel.com/
Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20260218091246.1764808-2-siva.kallam@broadcom.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bng_re/bng_dev.c | 27 ++++----------------------
1 file changed, 4 insertions(+), 23 deletions(-)
diff --git a/drivers/infiniband/hw/bng_re/bng_dev.c b/drivers/infiniband/hw/bng_re/bng_dev.c
index d8f8d7f7075f0..0678aaecb3b5a 100644
--- a/drivers/infiniband/hw/bng_re/bng_dev.c
+++ b/drivers/infiniband/hw/bng_re/bng_dev.c
@@ -54,9 +54,6 @@ static void bng_re_destroy_chip_ctx(struct bng_re_dev *rdev)
{
struct bng_re_chip_ctx *chip_ctx;
- if (!rdev->chip_ctx)
- return;
-
kfree(rdev->dev_attr);
rdev->dev_attr = NULL;
@@ -124,12 +121,6 @@ static int bng_re_net_ring_free(struct bng_re_dev *rdev,
struct bnge_fw_msg fw_msg = {};
int rc = -EINVAL;
- if (!rdev)
- return rc;
-
- if (!aux_dev)
- return rc;
-
bng_re_init_hwrm_hdr((void *)&req, HWRM_RING_FREE);
req.ring_type = type;
req.ring_id = cpu_to_le16(fw_ring_id);
@@ -150,10 +141,7 @@ static int bng_re_net_ring_alloc(struct bng_re_dev *rdev,
struct hwrm_ring_alloc_input req = {};
struct hwrm_ring_alloc_output resp;
struct bnge_fw_msg fw_msg = {};
- int rc = -EINVAL;
-
- if (!aux_dev)
- return rc;
+ int rc;
bng_re_init_hwrm_hdr((void *)&req, HWRM_RING_ALLOC);
req.enables = 0;
@@ -184,10 +172,7 @@ static int bng_re_stats_ctx_free(struct bng_re_dev *rdev)
struct hwrm_stat_ctx_free_input req = {};
struct hwrm_stat_ctx_free_output resp = {};
struct bnge_fw_msg fw_msg = {};
- int rc = -EINVAL;
-
- if (!aux_dev)
- return rc;
+ int rc;
bng_re_init_hwrm_hdr((void *)&req, HWRM_STAT_CTX_FREE);
req.stat_ctx_id = cpu_to_le32(rdev->stats_ctx.fw_id);
@@ -208,13 +193,10 @@ static int bng_re_stats_ctx_alloc(struct bng_re_dev *rdev)
struct hwrm_stat_ctx_alloc_output resp = {};
struct hwrm_stat_ctx_alloc_input req = {};
struct bnge_fw_msg fw_msg = {};
- int rc = -EINVAL;
+ int rc;
stats->fw_id = BNGE_INVALID_STATS_CTX_ID;
- if (!aux_dev)
- return rc;
-
bng_re_init_hwrm_hdr((void *)&req, HWRM_STAT_CTX_ALLOC);
req.update_period_ms = cpu_to_le32(1000);
req.stats_dma_addr = cpu_to_le64(stats->dma_map);
@@ -486,8 +468,7 @@ static void bng_re_remove(struct auxiliary_device *adev)
rdev = dev_info->rdev;
- if (rdev)
- bng_re_remove_device(rdev, adev);
+ bng_re_remove_device(rdev, adev);
kfree(dev_info);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 483/844] RDMA/bng_re: Unwind bng_re_dev_init properly
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (481 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 482/844] RDMA/bng_re: Remove unnessary validity checks Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 484/844] net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets Sasha Levin
` (369 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Siva Reddy Kallam, Simon Horman, kernel test robot, Dan Carpenter,
Leon Romanovsky, Sasha Levin
From: Siva Reddy Kallam <siva.kallam@broadcom.com>
[ Upstream commit 3d2e5d12a2eef0ca8a629a422aa593673235c77c ]
Fix below smatch warning:
drivers/infiniband/hw/bng_re/bng_dev.c:270
bng_re_dev_init() warn: missing unwind goto?
Current bng_re_dev_init function is not having clear unwinding code.
So, added proper unwinding with ladder.
Fixes: 4f830cd8d7fe ("RDMA/bng_re: Add infrastructure for enabling Firmware channel")
Reported-by: Simon Horman <horms@kernel.org>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202601010413.sWadrQel-lkp@intel.com/
Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Link: https://patch.msgid.link/20260218091246.1764808-3-siva.kallam@broadcom.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bng_re/bng_dev.c | 29 +++++++++++++-------------
1 file changed, 15 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/hw/bng_re/bng_dev.c b/drivers/infiniband/hw/bng_re/bng_dev.c
index 0678aaecb3b5a..fd0a4fe274ca6 100644
--- a/drivers/infiniband/hw/bng_re/bng_dev.c
+++ b/drivers/infiniband/hw/bng_re/bng_dev.c
@@ -285,7 +285,7 @@ static int bng_re_dev_init(struct bng_re_dev *rdev)
if (rc) {
ibdev_err(&rdev->ibdev,
"Failed to register with netedev: %#x\n", rc);
- return -EINVAL;
+ goto reg_netdev_fail;
}
set_bit(BNG_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
@@ -294,19 +294,16 @@ static int bng_re_dev_init(struct bng_re_dev *rdev)
ibdev_err(&rdev->ibdev,
"RoCE requires minimum 2 MSI-X vectors, but only %d reserved\n",
rdev->aux_dev->auxr_info->msix_requested);
- bnge_unregister_dev(rdev->aux_dev);
- clear_bit(BNG_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
- return -EINVAL;
+ rc = -EINVAL;
+ goto msix_ctx_fail;
}
ibdev_dbg(&rdev->ibdev, "Got %d MSI-X vectors\n",
rdev->aux_dev->auxr_info->msix_requested);
rc = bng_re_setup_chip_ctx(rdev);
if (rc) {
- bnge_unregister_dev(rdev->aux_dev);
- clear_bit(BNG_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
ibdev_err(&rdev->ibdev, "Failed to get chip context\n");
- return -EINVAL;
+ goto msix_ctx_fail;
}
bng_re_query_hwrm_version(rdev);
@@ -315,16 +312,14 @@ static int bng_re_dev_init(struct bng_re_dev *rdev)
if (rc) {
ibdev_err(&rdev->ibdev,
"Failed to allocate RCFW Channel: %#x\n", rc);
- goto fail;
+ goto alloc_fw_chl_fail;
}
/* Allocate nq record memory */
rdev->nqr = kzalloc(sizeof(*rdev->nqr), GFP_KERNEL);
if (!rdev->nqr) {
- bng_re_destroy_chip_ctx(rdev);
- bnge_unregister_dev(rdev->aux_dev);
- clear_bit(BNG_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
- return -ENOMEM;
+ rc = -ENOMEM;
+ goto nq_alloc_fail;
}
rdev->nqr->num_msix = rdev->aux_dev->auxr_info->msix_requested;
@@ -393,9 +388,15 @@ static int bng_re_dev_init(struct bng_re_dev *rdev)
free_ring:
bng_re_net_ring_free(rdev, rdev->rcfw.creq.ring_id, type);
free_rcfw:
+ kfree(rdev->nqr);
+nq_alloc_fail:
bng_re_free_rcfw_channel(&rdev->rcfw);
-fail:
- bng_re_dev_uninit(rdev);
+alloc_fw_chl_fail:
+ bng_re_destroy_chip_ctx(rdev);
+msix_ctx_fail:
+ bnge_unregister_dev(rdev->aux_dev);
+ clear_bit(BNG_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);
+reg_netdev_fail:
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 484/844] net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (482 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 483/844] RDMA/bng_re: Unwind bng_re_dev_init properly Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 485/844] netconsole: avoid OOB reads, msg is not nul-terminated Sasha Levin
` (368 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Duoming Zhou, Jijie Shao, Paolo Abeni, Sasha Levin
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit bae8a5d2e759da2e0cba33ab2080deee96a09373 ]
When the FarSync T-series card is being detached, the fst_card_info is
deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task
may still be running or pending, leading to use-after-free bugs when the
already freed fst_card_info is accessed in fst_process_tx_work_q() or
fst_process_int_work_q().
A typical race condition is depicted below:
CPU 0 (cleanup) | CPU 1 (tasklet)
| fst_start_xmit()
fst_remove_one() | tasklet_schedule()
unregister_hdlc_device()|
| fst_process_tx_work_q() //handler
kfree(card) //free | do_bottom_half_tx()
| card-> //use
The following KASAN trace was captured:
==================================================================
BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00
Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32
...
Call Trace:
<IRQ>
dump_stack_lvl+0x55/0x70
print_report+0xcb/0x5d0
? do_bottom_half_tx+0xb88/0xd00
kasan_report+0xb8/0xf0
? do_bottom_half_tx+0xb88/0xd00
do_bottom_half_tx+0xb88/0xd00
? _raw_spin_lock_irqsave+0x85/0xe0
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx___hrtimer_run_queues+0x10/0x10
fst_process_tx_work_q+0x67/0x90
tasklet_action_common+0x1fa/0x720
? hrtimer_interrupt+0x31f/0x780
handle_softirqs+0x176/0x530
__irq_exit_rcu+0xab/0xe0
sysvec_apic_timer_interrupt+0x70/0x80
...
Allocated by task 41 on cpu 3 at 72.330843s:
kasan_save_stack+0x24/0x50
kasan_save_track+0x17/0x60
__kasan_kmalloc+0x7f/0x90
fst_add_one+0x1a5/0x1cd0
local_pci_probe+0xdd/0x190
pci_device_probe+0x341/0x480
really_probe+0x1c6/0x6a0
__driver_probe_device+0x248/0x310
driver_probe_device+0x48/0x210
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x101/0x190
__device_attach+0x198/0x3a0
device_initial_probe+0x78/0xa0
pci_bus_add_device+0x81/0xc0
pci_bus_add_devices+0x7e/0x190
enable_slot+0x9b9/0x1130
acpiphp_check_bridge.part.0+0x2e1/0x460
acpiphp_hotplug_notify+0x36c/0x3c0
acpi_device_hotplug+0x203/0xb10
acpi_hotplug_work_fn+0x59/0x80
...
Freed by task 41 on cpu 1 at 75.138639s:
kasan_save_stack+0x24/0x50
kasan_save_track+0x17/0x60
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x135/0x410
fst_remove_one+0x2ca/0x540
pci_device_remove+0xa6/0x1d0
device_release_driver_internal+0x364/0x530
pci_stop_bus_device+0x105/0x150
pci_stop_and_remove_bus_device+0xd/0x20
disable_slot+0x116/0x260
acpiphp_disable_and_eject_slot+0x4b/0x190
acpiphp_hotplug_notify+0x230/0x3c0
acpi_device_hotplug+0x203/0xb10
acpi_hotplug_work_fn+0x59/0x80
...
The buggy address belongs to the object at ffff88800aad1000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 28 bytes inside of
freed 1024-byte region
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800aad1000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88800aad1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88800aad1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Fix this by ensuring that both fst_tx_task and fst_int_task are properly
canceled before the fst_card_info is released. Add tasklet_kill() in
fst_remove_one() to synchronize with any pending or running tasklets.
Since unregister_hdlc_device() stops data transmission and reception,
and fst_disable_intr() prevents further interrupts, it is appropriate
to place tasklet_kill() after these calls.
The bugs were identified through static analysis. To reproduce the issue
and validate the fix, a FarSync T-series card was simulated in QEMU and
delays(e.g., mdelay()) were introduced within the tasklet handler to
increase the likelihood of triggering the race condition.
Fixes: 2f623aaf9f31 ("net: farsync: Fix kmemleak when rmmods farsync")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Jijie Shao <shaojijie@huawei.com>
Link: https://patch.msgid.link/20260219124637.72578-1-duoming@zju.edu.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wan/farsync.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 5b01642ca44e0..6b2d1e63855e8 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2550,6 +2550,8 @@ fst_remove_one(struct pci_dev *pdev)
fst_disable_intr(card);
free_irq(card->irq, card);
+ tasklet_kill(&fst_tx_task);
+ tasklet_kill(&fst_int_task);
iounmap(card->ctlmem);
iounmap(card->mem);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 485/844] netconsole: avoid OOB reads, msg is not nul-terminated
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (483 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 484/844] net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 486/844] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port Sasha Levin
` (367 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jakub Kicinski, Simon Horman, Paolo Abeni, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 82aec772fca2223bc5774bd9af486fd95766e578 ]
msg passed to netconsole from the console subsystem is not guaranteed
to be nul-terminated. Before recent
commit 7eab73b18630 ("netconsole: convert to NBCON console infrastructure")
the message would be placed in printk_shared_pbufs, a static global
buffer, so KASAN had harder time catching OOB accesses. Now we see:
printk: console [netcon_ext0] enabled
BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240
Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594
CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9
Call Trace:
kasan_report+0xe4/0x120
string+0x1f7/0x240
vsnprintf+0x655/0xba0
scnprintf+0xba/0x120
netconsole_write+0x3fe/0xa10
nbcon_emit_next_record+0x46e/0x860
nbcon_kthread_func+0x623/0x750
Allocated by task 1:
nbcon_alloc+0x1ea/0x450
register_console+0x26b/0xe10
init_netconsole+0xbb0/0xda0
The buggy address belongs to the object at ffff88813b6d4000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 0 bytes to the right of
allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)
Fixes: c62c0a17f9b7 ("netconsole: Append kernel version to message")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260219195021.2099699-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/netconsole.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 9cb4dfc242f5f..f418efb38508c 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -1524,7 +1524,8 @@ static void send_msg_no_fragmentation(struct netconsole_target *nt,
if (release_len) {
release = init_utsname()->release;
- scnprintf(nt->buf, MAX_PRINT_CHUNK, "%s,%s", release, msg);
+ scnprintf(nt->buf, MAX_PRINT_CHUNK, "%s,%.*s", release,
+ msg_len, msg);
msg_len += release_len;
} else {
memcpy(nt->buf, msg, msg_len);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 486/844] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (484 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 485/844] netconsole: avoid OOB reads, msg is not nul-terminated Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 487/844] RDMA/efa: Fix typo in efa_alloc_mr() Sasha Levin
` (366 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kamal Heib, Leon Romanovsky, Sasha Levin
From: Kamal Heib <kheib@redhat.com>
[ Upstream commit fd80bd7105f88189f47d465ca8cb7d115570de30 ]
The function ionic_query_port() calls ib_device_get_netdev() without
checking the return value which could lead to NULL pointer dereference,
Fix it by checking the return value and return -ENODEV if the 'ndev' is
NULL.
Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality")
Signed-off-by: Kamal Heib <kheib@redhat.com>
Link: https://patch.msgid.link/20260220222125.16973-2-kheib@redhat.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/ionic/ionic_ibdev.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/hw/ionic/ionic_ibdev.c b/drivers/infiniband/hw/ionic/ionic_ibdev.c
index 164046d00e5d4..bd4c73e530d08 100644
--- a/drivers/infiniband/hw/ionic/ionic_ibdev.c
+++ b/drivers/infiniband/hw/ionic/ionic_ibdev.c
@@ -81,6 +81,8 @@ static int ionic_query_port(struct ib_device *ibdev, u32 port,
return -EINVAL;
ndev = ib_device_get_netdev(ibdev, port);
+ if (!ndev)
+ return -ENODEV;
if (netif_running(ndev) && netif_carrier_ok(ndev)) {
attr->state = IB_PORT_ACTIVE;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 487/844] RDMA/efa: Fix typo in efa_alloc_mr()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (485 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 486/844] RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 488/844] net: Drop the lock in skb_may_tx_timestamp() Sasha Levin
` (365 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jason Gunthorpe, Michael Margolin, Leon Romanovsky, Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit f22c77ce49db0589103d96487dca56f5b2136362 ]
The pattern is to check the entire driver request space, not just
sizeof something unrelated.
Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/1-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
Acked-by: Michael Margolin <mrgolin@amazon.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 755bba8d58bbc..5cab7dd70aebf 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1663,7 +1663,7 @@ static struct efa_mr *efa_alloc_mr(struct ib_pd *ibpd, int access_flags,
struct efa_mr *mr;
if (udata && udata->inlen &&
- !ib_is_udata_cleared(udata, 0, sizeof(udata->inlen))) {
+ !ib_is_udata_cleared(udata, 0, udata->inlen)) {
ibdev_dbg(&dev->ibdev,
"Incompatible ABI params, udata not cleared\n");
return ERR_PTR(-EINVAL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 488/844] net: Drop the lock in skb_may_tx_timestamp()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (486 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 487/844] RDMA/efa: Fix typo in efa_alloc_mr() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 489/844] net: usb: pegasus: enable basic endpoint checking Sasha Levin
` (364 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sebastian Andrzej Siewior, Willem de Bruijn, Jason Xing,
Eric Dumazet, Paolo Abeni, Sasha Levin
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 ]
skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must
not be taken in IRQ context, only softirq is okay. A few drivers receive
the timestamp via a dedicated interrupt and complete the TX timestamp
from that handler. This will lead to a deadlock if the lock is already
write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will
remain valid until the skb is released. The ->sk_socket and ->file
member will be set to NULL once the user closes the socket which may
happen before the timestamp arrives.
If we happen to observe the pointer while the socket is closing but
before the pointer is set to NULL then we may use it because both
pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a
matching WRITE_ONCE() where the pointer are cleared.
Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de
Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 2 +-
net/core/skbuff.c | 23 ++++++++++++++++++-----
net/socket.c | 2 +-
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index aafe8bdb2c0f9..ff65c3a67efa2 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2089,7 +2089,7 @@ static inline int sk_rx_queue_get(const struct sock *sk)
static inline void sk_set_socket(struct sock *sk, struct socket *sock)
{
- sk->sk_socket = sock;
+ WRITE_ONCE(sk->sk_socket, sock);
if (sock) {
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index fa6209f45de9c..79dc6d6900cd3 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5555,15 +5555,28 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
{
- bool ret;
+ struct socket *sock;
+ struct file *file;
+ bool ret = false;
if (likely(tsonly || READ_ONCE(sock_net(sk)->core.sysctl_tstamp_allow_data)))
return true;
- read_lock_bh(&sk->sk_callback_lock);
- ret = sk->sk_socket && sk->sk_socket->file &&
- file_ns_capable(sk->sk_socket->file, &init_user_ns, CAP_NET_RAW);
- read_unlock_bh(&sk->sk_callback_lock);
+ /* The sk pointer remains valid as long as the skb is. The sk_socket and
+ * file pointer may become NULL if the socket is closed. Both structures
+ * (including file->cred) are RCU freed which means they can be accessed
+ * within a RCU read section.
+ */
+ rcu_read_lock();
+ sock = READ_ONCE(sk->sk_socket);
+ if (!sock)
+ goto out;
+ file = READ_ONCE(sock->file);
+ if (!file)
+ goto out;
+ ret = file_ns_capable(file, &init_user_ns, CAP_NET_RAW);
+out:
+ rcu_read_unlock();
return ret;
}
diff --git a/net/socket.c b/net/socket.c
index 136b98c54fb37..05952188127f5 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -674,7 +674,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
iput(SOCK_INODE(sock));
return;
}
- sock->file = NULL;
+ WRITE_ONCE(sock->file, NULL);
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 489/844] net: usb: pegasus: enable basic endpoint checking
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (487 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 488/844] net: Drop the lock in skb_may_tx_timestamp() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 490/844] erofs: fix interlaced plain identification for encoded extents Sasha Levin
` (363 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ziyi Guo, Simon Horman, Paolo Abeni, Sasha Levin
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
[ Upstream commit 3d7e6ce34f4fcc7083510c28b17a7c36462a25d4 ]
pegasus_probe() fills URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:
- usb_rcvbulkpipe(dev, 1) for RX data
- usb_sndbulkpipe(dev, 2) for TX data
- usb_rcvintpipe(dev, 3) for status interrupts
A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.
Add a pegasus_usb_ep enum for endpoint numbers, replacing magic
constants throughout. Add usb_check_bulk_endpoints() and
usb_check_int_endpoints() calls before any resource allocation to
verify endpoint types before use, rejecting devices with mismatched
descriptors at probe time, and avoid triggering assertion.
Similar fix to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
- commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260222050633.410165-1-n7l8m4@u.northwestern.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/pegasus.c | 35 ++++++++++++++++++++++++++++++-----
1 file changed, 30 insertions(+), 5 deletions(-)
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index c514483134f05..0f16a133c75d1 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -31,6 +31,17 @@ static const char driver_name[] = "pegasus";
BMSR_100FULL | BMSR_ANEGCAPABLE)
#define CARRIER_CHECK_DELAY (2 * HZ)
+/*
+ * USB endpoints.
+ */
+
+enum pegasus_usb_ep {
+ PEGASUS_USB_EP_CONTROL = 0,
+ PEGASUS_USB_EP_BULK_IN = 1,
+ PEGASUS_USB_EP_BULK_OUT = 2,
+ PEGASUS_USB_EP_INT_IN = 3,
+};
+
static bool loopback;
static bool mii_mode;
static char *devid;
@@ -545,7 +556,7 @@ static void read_bulk_callback(struct urb *urb)
goto tl_sched;
goon:
usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb,
- usb_rcvbulkpipe(pegasus->usb, 1),
+ usb_rcvbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_IN),
pegasus->rx_skb->data, PEGASUS_MTU,
read_bulk_callback, pegasus);
rx_status = usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC);
@@ -585,7 +596,7 @@ static void rx_fixup(struct tasklet_struct *t)
return;
}
usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb,
- usb_rcvbulkpipe(pegasus->usb, 1),
+ usb_rcvbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_IN),
pegasus->rx_skb->data, PEGASUS_MTU,
read_bulk_callback, pegasus);
try_again:
@@ -713,7 +724,7 @@ static netdev_tx_t pegasus_start_xmit(struct sk_buff *skb,
((__le16 *) pegasus->tx_buff)[0] = cpu_to_le16(l16);
skb_copy_from_linear_data(skb, pegasus->tx_buff + 2, skb->len);
usb_fill_bulk_urb(pegasus->tx_urb, pegasus->usb,
- usb_sndbulkpipe(pegasus->usb, 2),
+ usb_sndbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_OUT),
pegasus->tx_buff, count,
write_bulk_callback, pegasus);
if ((res = usb_submit_urb(pegasus->tx_urb, GFP_ATOMIC))) {
@@ -840,7 +851,7 @@ static int pegasus_open(struct net_device *net)
set_registers(pegasus, EthID, 6, net->dev_addr);
usb_fill_bulk_urb(pegasus->rx_urb, pegasus->usb,
- usb_rcvbulkpipe(pegasus->usb, 1),
+ usb_rcvbulkpipe(pegasus->usb, PEGASUS_USB_EP_BULK_IN),
pegasus->rx_skb->data, PEGASUS_MTU,
read_bulk_callback, pegasus);
if ((res = usb_submit_urb(pegasus->rx_urb, GFP_KERNEL))) {
@@ -851,7 +862,7 @@ static int pegasus_open(struct net_device *net)
}
usb_fill_int_urb(pegasus->intr_urb, pegasus->usb,
- usb_rcvintpipe(pegasus->usb, 3),
+ usb_rcvintpipe(pegasus->usb, PEGASUS_USB_EP_INT_IN),
pegasus->intr_buff, sizeof(pegasus->intr_buff),
intr_callback, pegasus, pegasus->intr_interval);
if ((res = usb_submit_urb(pegasus->intr_urb, GFP_KERNEL))) {
@@ -1136,10 +1147,24 @@ static int pegasus_probe(struct usb_interface *intf,
pegasus_t *pegasus;
int dev_index = id - pegasus_ids;
int res = -ENOMEM;
+ static const u8 bulk_ep_addr[] = {
+ PEGASUS_USB_EP_BULK_IN | USB_DIR_IN,
+ PEGASUS_USB_EP_BULK_OUT | USB_DIR_OUT,
+ 0};
+ static const u8 int_ep_addr[] = {
+ PEGASUS_USB_EP_INT_IN | USB_DIR_IN,
+ 0};
if (pegasus_blacklisted(dev))
return -ENODEV;
+ /* Verify that all required endpoints are present */
+ if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+ !usb_check_int_endpoints(intf, int_ep_addr)) {
+ dev_err(&intf->dev, "Missing or invalid endpoints\n");
+ return -ENODEV;
+ }
+
net = alloc_etherdev(sizeof(struct pegasus));
if (!net)
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 490/844] erofs: fix interlaced plain identification for encoded extents
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (488 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 489/844] net: usb: pegasus: enable basic endpoint checking Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 491/844] RDMA/umem: Fix double dma_buf_unpin in failure path Sasha Levin
` (362 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Gao Xiang, syzbot+d988dc155e740d76a331, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 4a2d046e4b13202a6301a993961f5b30ae4d7119 ]
Only plain data whose start position and on-disk physical length are
both aligned to the block size should be classified as interlaced
plain extents. Otherwise, it must be treated as shifted plain extents.
This issue was found by syzbot using a crafted compressed image
containing plain extents with unaligned physical lengths, which can
cause OOB read in z_erofs_transform_plain().
Reported-and-tested-by: syzbot+d988dc155e740d76a331@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/699d5714.050a0220.cdd3c.03e7.GAE@google.com
Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/zmap.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index c8d8e129eb4ba..30775502b56da 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -513,6 +513,7 @@ static int z_erofs_map_blocks_ext(struct inode *inode,
unsigned int recsz = z_erofs_extent_recsize(vi->z_advise);
erofs_off_t pos = round_up(Z_EROFS_MAP_HEADER_END(erofs_iloc(inode) +
vi->inode_isize + vi->xattr_isize), recsz);
+ unsigned int bmask = sb->s_blocksize - 1;
bool in_mbox = erofs_inode_in_metabox(inode);
erofs_off_t lend = inode->i_size;
erofs_off_t l, r, mid, pa, la, lstart;
@@ -596,17 +597,17 @@ static int z_erofs_map_blocks_ext(struct inode *inode,
map->m_flags |= EROFS_MAP_MAPPED |
EROFS_MAP_FULL_MAPPED | EROFS_MAP_ENCODED;
fmt = map->m_plen >> Z_EROFS_EXTENT_PLEN_FMT_BIT;
+ if (map->m_plen & Z_EROFS_EXTENT_PLEN_PARTIAL)
+ map->m_flags |= EROFS_MAP_PARTIAL_REF;
+ map->m_plen &= Z_EROFS_EXTENT_PLEN_MASK;
if (fmt)
map->m_algorithmformat = fmt - 1;
- else if (interlaced && !erofs_blkoff(sb, map->m_pa))
+ else if (interlaced && !((map->m_pa | map->m_plen) & bmask))
map->m_algorithmformat =
Z_EROFS_COMPRESSION_INTERLACED;
else
map->m_algorithmformat =
Z_EROFS_COMPRESSION_SHIFTED;
- if (map->m_plen & Z_EROFS_EXTENT_PLEN_PARTIAL)
- map->m_flags |= EROFS_MAP_PARTIAL_REF;
- map->m_plen &= Z_EROFS_EXTENT_PLEN_MASK;
}
}
map->m_llen = lend - map->m_la;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 491/844] RDMA/umem: Fix double dma_buf_unpin in failure path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (489 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 490/844] erofs: fix interlaced plain identification for encoded extents Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 492/844] tcp: re-enable acceptance of FIN packets when RWIN is 0 Sasha Levin
` (361 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jacob Moroni, Leon Romanovsky, Sasha Levin
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 104016eb671e19709721c1b0048dd912dc2e96be ]
In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to
ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf
is immediately unpinned but the umem_dmabuf->pinned flag is still
set. Then, when ib_umem_release() is called, it calls
ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.
Fix this by removing the immediate unpin upon failure and just let
the ib_umem_release/revoke path handle it. This also ensures the
proper unmap-unpin unwind ordering if the dmabuf_map_pages call
happened to fail due to dma_resv_wait_timeout (and therefore has
a non-NULL umem_dmabuf->sgt).
Fixes: 1e4df4a21c5a ("RDMA/umem: Allow pinned dmabuf umem usage")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Link: https://patch.msgid.link/20260224234153.1207849-1-jmoroni@google.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/umem_dmabuf.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c
index 0ec2e4120cc94..17b16fe0e49d9 100644
--- a/drivers/infiniband/core/umem_dmabuf.c
+++ b/drivers/infiniband/core/umem_dmabuf.c
@@ -221,13 +221,11 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device,
err = ib_umem_dmabuf_map_pages(umem_dmabuf);
if (err)
- goto err_unpin;
+ goto err_release;
dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv);
return umem_dmabuf;
-err_unpin:
- dma_buf_unpin(umem_dmabuf->attach);
err_release:
dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv);
ib_umem_release(&umem_dmabuf->umem);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 492/844] tcp: re-enable acceptance of FIN packets when RWIN is 0
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (490 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 491/844] RDMA/umem: Fix double dma_buf_unpin in failure path Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 493/844] dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() Sasha Levin
` (360 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Simon Baatz, Eric Dumazet, Kuniyuki Iwashima, Jakub Kicinski,
Sasha Levin
From: Simon Baatz <gmbnomis@gmail.com>
[ Upstream commit 1e3bb184e94125bae7c1703472109a646d0f79d9 ]
Commit 2bd99aef1b19 ("tcp: accept bare FIN packets under memory
pressure") allowed accepting FIN packets in tcp_data_queue() even when
the receive window was closed, to prevent ACK/FIN loops with broken
clients.
Such a FIN packet is in sequence, but because the FIN consumes a
sequence number, it extends beyond the window. Before commit
9ca48d616ed7 ("tcp: do not accept packets beyond window"),
tcp_sequence() only required the seq to be within the window. After
that change, the entire packet (including the FIN) must fit within the
window. As a result, such FIN packets are now dropped and the handling
path is no longer reached.
Be more lenient by not counting the sequence number consumed by the
FIN when calling tcp_sequence(), restoring the previous behavior for
cases where only the FIN extends beyond the window.
Fixes: 9ca48d616ed7 ("tcp: do not accept packets beyond window")
Signed-off-by: Simon Baatz <gmbnomis@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260224-fix_zero_wnd_fin-v2-1-a16677ea7cea@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_input.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0d080a3e27d6f..aa4f5bf765596 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4611,15 +4611,24 @@ static enum skb_drop_reason tcp_disordered_ack_check(const struct sock *sk,
*/
static enum skb_drop_reason tcp_sequence(const struct sock *sk,
- u32 seq, u32 end_seq)
+ u32 seq, u32 end_seq,
+ const struct tcphdr *th)
{
const struct tcp_sock *tp = tcp_sk(sk);
+ u32 seq_limit;
if (before(end_seq, tp->rcv_wup))
return SKB_DROP_REASON_TCP_OLD_SEQUENCE;
- if (after(end_seq, tp->rcv_nxt + tcp_receive_window(tp))) {
- if (after(seq, tp->rcv_nxt + tcp_receive_window(tp)))
+ seq_limit = tp->rcv_nxt + tcp_receive_window(tp);
+ if (unlikely(after(end_seq, seq_limit))) {
+ /* Some stacks are known to handle FIN incorrectly; allow the
+ * FIN to extend beyond the window and check it in detail later.
+ */
+ if (!after(end_seq - th->fin, seq_limit))
+ return SKB_NOT_DROPPED_YET;
+
+ if (after(seq, seq_limit))
return SKB_DROP_REASON_TCP_INVALID_SEQUENCE;
/* Only accept this packet if receive queue is empty. */
@@ -6145,7 +6154,8 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
step1:
/* Step 1: check sequence number */
- reason = tcp_sequence(sk, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
+ reason = tcp_sequence(sk, TCP_SKB_CB(skb)->seq,
+ TCP_SKB_CB(skb)->end_seq, th);
if (reason) {
/* RFC793, page 37: "In all states except SYN-SENT, all reset
* (RST) segments are validated by checking their SEQ-fields."
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 493/844] dpll: zl3073x: Remove redundant cleanup in devm_dpll_init()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (491 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 492/844] tcp: re-enable acceptance of FIN packets when RWIN is 0 Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 494/844] net: mana: Fix double destroy_workqueue on service rescan PCI path Sasha Levin
` (359 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Felix Gu, Ivan Vecera, Jakub Kicinski, Sasha Levin
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 676c7af91fcd740d34e7cb788cbc58e3bcafde39 ]
The devm_add_action_or_reset() function already executes the cleanup
action on failure before returning an error, so the explicit goto error
and subsequent zl3073x_dev_dpll_fini() call causes double cleanup.
Fixes: ebb1031c5137 ("dpll: zl3073x: Refactor DPLL initialization")
Reviewed-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260224-dpll-v2-1-d7786414a830@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dpll/zl3073x/core.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c
index b20d4f24c0e94..b9b7c751b7602 100644
--- a/drivers/dpll/zl3073x/core.c
+++ b/drivers/dpll/zl3073x/core.c
@@ -978,11 +978,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls)
}
/* Add devres action to release DPLL related resources */
- rc = devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev);
- if (rc)
- goto error;
-
- return 0;
+ return devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev);
error:
zl3073x_dev_dpll_fini(zldev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 494/844] net: mana: Fix double destroy_workqueue on service rescan PCI path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (492 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 493/844] dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 495/844] team: avoid NETDEV_CHANGEMTU event when unregistering slave Sasha Levin
` (358 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dipayaan Roy, Haiyang Zhang, Simon Horman, Jakub Kicinski,
Sasha Levin
From: Dipayaan Roy <dipayanroy@linux.microsoft.com>
[ Upstream commit f975a0955276579e2176a134366ed586071c7c6a ]
While testing corner cases in the driver, a use-after-free crash
was found on the service rescan PCI path.
When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()
destroys gc->service_wq. If the subsequent mana_gd_resume() fails
with -ETIMEDOUT or -EPROTO, the code falls through to
mana_serv_rescan() which triggers pci_stop_and_remove_bus_device().
This invokes the PCI .remove callback (mana_gd_remove), which calls
mana_gd_cleanup() a second time, attempting to destroy the already-
freed workqueue. Fix this by NULL-checking gc->service_wq in
mana_gd_cleanup() and setting it to NULL after destruction.
Call stack of issue for reference:
[Sat Feb 21 18:53:48 2026] Call Trace:
[Sat Feb 21 18:53:48 2026] <TASK>
[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana]
[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]
[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0
[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70
[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250
[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20
[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90
[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30
[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana]
[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana]
[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0
[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0
[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130
[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10
[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10
[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350
[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10
[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30
[Sat Feb 21 18:53:48 2026] </TASK>
Fixes: 505cc26bcae0 ("net: mana: Add support for auxiliary device servicing events")
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/aZ2bzL64NagfyHpg@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/microsoft/mana/gdma_main.c | 5 ++++-
drivers/net/ethernet/microsoft/mana/mana_en.c | 4 +++-
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
index 0055c231acf6d..3926d18f1840b 100644
--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
@@ -1946,7 +1946,10 @@ static void mana_gd_cleanup(struct pci_dev *pdev)
mana_gd_remove_irqs(pdev);
- destroy_workqueue(gc->service_wq);
+ if (gc->service_wq) {
+ destroy_workqueue(gc->service_wq);
+ gc->service_wq = NULL;
+ }
dev_dbg(&pdev->dev, "mana gdma cleanup successful\n");
}
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index 1ad154f9db1ad..d487bf2f1cf1f 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -3690,7 +3690,9 @@ void mana_rdma_remove(struct gdma_dev *gd)
}
WRITE_ONCE(gd->rdma_teardown, true);
- flush_workqueue(gc->service_wq);
+
+ if (gc->service_wq)
+ flush_workqueue(gc->service_wq);
if (gd->adev)
remove_adev(gd);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 495/844] team: avoid NETDEV_CHANGEMTU event when unregistering slave
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (493 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 494/844] net: mana: Fix double destroy_workqueue on service rescan PCI path Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 496/844] net/mlx5: DR, Fix circular locking dependency in dump Sasha Levin
` (357 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tetsuo Handa, syzbot+881d65229ca4f9ae8c84, Ido Schimmel,
Jiri Pirko, Stanislav Fomichev, Jakub Kicinski, Sasha Levin
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit bb4c698633c0e19717586a6524a33196cff01a32 ]
syzbot is reporting
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
__netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
netdev_hold include/linux/netdevice.h:4429 [inline]
inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
team_del_slave drivers/net/team/team_core.c:1936 [inline]
team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
call_netdevice_notifiers net/core/dev.c:2295 [inline]
__dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
problem. Ido Schimmel found steps to reproduce
ip link add name team1 type team
ip link add name dummy1 mtu 1499 master team1 type dummy
ip netns add ns1
ip link set dev dummy1 netns ns1
ip -n ns1 link del dev dummy1
and also found that the same issue was fixed in the bond driver in
commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when
unregistering slave").
Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net:
hold netdev instance lock during sysfs operations") and commit 303a8487a657
("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.
Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20260224125709.317574-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/team/team_core.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index c08a5c1bd6e4d..a0fe998cc055d 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -1292,7 +1292,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
static void __team_port_change_port_removed(struct team_port *port);
-static int team_port_del(struct team *team, struct net_device *port_dev)
+static int team_port_del(struct team *team, struct net_device *port_dev, bool unregister)
{
struct net_device *dev = team->dev;
struct team_port *port;
@@ -1330,7 +1330,13 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
__team_port_change_port_removed(port);
team_port_set_orig_dev_addr(port);
- dev_set_mtu(port_dev, port->orig.mtu);
+ if (unregister) {
+ netdev_lock_ops(port_dev);
+ __netif_set_mtu(port_dev, port->orig.mtu);
+ netdev_unlock_ops(port_dev);
+ } else {
+ dev_set_mtu(port_dev, port->orig.mtu);
+ }
kfree_rcu(port, rcu);
netdev_info(dev, "Port device %s removed\n", portname);
netdev_compute_master_upper_features(team->dev, true);
@@ -1634,7 +1640,7 @@ static void team_uninit(struct net_device *dev)
ASSERT_RTNL();
list_for_each_entry_safe(port, tmp, &team->port_list, list)
- team_port_del(team, port->dev);
+ team_port_del(team, port->dev, false);
__team_change_mode(team, NULL); /* cleanup */
__team_options_unregister(team, team_options, ARRAY_SIZE(team_options));
@@ -1933,7 +1939,16 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
ASSERT_RTNL();
- return team_port_del(team, port_dev);
+ return team_port_del(team, port_dev, false);
+}
+
+static int team_del_slave_on_unregister(struct net_device *dev, struct net_device *port_dev)
+{
+ struct team *team = netdev_priv(dev);
+
+ ASSERT_RTNL();
+
+ return team_port_del(team, port_dev, true);
}
static netdev_features_t team_fix_features(struct net_device *dev,
@@ -2926,7 +2941,7 @@ static int team_device_event(struct notifier_block *unused,
!!netif_oper_up(port->dev));
break;
case NETDEV_UNREGISTER:
- team_del_slave(port->team->dev, dev);
+ team_del_slave_on_unregister(port->team->dev, dev);
break;
case NETDEV_FEAT_CHANGE:
if (!port->team->notifier_ctx) {
@@ -2999,3 +3014,4 @@ MODULE_LICENSE("GPL v2");
MODULE_AUTHOR("Jiri Pirko <jpirko@redhat.com>");
MODULE_DESCRIPTION("Ethernet team device driver");
MODULE_ALIAS_RTNL_LINK(DRV_NAME);
+MODULE_IMPORT_NS("NETDEV_INTERNAL");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 496/844] net/mlx5: DR, Fix circular locking dependency in dump
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (494 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 495/844] team: avoid NETDEV_CHANGEMTU event when unregistering slave Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 497/844] net/mlx5: LAG, disable MPESW in lag_disable_change() Sasha Levin
` (356 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shay Drory, Yevgeny Kliteynik, Alex Vesker, Tariq Toukan,
Simon Horman, Jakub Kicinski, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 2700b7e603af39ca55fe9fc876ca123efd44680f ]
Fix a circular locking dependency between dbg_mutex and the domain
rx/tx mutexes that could lead to a deadlock.
The dump path in dr_dump_domain_all() was acquiring locks in the order:
dbg_mutex -> rx.mutex -> tx.mutex
While the table/matcher creation paths acquire locks in the order:
rx.mutex -> tx.mutex -> dbg_mutex
This inverted lock ordering creates a circular dependency. Fix this by
changing dr_dump_domain_all() to acquire the domain lock before
dbg_mutex, matching the order used in mlx5dr_table_create() and
mlx5dr_matcher_create().
Lockdep splat:
======================================================
WARNING: possible circular locking dependency detected
6.19.0-rc6net_next_e817c4e #1 Not tainted
------------------------------------------------------
sos/30721 is trying to acquire lock:
ffff888102df5900 (&dmn->info.rx.mutex){+.+.}-{4:4}, at:
dr_dump_start+0x131/0x450 [mlx5_core]
but task is already holding lock:
ffff888102df5bc0 (&dmn->dump_info.dbg_mutex){+.+.}-{4:4}, at:
dr_dump_start+0x10b/0x450 [mlx5_core]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dmn->dump_info.dbg_mutex){+.+.}-{4:4}:
__mutex_lock+0x91/0x1060
mlx5dr_matcher_create+0x377/0x5e0 [mlx5_core]
mlx5_cmd_dr_create_flow_group+0x62/0xd0 [mlx5_core]
mlx5_create_flow_group+0x113/0x1c0 [mlx5_core]
mlx5_chains_create_prio+0x453/0x2290 [mlx5_core]
mlx5_chains_get_table+0x2e2/0x980 [mlx5_core]
esw_chains_create+0x1e6/0x3b0 [mlx5_core]
esw_create_offloads_fdb_tables.cold+0x62/0x63f [mlx5_core]
esw_offloads_enable+0x76f/0xd20 [mlx5_core]
mlx5_eswitch_enable_locked+0x35a/0x500 [mlx5_core]
mlx5_devlink_eswitch_mode_set+0x561/0x950 [mlx5_core]
devlink_nl_eswitch_set_doit+0x67/0xe0
genl_family_rcv_msg_doit+0xe0/0x130
genl_rcv_msg+0x188/0x290
netlink_rcv_skb+0x4b/0xf0
genl_rcv+0x24/0x40
netlink_unicast+0x1ed/0x2c0
netlink_sendmsg+0x210/0x450
__sock_sendmsg+0x38/0x60
__sys_sendto+0x119/0x180
__x64_sys_sendto+0x20/0x30
do_syscall_64+0x70/0xd00
entry_SYSCALL_64_after_hwframe+0x4b/0x53
-> #1 (&dmn->info.tx.mutex){+.+.}-{4:4}:
__mutex_lock+0x91/0x1060
mlx5dr_table_create+0x11d/0x530 [mlx5_core]
mlx5_cmd_dr_create_flow_table+0x62/0x140 [mlx5_core]
__mlx5_create_flow_table+0x46f/0x960 [mlx5_core]
mlx5_create_flow_table+0x16/0x20 [mlx5_core]
esw_create_offloads_fdb_tables+0x136/0x240 [mlx5_core]
esw_offloads_enable+0x76f/0xd20 [mlx5_core]
mlx5_eswitch_enable_locked+0x35a/0x500 [mlx5_core]
mlx5_devlink_eswitch_mode_set+0x561/0x950 [mlx5_core]
devlink_nl_eswitch_set_doit+0x67/0xe0
genl_family_rcv_msg_doit+0xe0/0x130
genl_rcv_msg+0x188/0x290
netlink_rcv_skb+0x4b/0xf0
genl_rcv+0x24/0x40
netlink_unicast+0x1ed/0x2c0
netlink_sendmsg+0x210/0x450
__sock_sendmsg+0x38/0x60
__sys_sendto+0x119/0x180
__x64_sys_sendto+0x20/0x30
do_syscall_64+0x70/0xd00
entry_SYSCALL_64_after_hwframe+0x4b/0x53
-> #0 (&dmn->info.rx.mutex){+.+.}-{4:4}:
__lock_acquire+0x18b6/0x2eb0
lock_acquire+0xd3/0x2c0
__mutex_lock+0x91/0x1060
dr_dump_start+0x131/0x450 [mlx5_core]
seq_read_iter+0xe3/0x410
seq_read+0xfb/0x130
full_proxy_read+0x53/0x80
vfs_read+0xba/0x330
ksys_read+0x65/0xe0
do_syscall_64+0x70/0xd00
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dmn->dump_info.dbg_mutex);
lock(&dmn->info.tx.mutex);
lock(&dmn->dump_info.dbg_mutex);
lock(&dmn->info.rx.mutex);
*** DEADLOCK ***
Fixes: 9222f0b27da2 ("net/mlx5: DR, Add support for dumping steering info")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Alex Vesker <valex@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260224114652.1787431-2-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c
index 030a5776c9374..a4c19af1775f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_dbg.c
@@ -1050,8 +1050,8 @@ static int dr_dump_domain_all(struct seq_file *file, struct mlx5dr_domain *dmn)
struct mlx5dr_table *tbl;
int ret;
- mutex_lock(&dmn->dump_info.dbg_mutex);
mlx5dr_domain_lock(dmn);
+ mutex_lock(&dmn->dump_info.dbg_mutex);
ret = dr_dump_domain(file, dmn);
if (ret < 0)
@@ -1064,8 +1064,8 @@ static int dr_dump_domain_all(struct seq_file *file, struct mlx5dr_domain *dmn)
}
unlock_mutex:
- mlx5dr_domain_unlock(dmn);
mutex_unlock(&dmn->dump_info.dbg_mutex);
+ mlx5dr_domain_unlock(dmn);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 497/844] net/mlx5: LAG, disable MPESW in lag_disable_change()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (495 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 496/844] net/mlx5: DR, Fix circular locking dependency in dump Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 498/844] net/mlx5: E-switch, Clear legacy flag when moving to switchdev Sasha Levin
` (355 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shay Drory, Mark Bloch, Tariq Toukan, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit bd7b9f83fb9f85228c3ac9748d9cba9fab7fb5a2 ]
mlx5_lag_disable_change() unconditionally called mlx5_disable_lag() when
LAG was active, which is incorrect for MLX5_LAG_MODE_MPESW.
Hnece, call mlx5_disable_mpesw() when running in MPESW mode.
Fixes: a32327a3a02c ("net/mlx5: Lag, Control MultiPort E-Switch single FDB mode")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260224114652.1787431-3-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 8 ++++++--
drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c | 8 ++++----
drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h | 5 +++++
3 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
index a459a30f36cae..73659a0463cde 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
@@ -1654,8 +1654,12 @@ void mlx5_lag_disable_change(struct mlx5_core_dev *dev)
mutex_lock(&ldev->lock);
ldev->mode_changes_in_progress++;
- if (__mlx5_lag_is_active(ldev))
- mlx5_disable_lag(ldev);
+ if (__mlx5_lag_is_active(ldev)) {
+ if (ldev->mode == MLX5_LAG_MODE_MPESW)
+ mlx5_lag_disable_mpesw(ldev);
+ else
+ mlx5_disable_lag(ldev);
+ }
mutex_unlock(&ldev->lock);
mlx5_devcom_comp_unlock(dev->priv.hca_devcom_comp);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
index 2d86af8f0d9b8..c217998604fdb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
@@ -65,7 +65,7 @@ static int mlx5_mpesw_metadata_set(struct mlx5_lag *ldev)
return err;
}
-static int enable_mpesw(struct mlx5_lag *ldev)
+static int mlx5_lag_enable_mpesw(struct mlx5_lag *ldev)
{
struct mlx5_core_dev *dev0;
int err;
@@ -124,7 +124,7 @@ static int enable_mpesw(struct mlx5_lag *ldev)
return err;
}
-static void disable_mpesw(struct mlx5_lag *ldev)
+void mlx5_lag_disable_mpesw(struct mlx5_lag *ldev)
{
if (ldev->mode == MLX5_LAG_MODE_MPESW) {
mlx5_mpesw_metadata_cleanup(ldev);
@@ -150,9 +150,9 @@ static void mlx5_mpesw_work(struct work_struct *work)
}
if (mpesww->op == MLX5_MPESW_OP_ENABLE)
- mpesww->result = enable_mpesw(ldev);
+ mpesww->result = mlx5_lag_enable_mpesw(ldev);
else if (mpesww->op == MLX5_MPESW_OP_DISABLE)
- disable_mpesw(ldev);
+ mlx5_lag_disable_mpesw(ldev);
unlock:
mutex_unlock(&ldev->lock);
mlx5_devcom_comp_unlock(devcom);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h
index 02520f27a033c..46de93ed790de 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h
@@ -31,5 +31,10 @@ int mlx5_lag_mpesw_do_mirred(struct mlx5_core_dev *mdev,
bool mlx5_lag_is_mpesw(struct mlx5_core_dev *dev);
void mlx5_lag_mpesw_disable(struct mlx5_core_dev *dev);
int mlx5_lag_mpesw_enable(struct mlx5_core_dev *dev);
+#ifdef CONFIG_MLX5_ESWITCH
+void mlx5_lag_disable_mpesw(struct mlx5_lag *ldev);
+#else
+static inline void mlx5_lag_disable_mpesw(struct mlx5_lag *ldev) {}
+#endif /* CONFIG_MLX5_ESWITCH */
#endif /* __MLX5_LAG_MPESW_H__ */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 498/844] net/mlx5: E-switch, Clear legacy flag when moving to switchdev
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (496 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 497/844] net/mlx5: LAG, disable MPESW in lag_disable_change() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 499/844] net/mlx5: Fix missing devlink lock in SRIOV enable error path Sasha Levin
` (354 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shay Drory, Mark Bloch, Tariq Toukan, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit d7073e8b978ae925f1f0f08754f33f84d8547ea7 ]
The cited commit introduced MLX5_PRIV_FLAGS_SWITCH_LEGACY to identify
when a transition to legacy mode is requested via devlink. However, the
logic failed to clear this flag if the mode was subsequently changed
back to MLX5_ESWITCH_OFFLOADS (switchdev). Consequently, if a user
toggled from legacy to switchdev, the flag remained set, leaving the
driver with wrong state indicating
Fix this by explicitly clearing the MLX5_PRIV_FLAGS_SWITCH_LEGACY bit
when the requested mode is MLX5_ESWITCH_OFFLOADS.
Fixes: 2a4f56fbcc47 ("net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260224114652.1787431-4-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 02b7e474586d9..ccf53d4783628 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -4068,6 +4068,8 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode,
if (mlx5_mode == MLX5_ESWITCH_LEGACY)
esw->dev->priv.flags |= MLX5_PRIV_FLAGS_SWITCH_LEGACY;
+ if (mlx5_mode == MLX5_ESWITCH_OFFLOADS)
+ esw->dev->priv.flags &= ~MLX5_PRIV_FLAGS_SWITCH_LEGACY;
mlx5_eswitch_disable_locked(esw);
if (mlx5_mode == MLX5_ESWITCH_OFFLOADS) {
if (mlx5_devlink_trap_get_num_active(esw->dev)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 499/844] net/mlx5: Fix missing devlink lock in SRIOV enable error path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (497 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 498/844] net/mlx5: E-switch, Clear legacy flag when moving to switchdev Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 500/844] net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Sasha Levin
` (353 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shay Drory, Mark Bloch, Tariq Toukan, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 60253042c0b87b61596368489c44d12ba720d11c ]
The cited commit miss to add locking in the error path of
mlx5_sriov_enable(). When pci_enable_sriov() fails,
mlx5_device_disable_sriov() is called to clean up. This cleanup function
now expects to be called with the devlink instance lock held.
Add the missing devl_lock(devlink) and devl_unlock(devlink)
Fixes: 84a433a40d0e ("net/mlx5: Lock mlx5 devlink reload callbacks")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260224114652.1787431-5-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index a2fc937d54617..172862a70c70d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -193,7 +193,9 @@ static int mlx5_sriov_enable(struct pci_dev *pdev, int num_vfs)
err = pci_enable_sriov(pdev, num_vfs);
if (err) {
mlx5_core_warn(dev, "pci_enable_sriov failed : %d\n", err);
+ devl_lock(devlink);
mlx5_device_disable_sriov(dev, num_vfs, true, true);
+ devl_unlock(devlink);
}
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 500/844] net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (498 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 499/844] net/mlx5: Fix missing devlink lock in SRIOV enable error path Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 501/844] net: consume xmit errors of GSO frames Sasha Levin
` (352 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jianbo Liu, Leon Romanovsky, Tariq Toukan, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Jianbo Liu <jianbol@nvidia.com>
[ Upstream commit 859380694f434597407632c29f30fdb5e763e6cc ]
Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by
replacing mlx5_query_mac_address() with ether_addr_copy() to get the
local MAC address directly from netdev->dev_addr.
The issue occurs because mlx5_query_mac_address() queries the hardware
which involves mlx5_cmd_exec() that can sleep, but it is called from
the mlx5e_ipsec_handle_event workqueue which runs in atomic context.
The MAC address is already available in netdev->dev_addr, so no need
to query hardware. This avoids the sleeping call and resolves the bug.
Call trace:
BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200
__schedule+0x7ab/0xa20
schedule+0x1c/0xb0
schedule_timeout+0x6e/0xf0
__wait_for_common+0x91/0x1b0
cmd_exec+0xa85/0xff0 [mlx5_core]
mlx5_cmd_exec+0x1f/0x50 [mlx5_core]
mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core]
mlx5_query_mac_address+0x19/0x30 [mlx5_core]
mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core]
mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core]
mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core]
process_one_work+0x178/0x2e0
worker_thread+0x2ea/0x430
Fixes: cee137a63431 ("net/mlx5e: Handle ESN update events")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260224114652.1787431-6-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index 9c7064187ed0f..f03507a522b4f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -259,7 +259,6 @@ static void mlx5e_ipsec_init_limits(struct mlx5e_ipsec_sa_entry *sa_entry,
static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry,
struct mlx5_accel_esp_xfrm_attrs *attrs)
{
- struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);
struct mlx5e_ipsec_addr *addrs = &attrs->addrs;
struct net_device *netdev = sa_entry->dev;
struct xfrm_state *x = sa_entry->x;
@@ -276,7 +275,7 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry,
attrs->type != XFRM_DEV_OFFLOAD_PACKET)
return;
- mlx5_query_mac_address(mdev, addr);
+ ether_addr_copy(addr, netdev->dev_addr);
switch (attrs->dir) {
case XFRM_DEV_OFFLOAD_IN:
src = attrs->dmac;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 501/844] net: consume xmit errors of GSO frames
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (499 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 500/844] net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 502/844] dpaa2-switch: validate num_ifs to prevent out-of-bounds write Sasha Levin
` (351 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jakub Kicinski, Eric Dumazet, Paolo Abeni, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 7aa767d0d3d04e50ae94e770db7db8197f666970 ]
udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests
currently in NIPA. They fail in the same exact way, TCP GRO
test stalls occasionally and the test gets killed after 10min.
These tests use veth to simulate GRO. They attach a trivial
("return XDP_PASS;") XDP program to the veth to force TSO off
and NAPI on.
Digging into the failure mode we can see that the connection
is completely stuck after a burst of drops. The sender's snd_nxt
is at sequence number N [1], but the receiver claims to have
received (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle
is that senders rtx queue is not empty (let's say the block in
the rtx queue is at sequence number N - 4 * MSS [3]).
In this state, sender sends a retransmission from the rtx queue
with a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].
Receiver sees it and responds with an ACK all the way up to
N + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA
because it has no recollection of ever sending data that far out [1].
And we are stuck.
The root cause is the mess of the xmit return codes. veth returns
an error when it can't xmit a frame. We end up with a loss event
like this:
-------------------------------------------------
| GSO super frame 1 | GSO super frame 2 |
|-----------------------------------------------|
| seg | seg | seg | seg | seg | seg | seg | seg |
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
-------------------------------------------------
x ok ok <ok>| ok ok ok <x>
\\
snd_nxt
"x" means packet lost by veth, and "ok" means it went thru.
Since veth has TSO disabled in this test it sees individual segments.
Segment 1 is on the retransmit queue and will be resent.
So why did the sender not advance snd_nxt even tho it clearly did
send up to seg 8? tcp_write_xmit() interprets the return code
from the core to mean that data has not been sent at all. Since
TCP deals with GSO super frames, not individual segment the crux
of the problem is that loss of a single segment can be interpreted
as loss of all. TCP only sees the last return code for the last
segment of the GSO frame (in <> brackets in the diagram above).
Of course for the problem to occur we need a setup or a device
without a Qdisc. Otherwise Qdisc layer disconnects the protocol
layer from the device errors completely.
We have multiple ways to fix this.
1) make veth not return an error when it lost a packet.
While this is what I think we did in the past, the issue keeps
reappearing and it's annoying to debug. The game of whack
a mole is not great.
2) fix the damn return codes
We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the
documentation, so maybe we should make the return code from
ndo_start_xmit() a boolean. I like that the most, but perhaps
some ancient, not-really-networking protocol would suffer.
3) make TCP ignore the errors
It is not entirely clear to me what benefit TCP gets from
interpreting the result of ip_queue_xmit()? Specifically once
the connection is established and we're pushing data - packet
loss is just packet loss?
4) this fix
Ignore the rc in the Qdisc-less+GSO case, since it's unreliable.
We already always return OK in the TCQ_F_CAN_BYPASS case.
In the Qdisc-less case let's be a bit more conservative and only
mask the GSO errors. This path is taken by non-IP-"networks"
like CAN, MCTP etc, so we could regress some ancient thing.
This is the simplest, but also maybe the hackiest fix?
Similar fix has been proposed by Eric in the past but never committed
because original reporter was working with an OOT driver and wasn't
providing feedback (see Link).
Link: https://lore.kernel.org/CANn89iJcLepEin7EtBETrZ36bjoD9LrR=k4cfwWh046GB+4f9A@mail.gmail.com
Fixes: 1f59533f9ca5 ("qdisc: validate frames going through the direct_xmit path")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260223235100.108939-1-kuba@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/dev.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 60a26208cbd87..062415cc3e5a4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4818,6 +4818,8 @@ int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
* to -1 or to their cpu id, but not to our id.
*/
if (READ_ONCE(txq->xmit_lock_owner) != cpu) {
+ bool is_list = false;
+
if (dev_xmit_recursion())
goto recursion_alert;
@@ -4828,17 +4830,28 @@ int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
HARD_TX_LOCK(dev, txq, cpu);
if (!netif_xmit_stopped(txq)) {
+ is_list = !!skb->next;
+
dev_xmit_recursion_inc();
skb = dev_hard_start_xmit(skb, dev, txq, &rc);
dev_xmit_recursion_dec();
- if (dev_xmit_complete(rc)) {
- HARD_TX_UNLOCK(dev, txq);
- goto out;
- }
+
+ /* GSO segments a single SKB into
+ * a list of frames. TCP expects error
+ * to mean none of the data was sent.
+ */
+ if (is_list)
+ rc = NETDEV_TX_OK;
}
HARD_TX_UNLOCK(dev, txq);
+ if (!skb) /* xmit completed */
+ goto out;
+
net_crit_ratelimited("Virtual device %s asks to queue packet!\n",
dev->name);
+ /* NETDEV_TX_BUSY or queue was stopped */
+ if (!is_list)
+ rc = -ENETDOWN;
} else {
/* Recursion is detected! It is possible,
* unfortunately
@@ -4846,10 +4859,10 @@ int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
recursion_alert:
net_crit_ratelimited("Dead loop on virtual device %s, fix it urgently!\n",
dev->name);
+ rc = -ENETDOWN;
}
}
- rc = -ENETDOWN;
rcu_read_unlock_bh();
dev_core_stats_tx_dropped_inc(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 502/844] dpaa2-switch: validate num_ifs to prevent out-of-bounds write
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (500 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 501/844] net: consume xmit errors of GSO frames Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 503/844] netfilter: nf_conntrack_h323: fix OOB read in decode_choice() Sasha Levin
` (350 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Junrui Luo, Ioana Ciornei, Paolo Abeni, Sasha Levin
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 8a5752c6dcc085a3bfc78589925182e4e98468c5 ]
The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()
but never validates it against DPSW_MAX_IF (64). This value controls
iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices
into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports
num_ifs >= 64, the loop can write past the array bounds.
Add a bound check for num_ifs in dpaa2_switch_init().
dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port
num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all
ports match the flood filter, the loop fills all 64 slots and the control
interface write overflows by one entry.
The check uses >= because num_ifs == DPSW_MAX_IF is also functionally
broken.
build_if_id_bitmap() silently drops any ID >= 64:
if (id[i] < DPSW_MAX_IF)
bmap[id[i] / 64] |= ...
Fixes: 539dda3c5d19 ("staging: dpaa2-switch: properly setup switching domains")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/SYBPR01MB78812B47B7F0470B617C408AAF74A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index 66240c340492c..78e21b46a5ba8 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -3034,6 +3034,13 @@ static int dpaa2_switch_init(struct fsl_mc_device *sw_dev)
goto err_close;
}
+ if (ethsw->sw_attr.num_ifs >= DPSW_MAX_IF) {
+ dev_err(dev, "DPSW num_ifs %u exceeds max %u\n",
+ ethsw->sw_attr.num_ifs, DPSW_MAX_IF);
+ err = -EINVAL;
+ goto err_close;
+ }
+
err = dpsw_get_api_version(ethsw->mc_io, 0,
ðsw->major,
ðsw->minor);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 503/844] netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (501 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 502/844] dpaa2-switch: validate num_ifs to prevent out-of-bounds write Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 504/844] x86/acpi/boot: Correct acpi_is_processor_usable() check again Sasha Levin
` (349 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vahagn Vardanian, Florian Westphal, Paolo Abeni, Sasha Levin
From: Vahagn Vardanian <vahagn@redrays.io>
[ Upstream commit baed0d9ba91d4f390da12d5039128ee897253d60 ]
In decode_choice(), the boundary check before get_len() uses the
variable `len`, which is still 0 from its initialization at the top of
the function:
unsigned int type, ext, len = 0;
...
if (ext || (son->attr & OPEN)) {
BYTE_ALIGN(bs);
if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */
return H323_ERROR_BOUND;
len = get_len(bs); /* OOB read */
When the bitstream is exactly consumed (bs->cur == bs->end), the check
nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),
which is false. The subsequent get_len() call then dereferences
*bs->cur++, reading 1 byte past the end of the buffer. If that byte
has bit 7 set, get_len() reads a second byte as well.
This can be triggered remotely by sending a crafted Q.931 SETUP message
with a User-User Information Element containing exactly 2 bytes of
PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with
the nf_conntrack_h323 helper active. The decoder fully consumes the
PER buffer before reaching this code path, resulting in a 1-2 byte
heap-buffer-overflow read confirmed by AddressSanitizer.
Fix this by checking for 2 bytes (the maximum that get_len() may read)
instead of the uninitialized `len`. This matches the pattern used at
every other get_len() call site in the same file, where the caller
checks for 2 bytes of available data before calling get_len().
Fixes: ec8a8f3c31dd ("netfilter: nf_ct_h323: Extend nf_h323_error_boundary to work on bits as well")
Signed-off-by: Vahagn Vardanian <vahagn@redrays.io>
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20260225130619.1248-2-fw@strlen.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_h323_asn1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 540d97715bd23..62aa22a078769 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -796,7 +796,7 @@ static int decode_choice(struct bitstr *bs, const struct field_t *f,
if (ext || (son->attr & OPEN)) {
BYTE_ALIGN(bs);
- if (nf_h323_error_boundary(bs, len, 0))
+ if (nf_h323_error_boundary(bs, 2, 0))
return H323_ERROR_BOUND;
len = get_len(bs);
if (nf_h323_error_boundary(bs, len, 0))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 504/844] x86/acpi/boot: Correct acpi_is_processor_usable() check again
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (502 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 503/844] netfilter: nf_conntrack_h323: fix OOB read in decode_choice() Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 505/844] rpmsg: core: fix race in driver_override_show() and use core helper Sasha Levin
` (348 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yazen Ghannam, Michal Pecio, Borislav Petkov (AMD), Ingo Molnar,
Ricardo Neri, Sasha Levin
From: Yazen Ghannam <yazen.ghannam@amd.com>
[ Upstream commit adbf61cc47cb72b102682e690ad323e1eda652c2 ]
ACPI v6.3 defined a new "Online Capable" MADT LAPIC flag. This bit is
used in conjunction with the "Enabled" MADT LAPIC flag to determine if
a CPU can be enabled/hotplugged by the OS after boot.
Before the new bit was defined, the "Enabled" bit was explicitly
described like this (ACPI v6.0 wording provided):
"If zero, this processor is unusable, and the operating system
support will not attempt to use it"
This means that CPU hotplug (based on MADT) is not possible. Many BIOS
implementations follow this guidance. They may include LAPIC entries in
MADT for unavailable CPUs, but since these entries are marked with
"Enabled=0" it is expected that the OS will completely ignore these
entries.
However, QEMU will do the same (include entries with "Enabled=0") for
the purpose of allowing CPU hotplug within the guest.
Comment from QEMU function pc_madt_cpu_entry():
/* ACPI spec says that LAPIC entry for non present
* CPU may be omitted from MADT or it must be marked
* as disabled. However omitting non present CPU from
* MADT breaks hotplug on linux. So possible CPUs
* should be put in MADT but kept disabled.
*/
Recent Linux topology changes broke the QEMU use case. A following fix
for the QEMU use case broke bare metal topology enumeration.
Rework the Linux MADT LAPIC flags check to allow the QEMU use case only
for guests and to maintain the ACPI spec behavior for bare metal.
Remove an unnecessary check added to fix a bare metal case introduced by
the QEMU "fix".
[ bp: Change logic as Michal suggested. ]
[ mingo: Removed misapplied -stable tag. ]
Fixes: fed8d8773b8e ("x86/acpi/boot: Correct acpi_is_processor_usable() check")
Fixes: f0551af02130 ("x86/topology: Ignore non-present APIC IDs in a present package")
Closes: https://lore.kernel.org/r/20251024204658.3da9bf3f.michal.pecio@gmail.com
Reported-by: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: Michal Pecio <michal.pecio@gmail.com>
Tested-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://lore.kernel.org/20251111145357.4031846-1-yazen.ghannam@amd.com
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/acpi/boot.c | 12 ++++++++----
arch/x86/kernel/cpu/topology.c | 15 ---------------
2 files changed, 8 insertions(+), 19 deletions(-)
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 9fa321a95eb33..d6138b2b633a3 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -35,6 +35,7 @@
#include <asm/smp.h>
#include <asm/i8259.h>
#include <asm/setup.h>
+#include <asm/hypervisor.h>
#include "sleep.h" /* To include x86_acpi_suspend_lowlevel */
static int __initdata acpi_force = 0;
@@ -164,11 +165,14 @@ static bool __init acpi_is_processor_usable(u32 lapic_flags)
if (lapic_flags & ACPI_MADT_ENABLED)
return true;
- if (!acpi_support_online_capable ||
- (lapic_flags & ACPI_MADT_ONLINE_CAPABLE))
- return true;
+ if (acpi_support_online_capable)
+ return lapic_flags & ACPI_MADT_ONLINE_CAPABLE;
- return false;
+ /*
+ * QEMU expects legacy "Enabled=0" LAPIC entries to be counted as usable
+ * in order to support CPU hotplug in guests.
+ */
+ return !hypervisor_is_type(X86_HYPER_NATIVE);
}
static int __init
diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c
index f55ea3cdbf88e..23190a786d310 100644
--- a/arch/x86/kernel/cpu/topology.c
+++ b/arch/x86/kernel/cpu/topology.c
@@ -27,7 +27,6 @@
#include <xen/xen.h>
#include <asm/apic.h>
-#include <asm/hypervisor.h>
#include <asm/io_apic.h>
#include <asm/mpspec.h>
#include <asm/msr.h>
@@ -236,20 +235,6 @@ static __init void topo_register_apic(u32 apic_id, u32 acpi_id, bool present)
cpuid_to_apicid[cpu] = apic_id;
topo_set_cpuids(cpu, apic_id, acpi_id);
} else {
- u32 pkgid = topo_apicid(apic_id, TOPO_PKG_DOMAIN);
-
- /*
- * Check for present APICs in the same package when running
- * on bare metal. Allow the bogosity in a guest.
- */
- if (hypervisor_is_type(X86_HYPER_NATIVE) &&
- topo_unit_count(pkgid, TOPO_PKG_DOMAIN, phys_cpu_present_map)) {
- pr_info_once("Ignoring hot-pluggable APIC ID %x in present package.\n",
- apic_id);
- topo_info.nr_rejected_cpus++;
- return;
- }
-
topo_info.nr_disabled_cpus++;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 505/844] rpmsg: core: fix race in driver_override_show() and use core helper
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (503 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 504/844] x86/acpi/boot: Correct acpi_is_processor_usable() check again Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:26 ` [PATCH 6.19 506/844] clk: renesas: rzg2l: Fix intin variable size Sasha Levin
` (347 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Gui-Dong Han, Mathieu Poirier, Sasha Levin
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit 42023d4b6d2661a40ee2dcf7e1a3528a35c638ca ]
The driver_override_show function reads the driver_override string
without holding the device_lock. However, the store function modifies
and frees the string while holding the device_lock. This creates a race
condition where the string can be freed by the store function while
being read by the show function, leading to a use-after-free.
To fix this, replace the rpmsg_string_attr macro with explicit show and
store functions. The new driver_override_store uses the standard
driver_set_override helper. Since the introduction of
driver_set_override, the comments in include/linux/rpmsg.h have stated
that this helper must be used to set or clear driver_override, but the
implementation was not updated until now.
Because driver_set_override modifies and frees the string while holding
the device_lock, the new driver_override_show now correctly holds the
device_lock during the read operation to prevent the race.
Additionally, since rpmsg_string_attr has only ever been used for
driver_override, removing the macro simplifies the code.
Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://lore.kernel.org/r/20251202174948.12693-1-hanguidong02@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/rpmsg_core.c | 66 ++++++++++++++++----------------------
1 file changed, 27 insertions(+), 39 deletions(-)
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 5d661681a9b6c..96964745065b1 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -352,50 +352,38 @@ field##_show(struct device *dev, \
} \
static DEVICE_ATTR_RO(field);
-#define rpmsg_string_attr(field, member) \
-static ssize_t \
-field##_store(struct device *dev, struct device_attribute *attr, \
- const char *buf, size_t sz) \
-{ \
- struct rpmsg_device *rpdev = to_rpmsg_device(dev); \
- const char *old; \
- char *new; \
- \
- new = kstrndup(buf, sz, GFP_KERNEL); \
- if (!new) \
- return -ENOMEM; \
- new[strcspn(new, "\n")] = '\0'; \
- \
- device_lock(dev); \
- old = rpdev->member; \
- if (strlen(new)) { \
- rpdev->member = new; \
- } else { \
- kfree(new); \
- rpdev->member = NULL; \
- } \
- device_unlock(dev); \
- \
- kfree(old); \
- \
- return sz; \
-} \
-static ssize_t \
-field##_show(struct device *dev, \
- struct device_attribute *attr, char *buf) \
-{ \
- struct rpmsg_device *rpdev = to_rpmsg_device(dev); \
- \
- return sprintf(buf, "%s\n", rpdev->member); \
-} \
-static DEVICE_ATTR_RW(field)
-
/* for more info, see Documentation/ABI/testing/sysfs-bus-rpmsg */
rpmsg_show_attr(name, id.name, "%s\n");
rpmsg_show_attr(src, src, "0x%x\n");
rpmsg_show_attr(dst, dst, "0x%x\n");
rpmsg_show_attr(announce, announce ? "true" : "false", "%s\n");
-rpmsg_string_attr(driver_override, driver_override);
+
+static ssize_t driver_override_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+{
+ struct rpmsg_device *rpdev = to_rpmsg_device(dev);
+ int ret;
+
+ ret = driver_set_override(dev, &rpdev->driver_override, buf, count);
+ if (ret)
+ return ret;
+
+ return count;
+}
+
+static ssize_t driver_override_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct rpmsg_device *rpdev = to_rpmsg_device(dev);
+ ssize_t len;
+
+ device_lock(dev);
+ len = sysfs_emit(buf, "%s\n", rpdev->driver_override);
+ device_unlock(dev);
+ return len;
+}
+static DEVICE_ATTR_RW(driver_override);
static ssize_t modalias_show(struct device *dev,
struct device_attribute *attr, char *buf)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 506/844] clk: renesas: rzg2l: Fix intin variable size
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (504 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 505/844] rpmsg: core: fix race in driver_override_show() and use core helper Sasha Levin
@ 2026-02-28 17:26 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 507/844] clk: renesas: rzg2l: Select correct div round macro Sasha Levin
` (346 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:26 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chris Brandt, Hugo Villeneuve, Geert Uytterhoeven, Sasha Levin
From: Chris Brandt <chris.brandt@renesas.com>
[ Upstream commit a00655d98cd885472c311f01dff3e668d1288d0a ]
INTIN is a 12-bit register value, so u8 is too small.
Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support")
Cc: stable@vger.kernel.org
Reported-by: Hugo Villeneuve <hugo@hugovil.com>
Closes: https://lore.kernel.org/20251107113058.f334957151d1a8dd94dd740b@hugovil.com
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251114193711.3277912-1-chris.brandt@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/rzg2l-cpg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
index c20ea1212b360..de58a960a922b 100644
--- a/drivers/clk/renesas/rzg2l-cpg.c
+++ b/drivers/clk/renesas/rzg2l-cpg.c
@@ -122,8 +122,8 @@ struct div_hw_data {
struct rzg2l_pll5_param {
u32 pl5_fracin;
+ u16 pl5_intin;
u8 pl5_refdiv;
- u8 pl5_intin;
u8 pl5_postdiv1;
u8 pl5_postdiv2;
u8 pl5_spread;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 507/844] clk: renesas: rzg2l: Select correct div round macro
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (505 preceding siblings ...)
2026-02-28 17:26 ` [PATCH 6.19 506/844] clk: renesas: rzg2l: Fix intin variable size Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 508/844] hfsplus: ensure sb->s_fs_info is always cleaned up Sasha Levin
` (345 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chris Brandt, stable, Geert Uytterhoeven, Sasha Levin
From: Chris Brandt <chris.brandt@renesas.com>
[ Upstream commit f9451374dcfdfe669ee55b58ee6c11e8638980e4 ]
Variable foutvco_rate is an unsigned long, not an unsigned long long.
Cc: stable@kernel.org
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Closes: https://lore.kernel.org/CAMuHMdVf7dSeqAhtyxDCFuCheQRzwS-8996Rr2Ntui21uiBgdA@mail.gmail.com
Fixes: dabf72b85f29 ("clk: renesas: rzg2l: Fix FOUTPOSTDIV clk")
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251114194529.3304361-1-chris.brandt@renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/rzg2l-cpg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
index de58a960a922b..f670c6408ea15 100644
--- a/drivers/clk/renesas/rzg2l-cpg.c
+++ b/drivers/clk/renesas/rzg2l-cpg.c
@@ -572,8 +572,8 @@ rzg2l_cpg_get_foutpostdiv_rate(struct rzg2l_pll5_param *params,
foutvco_rate = div_u64(mul_u32_u32(EXTAL_FREQ_IN_MEGA_HZ * MEGA,
(params->pl5_intin << 24) + params->pl5_fracin),
params->pl5_refdiv) >> 24;
- foutpostdiv_rate = DIV_ROUND_CLOSEST_ULL(foutvco_rate,
- params->pl5_postdiv1 * params->pl5_postdiv2);
+ foutpostdiv_rate = DIV_ROUND_CLOSEST(foutvco_rate,
+ params->pl5_postdiv1 * params->pl5_postdiv2);
return foutpostdiv_rate;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 508/844] hfsplus: ensure sb->s_fs_info is always cleaned up
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (506 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 507/844] clk: renesas: rzg2l: Select correct div round macro Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 509/844] memory: mtk-smi: fix device leaks on common probe Sasha Levin
` (344 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mehdi Ben Hadj Khelifa, Viacheslav Dubeyko, Christian Brauner,
Viacheslav Dubeyko, Sasha Levin
From: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
[ Upstream commit 126fb0ce99431126b44a6c360192668c818f641f ]
When hfsplus was converted to the new mount api a bug was introduced by
changing the allocation pattern of sb->s_fs_info. If setup_bdev_super()
fails after a new superblock has been allocated by sget_fc(), but before
hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info
data it was leaked.
Fix this by freeing sb->s_fs_info in hfsplus_kill_super().
Cc: stable@vger.kernel.org
Fixes: 432f7c78cb00 ("hfsplus: convert hfsplus to use the new mount api")
Reported-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20251201222843.82310-3-mehdi.benhadjkhelifa@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfsplus/super.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 7f327b777ece8..942b8ff01ad07 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -350,8 +350,6 @@ static void hfsplus_put_super(struct super_block *sb)
hfs_btree_close(sbi->ext_tree);
kfree(sbi->s_vhdr_buf);
kfree(sbi->s_backup_vhdr_buf);
- call_rcu(&sbi->rcu, delayed_free);
-
hfs_dbg("finished\n");
}
@@ -656,7 +654,6 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
out_unload_nls:
unload_nls(sbi->nls);
unload_nls(nls);
- kfree(sbi);
return err;
}
@@ -715,10 +712,18 @@ static int hfsplus_init_fs_context(struct fs_context *fc)
return 0;
}
+static void hfsplus_kill_super(struct super_block *sb)
+{
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
+
+ kill_block_super(sb);
+ call_rcu(&sbi->rcu, delayed_free);
+}
+
static struct file_system_type hfsplus_fs_type = {
.owner = THIS_MODULE,
.name = "hfsplus",
- .kill_sb = kill_block_super,
+ .kill_sb = hfsplus_kill_super,
.fs_flags = FS_REQUIRES_DEV,
.init_fs_context = hfsplus_init_fs_context,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 509/844] memory: mtk-smi: fix device leaks on common probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (507 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 508/844] hfsplus: ensure sb->s_fs_info is always cleaned up Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 510/844] memory: mtk-smi: fix device leak on larb probe Sasha Levin
` (343 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Yong Wu, Miaoqian Lin, Krzysztof Kozlowski,
Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6cfa038bddd710f544076ea2ef7792fc82fbedd6 ]
Make sure to drop the reference taken when looking up the SMI device
during common probe on late probe failure (e.g. probe deferral) and on
driver unbind.
Fixes: 47404757702e ("memory: mtk-smi: Add device link for smi-sub-common")
Fixes: 038ae37c510f ("memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common")
Cc: stable@vger.kernel.org # 5.16: 038ae37c510f
Cc: stable@vger.kernel.org # 5.16
Cc: Yong Wu <yong.wu@mediatek.com>
Cc: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251121164624.13685-2-johan@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/mtk-smi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
index 733e22f695ab7..dd6150d200e89 100644
--- a/drivers/memory/mtk-smi.c
+++ b/drivers/memory/mtk-smi.c
@@ -674,6 +674,7 @@ static int mtk_smi_larb_probe(struct platform_device *pdev)
err_pm_disable:
pm_runtime_disable(dev);
device_link_remove(dev, larb->smi_common_dev);
+ put_device(larb->smi_common_dev);
return ret;
}
@@ -917,6 +918,7 @@ static void mtk_smi_common_remove(struct platform_device *pdev)
if (common->plat->type == MTK_SMI_GEN2_SUB_COMM)
device_link_remove(&pdev->dev, common->smi_common_dev);
pm_runtime_disable(&pdev->dev);
+ put_device(common->smi_common_dev);
}
static int __maybe_unused mtk_smi_common_resume(struct device *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 510/844] memory: mtk-smi: fix device leak on larb probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (508 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 509/844] memory: mtk-smi: fix device leaks on common probe Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 511/844] arm64: dts: ti: am62p-verdin: Fix SD regulator startup delay Sasha Levin
` (342 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Yong Wu, Miaoqian Lin, Krzysztof Kozlowski,
Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6 ]
Make sure to drop the reference taken when looking up the SMI device
during larb probe on late probe failure (e.g. probe deferral) and on
driver unbind.
Fixes: cc8bbe1a8312 ("memory: mediatek: Add SMI driver")
Fixes: 038ae37c510f ("memory: mtk-smi: add missing put_device() call in mtk_smi_device_link_common")
Cc: stable@vger.kernel.org # 4.6: 038ae37c510f
Cc: stable@vger.kernel.org # 4.6
Cc: Yong Wu <yong.wu@mediatek.com>
Cc: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251121164624.13685-3-johan@kernel.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memory/mtk-smi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
index dd6150d200e89..3609bfd3c64be 100644
--- a/drivers/memory/mtk-smi.c
+++ b/drivers/memory/mtk-smi.c
@@ -685,6 +685,7 @@ static void mtk_smi_larb_remove(struct platform_device *pdev)
device_link_remove(&pdev->dev, larb->smi_common_dev);
pm_runtime_disable(&pdev->dev);
component_del(&pdev->dev, &mtk_smi_larb_component_ops);
+ put_device(larb->smi_common_dev);
}
static int __maybe_unused mtk_smi_larb_resume(struct device *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 511/844] arm64: dts: ti: am62p-verdin: Fix SD regulator startup delay
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (509 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 510/844] memory: mtk-smi: fix device leak on larb probe Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 512/844] drm/panthor: fix for dma-fence safe access rules Sasha Levin
` (341 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Francesco Dolcini, Nishanth Menon, Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit de86dbc0fb00bd3773db4b05d9f5926f0faa2244 ]
The power switch used to power the SD card interface might have
more than 2ms turn-on time, increase the startup delay to 20ms to
prevent failures.
Fixes: 87f95ea316ac ("arm64: dts: ti: Add Toradex Verdin AM62P")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20251209084126.33282-1-francesco@dolcini.it
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
index 5e050cbb9eaf3..ec9dd931fe922 100644
--- a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
@@ -112,7 +112,7 @@ reg_sd1_vmmc: regulator-sdhci1-vmmc {
regulator-max-microvolt = <3300000>;
regulator-min-microvolt = <3300000>;
regulator-name = "+V3.3_SD";
- startup-delay-us = <2000>;
+ startup-delay-us = <20000>;
};
reg_sd1_vqmmc: regulator-sdhci1-vqmmc {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 512/844] drm/panthor: fix for dma-fence safe access rules
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (510 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 511/844] arm64: dts: ti: am62p-verdin: Fix SD regulator startup delay Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 513/844] ASoC: SOF: ipc4-control: If there is no data do not send bytes update Sasha Levin
` (340 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Chia-I Wu, Boris Brezillon, Liviu Dudau, Steven Price,
Sasha Levin
From: Chia-I Wu <olvaffe@gmail.com>
[ Upstream commit efe24898485c5c831e629d9c6fb9350c35cb576f ]
Commit 506aa8b02a8d6 ("dma-fence: Add safe access helpers and document
the rules") details the dma-fence safe access rules. The most common
culprit is that drm_sched_fence_get_timeline_name may race with
group_free_queue.
Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Cc: stable@vger.kernel.org # v6.17+
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251204174545.399059-1-olvaffe@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index bd397d773d72b..5c55ba593b244 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -23,6 +23,7 @@
#include <linux/module.h>
#include <linux/platform_device.h>
#include <linux/pm_runtime.h>
+#include <linux/rcupdate.h>
#include "panthor_devfreq.h"
#include "panthor_device.h"
@@ -939,6 +940,9 @@ static void group_release_work(struct work_struct *work)
release_work);
u32 i;
+ /* dma-fences may still be accessing group->queues under rcu lock. */
+ synchronize_rcu();
+
for (i = 0; i < group->queue_count; i++)
group_free_queue(group, group->queues[i]);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 513/844] ASoC: SOF: ipc4-control: If there is no data do not send bytes update
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (511 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 512/844] drm/panthor: fix for dma-fence safe access rules Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 514/844] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls Sasha Levin
` (339 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Seppo Ingalsuo, Ranjani Sridharan, Bard Liao,
Kai Vehmanen, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit 2fa74713744dc5e908fff851c20f5f89fd665fb7 ]
When the bytes control have no data (payload) then there is no need to send
an IPC message as there is nothing to send.
Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://patch.msgid.link/20251217143945.2667-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/ipc4-control.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c
index 976a4794d6100..0a05f66ec7d92 100644
--- a/sound/soc/sof/ipc4-control.c
+++ b/sound/soc/sof/ipc4-control.c
@@ -412,8 +412,16 @@ static int sof_ipc4_set_get_bytes_data(struct snd_sof_dev *sdev,
int ret = 0;
/* Send the new data to the firmware only if it is powered up */
- if (set && !pm_runtime_active(sdev->dev))
- return 0;
+ if (set) {
+ if (!pm_runtime_active(sdev->dev))
+ return 0;
+
+ if (!data->size) {
+ dev_dbg(sdev->dev, "%s: No data to be sent.\n",
+ scontrol->name);
+ return 0;
+ }
+ }
msg->extension = SOF_IPC4_MOD_EXT_MSG_PARAM_ID(data->type);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 514/844] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (512 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 513/844] ASoC: SOF: ipc4-control: If there is no data do not send bytes update Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 515/844] ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data Sasha Levin
` (338 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Seppo Ingalsuo, Ranjani Sridharan, Bard Liao,
Kai Vehmanen, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit a653820700b81c9e6f05ac23b7969ecec1a18e85 ]
The size of the data behind of scontrol->ipc_control_data for bytes
controls is:
[1] sizeof(struct sof_ipc4_control_data) + // kernel only struct
[2] sizeof(struct sof_abi_hdr)) + payload
The max_size specifies the size of [2] and it is coming from topology.
Change the function to take this into account and allocate adequate amount
of memory behind scontrol->ipc_control_data.
With the change we will allocate [1] amount more memory to be able to hold
the full size of data.
Fixes: a382082ff74b ("ASoC: SOF: ipc4-topology: Add support for TPLG_CTL_BYTES")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://patch.msgid.link/20251217143945.2667-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/ipc4-topology.c | 35 +++++++++++++++++++++++++++--------
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
index d621e7914a73c..4854903654364 100644
--- a/sound/soc/sof/ipc4-topology.c
+++ b/sound/soc/sof/ipc4-topology.c
@@ -2870,22 +2870,41 @@ static int sof_ipc4_control_load_bytes(struct snd_sof_dev *sdev, struct snd_sof_
struct sof_ipc4_msg *msg;
int ret;
- if (scontrol->max_size < (sizeof(*control_data) + sizeof(struct sof_abi_hdr))) {
- dev_err(sdev->dev, "insufficient size for a bytes control %s: %zu.\n",
+ /*
+ * The max_size is coming from topology and indicates the maximum size
+ * of sof_abi_hdr plus the payload, which excludes the local only
+ * 'struct sof_ipc4_control_data'
+ */
+ if (scontrol->max_size < sizeof(struct sof_abi_hdr)) {
+ dev_err(sdev->dev,
+ "insufficient maximum size for a bytes control %s: %zu.\n",
scontrol->name, scontrol->max_size);
return -EINVAL;
}
- if (scontrol->priv_size > scontrol->max_size - sizeof(*control_data)) {
- dev_err(sdev->dev, "scontrol %s bytes data size %zu exceeds max %zu.\n",
- scontrol->name, scontrol->priv_size,
- scontrol->max_size - sizeof(*control_data));
+ if (scontrol->priv_size > scontrol->max_size) {
+ dev_err(sdev->dev,
+ "bytes control %s initial data size %zu exceeds max %zu.\n",
+ scontrol->name, scontrol->priv_size, scontrol->max_size);
+ return -EINVAL;
+ }
+
+ if (scontrol->priv_size < sizeof(struct sof_abi_hdr)) {
+ dev_err(sdev->dev,
+ "bytes control %s initial data size %zu is insufficient.\n",
+ scontrol->name, scontrol->priv_size);
return -EINVAL;
}
- scontrol->size = sizeof(struct sof_ipc4_control_data) + scontrol->priv_size;
+ /*
+ * The used size behind the cdata pointer, which can be smaller than
+ * the maximum size
+ */
+ scontrol->size = sizeof(*control_data) + scontrol->priv_size;
- scontrol->ipc_control_data = kzalloc(scontrol->max_size, GFP_KERNEL);
+ /* Allocate the cdata: local struct size + maximum payload size */
+ scontrol->ipc_control_data = kzalloc(sizeof(*control_data) + scontrol->max_size,
+ GFP_KERNEL);
if (!scontrol->ipc_control_data)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 515/844] ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (513 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 514/844] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 516/844] ASoC: SOF: ipc4-control: Keep the payload size up to date Sasha Levin
` (337 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Seppo Ingalsuo, Ranjani Sridharan, Bard Liao,
Kai Vehmanen, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit c1876fc33c5976837e4c73719c7582617efc6919 ]
The size of the data behind scontrol->ipc_control_data is stored in
scontrol->size, use this when copying data for backup/restore.
Fixes: db38d86d0c54 ("ASoC: sof: Improve sof_ipc4_bytes_ext_put function")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://patch.msgid.link/20251217143945.2667-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/ipc4-control.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c
index 0a05f66ec7d92..80111672c1796 100644
--- a/sound/soc/sof/ipc4-control.c
+++ b/sound/soc/sof/ipc4-control.c
@@ -66,7 +66,7 @@ static int sof_ipc4_set_get_kcontrol_data(struct snd_sof_control *scontrol,
* configuration
*/
memcpy(scontrol->ipc_control_data, scontrol->old_ipc_control_data,
- scontrol->max_size);
+ scontrol->size);
kfree(scontrol->old_ipc_control_data);
scontrol->old_ipc_control_data = NULL;
/* Send the last known good configuration to firmware */
@@ -567,7 +567,7 @@ static int sof_ipc4_bytes_ext_put(struct snd_sof_control *scontrol,
if (!scontrol->old_ipc_control_data) {
/* Create a backup of the current, valid bytes control */
scontrol->old_ipc_control_data = kmemdup(scontrol->ipc_control_data,
- scontrol->max_size, GFP_KERNEL);
+ scontrol->size, GFP_KERNEL);
if (!scontrol->old_ipc_control_data)
return -ENOMEM;
}
@@ -575,7 +575,7 @@ static int sof_ipc4_bytes_ext_put(struct snd_sof_control *scontrol,
/* Copy the whole binary data which includes the ABI header and the payload */
if (copy_from_user(data, tlvd->tlv, header.length)) {
memcpy(scontrol->ipc_control_data, scontrol->old_ipc_control_data,
- scontrol->max_size);
+ scontrol->size);
kfree(scontrol->old_ipc_control_data);
scontrol->old_ipc_control_data = NULL;
return -EFAULT;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 516/844] ASoC: SOF: ipc4-control: Keep the payload size up to date
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (514 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 515/844] ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 517/844] PCI: j721e: Add config guards for Cadence Host and Endpoint library APIs Sasha Levin
` (336 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peter Ujfalusi, Seppo Ingalsuo, Ranjani Sridharan, Bard Liao,
Kai Vehmanen, Mark Brown, Sasha Levin
From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
[ Upstream commit ebcfdbe4add923dfb690e6fb9d158da87ae0b6bf ]
When the bytes data is read from the firmware, the size of the payload
can be different than what it was previously.
For example when the topology did not contained payload data at all for the
control, the data size was 0.
For get operation allow maximum size of payload to be read and then update
the sizes according to the completed message.
Similarly, keep the size in sync when updating the data in firmware.
With the change we will be able to read data from firmware for bytes
controls which did not had initial payload defined in topology.
Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://patch.msgid.link/20251217143945.2667-5-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/ipc4-control.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c
index 80111672c1796..453ed1643b89c 100644
--- a/sound/soc/sof/ipc4-control.c
+++ b/sound/soc/sof/ipc4-control.c
@@ -426,13 +426,21 @@ static int sof_ipc4_set_get_bytes_data(struct snd_sof_dev *sdev,
msg->extension = SOF_IPC4_MOD_EXT_MSG_PARAM_ID(data->type);
msg->data_ptr = data->data;
- msg->data_size = data->size;
+ if (set)
+ msg->data_size = data->size;
+ else
+ msg->data_size = scontrol->max_size - sizeof(*data);
ret = sof_ipc4_set_get_kcontrol_data(scontrol, set, lock);
- if (ret < 0)
+ if (ret < 0) {
dev_err(sdev->dev, "Failed to %s for %s\n",
set ? "set bytes update" : "get bytes",
scontrol->name);
+ } else if (!set) {
+ /* Update the sizes according to the received payload data */
+ data->size = msg->data_size;
+ scontrol->size = sizeof(*cdata) + sizeof(*data) + data->size;
+ }
msg->data_ptr = NULL;
msg->data_size = 0;
@@ -448,6 +456,7 @@ static int sof_ipc4_bytes_put(struct snd_sof_control *scontrol,
struct snd_sof_dev *sdev = snd_soc_component_get_drvdata(scomp);
struct sof_abi_hdr *data = cdata->data;
size_t size;
+ int ret;
if (scontrol->max_size > sizeof(ucontrol->value.bytes.data)) {
dev_err_ratelimited(scomp->dev,
@@ -469,9 +478,12 @@ static int sof_ipc4_bytes_put(struct snd_sof_control *scontrol,
/* copy from kcontrol */
memcpy(data, ucontrol->value.bytes.data, size);
- sof_ipc4_set_get_bytes_data(sdev, scontrol, true, true);
+ ret = sof_ipc4_set_get_bytes_data(sdev, scontrol, true, true);
+ if (!ret)
+ /* Update the cdata size */
+ scontrol->size = sizeof(*cdata) + size;
- return 0;
+ return ret;
}
static int sof_ipc4_bytes_get(struct snd_sof_control *scontrol,
@@ -581,6 +593,9 @@ static int sof_ipc4_bytes_ext_put(struct snd_sof_control *scontrol,
return -EFAULT;
}
+ /* Update the cdata size */
+ scontrol->size = sizeof(*cdata) + header.length;
+
return sof_ipc4_set_get_bytes_data(sdev, scontrol, true, true);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 517/844] PCI: j721e: Add config guards for Cadence Host and Endpoint library APIs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (515 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 516/844] ASoC: SOF: ipc4-control: Keep the payload size up to date Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 518/844] fpga: dfl: use subsys_initcall to allow built-in drivers to be added Sasha Levin
` (335 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Siddharth Vadapalli, kernel test robot, Arnd Bergmann,
Manivannan Sadhasivam, Sasha Levin
From: Siddharth Vadapalli <s-vadapalli@ti.com>
[ Upstream commit 4b361b1e92be255ff923453fe8db74086cc7cf66 ]
Commit under Fixes enabled loadable module support for the driver under
the assumption that it shall be the sole user of the Cadence Host and
Endpoint library APIs. This assumption guarantees that we won't end up
in a case where the driver is built-in and the library support is built
as a loadable module.
With the introduction of [1], this assumption is no longer valid. The
SG2042 driver could be built as a loadable module, implying that the
Cadence Host library is also selected as a loadable module. However, the
pci-j721e.c driver could be built-in as indicated by CONFIG_PCI_J721E=y
due to which the Cadence Endpoint library is built-in. Despite the
library drivers being built as specified by their respective consumers,
since the 'pci-j721e.c' driver has references to the Cadence Host
library APIs as well, we run into a build error as reported at [0].
Fix this by adding config guards as a temporary workaround. The proper
fix is to split the 'pci-j721e.c' driver into independent Host and
Endpoint drivers as aligned at [2].
[0]: https://lore.kernel.org/r/202511111705.MZ7ls8Hm-lkp@intel.com/
[1]: commit 1c72774df028 ("PCI: sg2042: Add Sophgo SG2042 PCIe driver")
[2]: https://lore.kernel.org/r/37f6f8ce-12b2-44ee-a94c-f21b29c98821@app.fastmail.com/
Fixes: a2790bf81f0f ("PCI: j721e: Add support to build as a loadable module")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202511111705.MZ7ls8Hm-lkp@intel.com/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251117113246.1460644-1-s-vadapalli@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/cadence/pci-j721e.c | 41 +++++++++++++---------
1 file changed, 25 insertions(+), 16 deletions(-)
diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index ecd1b03124006..6f2501479c701 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -620,9 +620,11 @@ static int j721e_pcie_probe(struct platform_device *pdev)
gpiod_set_value_cansleep(pcie->reset_gpio, 1);
}
- ret = cdns_pcie_host_setup(rc);
- if (ret < 0)
- goto err_pcie_setup;
+ if (IS_ENABLED(CONFIG_PCI_J721E_HOST)) {
+ ret = cdns_pcie_host_setup(rc);
+ if (ret < 0)
+ goto err_pcie_setup;
+ }
break;
case PCI_MODE_EP:
@@ -632,9 +634,11 @@ static int j721e_pcie_probe(struct platform_device *pdev)
goto err_get_sync;
}
- ret = cdns_pcie_ep_setup(ep);
- if (ret < 0)
- goto err_pcie_setup;
+ if (IS_ENABLED(CONFIG_PCI_J721E_EP)) {
+ ret = cdns_pcie_ep_setup(ep);
+ if (ret < 0)
+ goto err_pcie_setup;
+ }
break;
}
@@ -659,10 +663,11 @@ static void j721e_pcie_remove(struct platform_device *pdev)
struct cdns_pcie_ep *ep;
struct cdns_pcie_rc *rc;
- if (pcie->mode == PCI_MODE_RC) {
+ if (IS_ENABLED(CONFIG_PCI_J721E_HOST) &&
+ pcie->mode == PCI_MODE_RC) {
rc = container_of(cdns_pcie, struct cdns_pcie_rc, pcie);
cdns_pcie_host_disable(rc);
- } else {
+ } else if (IS_ENABLED(CONFIG_PCI_J721E_EP)) {
ep = container_of(cdns_pcie, struct cdns_pcie_ep, pcie);
cdns_pcie_ep_disable(ep);
}
@@ -728,10 +733,12 @@ static int j721e_pcie_resume_noirq(struct device *dev)
gpiod_set_value_cansleep(pcie->reset_gpio, 1);
}
- ret = cdns_pcie_host_link_setup(rc);
- if (ret < 0) {
- clk_disable_unprepare(pcie->refclk);
- return ret;
+ if (IS_ENABLED(CONFIG_PCI_J721E_HOST)) {
+ ret = cdns_pcie_host_link_setup(rc);
+ if (ret < 0) {
+ clk_disable_unprepare(pcie->refclk);
+ return ret;
+ }
}
/*
@@ -741,10 +748,12 @@ static int j721e_pcie_resume_noirq(struct device *dev)
for (enum cdns_pcie_rp_bar bar = RP_BAR0; bar <= RP_NO_BAR; bar++)
rc->avail_ib_bar[bar] = true;
- ret = cdns_pcie_host_init(rc);
- if (ret) {
- clk_disable_unprepare(pcie->refclk);
- return ret;
+ if (IS_ENABLED(CONFIG_PCI_J721E_HOST)) {
+ ret = cdns_pcie_host_init(rc);
+ if (ret) {
+ clk_disable_unprepare(pcie->refclk);
+ return ret;
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 518/844] fpga: dfl: use subsys_initcall to allow built-in drivers to be added
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (516 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 517/844] PCI: j721e: Add config guards for Cadence Host and Endpoint library APIs Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 519/844] drm/tests: shmem: Swap names of export tests Sasha Levin
` (334 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thadeu Lima de Souza Cascardo, Xu Yilun, Xu Yilun, Sasha Levin
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
[ Upstream commit 267f53140c9d0bf270bbe0148082e9b8e5011273 ]
The dfl code adds a bus. If it is built-in and there is a built-in driver
as well, the dfl module_init may be called after the driver module_init,
leading to a failure to register the driver as the bus has not been added
yet.
Use subsys_initcall, which guarantees it will be called before the drivers
init code.
Without the fix, we see failures like this:
[ 0.479475] Driver 'intel-m10-bmc' was unable to register with bus_type 'dfl' because the bus was not initialized.
Cc: stable@vger.kernel.org
Fixes: 9ba3a0aa09fe ("fpga: dfl: create a dfl bus type to support DFL devices")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Link: https://lore.kernel.org/r/20251215-dfl_subsys-v1-1-21807bad6b10@igalia.com
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/fpga/dfl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
index 7022657243c0a..449c3a082e232 100644
--- a/drivers/fpga/dfl.c
+++ b/drivers/fpga/dfl.c
@@ -2018,7 +2018,7 @@ static void __exit dfl_fpga_exit(void)
bus_unregister(&dfl_bus_type);
}
-module_init(dfl_fpga_init);
+subsys_initcall(dfl_fpga_init);
module_exit(dfl_fpga_exit);
MODULE_DESCRIPTION("FPGA Device Feature List (DFL) Support");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 519/844] drm/tests: shmem: Swap names of export tests
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (517 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 518/844] fpga: dfl: use subsys_initcall to allow built-in drivers to be added Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 520/844] drm/tests: shmem: Add clean-up action to unpin pages Sasha Levin
` (333 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Zimmermann, dri-devel, Boris Brezillon, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 89f23d42006630dd94c01a8c916f8c648141ad8e ]
GEM SHMEM has 2 helpers for exporting S/G tables. Swap the names of
the rsp. tests, so that each matches the helper it tests.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 93032ae634d4 ("drm/test: add a test suite for GEM objects backed by shmem")
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251212160317.287409-2-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tests/drm_gem_shmem_test.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
index 68f2c31623547..872881ec9c30d 100644
--- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c
+++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
@@ -194,7 +194,7 @@ static void drm_gem_shmem_test_vmap(struct kunit *test)
* scatter/gather table large enough to accommodate the backing memory
* is successfully exported.
*/
-static void drm_gem_shmem_test_get_pages_sgt(struct kunit *test)
+static void drm_gem_shmem_test_get_sg_table(struct kunit *test)
{
struct drm_device *drm_dev = test->priv;
struct drm_gem_shmem_object *shmem;
@@ -236,7 +236,7 @@ static void drm_gem_shmem_test_get_pages_sgt(struct kunit *test)
* backing pages are pinned and a scatter/gather table large enough to
* accommodate the backing memory is successfully exported.
*/
-static void drm_gem_shmem_test_get_sg_table(struct kunit *test)
+static void drm_gem_shmem_test_get_pages_sgt(struct kunit *test)
{
struct drm_device *drm_dev = test->priv;
struct drm_gem_shmem_object *shmem;
@@ -366,8 +366,8 @@ static struct kunit_case drm_gem_shmem_test_cases[] = {
KUNIT_CASE(drm_gem_shmem_test_obj_create_private),
KUNIT_CASE(drm_gem_shmem_test_pin_pages),
KUNIT_CASE(drm_gem_shmem_test_vmap),
- KUNIT_CASE(drm_gem_shmem_test_get_pages_sgt),
KUNIT_CASE(drm_gem_shmem_test_get_sg_table),
+ KUNIT_CASE(drm_gem_shmem_test_get_pages_sgt),
KUNIT_CASE(drm_gem_shmem_test_madvise),
KUNIT_CASE(drm_gem_shmem_test_purge),
{}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 520/844] drm/tests: shmem: Add clean-up action to unpin pages
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (518 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 519/844] drm/tests: shmem: Swap names of export tests Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 521/844] drm/tests: shmem: Hold reservation lock around vmap/vunmap Sasha Levin
` (332 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Zimmermann, dri-devel, Boris Brezillon, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit b47b9ecef309459278eb52f02b50eefdeaac4f6d ]
Automatically unpin pages on cleanup. The test currently fails with
the error
[ 58.246263] drm-kunit-mock-device drm_gem_shmem_test_get_sg_table.drm-kunit-mock-device: [drm] drm_WARN_ON(refcount_read(&shmem->pages_pin_count))
while cleaning up the GEM object. The pin count has to be zero at this
point.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: d586b535f144 ("drm/shmem-helper: Add and use pages_pin_count")
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251212160317.287409-3-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tests/drm_gem_shmem_test.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
index 872881ec9c30d..1d50bab51ef3f 100644
--- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c
+++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
@@ -34,6 +34,9 @@ KUNIT_DEFINE_ACTION_WRAPPER(sg_free_table_wrapper, sg_free_table,
KUNIT_DEFINE_ACTION_WRAPPER(drm_gem_shmem_free_wrapper, drm_gem_shmem_free,
struct drm_gem_shmem_object *);
+KUNIT_DEFINE_ACTION_WRAPPER(drm_gem_shmem_unpin_wrapper, drm_gem_shmem_unpin,
+ struct drm_gem_shmem_object *);
+
/*
* Test creating a shmem GEM object backed by shmem buffer. The test
* case succeeds if the GEM object is successfully allocated with the
@@ -212,6 +215,9 @@ static void drm_gem_shmem_test_get_sg_table(struct kunit *test)
ret = drm_gem_shmem_pin(shmem);
KUNIT_ASSERT_EQ(test, ret, 0);
+ ret = kunit_add_action_or_reset(test, drm_gem_shmem_unpin_wrapper, shmem);
+ KUNIT_ASSERT_EQ(test, ret, 0);
+
sgt = drm_gem_shmem_get_sg_table(shmem);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, sgt);
KUNIT_EXPECT_NULL(test, shmem->sgt);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 521/844] drm/tests: shmem: Hold reservation lock around vmap/vunmap
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (519 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 520/844] drm/tests: shmem: Add clean-up action to unpin pages Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 522/844] drm/tests: shmem: Hold reservation lock around madvise Sasha Levin
` (331 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Zimmermann, dri-devel, Boris Brezillon, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit cda83b099f117f2a28a77bf467af934cb39e49cf ]
Acquire and release the GEM object's reservation lock around vmap and
vunmap operations. The tests use vmap_locked, which led to errors such
as show below.
[ 122.292030] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:390 drm_gem_shmem_vmap_locked+0x3a3/0x6f0
[ 122.468066] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:293 drm_gem_shmem_pin_locked+0x1fe/0x350
[ 122.563504] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:234 drm_gem_shmem_get_pages_locked+0x23c/0x370
[ 122.662248] WARNING: CPU: 2 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:452 drm_gem_shmem_vunmap_locked+0x101/0x330
Only export the new vmap/vunmap helpers for Kunit tests. These are
not interfaces for regular drivers.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions")
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251212160317.287409-4-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem_shmem_helper.c | 33 ++++++++++++++++++++++
drivers/gpu/drm/tests/drm_gem_shmem_test.c | 6 ++--
include/drm/drm_gem_shmem_helper.h | 9 ++++++
3 files changed, 46 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index f13eb5f36e8a9..b7064b8333e89 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -15,6 +15,8 @@
#include <asm/set_memory.h>
#endif
+#include <kunit/visibility.h>
+
#include <drm/drm.h>
#include <drm/drm_device.h>
#include <drm/drm_drv.h>
@@ -894,6 +896,37 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
}
EXPORT_SYMBOL_GPL(drm_gem_shmem_prime_import_no_map);
+/*
+ * Kunit helpers
+ */
+
+#if IS_ENABLED(CONFIG_KUNIT)
+int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map)
+{
+ struct drm_gem_object *obj = &shmem->base;
+ int ret;
+
+ ret = dma_resv_lock_interruptible(obj->resv, NULL);
+ if (ret)
+ return ret;
+ ret = drm_gem_shmem_vmap_locked(shmem, map);
+ dma_resv_unlock(obj->resv);
+
+ return ret;
+}
+EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_vmap);
+
+void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map)
+{
+ struct drm_gem_object *obj = &shmem->base;
+
+ dma_resv_lock_interruptible(obj->resv, NULL);
+ drm_gem_shmem_vunmap_locked(shmem, map);
+ dma_resv_unlock(obj->resv);
+}
+EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_vunmap);
+#endif
+
MODULE_DESCRIPTION("DRM SHMEM memory-management helpers");
MODULE_IMPORT_NS("DMA_BUF");
MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
index 1d50bab51ef3f..3e7c6f20fbcca 100644
--- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c
+++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
@@ -19,6 +19,8 @@
#include <drm/drm_gem_shmem_helper.h>
#include <drm/drm_kunit_helpers.h>
+MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+
#define TEST_SIZE SZ_1M
#define TEST_BYTE 0xae
@@ -176,7 +178,7 @@ static void drm_gem_shmem_test_vmap(struct kunit *test)
ret = kunit_add_action_or_reset(test, drm_gem_shmem_free_wrapper, shmem);
KUNIT_ASSERT_EQ(test, ret, 0);
- ret = drm_gem_shmem_vmap_locked(shmem, &map);
+ ret = drm_gem_shmem_vmap(shmem, &map);
KUNIT_ASSERT_EQ(test, ret, 0);
KUNIT_ASSERT_NOT_NULL(test, shmem->vaddr);
KUNIT_ASSERT_FALSE(test, iosys_map_is_null(&map));
@@ -186,7 +188,7 @@ static void drm_gem_shmem_test_vmap(struct kunit *test)
for (i = 0; i < TEST_SIZE; i++)
KUNIT_EXPECT_EQ(test, iosys_map_rd(&map, i, u8), TEST_BYTE);
- drm_gem_shmem_vunmap_locked(shmem, &map);
+ drm_gem_shmem_vunmap(shmem, &map);
KUNIT_EXPECT_NULL(test, shmem->vaddr);
KUNIT_EXPECT_EQ(test, refcount_read(&shmem->vmap_use_count), 0);
}
diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h
index 589f7bfe7506e..6924ee226655a 100644
--- a/include/drm/drm_gem_shmem_helper.h
+++ b/include/drm/drm_gem_shmem_helper.h
@@ -303,4 +303,13 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
.gem_prime_import = drm_gem_shmem_prime_import_no_map, \
.dumb_create = drm_gem_shmem_dumb_create
+/*
+ * Kunit helpers
+ */
+
+#if IS_ENABLED(CONFIG_KUNIT)
+int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map);
+void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map);
+#endif
+
#endif /* __DRM_GEM_SHMEM_HELPER_H__ */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 522/844] drm/tests: shmem: Hold reservation lock around madvise
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (520 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 521/844] drm/tests: shmem: Hold reservation lock around vmap/vunmap Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 523/844] drm/tests: shmem: Hold reservation lock around purge Sasha Levin
` (330 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Zimmermann, dri-devel, Boris Brezillon, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 607d07d8cc0b835a8701259f08a03dc149b79b4f ]
Acquire and release the GEM object's reservation lock around calls
to the object's madvide operation. The tests use
drm_gem_shmem_madvise_locked(), which led to errors such as show below.
[ 58.339389] WARNING: CPU: 1 PID: 1352 at drivers/gpu/drm/drm_gem_shmem_helper.c:499 drm_gem_shmem_madvise_locked+0xde/0x140
Only export the new helper drm_gem_shmem_madvise() for Kunit tests.
This is not an interface for regular drivers.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions")
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251212160317.287409-5-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem_shmem_helper.c | 15 +++++++++++++++
drivers/gpu/drm/tests/drm_gem_shmem_test.c | 8 ++++----
include/drm/drm_gem_shmem_helper.h | 1 +
3 files changed, 20 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index b7064b8333e89..1dfc9c4089587 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -925,6 +925,21 @@ void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *
dma_resv_unlock(obj->resv);
}
EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_vunmap);
+
+int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv)
+{
+ struct drm_gem_object *obj = &shmem->base;
+ int ret;
+
+ ret = dma_resv_lock_interruptible(obj->resv, NULL);
+ if (ret)
+ return ret;
+ ret = drm_gem_shmem_madvise_locked(shmem, madv);
+ dma_resv_unlock(obj->resv);
+
+ return ret;
+}
+EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_madvise);
#endif
MODULE_DESCRIPTION("DRM SHMEM memory-management helpers");
diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
index 3e7c6f20fbcca..d639848e3c8ea 100644
--- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c
+++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
@@ -292,17 +292,17 @@ static void drm_gem_shmem_test_madvise(struct kunit *test)
ret = kunit_add_action_or_reset(test, drm_gem_shmem_free_wrapper, shmem);
KUNIT_ASSERT_EQ(test, ret, 0);
- ret = drm_gem_shmem_madvise_locked(shmem, 1);
+ ret = drm_gem_shmem_madvise(shmem, 1);
KUNIT_EXPECT_TRUE(test, ret);
KUNIT_ASSERT_EQ(test, shmem->madv, 1);
/* Set madv to a negative value */
- ret = drm_gem_shmem_madvise_locked(shmem, -1);
+ ret = drm_gem_shmem_madvise(shmem, -1);
KUNIT_EXPECT_FALSE(test, ret);
KUNIT_ASSERT_EQ(test, shmem->madv, -1);
/* Check that madv cannot be set back to a positive value */
- ret = drm_gem_shmem_madvise_locked(shmem, 0);
+ ret = drm_gem_shmem_madvise(shmem, 0);
KUNIT_EXPECT_FALSE(test, ret);
KUNIT_ASSERT_EQ(test, shmem->madv, -1);
}
@@ -330,7 +330,7 @@ static void drm_gem_shmem_test_purge(struct kunit *test)
ret = drm_gem_shmem_is_purgeable(shmem);
KUNIT_EXPECT_FALSE(test, ret);
- ret = drm_gem_shmem_madvise_locked(shmem, 1);
+ ret = drm_gem_shmem_madvise(shmem, 1);
KUNIT_EXPECT_TRUE(test, ret);
/* The scatter/gather table will be freed by drm_gem_shmem_free */
diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h
index 6924ee226655a..3dd93e2df7092 100644
--- a/include/drm/drm_gem_shmem_helper.h
+++ b/include/drm/drm_gem_shmem_helper.h
@@ -310,6 +310,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
#if IS_ENABLED(CONFIG_KUNIT)
int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map);
void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map);
+int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv);
#endif
#endif /* __DRM_GEM_SHMEM_HELPER_H__ */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 523/844] drm/tests: shmem: Hold reservation lock around purge
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (521 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 522/844] drm/tests: shmem: Hold reservation lock around madvise Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 524/844] drm/xe: Fix ggtt fb alignment Sasha Levin
` (329 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Zimmermann, dri-devel, Boris Brezillon, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 3f41307d589c2f25d556d47b165df808124cd0c4 ]
Acquire and release the GEM object's reservation lock around calls
to the object's purge operation. The tests use
drm_gem_shmem_purge_locked(), which led to errors such as show below.
[ 58.709128] WARNING: CPU: 1 PID: 1354 at drivers/gpu/drm/drm_gem_shmem_helper.c:515 drm_gem_shmem_purge_locked+0x51c/0x740
Only export the new helper drm_gem_shmem_purge() for Kunit tests.
This is not an interface for regular drivers.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 954907f7147d ("drm/shmem-helper: Refactor locked/unlocked functions")
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251212160317.287409-6-tzimmermann@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_gem_shmem_helper.c | 15 +++++++++++++++
drivers/gpu/drm/tests/drm_gem_shmem_test.c | 4 +++-
include/drm/drm_gem_shmem_helper.h | 1 +
3 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 1dfc9c4089587..0db3fe08a57b7 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -940,6 +940,21 @@ int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv)
return ret;
}
EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_madvise);
+
+int drm_gem_shmem_purge(struct drm_gem_shmem_object *shmem)
+{
+ struct drm_gem_object *obj = &shmem->base;
+ int ret;
+
+ ret = dma_resv_lock_interruptible(obj->resv, NULL);
+ if (ret)
+ return ret;
+ drm_gem_shmem_purge_locked(shmem);
+ dma_resv_unlock(obj->resv);
+
+ return 0;
+}
+EXPORT_SYMBOL_IF_KUNIT(drm_gem_shmem_purge);
#endif
MODULE_DESCRIPTION("DRM SHMEM memory-management helpers");
diff --git a/drivers/gpu/drm/tests/drm_gem_shmem_test.c b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
index d639848e3c8ea..4b459f21acfd9 100644
--- a/drivers/gpu/drm/tests/drm_gem_shmem_test.c
+++ b/drivers/gpu/drm/tests/drm_gem_shmem_test.c
@@ -340,7 +340,9 @@ static void drm_gem_shmem_test_purge(struct kunit *test)
ret = drm_gem_shmem_is_purgeable(shmem);
KUNIT_EXPECT_TRUE(test, ret);
- drm_gem_shmem_purge_locked(shmem);
+ ret = drm_gem_shmem_purge(shmem);
+ KUNIT_ASSERT_EQ(test, ret, 0);
+
KUNIT_EXPECT_NULL(test, shmem->pages);
KUNIT_EXPECT_NULL(test, shmem->sgt);
KUNIT_EXPECT_EQ(test, shmem->madv, -1);
diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h
index 3dd93e2df7092..8d56970d7eed1 100644
--- a/include/drm/drm_gem_shmem_helper.h
+++ b/include/drm/drm_gem_shmem_helper.h
@@ -311,6 +311,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
int drm_gem_shmem_vmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map);
void drm_gem_shmem_vunmap(struct drm_gem_shmem_object *shmem, struct iosys_map *map);
int drm_gem_shmem_madvise(struct drm_gem_shmem_object *shmem, int madv);
+int drm_gem_shmem_purge(struct drm_gem_shmem_object *shmem);
#endif
#endif /* __DRM_GEM_SHMEM_HELPER_H__ */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 524/844] drm/xe: Fix ggtt fb alignment
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (522 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 523/844] drm/tests: shmem: Hold reservation lock around purge Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 525/844] Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up" Sasha Levin
` (328 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Tvrtko Ursulin, Ville Syrjälä, Juha-Pekka Heikkila,
Thomas Hellström, Sasha Levin
From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
[ Upstream commit a61bf068f1fe359203f1af191cb523b77dc32752 ]
Pass the correct alignment from intel_fb_pin_to_ggtt() down to
__xe_pin_fb_vma().
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Closes: https://lore.kernel.org/intel-xe/aNL_RgLy13fXJbYx@intel.com/
Cc: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Fixes: b0228a337de8 ("drm/xe/display: align framebuffers according to hw requirements")
Cc: <stable@vger.kernel.org> # v6.13+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/20251208181550.6618-1-tursulin@igalia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/display/xe_fb_pin.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/display/xe_fb_pin.c b/drivers/gpu/drm/xe/display/xe_fb_pin.c
index 1fd4a815e784b..b18d15cc3c53d 100644
--- a/drivers/gpu/drm/xe/display/xe_fb_pin.c
+++ b/drivers/gpu/drm/xe/display/xe_fb_pin.c
@@ -378,7 +378,7 @@ intel_fb_pin_to_ggtt(const struct drm_framebuffer *fb,
{
*out_flags = 0;
- return __xe_pin_fb_vma(to_intel_framebuffer(fb), view, phys_alignment);
+ return __xe_pin_fb_vma(to_intel_framebuffer(fb), view, alignment);
}
void intel_fb_unpin_vma(struct i915_vma *vma, unsigned long flags)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 525/844] Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (523 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 524/844] drm/xe: Fix ggtt fb alignment Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 526/844] PCI: dwc: Add L1 Substates context to ltssm_status of debugfs Sasha Levin
` (327 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit fc6298086bfacaa7003b0bd1da4e4f42b29f7d77 ]
This reverts commit ec9fd499b9c60a187ac8d6414c3c343c77d32e42.
While this fake hotplugging was a nice idea, it has shown that this feature
does not handle PCIe switches correctly:
pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
During the initial scan, PCI core doesn't see the switch and since the Root
Port is not hot plug capable, the secondary bus number gets assigned as the
subordinate bus number. This means, the PCI core assumes that only one bus
will appear behind the Root Port since the Root Port is not hot plug
capable.
This works perfectly fine for PCIe endpoints connected to the Root Port,
since they don't extend the bus. However, if a PCIe switch is connected,
then there is a problem when the downstream busses starts showing up and
the PCI core doesn't extend the subordinate bus number and bridge resources
after initial scan during boot.
The long term plan is to migrate this driver to the upcoming pwrctrl APIs
that are supposed to handle this problem elegantly.
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251222064207.3246632-9-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-dw-rockchip.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
index a3daac74d3f18..59396db3f4812 100644
--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
@@ -588,7 +588,6 @@ static int rockchip_pcie_configure_rc(struct platform_device *pdev,
pp = &rockchip->pci.pp;
pp->ops = &rockchip_pcie_host_ops;
- pp->use_linkup_irq = true;
ret = dw_pcie_host_init(pp);
if (ret) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 526/844] PCI: dwc: Add L1 Substates context to ltssm_status of debugfs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (524 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 525/844] Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up" Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 527/844] PCI: dw-rockchip: Change get_ltssm() to provide L1 Substates info Sasha Levin
` (326 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shawn Lin, Manivannan Sadhasivam, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 679ec639f29cbdaf36bd79bf3e98240fffa335ee ]
DWC core couldn't distinguish LTSSM state among L1.0, L1.1 and L1.2. But
the vendor glue driver may implement additional logic to convey this
information. So add two pseudo definitions for vendor glue drivers to
translate their internal L1 Substates for debugfs to show.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/1765503205-22184-1-git-send-email-shawn.lin@rock-chips.com
Stable-dep-of: 180c3cfe3678 ("Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ"")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-designware-debugfs.c | 2 ++
drivers/pci/controller/dwc/pcie-designware.h | 4 ++++
2 files changed, 6 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-designware-debugfs.c b/drivers/pci/controller/dwc/pcie-designware-debugfs.c
index 0fbf86c0b97e0..df98fee69892b 100644
--- a/drivers/pci/controller/dwc/pcie-designware-debugfs.c
+++ b/drivers/pci/controller/dwc/pcie-designware-debugfs.c
@@ -485,6 +485,8 @@ static const char *ltssm_status_string(enum dw_pcie_ltssm ltssm)
DW_PCIE_LTSSM_NAME(DW_PCIE_LTSSM_RCVRY_EQ1);
DW_PCIE_LTSSM_NAME(DW_PCIE_LTSSM_RCVRY_EQ2);
DW_PCIE_LTSSM_NAME(DW_PCIE_LTSSM_RCVRY_EQ3);
+ DW_PCIE_LTSSM_NAME(DW_PCIE_LTSSM_L1_1);
+ DW_PCIE_LTSSM_NAME(DW_PCIE_LTSSM_L1_2);
default:
str = "DW_PCIE_LTSSM_UNKNOWN";
break;
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index 5c429b62cb086..ed1801dd8e39a 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -392,6 +392,10 @@ enum dw_pcie_ltssm {
DW_PCIE_LTSSM_RCVRY_EQ2 = 0x22,
DW_PCIE_LTSSM_RCVRY_EQ3 = 0x23,
+ /* Vendor glue drivers provide pseudo L1 substates from get_ltssm() */
+ DW_PCIE_LTSSM_L1_1 = 0x141,
+ DW_PCIE_LTSSM_L1_2 = 0x142,
+
DW_PCIE_LTSSM_UNKNOWN = 0xFFFFFFFF,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 527/844] PCI: dw-rockchip: Change get_ltssm() to provide L1 Substates info
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (525 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 526/844] PCI: dwc: Add L1 Substates context to ltssm_status of debugfs Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 528/844] Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ" Sasha Levin
` (325 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shawn Lin, Manivannan Sadhasivam, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit f994bb8f1c94726e0124356ccd31c3c23a8a69f4 ]
Rename rockchip_pcie_get_ltssm() to rockchip_pcie_get_ltssm_reg() and add
rockchip_pcie_get_ltssm() to get_ltssm() callback in order to show the
proper L1 Substates. The PCIE_CLIENT_LTSSM_STATUS[5:0] register returns
the same LTSSM layout as enum dw_pcie_ltssm. So the driver just need to
convey L1 PM Substates by returning the proper value defined in
pcie-designware.h.
cat /sys/kernel/debug/dwc_pcie_a40000000.pcie/ltssm_status
L1_2 (0x142)
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/1765503205-22184-2-git-send-email-shawn.lin@rock-chips.com
Stable-dep-of: 180c3cfe3678 ("Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ"")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-dw-rockchip.c | 29 ++++++++++++++++---
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
index 59396db3f4812..0ec12e5edf62f 100644
--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
@@ -68,6 +68,11 @@
#define PCIE_CLKREQ_NOT_READY FIELD_PREP_WM16(BIT(0), 0)
#define PCIE_CLKREQ_PULL_DOWN FIELD_PREP_WM16(GENMASK(13, 12), 1)
+/* RASDES TBA information */
+#define PCIE_CLIENT_CDM_RASDES_TBA_INFO_CMN 0x154
+#define PCIE_CLIENT_CDM_RASDES_TBA_L1_1 BIT(4)
+#define PCIE_CLIENT_CDM_RASDES_TBA_L1_2 BIT(5)
+
/* Hot Reset Control Register */
#define PCIE_CLIENT_HOT_RESET_CTRL 0x180
#define PCIE_LTSSM_APP_DLY2_EN BIT(1)
@@ -183,11 +188,26 @@ static int rockchip_pcie_init_irq_domain(struct rockchip_pcie *rockchip)
return 0;
}
-static u32 rockchip_pcie_get_ltssm(struct rockchip_pcie *rockchip)
+static u32 rockchip_pcie_get_ltssm_reg(struct rockchip_pcie *rockchip)
{
return rockchip_pcie_readl_apb(rockchip, PCIE_CLIENT_LTSSM_STATUS);
}
+static enum dw_pcie_ltssm rockchip_pcie_get_ltssm(struct dw_pcie *pci)
+{
+ struct rockchip_pcie *rockchip = to_rockchip_pcie(pci);
+ u32 val = rockchip_pcie_readl_apb(rockchip,
+ PCIE_CLIENT_CDM_RASDES_TBA_INFO_CMN);
+
+ if (val & PCIE_CLIENT_CDM_RASDES_TBA_L1_1)
+ return DW_PCIE_LTSSM_L1_1;
+
+ if (val & PCIE_CLIENT_CDM_RASDES_TBA_L1_2)
+ return DW_PCIE_LTSSM_L1_2;
+
+ return rockchip_pcie_get_ltssm_reg(rockchip) & PCIE_LTSSM_STATUS_MASK;
+}
+
static void rockchip_pcie_enable_ltssm(struct rockchip_pcie *rockchip)
{
rockchip_pcie_writel_apb(rockchip, PCIE_CLIENT_ENABLE_LTSSM,
@@ -203,7 +223,7 @@ static void rockchip_pcie_disable_ltssm(struct rockchip_pcie *rockchip)
static bool rockchip_pcie_link_up(struct dw_pcie *pci)
{
struct rockchip_pcie *rockchip = to_rockchip_pcie(pci);
- u32 val = rockchip_pcie_get_ltssm(rockchip);
+ u32 val = rockchip_pcie_get_ltssm_reg(rockchip);
return FIELD_GET(PCIE_LINKUP_MASK, val) == PCIE_LINKUP;
}
@@ -493,6 +513,7 @@ static const struct dw_pcie_ops dw_pcie_ops = {
.link_up = rockchip_pcie_link_up,
.start_link = rockchip_pcie_start_link,
.stop_link = rockchip_pcie_stop_link,
+ .get_ltssm = rockchip_pcie_get_ltssm,
};
static irqreturn_t rockchip_pcie_rc_sys_irq_thread(int irq, void *arg)
@@ -507,7 +528,7 @@ static irqreturn_t rockchip_pcie_rc_sys_irq_thread(int irq, void *arg)
rockchip_pcie_writel_apb(rockchip, reg, PCIE_CLIENT_INTR_STATUS_MISC);
dev_dbg(dev, "PCIE_CLIENT_INTR_STATUS_MISC: %#x\n", reg);
- dev_dbg(dev, "LTSSM_STATUS: %#x\n", rockchip_pcie_get_ltssm(rockchip));
+ dev_dbg(dev, "LTSSM_STATUS: %#x\n", rockchip_pcie_get_ltssm_reg(rockchip));
if (reg & PCIE_RDLH_LINK_UP_CHGED) {
if (rockchip_pcie_link_up(pci)) {
@@ -534,7 +555,7 @@ static irqreturn_t rockchip_pcie_ep_sys_irq_thread(int irq, void *arg)
rockchip_pcie_writel_apb(rockchip, reg, PCIE_CLIENT_INTR_STATUS_MISC);
dev_dbg(dev, "PCIE_CLIENT_INTR_STATUS_MISC: %#x\n", reg);
- dev_dbg(dev, "LTSSM_STATUS: %#x\n", rockchip_pcie_get_ltssm(rockchip));
+ dev_dbg(dev, "LTSSM_STATUS: %#x\n", rockchip_pcie_get_ltssm_reg(rockchip));
if (reg & PCIE_LINK_REQ_RST_NOT_INT) {
dev_dbg(dev, "hot reset or link-down reset\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 528/844] Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (526 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 527/844] PCI: dw-rockchip: Change get_ltssm() to provide L1 Substates info Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 529/844] Revert "PCI: qcom: Don't wait for link if we can detect Link Up" Sasha Levin
` (324 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 180c3cfe36786d261a55da52a161f9e279b19a6f ]
This reverts commit 0e0b45ab5d770a748487ba0ae8f77d1fb0f0de3e.
While this fake hotplugging was a nice idea, it has shown that this feature
does not handle PCIe switches correctly:
pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
During the initial scan, PCI core doesn't see the switch and since the Root
Port is not hot plug capable, the secondary bus number gets assigned as the
subordinate bus number. This means, the PCI core assumes that only one bus
will appear behind the Root Port since the Root Port is not hot plug
capable.
This works perfectly fine for PCIe endpoints connected to the Root Port,
since they don't extend the bus. However, if a PCIe switch is connected,
then there is a problem when the downstream busses starts showing up and
the PCI core doesn't extend the subordinate bus number and bridge resources
after initial scan during boot.
The long term plan is to migrate this driver to the upcoming pwrctrl APIs
that are supposed to handle this problem elegantly.
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251222064207.3246632-10-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-dw-rockchip.c | 59 +------------------
1 file changed, 3 insertions(+), 56 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-dw-rockchip.c b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
index 0ec12e5edf62f..5b17da63151d5 100644
--- a/drivers/pci/controller/dwc/pcie-dw-rockchip.c
+++ b/drivers/pci/controller/dwc/pcie-dw-rockchip.c
@@ -516,34 +516,6 @@ static const struct dw_pcie_ops dw_pcie_ops = {
.get_ltssm = rockchip_pcie_get_ltssm,
};
-static irqreturn_t rockchip_pcie_rc_sys_irq_thread(int irq, void *arg)
-{
- struct rockchip_pcie *rockchip = arg;
- struct dw_pcie *pci = &rockchip->pci;
- struct dw_pcie_rp *pp = &pci->pp;
- struct device *dev = pci->dev;
- u32 reg;
-
- reg = rockchip_pcie_readl_apb(rockchip, PCIE_CLIENT_INTR_STATUS_MISC);
- rockchip_pcie_writel_apb(rockchip, reg, PCIE_CLIENT_INTR_STATUS_MISC);
-
- dev_dbg(dev, "PCIE_CLIENT_INTR_STATUS_MISC: %#x\n", reg);
- dev_dbg(dev, "LTSSM_STATUS: %#x\n", rockchip_pcie_get_ltssm_reg(rockchip));
-
- if (reg & PCIE_RDLH_LINK_UP_CHGED) {
- if (rockchip_pcie_link_up(pci)) {
- msleep(PCIE_RESET_CONFIG_WAIT_MS);
- dev_dbg(dev, "Received Link up event. Starting enumeration!\n");
- /* Rescan the bus to enumerate endpoint devices */
- pci_lock_rescan_remove();
- pci_rescan_bus(pp->bridge->bus);
- pci_unlock_rescan_remove();
- }
- }
-
- return IRQ_HANDLED;
-}
-
static irqreturn_t rockchip_pcie_ep_sys_irq_thread(int irq, void *arg)
{
struct rockchip_pcie *rockchip = arg;
@@ -576,29 +548,14 @@ static irqreturn_t rockchip_pcie_ep_sys_irq_thread(int irq, void *arg)
return IRQ_HANDLED;
}
-static int rockchip_pcie_configure_rc(struct platform_device *pdev,
- struct rockchip_pcie *rockchip)
+static int rockchip_pcie_configure_rc(struct rockchip_pcie *rockchip)
{
- struct device *dev = &pdev->dev;
struct dw_pcie_rp *pp;
- int irq, ret;
u32 val;
if (!IS_ENABLED(CONFIG_PCIE_ROCKCHIP_DW_HOST))
return -ENODEV;
- irq = platform_get_irq_byname(pdev, "sys");
- if (irq < 0)
- return irq;
-
- ret = devm_request_threaded_irq(dev, irq, NULL,
- rockchip_pcie_rc_sys_irq_thread,
- IRQF_ONESHOT, "pcie-sys-rc", rockchip);
- if (ret) {
- dev_err(dev, "failed to request PCIe sys IRQ\n");
- return ret;
- }
-
/* LTSSM enable control mode */
val = FIELD_PREP_WM16(PCIE_LTSSM_ENABLE_ENHANCE, 1);
rockchip_pcie_writel_apb(rockchip, val, PCIE_CLIENT_HOT_RESET_CTRL);
@@ -610,17 +567,7 @@ static int rockchip_pcie_configure_rc(struct platform_device *pdev,
pp = &rockchip->pci.pp;
pp->ops = &rockchip_pcie_host_ops;
- ret = dw_pcie_host_init(pp);
- if (ret) {
- dev_err(dev, "failed to initialize host\n");
- return ret;
- }
-
- /* unmask DLL up/down indicator */
- val = FIELD_PREP_WM16(PCIE_RDLH_LINK_UP_CHGED, 0);
- rockchip_pcie_writel_apb(rockchip, val, PCIE_CLIENT_INTR_MASK_MISC);
-
- return ret;
+ return dw_pcie_host_init(pp);
}
static int rockchip_pcie_configure_ep(struct platform_device *pdev,
@@ -739,7 +686,7 @@ static int rockchip_pcie_probe(struct platform_device *pdev)
switch (data->mode) {
case DW_PCIE_RC_TYPE:
- ret = rockchip_pcie_configure_rc(pdev, rockchip);
+ ret = rockchip_pcie_configure_rc(rockchip);
if (ret)
goto deinit_clk;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 529/844] Revert "PCI: qcom: Don't wait for link if we can detect Link Up"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (527 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 528/844] Revert "PCI: dw-rockchip: Enumerate endpoints based on dll_link_up IRQ" Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 530/844] Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" Sasha Levin
` (323 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit e9ce5b3804436301ab343bc14203a4c14b336d1b ]
This reverts commit 36971d6c5a9a134c15760ae9fd13c6d5f9a36abb.
While this fake hotplugging was a nice idea, it has shown that this feature
does not handle PCIe switches correctly:
pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
During the initial scan, PCI core doesn't see the switch and since the Root
Port is not hot plug capable, the secondary bus number gets assigned as the
subordinate bus number. This means, the PCI core assumes that only one bus
will appear behind the Root Port since the Root Port is not hot plug
capable.
This works perfectly fine for PCIe endpoints connected to the Root Port,
since they don't extend the bus. However, if a PCIe switch is connected,
then there is a problem when the downstream busses starts showing up and
the PCI core doesn't extend the subordinate bus number and bridge resources
after initial scan during boot.
The long term plan is to migrate this driver to the upcoming pwrctrl APIs
that are supposed to handle this problem elegantly.
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251222064207.3246632-11-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 5a318487b2b3f..9a115bacd3ad1 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1957,10 +1957,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, pcie);
- irq = platform_get_irq_byname_optional(pdev, "global");
- if (irq > 0)
- pp->use_linkup_irq = true;
-
ret = dw_pcie_host_init(pp);
if (ret) {
dev_err(dev, "cannot initialize host\n");
@@ -1974,6 +1970,7 @@ static int qcom_pcie_probe(struct platform_device *pdev)
goto err_host_deinit;
}
+ irq = platform_get_irq_byname_optional(pdev, "global");
if (irq > 0) {
ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
qcom_pcie_global_irq_thread,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 530/844] Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (528 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 529/844] Revert "PCI: qcom: Don't wait for link if we can detect Link Up" Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 531/844] Revert "PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt" Sasha Levin
` (322 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 7ebdefb87942073679e56cfbc5a72e8fc5441bfc ]
This reverts commit ba4a2e2317b9faeca9193ed6d3193ddc3cf2aba3.
Since the Link up IRQ support is going away, revert the MSI logic that got
added for it too.
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
[mani: reworded the description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251222064207.3246632-12-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 9a115bacd3ad1..39e5993d01e7c 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -136,7 +136,6 @@
/* PARF_INT_ALL_{STATUS/CLEAR/MASK} register fields */
#define PARF_INT_ALL_LINK_UP BIT(13)
-#define PARF_INT_MSI_DEV_0_7 GENMASK(30, 23)
/* PARF_NO_SNOOP_OVERRIDE register fields */
#define WR_NO_SNOOP_OVERRIDE_EN BIT(1)
@@ -1981,8 +1980,7 @@ static int qcom_pcie_probe(struct platform_device *pdev)
goto err_host_deinit;
}
- writel_relaxed(PARF_INT_ALL_LINK_UP | PARF_INT_MSI_DEV_0_7,
- pcie->parf + PARF_INT_ALL_MASK);
+ writel_relaxed(PARF_INT_ALL_LINK_UP, pcie->parf + PARF_INT_ALL_MASK);
}
qcom_pcie_icc_opp_update(pcie);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 531/844] Revert "PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (529 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 530/844] Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 532/844] Revert "PCI: dwc: Don't wait for link up if driver can detect Link Up event" Sasha Levin
` (321 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 9a9793b55854422652ea92625e48277c4651c0fd ]
This reverts commit 4581403f67929d02c197cb187c4e1e811c9e762a.
While this fake hotplugging was a nice idea, it has shown that this feature
does not handle PCIe switches correctly:
pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
During the initial scan, PCI core doesn't see the switch and since the Root
Port is not hot plug capable, the secondary bus number gets assigned as the
subordinate bus number. This means, the PCI core assumes that only one bus
will appear behind the Root Port since the Root Port is not hot plug
capable.
This works perfectly fine for PCIe endpoints connected to the Root Port,
since they don't extend the bus. However, if a PCIe switch is connected,
then there is a problem when the downstream busses starts showing up and
the PCI core doesn't extend the subordinate bus number and bridge resources
after initial scan during boot.
The long term plan is to migrate this driver to the upcoming pwrctrl APIs
that are supposed to handle this problem elegantly.
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251222064207.3246632-13-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 58 +-------------------------
1 file changed, 1 insertion(+), 57 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
index 39e5993d01e7c..cf1cc7279c10d 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -55,9 +55,6 @@
#define PARF_AXI_MSTR_WR_ADDR_HALT_V2 0x1a8
#define PARF_Q2A_FLUSH 0x1ac
#define PARF_LTSSM 0x1b0
-#define PARF_INT_ALL_STATUS 0x224
-#define PARF_INT_ALL_CLEAR 0x228
-#define PARF_INT_ALL_MASK 0x22c
#define PARF_SID_OFFSET 0x234
#define PARF_BDF_TRANSLATE_CFG 0x24c
#define PARF_DBI_BASE_ADDR_V2 0x350
@@ -134,9 +131,6 @@
/* PARF_LTSSM register fields */
#define LTSSM_EN BIT(8)
-/* PARF_INT_ALL_{STATUS/CLEAR/MASK} register fields */
-#define PARF_INT_ALL_LINK_UP BIT(13)
-
/* PARF_NO_SNOOP_OVERRIDE register fields */
#define WR_NO_SNOOP_OVERRIDE_EN BIT(1)
#define RD_NO_SNOOP_OVERRIDE_EN BIT(3)
@@ -1634,32 +1628,6 @@ static void qcom_pcie_init_debugfs(struct qcom_pcie *pcie)
qcom_pcie_link_transition_count);
}
-static irqreturn_t qcom_pcie_global_irq_thread(int irq, void *data)
-{
- struct qcom_pcie *pcie = data;
- struct dw_pcie_rp *pp = &pcie->pci->pp;
- struct device *dev = pcie->pci->dev;
- u32 status = readl_relaxed(pcie->parf + PARF_INT_ALL_STATUS);
-
- writel_relaxed(status, pcie->parf + PARF_INT_ALL_CLEAR);
-
- if (FIELD_GET(PARF_INT_ALL_LINK_UP, status)) {
- msleep(PCIE_RESET_CONFIG_WAIT_MS);
- dev_dbg(dev, "Received Link up event. Starting enumeration!\n");
- /* Rescan the bus to enumerate endpoint devices */
- pci_lock_rescan_remove();
- pci_rescan_bus(pp->bridge->bus);
- pci_unlock_rescan_remove();
-
- qcom_pcie_icc_opp_update(pcie);
- } else {
- dev_WARN_ONCE(dev, 1, "Received unknown event. INT_STATUS: 0x%08x\n",
- status);
- }
-
- return IRQ_HANDLED;
-}
-
static void qcom_pci_free_msi(void *ptr)
{
struct dw_pcie_rp *pp = (struct dw_pcie_rp *)ptr;
@@ -1804,8 +1772,7 @@ static int qcom_pcie_probe(struct platform_device *pdev)
struct dw_pcie_rp *pp;
struct resource *res;
struct dw_pcie *pci;
- int ret, irq;
- char *name;
+ int ret;
pcie_cfg = of_device_get_match_data(dev);
if (!pcie_cfg) {
@@ -1962,27 +1929,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
goto err_phy_exit;
}
- name = devm_kasprintf(dev, GFP_KERNEL, "qcom_pcie_global_irq%d",
- pci_domain_nr(pp->bridge->bus));
- if (!name) {
- ret = -ENOMEM;
- goto err_host_deinit;
- }
-
- irq = platform_get_irq_byname_optional(pdev, "global");
- if (irq > 0) {
- ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
- qcom_pcie_global_irq_thread,
- IRQF_ONESHOT, name, pcie);
- if (ret) {
- dev_err_probe(&pdev->dev, ret,
- "Failed to request Global IRQ\n");
- goto err_host_deinit;
- }
-
- writel_relaxed(PARF_INT_ALL_LINK_UP, pcie->parf + PARF_INT_ALL_MASK);
- }
-
qcom_pcie_icc_opp_update(pcie);
if (pcie->mhi)
@@ -1990,8 +1936,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
return 0;
-err_host_deinit:
- dw_pcie_host_deinit(pp);
err_phy_exit:
list_for_each_entry_safe(port, tmp, &pcie->ports, list) {
phy_exit(port->phy);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 532/844] Revert "PCI: dwc: Don't wait for link up if driver can detect Link Up event"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (530 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 531/844] Revert "PCI: qcom: Enumerate endpoints based on Link up event in 'global_irq' interrupt" Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 533/844] PCI: Use resource_set_range() that correctly sets ->end Sasha Levin
` (320 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 142d5869f6eec3110adda0ad2d931f5b3c22371d ]
This reverts commit 8d3bf19f1b585a3cc0027f508b64c33484db8d0d.
While this fake hotplugging was a nice idea, it has shown that this feature
does not handle PCIe switches correctly:
pci_bus 0004:43: busn_res: can not insert [bus 43-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:43: busn_res: [bus 43-41] end is updated to 43
pci_bus 0004:43: busn_res: can not insert [bus 43] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:00.0: devices behind bridge are unusable because [bus 43] cannot be assigned for them
pci_bus 0004:44: busn_res: can not insert [bus 44-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:44: busn_res: [bus 44-41] end is updated to 44
pci_bus 0004:44: busn_res: can not insert [bus 44] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:02.0: devices behind bridge are unusable because [bus 44] cannot be assigned for them
pci_bus 0004:45: busn_res: can not insert [bus 45-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:45: busn_res: [bus 45-41] end is updated to 45
pci_bus 0004:45: busn_res: can not insert [bus 45] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:06.0: devices behind bridge are unusable because [bus 45] cannot be assigned for them
pci_bus 0004:46: busn_res: can not insert [bus 46-41] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci_bus 0004:46: busn_res: [bus 46-41] end is updated to 46
pci_bus 0004:46: busn_res: can not insert [bus 46] under [bus 42-41] (conflicts with (null) [bus 42-41])
pci 0004:42:0e.0: devices behind bridge are unusable because [bus 46] cannot be assigned for them
pci_bus 0004:42: busn_res: [bus 42-41] end is updated to 46
pci_bus 0004:42: busn_res: can not insert [bus 42-46] under [bus 41] (conflicts with (null) [bus 41])
pci 0004:41:00.0: devices behind bridge are unusable because [bus 42-46] cannot be assigned for them
pcieport 0004:40:00.0: bridge has subordinate 41 but max busn 46
During the initial scan, PCI core doesn't see the switch and since the Root
Port is not hot plug capable, the secondary bus number gets assigned as the
subordinate bus number. This means, the PCI core assumes that only one bus
will appear behind the Root Port since the Root Port is not hot plug
capable.
This works perfectly fine for PCIe endpoints connected to the Root Port,
since they don't extend the bus. However, if a PCIe switch is connected,
then there is a problem when the downstream busses starts showing up and
the PCI core doesn't extend the subordinate bus number and bridge resources
after initial scan during boot.
So revert the change that skipped dw_pcie_wait_for_link() if the Link up
IRQ was used by a vendor glue driver.
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251222064207.3246632-14-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-designware-host.c | 10 ++--------
drivers/pci/controller/dwc/pcie-designware.h | 1 -
2 files changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 250725ced9026..f1c7d50eba746 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -665,14 +665,8 @@ int dw_pcie_host_init(struct dw_pcie_rp *pp)
goto err_remove_edma;
}
- /*
- * Note: Skip the link up delay only when a Link Up IRQ is present.
- * If there is no Link Up IRQ, we should not bypass the delay
- * because that would require users to manually rescan for devices.
- */
- if (!pp->use_linkup_irq)
- /* Ignore errors, the link may come up later */
- dw_pcie_wait_for_link(pci);
+ /* Ignore errors, the link may come up later */
+ dw_pcie_wait_for_link(pci);
ret = pci_host_probe(bridge);
if (ret)
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index ed1801dd8e39a..6f0dfdde1d577 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -442,7 +442,6 @@ struct dw_pcie_rp {
bool use_atu_msg;
int msg_atu_index;
struct resource *msg_res;
- bool use_linkup_irq;
struct pci_eq_presets presets;
struct pci_config_window *cfg;
bool ecam_enabled;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 533/844] PCI: Use resource_set_range() that correctly sets ->end
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (531 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 532/844] Revert "PCI: dwc: Don't wait for link up if driver can detect Link Up event" Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 534/844] net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels Sasha Levin
` (319 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilpo Järvinen, Bjorn Helgaas, Andy Shevchenko,
Christian Marangi, Sasha Levin
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 11721c45a8266a9d0c9684153d20e37159465f96 ]
__pci_read_base() sets resource start and end addresses when resource
is larger than 4G but pci_bus_addr_t or resource_size_t are not capable
of representing 64-bit PCI addresses. This creates a problematic
resource that has non-zero flags but the start and end addresses do not
yield to resource size of 0 but 1.
Replace custom resource addresses setup with resource_set_range()
that correctly sets end address as -1 which results in resource_size()
returning 0.
For consistency, also use resource_set_range() in the other branch that
does size based resource setup.
Fixes: 23b13bc76f35 ("PCI: Fail safely if we can't handle BARs larger than 4GB")
Link: https://lore.kernel.org/all/20251207215359.28895-1-ansuelsmth@gmail.com/T/#m990492684913c5a158ff0e5fc90697d8ad95351b
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: stable@vger.kernel.org
Cc: Christian Marangi <ansuelsmth@gmail.com>
Link: https://patch.msgid.link/20251208145654.5294-1-ilpo.jarvinen@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/probe.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c791bca2891f6..cd1cd044aaf9d 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -287,8 +287,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
if ((sizeof(pci_bus_addr_t) < 8 || sizeof(resource_size_t) < 8)
&& sz64 > 0x100000000ULL) {
res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED;
- res->start = 0;
- res->end = 0;
+ resource_set_range(res, 0, 0);
pci_err(dev, "%s: can't handle BAR larger than 4GB (size %#010llx)\n",
res_name, (unsigned long long)sz64);
goto out;
@@ -297,8 +296,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
if ((sizeof(pci_bus_addr_t) < 8) && l) {
/* Above 32-bit boundary; try to reallocate */
res->flags |= IORESOURCE_UNSET;
- res->start = 0;
- res->end = sz64 - 1;
+ resource_set_range(res, 0, sz64);
pci_info(dev, "%s: can't handle BAR above 4GB (bus address %#010llx)\n",
res_name, (unsigned long long)l64);
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 534/844] net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (532 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 533/844] PCI: Use resource_set_range() that correctly sets ->end Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 535/844] phy: qcom: edp: Make the number of clocks flexible Sasha Levin
` (318 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Manivannan Sadhasivam, Johan Hovold, Chris Lew, Jeff Hugo,
Loic Poulain, Jeff Johnson, Paolo Abeni, Sasha Levin
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 51731792a25cb312ca94cdccfa139eb46de1b2ef ]
MHI stack offers the 'auto_queue' feature, which allows the MHI stack to
auto queue the buffers for the RX path (DL channel). Though this feature
simplifies the client driver design, it introduces race between the client
drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback'
for the DL channel may get called before the client driver is fully probed.
This means, by the time the dl_callback gets called, the client driver's
structures might not be initialized, leading to NULL ptr dereference.
Currently, the drivers have to workaround this issue by initializing the
internal structures before calling mhi_prepare_for_transfer_autoqueue().
But even so, there is a chance that the client driver's internal code path
may call the MHI queue APIs before mhi_prepare_for_transfer_autoqueue() is
called, leading to similar NULL ptr dereference. This issue has been
reported on the Qcom X1E80100 CRD machines affecting boot.
So to properly fix all these races, drop the MHI 'auto_queue' feature
altogether and let the client driver (QRTR) manage the RX buffers manually.
In the QRTR driver, queue the RX buffers based on the ring length during
probe and recycle the buffers in 'dl_callback' once they are consumed. This
also warrants removing the setting of 'auto_queue' flag from controller
drivers.
Currently, this 'auto_queue' feature is only enabled for IPCR DL channel.
So only the QRTR client driver requires the modification.
Fixes: 227fee5fc99e ("bus: mhi: core: Add an API for auto queueing buffers for DL channel")
Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation")
Reported-by: Johan Hovold <johan@kernel.org>
Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com
Suggested-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Acked-by: Jeff Johnson <jjohnson@kernel.org> # drivers/net/wireless/ath/...
Acked-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251218-qrtr-fix-v2-1-c7499bfcfbe0@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/qaic/mhi_controller.c | 44 -----------------
drivers/bus/mhi/host/pci_generic.c | 20 +-------
drivers/net/wireless/ath/ath11k/mhi.c | 4 --
drivers/net/wireless/ath/ath12k/mhi.c | 4 --
net/qrtr/mhi.c | 69 ++++++++++++++++++++++-----
5 files changed, 60 insertions(+), 81 deletions(-)
diff --git a/drivers/accel/qaic/mhi_controller.c b/drivers/accel/qaic/mhi_controller.c
index 13a14c6c61689..4d787f77ce419 100644
--- a/drivers/accel/qaic/mhi_controller.c
+++ b/drivers/accel/qaic/mhi_controller.c
@@ -39,7 +39,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -55,7 +54,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -71,7 +69,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -87,7 +84,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -103,7 +99,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -119,7 +114,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -135,7 +129,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -151,7 +144,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -167,7 +159,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -183,7 +174,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -199,7 +189,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -215,7 +204,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -231,7 +219,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -247,7 +234,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -263,7 +249,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -279,7 +264,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -295,7 +279,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -311,7 +294,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -327,7 +309,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -343,7 +324,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -359,7 +339,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -375,7 +354,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -391,7 +369,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -407,7 +384,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -423,7 +399,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -439,7 +414,6 @@ static const struct mhi_channel_config aic100_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = true,
.wake_capable = false,
},
};
@@ -458,7 +432,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -474,7 +447,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -490,7 +462,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -506,7 +477,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -522,7 +492,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -538,7 +507,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -554,7 +522,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -570,7 +537,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -586,7 +552,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -602,7 +567,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -618,7 +582,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -634,7 +597,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -650,7 +612,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -666,7 +627,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -682,7 +642,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -698,7 +657,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -714,7 +672,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
.wake_capable = false,
},
{
@@ -730,7 +687,6 @@ static const struct mhi_channel_config aic200_channels[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = true,
.wake_capable = false,
},
};
diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c
index e3bc737313a2f..0884a384b77fc 100644
--- a/drivers/bus/mhi/host/pci_generic.c
+++ b/drivers/bus/mhi/host/pci_generic.c
@@ -94,22 +94,6 @@ struct mhi_pci_dev_info {
.doorbell_mode_switch = false, \
}
-#define MHI_CHANNEL_CONFIG_DL_AUTOQUEUE(ch_num, ch_name, el_count, ev_ring) \
- { \
- .num = ch_num, \
- .name = ch_name, \
- .num_elements = el_count, \
- .event_ring = ev_ring, \
- .dir = DMA_FROM_DEVICE, \
- .ee_mask = BIT(MHI_EE_AMSS), \
- .pollcfg = 0, \
- .doorbell = MHI_DB_BRST_DISABLE, \
- .lpm_notify = false, \
- .offload_channel = false, \
- .doorbell_mode_switch = false, \
- .auto_queue = true, \
- }
-
#define MHI_EVENT_CONFIG_CTRL(ev_ring, el_count) \
{ \
.num_elements = el_count, \
@@ -329,7 +313,7 @@ static const struct mhi_channel_config modem_qcom_v1_mhi_channels[] = {
MHI_CHANNEL_CONFIG_UL(14, "QMI", 4, 0),
MHI_CHANNEL_CONFIG_DL(15, "QMI", 4, 0),
MHI_CHANNEL_CONFIG_UL(20, "IPCR", 8, 0),
- MHI_CHANNEL_CONFIG_DL_AUTOQUEUE(21, "IPCR", 8, 0),
+ MHI_CHANNEL_CONFIG_DL(21, "IPCR", 8, 0),
MHI_CHANNEL_CONFIG_UL_FP(34, "FIREHOSE", 32, 0),
MHI_CHANNEL_CONFIG_DL_FP(35, "FIREHOSE", 32, 0),
MHI_CHANNEL_CONFIG_UL(46, "IP_SW0", 64, 2),
@@ -762,7 +746,7 @@ static const struct mhi_channel_config mhi_telit_fn980_hw_v1_channels[] = {
MHI_CHANNEL_CONFIG_UL(14, "QMI", 32, 0),
MHI_CHANNEL_CONFIG_DL(15, "QMI", 32, 0),
MHI_CHANNEL_CONFIG_UL(20, "IPCR", 16, 0),
- MHI_CHANNEL_CONFIG_DL_AUTOQUEUE(21, "IPCR", 16, 0),
+ MHI_CHANNEL_CONFIG_DL(21, "IPCR", 16, 0),
MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0", 128, 1),
MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0", 128, 2),
};
diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c
index acd76e9392d31..d2c44f7f9b622 100644
--- a/drivers/net/wireless/ath/ath11k/mhi.c
+++ b/drivers/net/wireless/ath/ath11k/mhi.c
@@ -34,7 +34,6 @@ static const struct mhi_channel_config ath11k_mhi_channels_qca6390[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
},
{
.num = 21,
@@ -48,7 +47,6 @@ static const struct mhi_channel_config ath11k_mhi_channels_qca6390[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = true,
},
};
@@ -99,7 +97,6 @@ static const struct mhi_channel_config ath11k_mhi_channels_qcn9074[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
},
{
.num = 21,
@@ -113,7 +110,6 @@ static const struct mhi_channel_config ath11k_mhi_channels_qcn9074[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = true,
},
};
diff --git a/drivers/net/wireless/ath/ath12k/mhi.c b/drivers/net/wireless/ath/ath12k/mhi.c
index 08f44baf182a5..2dbdb95ae7bea 100644
--- a/drivers/net/wireless/ath/ath12k/mhi.c
+++ b/drivers/net/wireless/ath/ath12k/mhi.c
@@ -31,7 +31,6 @@ static const struct mhi_channel_config ath12k_mhi_channels_qcn9274[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
},
{
.num = 21,
@@ -45,7 +44,6 @@ static const struct mhi_channel_config ath12k_mhi_channels_qcn9274[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = true,
},
};
@@ -96,7 +94,6 @@ static const struct mhi_channel_config ath12k_mhi_channels_wcn7850[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = false,
},
{
.num = 21,
@@ -110,7 +107,6 @@ static const struct mhi_channel_config ath12k_mhi_channels_wcn7850[] = {
.lpm_notify = false,
.offload_channel = false,
.doorbell_mode_switch = false,
- .auto_queue = true,
},
};
diff --git a/net/qrtr/mhi.c b/net/qrtr/mhi.c
index 69f53625a049d..80e341d2f8a45 100644
--- a/net/qrtr/mhi.c
+++ b/net/qrtr/mhi.c
@@ -24,13 +24,25 @@ static void qcom_mhi_qrtr_dl_callback(struct mhi_device *mhi_dev,
struct qrtr_mhi_dev *qdev = dev_get_drvdata(&mhi_dev->dev);
int rc;
- if (!qdev || mhi_res->transaction_status)
+ if (!qdev || (mhi_res->transaction_status && mhi_res->transaction_status != -ENOTCONN))
return;
+ /* Channel got reset. So just free the buffer */
+ if (mhi_res->transaction_status == -ENOTCONN) {
+ devm_kfree(&mhi_dev->dev, mhi_res->buf_addr);
+ return;
+ }
+
rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr,
mhi_res->bytes_xferd);
if (rc == -EINVAL)
dev_err(qdev->dev, "invalid ipcrouter packet\n");
+
+ /* Done with the buffer, now recycle it for future use */
+ rc = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, mhi_res->buf_addr,
+ mhi_dev->mhi_cntrl->buffer_len, MHI_EOT);
+ if (rc)
+ dev_err(&mhi_dev->dev, "Failed to recycle the buffer: %d\n", rc);
}
/* From QRTR to MHI */
@@ -72,6 +84,29 @@ static int qcom_mhi_qrtr_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
return rc;
}
+static int qcom_mhi_qrtr_queue_dl_buffers(struct mhi_device *mhi_dev)
+{
+ u32 free_desc;
+ void *buf;
+ int ret;
+
+ free_desc = mhi_get_free_desc_count(mhi_dev, DMA_FROM_DEVICE);
+ while (free_desc--) {
+ buf = devm_kmalloc(&mhi_dev->dev, mhi_dev->mhi_cntrl->buffer_len, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ ret = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, buf, mhi_dev->mhi_cntrl->buffer_len,
+ MHI_EOT);
+ if (ret) {
+ dev_err(&mhi_dev->dev, "Failed to queue buffer: %d\n", ret);
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
const struct mhi_device_id *id)
{
@@ -87,20 +122,30 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
qdev->ep.xmit = qcom_mhi_qrtr_send;
dev_set_drvdata(&mhi_dev->dev, qdev);
- rc = qrtr_endpoint_register(&qdev->ep, QRTR_EP_NID_AUTO);
- if (rc)
- return rc;
/* start channels */
- rc = mhi_prepare_for_transfer_autoqueue(mhi_dev);
- if (rc) {
- qrtr_endpoint_unregister(&qdev->ep);
+ rc = mhi_prepare_for_transfer(mhi_dev);
+ if (rc)
return rc;
- }
+
+ rc = qrtr_endpoint_register(&qdev->ep, QRTR_EP_NID_AUTO);
+ if (rc)
+ goto err_unprepare;
+
+ rc = qcom_mhi_qrtr_queue_dl_buffers(mhi_dev);
+ if (rc)
+ goto err_unregister;
dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n");
return 0;
+
+err_unregister:
+ qrtr_endpoint_unregister(&qdev->ep);
+err_unprepare:
+ mhi_unprepare_from_transfer(mhi_dev);
+
+ return rc;
}
static void qcom_mhi_qrtr_remove(struct mhi_device *mhi_dev)
@@ -151,11 +196,13 @@ static int __maybe_unused qcom_mhi_qrtr_pm_resume_early(struct device *dev)
if (state == MHI_STATE_M3)
return 0;
- rc = mhi_prepare_for_transfer_autoqueue(mhi_dev);
- if (rc)
+ rc = mhi_prepare_for_transfer(mhi_dev);
+ if (rc) {
dev_err(dev, "failed to prepare for autoqueue transfer %d\n", rc);
+ return rc;
+ }
- return rc;
+ return qcom_mhi_qrtr_queue_dl_buffers(mhi_dev);
}
static const struct dev_pm_ops qcom_mhi_qrtr_pm_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 535/844] phy: qcom: edp: Make the number of clocks flexible
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (533 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 534/844] net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 536/844] arm64: dts: qcom: sdm630: Add missing MDSS reset Sasha Levin
` (317 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Abel Vesa, Dmitry Baryshkov, Bjorn Andersson, Vinod Koul,
Sasha Levin
From: Abel Vesa <abel.vesa@linaro.org>
[ Upstream commit 7d51b709262c5aa31d2b9cd31444112c1b2dae03 ]
On X Elite, the DP PHY needs another clock called ref, while all other
platforms do not.
The current X Elite devices supported upstream work fine without this
clock, because the boot firmware leaves this clock enabled. But we should
not rely on that. Also, even though this change breaks the ABI, it is
needed in order to make the driver disables this clock along with the
other ones, for a proper bring-down of the entire PHY.
So in order to handle these clocks on different platforms, make the driver
get all the clocks regardless of how many there are provided.
Cc: stable@vger.kernel.org # v6.10
Fixes: db83c107dc29 ("phy: qcom: edp: Add v6 specific ops and X1E80100 platform support")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://patch.msgid.link/20251224-phy-qcom-edp-add-missing-refclk-v5-2-3f45d349b5ac@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-edp.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-edp.c b/drivers/phy/qualcomm/phy-qcom-edp.c
index f1b51018683d5..06a08c9ea0f70 100644
--- a/drivers/phy/qualcomm/phy-qcom-edp.c
+++ b/drivers/phy/qualcomm/phy-qcom-edp.c
@@ -103,7 +103,9 @@ struct qcom_edp {
struct phy_configure_opts_dp dp_opts;
- struct clk_bulk_data clks[2];
+ struct clk_bulk_data *clks;
+ int num_clks;
+
struct regulator_bulk_data supplies[2];
bool is_edp;
@@ -218,7 +220,7 @@ static int qcom_edp_phy_init(struct phy *phy)
if (ret)
return ret;
- ret = clk_bulk_prepare_enable(ARRAY_SIZE(edp->clks), edp->clks);
+ ret = clk_bulk_prepare_enable(edp->num_clks, edp->clks);
if (ret)
goto out_disable_supplies;
@@ -885,7 +887,7 @@ static int qcom_edp_phy_exit(struct phy *phy)
{
struct qcom_edp *edp = phy_get_drvdata(phy);
- clk_bulk_disable_unprepare(ARRAY_SIZE(edp->clks), edp->clks);
+ clk_bulk_disable_unprepare(edp->num_clks, edp->clks);
regulator_bulk_disable(ARRAY_SIZE(edp->supplies), edp->supplies);
return 0;
@@ -1092,11 +1094,9 @@ static int qcom_edp_phy_probe(struct platform_device *pdev)
if (IS_ERR(edp->pll))
return PTR_ERR(edp->pll);
- edp->clks[0].id = "aux";
- edp->clks[1].id = "cfg_ahb";
- ret = devm_clk_bulk_get(dev, ARRAY_SIZE(edp->clks), edp->clks);
- if (ret)
- return ret;
+ edp->num_clks = devm_clk_bulk_get_all(dev, &edp->clks);
+ if (edp->num_clks < 0)
+ return dev_err_probe(dev, edp->num_clks, "failed to get clocks\n");
edp->supplies[0].supply = "vdda-phy";
edp->supplies[1].supply = "vdda-pll";
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 536/844] arm64: dts: qcom: sdm630: Add missing MDSS reset
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (534 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 535/844] phy: qcom: edp: Make the number of clocks flexible Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 537/844] dm-verity: correctly handle dm_bufio_client_create() failure Sasha Levin
` (316 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexey Minnekhanov, Dmitry Baryshkov, Bjorn Andersson,
Sasha Levin
From: Alexey Minnekhanov <alexeymin@postmarketos.org>
[ Upstream commit 0c1d1591f898d54eaa4c8f2a1535ab21bf4e42e4 ]
If the OS does not support recovering the state left by the
bootloader it needs a way to reset display hardware, so that it can
start from a clean state. Add a reference to the relevant reset.
It fixes display init issue appeared in Linux v6.17: without reset
device boots into black screen and you need to turn display off/on
to "fix" it. Also sometimes it can boot into solid blue color
with these messages in kernel log:
hw recovery is not complete for ctl:2
[drm:dpu_encoder_phys_vid_prepare_for_kickoff:569] [dpu error]enc33
intf1 ctl 2 reset failure: -22
[drm:dpu_encoder_frame_done_timeout:2727] [dpu error]enc33 frame
done timeout
Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state")
Cc: stable@vger.kernel.org # 6.17
Signed-off-by: Alexey Minnekhanov <alexeymin@postmarketos.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251116-sdm660-mdss-reset-v2-3-6219bec0a97f@postmarketos.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm630.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
index b383e480a394d..876a6871745cf 100644
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -1563,6 +1563,7 @@ mdss: display-subsystem@c900000 {
reg-names = "mdss_phys", "vbif_phys";
power-domains = <&mmcc MDSS_GDSC>;
+ resets = <&mmcc MDSS_BCR>;
clocks = <&mmcc MDSS_AHB_CLK>,
<&mmcc MDSS_AXI_CLK>,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 537/844] dm-verity: correctly handle dm_bufio_client_create() failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (535 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 536/844] arm64: dts: qcom: sdm630: Add missing MDSS reset Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 538/844] media: uvcvideo: Fix support for V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX Sasha Levin
` (315 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Biggers, Sami Tolvanen, Mikulas Patocka, Sasha Levin
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit 119f4f04186fa4f33ee6bd39af145cdaff1ff17f ]
If either of the calls to dm_bufio_client_create() in verity_fec_ctr()
fails, then dm_bufio_client_destroy() is later called with an ERR_PTR()
argument. That causes a crash. Fix this.
Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
Cc: stable@vger.kernel.org
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-verity-fec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
index c79de517afee7..0ac98a620f3ac 100644
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -534,9 +534,9 @@ void verity_fec_dtr(struct dm_verity *v)
mempool_exit(&f->output_pool);
kmem_cache_destroy(f->cache);
- if (f->data_bufio)
+ if (!IS_ERR_OR_NULL(f->data_bufio))
dm_bufio_client_destroy(f->data_bufio);
- if (f->bufio)
+ if (!IS_ERR_OR_NULL(f->bufio))
dm_bufio_client_destroy(f->bufio);
if (f->dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 538/844] media: uvcvideo: Fix support for V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (536 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 537/844] dm-verity: correctly handle dm_bufio_client_create() failure Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 539/844] media: mediatek: encoder: Fix uninitialized scalar variable issue Sasha Levin
` (314 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ricardo Ribalda, Hans de Goede, Hans Verkuil, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 4238bd6dc6ba36f44d89a60338223d5a4f708cbf ]
The VIDIOC_G_EXT_CTRLS with which V4L2_CTRL_WHICH_(MIN|MAX)_VAL can only
work for controls that have previously announced support for it.
This patch fixes the following v4l2-compliance error:
info: checking extended control 'User Controls' (0x00980001)
fail: v4l2-test-controls.cpp(980): ret != EINVAL (got 13)
test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL
Fixes: 39d2c891c96e ("media: uvcvideo: support V4L2_CTRL_WHICH_MIN/MAX_VAL")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 14 ++++++++++++--
drivers/media/usb/uvc/uvc_v4l2.c | 10 ++++++----
drivers/media/usb/uvc/uvcvideo.h | 2 +-
3 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 2905505c240c0..2738ef74c7373 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1432,7 +1432,7 @@ static bool uvc_ctrl_is_readable(u32 which, struct uvc_control *ctrl,
* auto_exposure=1, exposure_time_absolute=251.
*/
int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
- const struct v4l2_ext_controls *ctrls,
+ const struct v4l2_ext_controls *ctrls, u32 which,
unsigned long ioctl)
{
struct uvc_control_mapping *master_map = NULL;
@@ -1442,14 +1442,24 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
s32 val;
int ret;
int i;
+ /*
+ * There is no need to check the ioctl, all the ioctls except
+ * VIDIOC_G_EXT_CTRLS use which=V4L2_CTRL_WHICH_CUR_VAL.
+ */
+ bool is_which_min_max = which == V4L2_CTRL_WHICH_MIN_VAL ||
+ which == V4L2_CTRL_WHICH_MAX_VAL;
if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0)
- return -EACCES;
+ return is_which_min_max ? -EINVAL : -EACCES;
ctrl = uvc_find_control(chain, v4l2_id, &mapping);
if (!ctrl)
return -EINVAL;
+ if ((!(ctrl->info.flags & UVC_CTRL_FLAG_GET_MIN) ||
+ !(ctrl->info.flags & UVC_CTRL_FLAG_GET_MAX)) && is_which_min_max)
+ return -EINVAL;
+
if (ioctl == VIDIOC_G_EXT_CTRLS)
return uvc_ctrl_is_readable(ctrls->which, ctrl, mapping);
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 9e4a251eca880..30c160daed8cb 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -765,14 +765,15 @@ static int uvc_ioctl_query_ext_ctrl(struct file *file, void *priv,
static int uvc_ctrl_check_access(struct uvc_video_chain *chain,
struct v4l2_ext_controls *ctrls,
- unsigned long ioctl)
+ u32 which, unsigned long ioctl)
{
struct v4l2_ext_control *ctrl = ctrls->controls;
unsigned int i;
int ret = 0;
for (i = 0; i < ctrls->count; ++ctrl, ++i) {
- ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, ioctl);
+ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, which,
+ ioctl);
if (ret)
break;
}
@@ -806,7 +807,7 @@ static int uvc_ioctl_g_ext_ctrls(struct file *file, void *priv,
which = V4L2_CTRL_WHICH_CUR_VAL;
}
- ret = uvc_ctrl_check_access(chain, ctrls, VIDIOC_G_EXT_CTRLS);
+ ret = uvc_ctrl_check_access(chain, ctrls, which, VIDIOC_G_EXT_CTRLS);
if (ret < 0)
return ret;
@@ -840,7 +841,8 @@ static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle,
if (!ctrls->count)
return 0;
- ret = uvc_ctrl_check_access(chain, ctrls, ioctl);
+ ret = uvc_ctrl_check_access(chain, ctrls, V4L2_CTRL_WHICH_CUR_VAL,
+ ioctl);
if (ret < 0)
return ret;
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 3f2e832025e71..8480d65ecb85e 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -787,7 +787,7 @@ int uvc_ctrl_get(struct uvc_video_chain *chain, u32 which,
struct v4l2_ext_control *xctrl);
int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl);
int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id,
- const struct v4l2_ext_controls *ctrls,
+ const struct v4l2_ext_controls *ctrls, u32 which,
unsigned long ioctl);
int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 539/844] media: mediatek: encoder: Fix uninitialized scalar variable issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (537 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 538/844] media: uvcvideo: Fix support for V4L2_CTRL_FLAG_HAS_WHICH_MIN_MAX Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 540/844] media: mtk-mdp: Fix error handling in probe function Sasha Levin
` (313 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Irui Wang, AngeloGioacchino Del Regno, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
From: Irui Wang <irui.wang@mediatek.com>
[ Upstream commit 88e935de7cf8795d7a6a51385db87ecb361a7050 ]
UNINIT checker finds some instances of variables that are used
without being initialized, for example using the uninitialized
value enc_result.is_key_frm can result in unpredictable behavior,
so initialize these variables after declaring.
Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Irui Wang <irui.wang@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc.c
index 6faf3f659e751..b3a0a1d8b7a8e 100644
--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc.c
+++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc.c
@@ -850,7 +850,7 @@ static void vb2ops_venc_buf_queue(struct vb2_buffer *vb)
static int vb2ops_venc_start_streaming(struct vb2_queue *q, unsigned int count)
{
struct mtk_vcodec_enc_ctx *ctx = vb2_get_drv_priv(q);
- struct venc_enc_param param;
+ struct venc_enc_param param = { };
int ret;
int i;
@@ -1004,7 +1004,7 @@ static int mtk_venc_encode_header(void *priv)
int ret;
struct vb2_v4l2_buffer *src_buf, *dst_buf;
struct mtk_vcodec_mem bs_buf;
- struct venc_done_result enc_result;
+ struct venc_done_result enc_result = { };
dst_buf = v4l2_m2m_dst_buf_remove(ctx->m2m_ctx);
if (!dst_buf) {
@@ -1125,7 +1125,7 @@ static void mtk_venc_worker(struct work_struct *work)
struct vb2_v4l2_buffer *src_buf, *dst_buf;
struct venc_frm_buf frm_buf;
struct mtk_vcodec_mem bs_buf;
- struct venc_done_result enc_result;
+ struct venc_done_result enc_result = { };
int ret, i;
/* check dst_buf, dst_buf may be removed in device_run
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 540/844] media: mtk-mdp: Fix error handling in probe function
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (538 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 539/844] media: mediatek: encoder: Fix uninitialized scalar variable issue Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 541/844] media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() Sasha Levin
` (312 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Haoxiang Li, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Haoxiang Li <haoxiang_li2024@163.com>
[ Upstream commit 8a8a3232abac5b972058a5f2cb3e33199d2a8648 ]
Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent
resource leak.
Add check for the return value of vpu_get_plat_device() to prevent null
pointer dereference. And vpu_get_plat_device() increases the reference
count of the returned platform device. Add platform_device_put() to
prevent reference leak.
Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/mdp/mtk_mdp_core.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
index 80fdc6ff57e0e..f78fa30f18648 100644
--- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
+++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
@@ -194,11 +194,17 @@ static int mtk_mdp_probe(struct platform_device *pdev)
}
mdp->vpu_dev = vpu_get_plat_device(pdev);
+ if (!mdp->vpu_dev) {
+ dev_err(&pdev->dev, "Failed to get vpu device\n");
+ ret = -ENODEV;
+ goto err_vpu_get_dev;
+ }
+
ret = vpu_wdt_reg_handler(mdp->vpu_dev, mtk_mdp_reset_handler, mdp,
VPU_RST_MDP);
if (ret) {
dev_err(&pdev->dev, "Failed to register reset handler\n");
- goto err_m2m_register;
+ goto err_reg_handler;
}
platform_set_drvdata(pdev, mdp);
@@ -206,7 +212,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)
ret = vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
if (ret) {
dev_err(&pdev->dev, "Failed to set vb2 dma mag seg size\n");
- goto err_m2m_register;
+ goto err_reg_handler;
}
pm_runtime_enable(dev);
@@ -214,6 +220,12 @@ static int mtk_mdp_probe(struct platform_device *pdev)
return 0;
+err_reg_handler:
+ platform_device_put(mdp->vpu_dev);
+
+err_vpu_get_dev:
+ mtk_mdp_unregister_m2m_device(mdp);
+
err_m2m_register:
v4l2_device_unregister(&mdp->v4l2_dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 541/844] media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (539 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 540/844] media: mtk-mdp: Fix error handling in probe function Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 542/844] media: chips-media: wave5: Fix PM runtime usage count underflow Sasha Levin
` (311 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Haoxiang Li, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Haoxiang Li <haoxiang_li2024@163.com>
[ Upstream commit f128bab57b8018e526b7eda854ca20069863af47 ]
In mtk_mdp_probe(), vpu_get_plat_device() increases the reference
count of the returned platform device. Add platform_device_put()
to prevent reference leak.
Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mediatek/mdp/mtk_mdp_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
index f78fa30f18648..8432833814f31 100644
--- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
+++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
@@ -254,6 +254,7 @@ static void mtk_mdp_remove(struct platform_device *pdev)
pm_runtime_disable(&pdev->dev);
vb2_dma_contig_clear_max_seg_size(&pdev->dev);
+ platform_device_put(mdp->vpu_dev);
mtk_mdp_unregister_m2m_device(mdp);
v4l2_device_unregister(&mdp->v4l2_dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 542/844] media: chips-media: wave5: Fix PM runtime usage count underflow
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (540 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 541/844] media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 543/844] media: chips-media: wave5: Fix kthread worker destruction in polling mode Sasha Levin
` (310 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xulin Sun, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Xulin Sun <xulin.sun@windriver.com>
[ Upstream commit 9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38 ]
Replace pm_runtime_put_sync() with pm_runtime_dont_use_autosuspend() in
the remove path to properly pair with pm_runtime_use_autosuspend() from
probe. This allows pm_runtime_disable() to handle reference count cleanup
correctly regardless of current suspend state.
The driver calls pm_runtime_put_sync() unconditionally in remove, but the
device may already be suspended due to autosuspend configured in probe.
When autosuspend has already suspended the device, the usage count is 0,
and pm_runtime_put_sync() decrements it to -1.
This causes the following warning on module unload:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 963 at kernel/kthread.c:1430
kthread_destroy_worker+0x84/0x98
...
vdec 30210000.video-codec: Runtime PM usage count underflow!
Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index e1715d3f43b0d..23aa3ab51a0ef 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -356,7 +356,7 @@ static void wave5_vpu_remove(struct platform_device *pdev)
hrtimer_cancel(&dev->hrtimer);
}
- pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_disable(&pdev->dev);
mutex_destroy(&dev->dev_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 543/844] media: chips-media: wave5: Fix kthread worker destruction in polling mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (541 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 542/844] media: chips-media: wave5: Fix PM runtime usage count underflow Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 544/844] media: chips-media: wave5: Fix device cleanup order to prevent kernel panic Sasha Levin
` (309 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xulin Sun, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Xulin Sun <xulin.sun@windriver.com>
[ Upstream commit 5a0c122e834b2f7f029526422c71be922960bf03 ]
Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings
during module removal. Cancel the hrtimer before destroying the kthread
worker to ensure work queues are empty.
In polling mode, the driver uses hrtimer to periodically trigger
wave5_vpu_timer_callback() which queues work via kthread_queue_work().
The kthread_destroy_worker() function validates that both work queues
are empty with WARN_ON(!list_empty(&worker->work_list)) and
WARN_ON(!list_empty(&worker->delayed_work_list)).
The original code called kthread_destroy_worker() before hrtimer_cancel(),
creating a race condition where the timer could fire during worker
destruction and queue new work, triggering the WARN_ON.
This causes the following warning on every module unload in polling mode:
------------[ cut here ]------------
WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430
kthread_destroy_worker+0x84/0x98
Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...
Call trace:
kthread_destroy_worker+0x84/0x98
wave5_vpu_remove+0xc8/0xe0 [wave5]
platform_remove+0x30/0x58
...
---[ end trace 0000000000000000 ]---
Fixes: ed7276ed2fd0 ("media: chips-media: wave5: Add hrtimer based polling support")
Cc: stable@vger.kernel.org
Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 23aa3ab51a0ef..0bcd48df49d0f 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -352,8 +352,9 @@ static void wave5_vpu_remove(struct platform_device *pdev)
struct vpu_device *dev = dev_get_drvdata(&pdev->dev);
if (dev->irq < 0) {
- kthread_destroy_worker(dev->worker);
hrtimer_cancel(&dev->hrtimer);
+ kthread_cancel_work_sync(&dev->work);
+ kthread_destroy_worker(dev->worker);
}
pm_runtime_dont_use_autosuspend(&pdev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 544/844] media: chips-media: wave5: Fix device cleanup order to prevent kernel panic
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (542 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 543/844] media: chips-media: wave5: Fix kthread worker destruction in polling mode Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 545/844] media: chips-media: wave5: Fix SError of kernel panic when closed Sasha Levin
` (308 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xulin Sun, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Xulin Sun <xulin.sun@windriver.com>
[ Upstream commit b74cedac643b02aefa7da881b58a3792859d9748 ]
Move video device unregistration to the beginning of the remove function
to ensure all video operations are stopped before cleaning up the worker
thread and disabling PM runtime. This prevents hardware register access
after the device has been powered down.
In polling mode, the hrtimer periodically triggers
wave5_vpu_timer_callback() which queues work to the kthread worker.
The worker executes wave5_vpu_irq_work_fn() which reads hardware
registers via wave5_vdi_read_register().
The original cleanup order disabled PM runtime and powered down hardware
before unregistering video devices. When autosuspend triggers and powers
off the hardware, the video devices are still registered and the worker
thread can still be triggered by the hrtimer, causing it to attempt
reading registers from powered-off hardware. This results in a bus error
(synchronous external abort) and kernel panic.
This causes random kernel panics during encoding operations:
Internal error: synchronous external abort: 0000000096000010
[#1] PREEMPT SMP
Modules linked in: wave5 rpmsg_ctrl rpmsg_char ...
CPU: 0 UID: 0 PID: 1520 Comm: vpu_irq_thread
Tainted: G M W
pc : wave5_vdi_read_register+0x10/0x38 [wave5]
lr : wave5_vpu_irq_work_fn+0x28/0x60 [wave5]
Call trace:
wave5_vdi_read_register+0x10/0x38 [wave5]
kthread_worker_fn+0xd8/0x238
kthread+0x104/0x120
ret_from_fork+0x10/0x20
Code: aa1e03e9 d503201f f9416800 8b214000 (b9400000)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: synchronous external abort:
Fatal exception
Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 0bcd48df49d0f..77d6c934d0b9d 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -351,6 +351,10 @@ static void wave5_vpu_remove(struct platform_device *pdev)
{
struct vpu_device *dev = dev_get_drvdata(&pdev->dev);
+ wave5_vpu_enc_unregister_device(dev);
+ wave5_vpu_dec_unregister_device(dev);
+ v4l2_device_unregister(&dev->v4l2_dev);
+
if (dev->irq < 0) {
hrtimer_cancel(&dev->hrtimer);
kthread_cancel_work_sync(&dev->work);
@@ -364,9 +368,6 @@ static void wave5_vpu_remove(struct platform_device *pdev)
mutex_destroy(&dev->hw_lock);
reset_control_assert(dev->resets);
clk_bulk_disable_unprepare(dev->num_clks, dev->clks);
- wave5_vpu_enc_unregister_device(dev);
- wave5_vpu_dec_unregister_device(dev);
- v4l2_device_unregister(&dev->v4l2_dev);
wave5_vdi_release(&pdev->dev);
ida_destroy(&dev->inst_ida);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 545/844] media: chips-media: wave5: Fix SError of kernel panic when closed
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (543 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 544/844] media: chips-media: wave5: Fix device cleanup order to prevent kernel panic Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 546/844] media: chips-media: wave5: Fix Null reference while testing fluster Sasha Levin
` (307 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jackson Lee, Nas Chung, Nicolas Dufresne, Brandon Brnich,
Hans Verkuil, Sasha Levin
From: Jackson Lee <jackson.lee@chipsnmedia.com>
[ Upstream commit cbb9c0d50e471483cced55f5b7db4569dcd959a6 ]
SError of kernel panic rarely happened while testing fluster.
The root cause was to enter suspend mode because timeout of autosuspend
delay happened.
[ 48.834439] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError
[ 48.834455] CPU: 0 UID: 0 PID: 1067 Comm: v4l2h265dec0:sr Not tainted 6.12.9-gc9e21a1ebd75-dirty #7
[ 48.834461] Hardware name: ti Texas Instruments J721S2 EVM/Texas Instruments J721S2 EVM, BIOS 2025.01-00345-gbaf3aaa8ecfa 01/01/2025
[ 48.834464] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 48.834468] pc : wave5_dec_clr_disp_flag+0x40/0x80 [wave5]
[ 48.834488] lr : wave5_dec_clr_disp_flag+0x40/0x80 [wave5]
[ 48.834495] sp : ffff8000856e3a30
[ 48.834497] x29: ffff8000856e3a30 x28: ffff0008093f6010 x27: ffff000809158130
[ 48.834504] x26: 0000000000000000 x25: ffff00080b625000 x24: ffff000804a9ba80
[ 48.834509] x23: ffff000802343028 x22: ffff000809158150 x21: ffff000802218000
[ 48.834513] x20: ffff0008093f6000 x19: ffff0008093f6000 x18: 0000000000000000
[ 48.834518] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff74009618
[ 48.834523] x14: 000000010000000c x13: 0000000000000000 x12: 0000000000000000
[ 48.834527] x11: ffffffffffffffff x10: ffffffffffffffff x9 : ffff000802343028
[ 48.834532] x8 : ffff00080b6252a0 x7 : 0000000000000038 x6 : 0000000000000000
[ 48.834536] x5 : ffff00080b625060 x4 : 0000000000000000 x3 : 0000000000000000
[ 48.834541] x2 : 0000000000000000 x1 : ffff800084bf0118 x0 : ffff800084bf0000
[ 48.834547] Kernel panic - not syncing: Asynchronous SError Interrupt
[ 48.834549] CPU: 0 UID: 0 PID: 1067 Comm: v4l2h265dec0:sr Not tainted 6.12.9-gc9e21a1ebd75-dirty #7
[ 48.834554] Hardware name: ti Texas Instruments J721S2 EVM/Texas Instruments J721S2 EVM, BIOS 2025.01-00345-gbaf3aaa8ecfa 01/01/2025
[ 48.834556] Call trace:
[ 48.834559] dump_backtrace+0x94/0xec
[ 48.834574] show_stack+0x18/0x24
[ 48.834579] dump_stack_lvl+0x38/0x90
[ 48.834585] dump_stack+0x18/0x24
[ 48.834588] panic+0x35c/0x3e0
[ 48.834592] nmi_panic+0x40/0x8c
[ 48.834595] arm64_serror_panic+0x64/0x70
[ 48.834598] do_serror+0x3c/0x78
[ 48.834601] el1h_64_error_handler+0x34/0x4c
[ 48.834605] el1h_64_error+0x64/0x68
[ 48.834608] wave5_dec_clr_disp_flag+0x40/0x80 [wave5]
[ 48.834615] wave5_vpu_dec_clr_disp_flag+0x54/0x80 [wave5]
[ 48.834622] wave5_vpu_dec_buf_queue+0x19c/0x1a0 [wave5]
[ 48.834628] __enqueue_in_driver+0x3c/0x74 [videobuf2_common]
[ 48.834639] vb2_core_qbuf+0x508/0x61c [videobuf2_common]
[ 48.834646] vb2_qbuf+0xa4/0x168 [videobuf2_v4l2]
[ 48.834656] v4l2_m2m_qbuf+0x80/0x238 [v4l2_mem2mem]
[ 48.834666] v4l2_m2m_ioctl_qbuf+0x18/0x24 [v4l2_mem2mem]
[ 48.834673] v4l_qbuf+0x48/0x5c [videodev]
[ 48.834704] __video_do_ioctl+0x180/0x3f0 [videodev]
[ 48.834725] video_usercopy+0x2ec/0x68c [videodev]
[ 48.834745] video_ioctl2+0x18/0x24 [videodev]
[ 48.834766] v4l2_ioctl+0x40/0x60 [videodev]
[ 48.834786] __arm64_sys_ioctl+0xa8/0xec
[ 48.834793] invoke_syscall+0x44/0x100
[ 48.834800] el0_svc_common.constprop.0+0xc0/0xe0
[ 48.834804] do_el0_svc+0x1c/0x28
[ 48.834809] el0_svc+0x30/0xd0
[ 48.834813] el0t_64_sync_handler+0xc0/0xc4
[ 48.834816] el0t_64_sync+0x190/0x194
[ 48.834820] SMP: stopping secondary CPUs
[ 48.834831] Kernel Offset: disabled
[ 48.834833] CPU features: 0x08,00002002,80200000,4200421b
[ 48.834837] Memory Limit: none
[ 49.161404] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---
Fixes: 2092b3833487 ("media: chips-media: wave5: Support runtime suspend/resume")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson Lee <jackson.lee@chipsnmedia.com>
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Tested-by: Brandon Brnich <b-brnich@ti.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/chips-media/wave5/wave5-vpu-dec.c | 5 ++---
.../platform/chips-media/wave5/wave5-vpu-enc.c | 3 ---
.../media/platform/chips-media/wave5/wave5-vpu.c | 2 +-
.../platform/chips-media/wave5/wave5-vpuapi.c | 15 ---------------
4 files changed, 3 insertions(+), 22 deletions(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
index a4387ed58cac3..a90f00f589e04 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1243,6 +1243,7 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_buffer *vb)
struct vpu_instance *inst = vb2_get_drv_priv(vb->vb2_queue);
struct v4l2_m2m_ctx *m2m_ctx = inst->v4l2_fh.m2m_ctx;
+ pm_runtime_resume_and_get(inst->dev->dev);
vbuf->sequence = inst->queued_dst_buf_num++;
if (inst->state == VPU_INST_STATE_PIC_RUN) {
@@ -1275,6 +1276,7 @@ static void wave5_vpu_dec_buf_queue_dst(struct vb2_buffer *vb)
} else {
v4l2_m2m_buf_queue(m2m_ctx, vbuf);
}
+ pm_runtime_put_autosuspend(inst->dev->dev);
}
static void wave5_vpu_dec_buf_queue(struct vb2_buffer *vb)
@@ -1827,9 +1829,6 @@ static int wave5_vpu_open_dec(struct file *filp)
if (ret)
goto cleanup_inst;
- if (list_empty(&dev->instances))
- pm_runtime_use_autosuspend(inst->dev->dev);
-
list_add_tail(&inst->list, &dev->instances);
mutex_unlock(&dev->dev_lock);
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
index a254830e4009e..5388efa63f73d 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
@@ -1773,9 +1773,6 @@ static int wave5_vpu_open_enc(struct file *filp)
if (ret)
goto cleanup_inst;
- if (list_empty(&dev->instances))
- pm_runtime_use_autosuspend(inst->dev->dev);
-
list_add_tail(&inst->list, &dev->instances);
mutex_unlock(&dev->dev_lock);
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 77d6c934d0b9d..0026f58403620 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -322,7 +322,7 @@ static int wave5_vpu_probe(struct platform_device *pdev)
dev_info(&pdev->dev, "Product Code: 0x%x\n", dev->product_code);
dev_info(&pdev->dev, "Firmware Revision: %u\n", fw_revision);
- pm_runtime_set_autosuspend_delay(&pdev->dev, 100);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 500);
pm_runtime_use_autosuspend(&pdev->dev);
pm_runtime_enable(&pdev->dev);
wave5_vpu_sleep_wake(&pdev->dev, true, NULL, 0);
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
index e5e879a13e8b8..e94d6ebc9f816 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.c
@@ -207,8 +207,6 @@ int wave5_vpu_dec_close(struct vpu_instance *inst, u32 *fail_res)
int retry = 0;
struct vpu_device *vpu_dev = inst->dev;
int i;
- int inst_count = 0;
- struct vpu_instance *inst_elm;
*fail_res = 0;
if (!inst->codec_info)
@@ -250,11 +248,6 @@ int wave5_vpu_dec_close(struct vpu_instance *inst, u32 *fail_res)
wave5_vdi_free_dma_memory(vpu_dev, &p_dec_info->vb_task);
- list_for_each_entry(inst_elm, &vpu_dev->instances, list)
- inst_count++;
- if (inst_count == 1)
- pm_runtime_dont_use_autosuspend(vpu_dev->dev);
-
unlock_and_return:
mutex_unlock(&vpu_dev->hw_lock);
pm_runtime_put_sync(inst->dev->dev);
@@ -720,8 +713,6 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
int ret;
int retry = 0;
struct vpu_device *vpu_dev = inst->dev;
- int inst_count = 0;
- struct vpu_instance *inst_elm;
*fail_res = 0;
if (!inst->codec_info)
@@ -764,12 +755,6 @@ int wave5_vpu_enc_close(struct vpu_instance *inst, u32 *fail_res)
}
wave5_vdi_free_dma_memory(vpu_dev, &p_enc_info->vb_task);
-
- list_for_each_entry(inst_elm, &vpu_dev->instances, list)
- inst_count++;
- if (inst_count == 1)
- pm_runtime_dont_use_autosuspend(vpu_dev->dev);
-
mutex_unlock(&vpu_dev->hw_lock);
pm_runtime_put_sync(inst->dev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 546/844] media: chips-media: wave5: Fix Null reference while testing fluster
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (544 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 545/844] media: chips-media: wave5: Fix SError of kernel panic when closed Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 547/844] media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure Sasha Levin
` (306 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jackson Lee, Nas Chung, Brandon Brnich, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
From: Jackson Lee <jackson.lee@chipsnmedia.com>
[ Upstream commit e66ff2b08e4ee1c4d3b84f24818e5bcc178cc3a4 ]
When multi instances are created/destroyed, many interrupts happens
and structures for decoder are removed.
"struct vpu_instance" this structure is shared for all flow in the decoder,
so if the structure is not protected by lock, Null dereference
could happens sometimes.
IRQ Handler was spilt to two phases and Lock was added as well.
Fixes: 9707a6254a8a ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson Lee <jackson.lee@chipsnmedia.com>
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Tested-by: Brandon Brnich <b-brnich@ti.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/chips-media/wave5/wave5-helper.c | 28 +++++-
.../platform/chips-media/wave5/wave5-helper.h | 1 +
.../chips-media/wave5/wave5-vpu-dec.c | 5 +
.../chips-media/wave5/wave5-vpu-enc.c | 5 +
.../platform/chips-media/wave5/wave5-vpu.c | 97 +++++++++++++++++--
.../platform/chips-media/wave5/wave5-vpuapi.h | 6 ++
6 files changed, 131 insertions(+), 11 deletions(-)
diff --git a/drivers/media/platform/chips-media/wave5/wave5-helper.c b/drivers/media/platform/chips-media/wave5/wave5-helper.c
index f03ad9c0de221..53a0ac068c2e2 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-helper.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-helper.c
@@ -27,6 +27,11 @@ const char *state_to_str(enum vpu_instance_state state)
}
}
+int wave5_kfifo_alloc(struct vpu_instance *inst)
+{
+ return kfifo_alloc(&inst->irq_status, 16 * sizeof(int), GFP_KERNEL);
+}
+
void wave5_cleanup_instance(struct vpu_instance *inst, struct file *filp)
{
int i;
@@ -49,7 +54,7 @@ void wave5_cleanup_instance(struct vpu_instance *inst, struct file *filp)
v4l2_fh_del(&inst->v4l2_fh, filp);
v4l2_fh_exit(&inst->v4l2_fh);
}
- list_del_init(&inst->list);
+ kfifo_free(&inst->irq_status);
ida_free(&inst->dev->inst_ida, inst->id);
kfree(inst->codec_info);
kfree(inst);
@@ -61,8 +66,29 @@ int wave5_vpu_release_device(struct file *filp,
{
struct vpu_instance *inst = file_to_vpu_inst(filp);
int ret = 0;
+ unsigned long flags;
v4l2_m2m_ctx_release(inst->v4l2_fh.m2m_ctx);
+ /*
+ * To prevent Null reference exception, the existing irq handler were
+ * separated to two modules.
+ * One is to queue interrupt reason into the irq handler,
+ * the other is irq_thread to call the wave5_vpu_dec_finish_decode
+ * to get decoded frame.
+ * The list of instances should be protected between all flow of the
+ * decoding process, but to protect the list in the irq_handler, spin lock
+ * should be used, and mutex should be used in the irq_thread because spin lock
+ * is not able to be used because mutex is already being used
+ * in the wave5_vpu_dec_finish_decode.
+ * So the spin lock and mutex were used to protect the list in the release function.
+ */
+ ret = mutex_lock_interruptible(&inst->dev->irq_lock);
+ if (ret)
+ return ret;
+ spin_lock_irqsave(&inst->dev->irq_spinlock, flags);
+ list_del_init(&inst->list);
+ spin_unlock_irqrestore(&inst->dev->irq_spinlock, flags);
+ mutex_unlock(&inst->dev->irq_lock);
if (inst->state != VPU_INST_STATE_NONE) {
u32 fail_res;
diff --git a/drivers/media/platform/chips-media/wave5/wave5-helper.h b/drivers/media/platform/chips-media/wave5/wave5-helper.h
index 976a402e426ff..d61fdbda359d6 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-helper.h
+++ b/drivers/media/platform/chips-media/wave5/wave5-helper.h
@@ -33,4 +33,5 @@ void wave5_update_pix_fmt(struct v4l2_pix_format_mplane *pix_mp,
unsigned int width,
unsigned int height,
const struct v4l2_frmsize_stepwise *frmsize);
+int wave5_kfifo_alloc(struct vpu_instance *inst);
#endif
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
index a90f00f589e04..cff2fa17c3f59 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1810,6 +1810,11 @@ static int wave5_vpu_open_dec(struct file *filp)
inst->xfer_func = V4L2_XFER_FUNC_DEFAULT;
init_completion(&inst->irq_done);
+ ret = wave5_kfifo_alloc(inst);
+ if (ret) {
+ dev_err(inst->dev->dev, "failed to allocate fifo\n");
+ goto cleanup_inst;
+ }
inst->id = ida_alloc(&inst->dev->inst_ida, GFP_KERNEL);
if (inst->id < 0) {
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
index 5388efa63f73d..24fc0d0d3f4aa 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c
@@ -1759,6 +1759,11 @@ static int wave5_vpu_open_enc(struct file *filp)
inst->frame_rate = 30;
init_completion(&inst->irq_done);
+ ret = wave5_kfifo_alloc(inst);
+ if (ret) {
+ dev_err(inst->dev->dev, "failed to allocate fifo\n");
+ goto cleanup_inst;
+ }
inst->id = ida_alloc(&inst->dev->inst_ida, GFP_KERNEL);
if (inst->id < 0) {
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 0026f58403620..3216b49976447 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -51,8 +51,11 @@ static void wave5_vpu_handle_irq(void *dev_id)
u32 seq_done;
u32 cmd_done;
u32 irq_reason;
- struct vpu_instance *inst;
+ u32 irq_subreason;
+ struct vpu_instance *inst, *tmp;
struct vpu_device *dev = dev_id;
+ int val;
+ unsigned long flags;
irq_reason = wave5_vdi_read_register(dev, W5_VPU_VINT_REASON);
seq_done = wave5_vdi_read_register(dev, W5_RET_SEQ_DONE_INSTANCE_INFO);
@@ -60,7 +63,8 @@ static void wave5_vpu_handle_irq(void *dev_id)
wave5_vdi_write_register(dev, W5_VPU_VINT_REASON_CLR, irq_reason);
wave5_vdi_write_register(dev, W5_VPU_VINT_CLEAR, 0x1);
- list_for_each_entry(inst, &dev->instances, list) {
+ spin_lock_irqsave(&dev->irq_spinlock, flags);
+ list_for_each_entry_safe(inst, tmp, &dev->instances, list) {
if (irq_reason & BIT(INT_WAVE5_INIT_SEQ) ||
irq_reason & BIT(INT_WAVE5_ENC_SET_PARAM)) {
@@ -82,22 +86,54 @@ static void wave5_vpu_handle_irq(void *dev_id)
irq_reason & BIT(INT_WAVE5_ENC_PIC)) {
if (cmd_done & BIT(inst->id)) {
cmd_done &= ~BIT(inst->id);
- wave5_vdi_write_register(dev, W5_RET_QUEUE_CMD_DONE_INST,
- cmd_done);
- inst->ops->finish_process(inst);
+ if (dev->irq >= 0) {
+ irq_subreason =
+ wave5_vdi_read_register(dev, W5_VPU_VINT_REASON);
+ if (!(irq_subreason & BIT(INT_WAVE5_DEC_PIC)))
+ wave5_vdi_write_register(dev,
+ W5_RET_QUEUE_CMD_DONE_INST,
+ cmd_done);
+ }
+ val = BIT(INT_WAVE5_DEC_PIC);
+ kfifo_in(&inst->irq_status, &val, sizeof(int));
}
}
+ }
+ spin_unlock_irqrestore(&dev->irq_spinlock, flags);
+
+ if (dev->irq < 0)
+ up(&dev->irq_sem);
+}
+
+static irqreturn_t wave5_vpu_irq(int irq, void *dev_id)
+{
+ struct vpu_device *dev = dev_id;
- wave5_vpu_clear_interrupt(inst, irq_reason);
+ if (wave5_vdi_read_register(dev, W5_VPU_VPU_INT_STS)) {
+ wave5_vpu_handle_irq(dev);
+ return IRQ_WAKE_THREAD;
}
+
+ return IRQ_HANDLED;
}
static irqreturn_t wave5_vpu_irq_thread(int irq, void *dev_id)
{
struct vpu_device *dev = dev_id;
+ struct vpu_instance *inst, *tmp;
+ int irq_status, ret;
- if (wave5_vdi_read_register(dev, W5_VPU_VPU_INT_STS))
- wave5_vpu_handle_irq(dev);
+ mutex_lock(&dev->irq_lock);
+ list_for_each_entry_safe(inst, tmp, &dev->instances, list) {
+ while (kfifo_len(&inst->irq_status)) {
+ ret = kfifo_out(&inst->irq_status, &irq_status, sizeof(int));
+ if (!ret)
+ break;
+
+ inst->ops->finish_process(inst);
+ }
+ }
+ mutex_unlock(&dev->irq_lock);
return IRQ_HANDLED;
}
@@ -121,6 +157,35 @@ static enum hrtimer_restart wave5_vpu_timer_callback(struct hrtimer *timer)
return HRTIMER_RESTART;
}
+static int irq_thread(void *data)
+{
+ struct vpu_device *dev = (struct vpu_device *)data;
+ struct vpu_instance *inst, *tmp;
+ int irq_status, ret;
+
+ while (!kthread_should_stop()) {
+ if (down_interruptible(&dev->irq_sem))
+ continue;
+
+ if (kthread_should_stop())
+ break;
+
+ mutex_lock(&dev->irq_lock);
+ list_for_each_entry_safe(inst, tmp, &dev->instances, list) {
+ while (kfifo_len(&inst->irq_status)) {
+ ret = kfifo_out(&inst->irq_status, &irq_status, sizeof(int));
+ if (!ret)
+ break;
+
+ inst->ops->finish_process(inst);
+ }
+ }
+ mutex_unlock(&dev->irq_lock);
+ }
+
+ return 0;
+}
+
static int wave5_vpu_load_firmware(struct device *dev, const char *fw_name,
u32 *revision)
{
@@ -224,6 +289,8 @@ static int wave5_vpu_probe(struct platform_device *pdev)
mutex_init(&dev->dev_lock);
mutex_init(&dev->hw_lock);
+ mutex_init(&dev->irq_lock);
+ spin_lock_init(&dev->irq_spinlock);
dev_set_drvdata(&pdev->dev, dev);
dev->dev = &pdev->dev;
@@ -266,9 +333,13 @@ static int wave5_vpu_probe(struct platform_device *pdev)
}
dev->product = wave5_vpu_get_product_id(dev);
+ INIT_LIST_HEAD(&dev->instances);
+
dev->irq = platform_get_irq(pdev, 0);
if (dev->irq < 0) {
dev_err(&pdev->dev, "failed to get irq resource, falling back to polling\n");
+ sema_init(&dev->irq_sem, 1);
+ dev->irq_thread = kthread_run(irq_thread, dev, "irq thread");
hrtimer_setup(&dev->hrtimer, &wave5_vpu_timer_callback, CLOCK_MONOTONIC,
HRTIMER_MODE_REL_PINNED);
dev->worker = kthread_run_worker(0, "vpu_irq_thread");
@@ -280,7 +351,7 @@ static int wave5_vpu_probe(struct platform_device *pdev)
dev->vpu_poll_interval = vpu_poll_interval;
kthread_init_work(&dev->work, wave5_vpu_irq_work_fn);
} else {
- ret = devm_request_threaded_irq(&pdev->dev, dev->irq, NULL,
+ ret = devm_request_threaded_irq(&pdev->dev, dev->irq, wave5_vpu_irq,
wave5_vpu_irq_thread, IRQF_ONESHOT, "vpu_irq", dev);
if (ret) {
dev_err(&pdev->dev, "Register interrupt handler, fail: %d\n", ret);
@@ -288,7 +359,6 @@ static int wave5_vpu_probe(struct platform_device *pdev)
}
}
- INIT_LIST_HEAD(&dev->instances);
ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
if (ret) {
dev_err(&pdev->dev, "v4l2_device_register, fail: %d\n", ret);
@@ -356,6 +426,12 @@ static void wave5_vpu_remove(struct platform_device *pdev)
v4l2_device_unregister(&dev->v4l2_dev);
if (dev->irq < 0) {
+ if (dev->irq_thread) {
+ kthread_stop(dev->irq_thread);
+ up(&dev->irq_sem);
+ dev->irq_thread = NULL;
+ }
+
hrtimer_cancel(&dev->hrtimer);
kthread_cancel_work_sync(&dev->work);
kthread_destroy_worker(dev->worker);
@@ -366,6 +442,7 @@ static void wave5_vpu_remove(struct platform_device *pdev)
mutex_destroy(&dev->dev_lock);
mutex_destroy(&dev->hw_lock);
+ mutex_destroy(&dev->irq_lock);
reset_control_assert(dev->resets);
clk_bulk_disable_unprepare(dev->num_clks, dev->clks);
wave5_vdi_release(&pdev->dev);
diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.h b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.h
index 45615c15beca3..bc101397204da 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpuapi.h
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpuapi.h
@@ -8,6 +8,7 @@
#ifndef VPUAPI_H_INCLUDED
#define VPUAPI_H_INCLUDED
+#include <linux/kfifo.h>
#include <linux/idr.h>
#include <linux/genalloc.h>
#include <media/v4l2-device.h>
@@ -747,6 +748,7 @@ struct vpu_device {
struct video_device *video_dev_enc;
struct mutex dev_lock; /* lock for the src, dst v4l2 queues */
struct mutex hw_lock; /* lock hw configurations */
+ struct mutex irq_lock;
int irq;
enum product_id product;
struct vpu_attr attr;
@@ -764,7 +766,10 @@ struct vpu_device {
struct kthread_worker *worker;
int vpu_poll_interval;
int num_clks;
+ struct task_struct *irq_thread;
+ struct semaphore irq_sem; /* signal to irq_thread when interrupt happens*/
struct reset_control *resets;
+ spinlock_t irq_spinlock; /* protect instances list */
};
struct vpu_instance;
@@ -788,6 +793,7 @@ struct vpu_instance {
enum v4l2_ycbcr_encoding ycbcr_enc;
enum v4l2_quantization quantization;
+ struct kfifo irq_status;
enum vpu_instance_state state;
enum vpu_instance_type type;
const struct vpu_instance_ops *ops;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 547/844] media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (545 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 546/844] media: chips-media: wave5: Fix Null reference while testing fluster Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 548/844] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC Sasha Levin
` (305 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicolas Dufresne, Ming Qian, Frank Li, Hans Verkuil, Sasha Levin
From: Nicolas Dufresne <nicolas.dufresne@collabora.com>
[ Upstream commit db6b97a4f8041e479be9ef4b8b07022636c96f50 ]
Adding a reference count to the v4l2_m2m_dev structure allow safely
sharing it across multiple hardware nodes. This can be used to prevent
running jobs concurrently on m2m cores that have some internal resource
sharing.
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: fix typos in v4l2_m2m_put documentation]
Stable-dep-of: e0203ddf9af7 ("media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-mem2mem.c | 23 +++++++++++++++++++++++
include/media/v4l2-mem2mem.h | 21 +++++++++++++++++++++
2 files changed, 44 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
index fec93c1a92317..ae0de54d4c3e1 100644
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@ -90,6 +90,7 @@ static const char * const m2m_entity_name[] = {
* @job_work: worker to run queued jobs.
* @job_queue_flags: flags of the queue status, %QUEUE_PAUSED.
* @m2m_ops: driver callbacks
+ * @kref: device reference count
*/
struct v4l2_m2m_dev {
struct v4l2_m2m_ctx *curr_ctx;
@@ -109,6 +110,8 @@ struct v4l2_m2m_dev {
unsigned long job_queue_flags;
const struct v4l2_m2m_ops *m2m_ops;
+
+ struct kref kref;
};
static struct v4l2_m2m_queue_ctx *get_queue_ctx(struct v4l2_m2m_ctx *m2m_ctx,
@@ -1200,6 +1203,7 @@ struct v4l2_m2m_dev *v4l2_m2m_init(const struct v4l2_m2m_ops *m2m_ops)
INIT_LIST_HEAD(&m2m_dev->job_queue);
spin_lock_init(&m2m_dev->job_spinlock);
INIT_WORK(&m2m_dev->job_work, v4l2_m2m_device_run_work);
+ kref_init(&m2m_dev->kref);
return m2m_dev;
}
@@ -1211,6 +1215,25 @@ void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev)
}
EXPORT_SYMBOL_GPL(v4l2_m2m_release);
+void v4l2_m2m_get(struct v4l2_m2m_dev *m2m_dev)
+{
+ kref_get(&m2m_dev->kref);
+}
+EXPORT_SYMBOL_GPL(v4l2_m2m_get);
+
+static void v4l2_m2m_release_from_kref(struct kref *kref)
+{
+ struct v4l2_m2m_dev *m2m_dev = container_of(kref, struct v4l2_m2m_dev, kref);
+
+ v4l2_m2m_release(m2m_dev);
+}
+
+void v4l2_m2m_put(struct v4l2_m2m_dev *m2m_dev)
+{
+ kref_put(&m2m_dev->kref, v4l2_m2m_release_from_kref);
+}
+EXPORT_SYMBOL_GPL(v4l2_m2m_put);
+
struct v4l2_m2m_ctx *v4l2_m2m_ctx_init(struct v4l2_m2m_dev *m2m_dev,
void *drv_priv,
int (*queue_init)(void *priv, struct vb2_queue *src_vq, struct vb2_queue *dst_vq))
diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
index bf6a09a04dcf8..31de25d792b98 100644
--- a/include/media/v4l2-mem2mem.h
+++ b/include/media/v4l2-mem2mem.h
@@ -547,6 +547,27 @@ v4l2_m2m_register_media_controller(struct v4l2_m2m_dev *m2m_dev,
*/
void v4l2_m2m_release(struct v4l2_m2m_dev *m2m_dev);
+/**
+ * v4l2_m2m_get() - take a reference to the m2m_dev structure
+ *
+ * @m2m_dev: opaque pointer to the internal data to handle M2M context
+ *
+ * This is used to share the M2M device across multiple devices. This
+ * can be used to avoid scheduling two hardware nodes concurrently.
+ */
+void v4l2_m2m_get(struct v4l2_m2m_dev *m2m_dev);
+
+/**
+ * v4l2_m2m_put() - remove a reference to the m2m_dev structure
+ *
+ * @m2m_dev: opaque pointer to the internal data to handle M2M context
+ *
+ * Once the M2M device has no more references, v4l2_m2m_release() will be
+ * called automatically. Users of this method should never call
+ * v4l2_m2m_release() directly. See v4l2_m2m_get() for more details.
+ */
+void v4l2_m2m_put(struct v4l2_m2m_dev *m2m_dev);
+
/**
* v4l2_m2m_ctx_init() - allocate and initialize a m2m context
*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 548/844] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (546 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 547/844] media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 549/844] media: verisilicon: AV1: Fix enable cdef computation Sasha Levin
` (304 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ming Qian, Frank Li, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Ming Qian <ming.qian@oss.nxp.com>
[ Upstream commit e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765 ]
For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and
g2 VPU cannot decode simultaneously; otherwise, it will cause below bus
error and produce corrupted pictures, even potentially lead to system hang.
[ 110.527986] hantro-vpu 38310000.video-codec: frame decode timed out.
[ 110.583517] hantro-vpu 38310000.video-codec: bus error detected.
Therefore, it is necessary to ensure that g1 and g2 operate alternately.
This allows for successful multi-instance decoding of H.264 and HEVC.
To achieve this, g1 and g2 share the same v4l2_m2m_dev, and then the
v4l2_m2m_dev can handle the scheduling.
Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Co-developed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/hantro.h | 2 +
.../media/platform/verisilicon/hantro_drv.c | 42 +++++++++++++++++--
.../media/platform/verisilicon/imx8m_vpu_hw.c | 8 ++++
3 files changed, 49 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro.h b/drivers/media/platform/verisilicon/hantro.h
index e0fdc4535b2d7..0353de154a1ec 100644
--- a/drivers/media/platform/verisilicon/hantro.h
+++ b/drivers/media/platform/verisilicon/hantro.h
@@ -77,6 +77,7 @@ struct hantro_irq {
* @double_buffer: core needs double buffering
* @legacy_regs: core uses legacy register set
* @late_postproc: postproc must be set up at the end of the job
+ * @shared_devices: an array of device ids that cannot run concurrently
*/
struct hantro_variant {
unsigned int enc_offset;
@@ -101,6 +102,7 @@ struct hantro_variant {
unsigned int double_buffer : 1;
unsigned int legacy_regs : 1;
unsigned int late_postproc : 1;
+ const struct of_device_id *shared_devices;
};
/**
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 60b95b5d8565f..94f58f4e4a4e5 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -13,6 +13,7 @@
#include <linux/clk.h>
#include <linux/module.h>
#include <linux/of.h>
+#include <linux/of_platform.h>
#include <linux/platform_device.h>
#include <linux/pm.h>
#include <linux/pm_runtime.h>
@@ -1035,6 +1036,41 @@ static int hantro_disable_multicore(struct hantro_dev *vpu)
return 0;
}
+static struct v4l2_m2m_dev *hantro_get_v4l2_m2m_dev(struct hantro_dev *vpu)
+{
+ struct device_node *node;
+ struct hantro_dev *shared_vpu;
+
+ if (!vpu->variant || !vpu->variant->shared_devices)
+ goto init_new_m2m_dev;
+
+ for_each_matching_node(node, vpu->variant->shared_devices) {
+ struct platform_device *pdev;
+ struct v4l2_m2m_dev *m2m_dev;
+
+ pdev = of_find_device_by_node(node);
+ if (!pdev)
+ continue;
+
+ shared_vpu = platform_get_drvdata(pdev);
+ if (IS_ERR_OR_NULL(shared_vpu) || shared_vpu == vpu) {
+ platform_device_put(pdev);
+ continue;
+ }
+
+ v4l2_m2m_get(shared_vpu->m2m_dev);
+ m2m_dev = shared_vpu->m2m_dev;
+ platform_device_put(pdev);
+
+ of_node_put(node);
+
+ return m2m_dev;
+ }
+
+init_new_m2m_dev:
+ return v4l2_m2m_init(&vpu_m2m_ops);
+}
+
static int hantro_probe(struct platform_device *pdev)
{
const struct of_device_id *match;
@@ -1186,7 +1222,7 @@ static int hantro_probe(struct platform_device *pdev)
}
platform_set_drvdata(pdev, vpu);
- vpu->m2m_dev = v4l2_m2m_init(&vpu_m2m_ops);
+ vpu->m2m_dev = hantro_get_v4l2_m2m_dev(vpu);
if (IS_ERR(vpu->m2m_dev)) {
v4l2_err(&vpu->v4l2_dev, "Failed to init mem2mem device\n");
ret = PTR_ERR(vpu->m2m_dev);
@@ -1225,7 +1261,7 @@ static int hantro_probe(struct platform_device *pdev)
hantro_remove_enc_func(vpu);
err_m2m_rel:
media_device_cleanup(&vpu->mdev);
- v4l2_m2m_release(vpu->m2m_dev);
+ v4l2_m2m_put(vpu->m2m_dev);
err_v4l2_unreg:
v4l2_device_unregister(&vpu->v4l2_dev);
err_clk_unprepare:
@@ -1248,7 +1284,7 @@ static void hantro_remove(struct platform_device *pdev)
hantro_remove_dec_func(vpu);
hantro_remove_enc_func(vpu);
media_device_cleanup(&vpu->mdev);
- v4l2_m2m_release(vpu->m2m_dev);
+ v4l2_m2m_put(vpu->m2m_dev);
v4l2_device_unregister(&vpu->v4l2_dev);
clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
reset_control_assert(vpu->resets);
diff --git a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
index 5be0e2e76882f..6f8e43b7f1575 100644
--- a/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/imx8m_vpu_hw.c
@@ -343,6 +343,12 @@ const struct hantro_variant imx8mq_vpu_variant = {
.num_regs = ARRAY_SIZE(imx8mq_reg_names)
};
+static const struct of_device_id imx8mq_vpu_shared_resources[] __initconst = {
+ { .compatible = "nxp,imx8mq-vpu-g1", },
+ { .compatible = "nxp,imx8mq-vpu-g2", },
+ { /* sentinel */ }
+};
+
const struct hantro_variant imx8mq_vpu_g1_variant = {
.dec_fmts = imx8m_vpu_dec_fmts,
.num_dec_fmts = ARRAY_SIZE(imx8m_vpu_dec_fmts),
@@ -356,6 +362,7 @@ const struct hantro_variant imx8mq_vpu_g1_variant = {
.num_irqs = ARRAY_SIZE(imx8mq_irqs),
.clk_names = imx8mq_g1_clk_names,
.num_clocks = ARRAY_SIZE(imx8mq_g1_clk_names),
+ .shared_devices = imx8mq_vpu_shared_resources,
};
const struct hantro_variant imx8mq_vpu_g2_variant = {
@@ -371,6 +378,7 @@ const struct hantro_variant imx8mq_vpu_g2_variant = {
.num_irqs = ARRAY_SIZE(imx8mq_g2_irqs),
.clk_names = imx8mq_g2_clk_names,
.num_clocks = ARRAY_SIZE(imx8mq_g2_clk_names),
+ .shared_devices = imx8mq_vpu_shared_resources,
};
const struct hantro_variant imx8mm_vpu_g1_variant = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 549/844] media: verisilicon: AV1: Fix enable cdef computation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (547 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 548/844] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 550/844] media: verisilicon: AV1: Fix tx mode bit setting Sasha Levin
` (303 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Benjamin Gaignard, Jianfeng Liu, Nicolas Dufresne, Hans Verkuil,
Sasha Levin
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
[ Upstream commit e0f99b810e1181374370f91cd996d761549e147f ]
If all the fields of the CDEF parameters are zero (which is the default),
then av1_enable_cdef register needs to be unset
(despite the V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF possibly being set).
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Reported-by: Jianfeng Liu <liujianfeng1994@gmail.com>
Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4786
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: dropped Link tag since it just duplicated the Closes: URL]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../platform/verisilicon/rockchip_vpu981_hw_av1_dec.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index e4703bb6be7c1..f4f7cb45b1f1b 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -1396,8 +1396,16 @@ static void rockchip_vpu981_av1_dec_set_cdef(struct hantro_ctx *ctx)
u16 luma_sec_strength = 0;
u32 chroma_pri_strength = 0;
u16 chroma_sec_strength = 0;
+ bool enable_cdef;
int i;
+ enable_cdef = !(cdef->bits == 0 &&
+ cdef->damping_minus_3 == 0 &&
+ cdef->y_pri_strength[0] == 0 &&
+ cdef->y_sec_strength[0] == 0 &&
+ cdef->uv_pri_strength[0] == 0 &&
+ cdef->uv_sec_strength[0] == 0);
+ hantro_reg_write(vpu, &av1_enable_cdef, enable_cdef);
hantro_reg_write(vpu, &av1_cdef_bits, cdef->bits);
hantro_reg_write(vpu, &av1_cdef_damping, cdef->damping_minus_3);
@@ -1953,8 +1961,6 @@ static void rockchip_vpu981_av1_dec_set_parameters(struct hantro_ctx *ctx)
!!(ctrls->frame->flags & V4L2_AV1_FRAME_FLAG_SHOW_FRAME));
hantro_reg_write(vpu, &av1_switchable_motion_mode,
!!(ctrls->frame->flags & V4L2_AV1_FRAME_FLAG_IS_MOTION_MODE_SWITCHABLE));
- hantro_reg_write(vpu, &av1_enable_cdef,
- !!(ctrls->sequence->flags & V4L2_AV1_SEQUENCE_FLAG_ENABLE_CDEF));
hantro_reg_write(vpu, &av1_allow_masked_compound,
!!(ctrls->sequence->flags
& V4L2_AV1_SEQUENCE_FLAG_ENABLE_MASKED_COMPOUND));
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 550/844] media: verisilicon: AV1: Fix tx mode bit setting
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (548 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 549/844] media: verisilicon: AV1: Fix enable cdef computation Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 551/844] arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs Sasha Levin
` (302 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Benjamin Gaignard, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
[ Upstream commit cb3f945c012ab152fd2323e0df34c2b640071738 ]
AV1 specification describes 3 possibles tx modes: 4x4 only, largest and
select. The hardware allows 5 possibles tx modes: 4x4 only, 8x8, 16x16,
32x32 and select. Since the both aren't exactly matching we need to add
a mapping function to set the correct mode on hardware.
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../verisilicon/rockchip_vpu981_hw_av1_dec.c | 27 ++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index f4f7cb45b1f1b..f52b8208e6b93 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -72,6 +72,14 @@
: AV1_DIV_ROUND_UP_POW2((_value_), (_n_))); \
})
+enum rockchip_av1_tx_mode {
+ ROCKCHIP_AV1_TX_MODE_ONLY_4X4 = 0,
+ ROCKCHIP_AV1_TX_MODE_8X8 = 1,
+ ROCKCHIP_AV1_TX_MODE_16x16 = 2,
+ ROCKCHIP_AV1_TX_MODE_32x32 = 3,
+ ROCKCHIP_AV1_TX_MODE_SELECT = 4,
+};
+
struct rockchip_av1_film_grain {
u8 scaling_lut_y[256];
u8 scaling_lut_cb[256];
@@ -1935,11 +1943,26 @@ static void rockchip_vpu981_av1_dec_set_reference_frames(struct hantro_ctx *ctx)
rockchip_vpu981_av1_dec_set_other_frames(ctx);
}
+static int rockchip_vpu981_av1_get_hardware_tx_mode(enum v4l2_av1_tx_mode tx_mode)
+{
+ switch (tx_mode) {
+ case V4L2_AV1_TX_MODE_ONLY_4X4:
+ return ROCKCHIP_AV1_TX_MODE_ONLY_4X4;
+ case V4L2_AV1_TX_MODE_LARGEST:
+ return ROCKCHIP_AV1_TX_MODE_32x32;
+ case V4L2_AV1_TX_MODE_SELECT:
+ return ROCKCHIP_AV1_TX_MODE_SELECT;
+ }
+
+ return ROCKCHIP_AV1_TX_MODE_32x32;
+}
+
static void rockchip_vpu981_av1_dec_set_parameters(struct hantro_ctx *ctx)
{
struct hantro_dev *vpu = ctx->dev;
struct hantro_av1_dec_hw_ctx *av1_dec = &ctx->av1_dec;
struct hantro_av1_dec_ctrls *ctrls = &av1_dec->ctrls;
+ int tx_mode;
hantro_reg_write(vpu, &av1_skip_mode,
!!(ctrls->frame->flags & V4L2_AV1_FRAME_FLAG_SKIP_MODE_PRESENT));
@@ -2005,7 +2028,9 @@ static void rockchip_vpu981_av1_dec_set_parameters(struct hantro_ctx *ctx)
!!(ctrls->frame->flags & V4L2_AV1_FRAME_FLAG_ALLOW_HIGH_PRECISION_MV));
hantro_reg_write(vpu, &av1_comp_pred_mode,
(ctrls->frame->flags & V4L2_AV1_FRAME_FLAG_REFERENCE_SELECT) ? 2 : 0);
- hantro_reg_write(vpu, &av1_transform_mode, (ctrls->frame->tx_mode == 1) ? 3 : 4);
+
+ tx_mode = rockchip_vpu981_av1_get_hardware_tx_mode(ctrls->frame->tx_mode);
+ hantro_reg_write(vpu, &av1_transform_mode, tx_mode);
hantro_reg_write(vpu, &av1_max_cb_size,
(ctrls->sequence->flags
& V4L2_AV1_SEQUENCE_FLAG_USE_128X128_SUPERBLOCK) ? 7 : 6);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 551/844] arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (549 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 550/844] media: verisilicon: AV1: Fix tx mode bit setting Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 552/844] arm64: dts: qcom: sm8750: Fix BAM DMA probing Sasha Levin
` (301 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Abel Vesa, Bjorn Andersson, Sasha Levin
From: Abel Vesa <abel.vesa@linaro.org>
[ Upstream commit 0907cab01ff9746ecf08592edd9bd85d2636be58 ]
The DP PHYs on X1E80100 need the ref clock which is provided by the
TCSR CC.
The current X Elite devices supported upstream work fine without this
clock, because the boot firmware leaves this clock enabled. But we should
not rely on that. Also, even though this change breaks the ABI, it is
needed in order to make the driver disables this clock along with the
other ones, for a proper bring-down of the entire PHY.
So lets attach it to each of the DP PHYs in order to do that.
Cc: stable@vger.kernel.org # v6.9
Fixes: 1940c25eaa63 ("arm64: dts: qcom: x1e80100: Add display nodes")
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20251224-phy-qcom-edp-add-missing-refclk-v5-3-3f45d349b5ac@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/hamoa.dtsi | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/hamoa.dtsi b/arch/arm64/boot/dts/qcom/hamoa.dtsi
index 83a0a0c3239d2..9e0934b302c3e 100644
--- a/arch/arm64/boot/dts/qcom/hamoa.dtsi
+++ b/arch/arm64/boot/dts/qcom/hamoa.dtsi
@@ -5896,9 +5896,11 @@ mdss_dp2_phy: phy@aec2a00 {
<0 0x0aec2000 0 0x1c8>;
clocks = <&dispcc DISP_CC_MDSS_DPTX2_AUX_CLK>,
- <&dispcc DISP_CC_MDSS_AHB_CLK>;
+ <&dispcc DISP_CC_MDSS_AHB_CLK>,
+ <&tcsr TCSR_EDP_CLKREF_EN>;
clock-names = "aux",
- "cfg_ahb";
+ "cfg_ahb",
+ "ref";
power-domains = <&rpmhpd RPMHPD_MX>;
@@ -5916,9 +5918,11 @@ mdss_dp3_phy: phy@aec5a00 {
<0 0x0aec5000 0 0x1c8>;
clocks = <&dispcc DISP_CC_MDSS_DPTX3_AUX_CLK>,
- <&dispcc DISP_CC_MDSS_AHB_CLK>;
+ <&dispcc DISP_CC_MDSS_AHB_CLK>,
+ <&tcsr TCSR_EDP_CLKREF_EN>;
clock-names = "aux",
- "cfg_ahb";
+ "cfg_ahb",
+ "ref";
power-domains = <&rpmhpd RPMHPD_MX>;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 552/844] arm64: dts: qcom: sm8750: Fix BAM DMA probing
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (550 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 551/844] arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 553/844] ARM: omap2: Fix reference count leaks in omap_control_init() Sasha Levin
` (300 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Krzysztof Kozlowski, Konrad Dybcio, Bjorn Andersson, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit 1c6192ec9c4ab8bdb7b2cf8763b7ef7e38671ffe ]
Bindings always required "qcom,num-ees" and "num-channels" properties,
as reported by dtbs_check:
sm8750-mtp.dtb: dma-controller@1dc4000 (qcom,bam-v1.7.4): 'anyOf' conditional failed, one must be fixed:
'qcom,powered-remotely' is a required property
'num-channels' is a required property
'qcom,num-ees' is a required property
'clocks' is a required property
'clock-names' is a required property
However since commit 5068b5254812 ("dmaengine: qcom: bam_dma: Fix DT
error handling for num-channels/ees") missing properties are actually
fatal and BAM does not probe:
bam-dma-engine 1dc4000.dma-controller: num-channels unspecified in dt
bam-dma-engine 1dc4000.dma-controller: probe with driver bam-dma-engine failed with error -22
Fixes: eeb0f3e4ea67 ("arm64: dts: qcom: sm8750: Add QCrypto nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251229115734.205744-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8750.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sm8750.dtsi b/arch/arm64/boot/dts/qcom/sm8750.dtsi
index 3f0b57f428bbb..0efbf5e29f0f7 100644
--- a/arch/arm64/boot/dts/qcom/sm8750.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8750.dtsi
@@ -2073,6 +2073,8 @@ cryptobam: dma-controller@1dc4000 {
<&apps_smmu 0x481 0>;
qcom,ee = <0>;
+ qcom,num-ees = <4>;
+ num-channels = <20>;
qcom,controlled-remotely;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 553/844] ARM: omap2: Fix reference count leaks in omap_control_init()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (551 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 552/844] arm64: dts: qcom: sm8750: Fix BAM DMA probing Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 554/844] arm64: kernel: initialize missing kexec_buf->random field Sasha Levin
` (299 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wentao Liang, Andreas Kemnade, Kevin Hilman, Sasha Levin
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 93a04ab480c8bbcb7d9004be139c538c8a0c1bc8 ]
The of_get_child_by_name() function increments the reference count
of child nodes, causing multiple reference leaks in omap_control_init():
1. scm_conf node never released in normal/error paths
2. clocks node leak when checking existence
3. Missing scm_conf release before np in error paths
Fix these leaks by adding proper of_node_put() calls and separate error
handling.
Fixes: e5b635742e98 ("ARM: OMAP2+: control: add syscon support for register accesses")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20251217142122.1861292-1-vulab@iscas.ac.cn
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/control.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
index 79860b23030de..eb6fc7c61b6e0 100644
--- a/arch/arm/mach-omap2/control.c
+++ b/arch/arm/mach-omap2/control.c
@@ -732,7 +732,7 @@ int __init omap2_control_base_init(void)
*/
int __init omap_control_init(void)
{
- struct device_node *np, *scm_conf;
+ struct device_node *np, *scm_conf, *clocks_node;
const struct of_device_id *match;
const struct omap_prcm_init_data *data;
int ret;
@@ -753,16 +753,19 @@ int __init omap_control_init(void)
if (IS_ERR(syscon)) {
ret = PTR_ERR(syscon);
- goto of_node_put;
+ goto err_put_scm_conf;
}
- if (of_get_child_by_name(scm_conf, "clocks")) {
+ clocks_node = of_get_child_by_name(scm_conf, "clocks");
+ if (clocks_node) {
+ of_node_put(clocks_node);
ret = omap2_clk_provider_init(scm_conf,
data->index,
syscon, NULL);
if (ret)
- goto of_node_put;
+ goto err_put_scm_conf;
}
+ of_node_put(scm_conf);
} else {
/* No scm_conf found, direct access */
ret = omap2_clk_provider_init(np, data->index, NULL,
@@ -780,6 +783,9 @@ int __init omap_control_init(void)
return 0;
+err_put_scm_conf:
+ if (scm_conf)
+ of_node_put(scm_conf);
of_node_put:
of_node_put(np);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 554/844] arm64: kernel: initialize missing kexec_buf->random field
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (552 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 553/844] ARM: omap2: Fix reference count leaks in omap_control_init() Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 555/844] powerpc/pseries: Fix MSI-X allocation failure when quota is exceeded Sasha Levin
` (298 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yeoreum Yun, Breno Leitao, Andrew Morton, Pratyush Yadav,
Will Deacon, Sasha Levin
From: Yeoreum Yun <yeoreum.yun@arm.com>
[ Upstream commit 15dd20dda979ebab72f6df97845828e78d63ab91 ]
Commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly")
introduced the kexec_buf->random field to enable random placement of
kexec_buf.
However, this field was never properly initialized for kexec images
that do not need to be placed randomly, leading to the following UBSAN
warning:
[ +0.364528] ------------[ cut here ]------------
[ +0.000019] UBSAN: invalid-load in ./include/linux/kexec.h:210:12
[ +0.000131] load of value 2 is not a valid value for type 'bool' (aka '_Bool')
[ +0.000003] CPU: 4 UID: 0 PID: 927 Comm: kexec Not tainted 6.18.0-rc7+ #3 PREEMPT(full)
[ +0.000002] Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
[ +0.000000] Call trace:
[ +0.000001] show_stack+0x24/0x40 (C)
[ +0.000006] __dump_stack+0x28/0x48
[ +0.000002] dump_stack_lvl+0x7c/0xb0
[ +0.000002] dump_stack+0x18/0x34
[ +0.000001] ubsan_epilogue+0x10/0x50
[ +0.000002] __ubsan_handle_load_invalid_value+0xc8/0xd0
[ +0.000003] locate_mem_hole_callback+0x28c/0x2a0
[ +0.000003] kexec_locate_mem_hole+0xf4/0x2f0
[ +0.000001] kexec_add_buffer+0xa8/0x178
[ +0.000002] image_load+0xf0/0x258
[ +0.000001] __arm64_sys_kexec_file_load+0x510/0x718
[ +0.000002] invoke_syscall+0x68/0xe8
[ +0.000001] el0_svc_common+0xb0/0xf8
[ +0.000002] do_el0_svc+0x28/0x48
[ +0.000001] el0_svc+0x40/0xe8
[ +0.000002] el0t_64_sync_handler+0x84/0x140
[ +0.000002] el0t_64_sync+0x1bc/0x1c0
To address this, initialise kexec_buf->random field properly.
Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly")
Suggested-by: Breno Leitao <leitao@debian.org>
Cc: stable@vger.kernel.org
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://lore.kernel.org/all/oninomspajhxp4omtdapxnckxydbk2nzmrix7rggmpukpnzadw@c67o7njgdgm3/ [1]
Link: https://lore.kernel.org/all/20250825180531.94bfb86a26a43127c0a1296f@linux-foundation.org/ [2]
Link: https://lkml.kernel.org/r/20250826-akpm-v1-1-3c831f0e3799@debian.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/kexec_image.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c
index 532d72ea42ee8..b70f4df15a1ae 100644
--- a/arch/arm64/kernel/kexec_image.c
+++ b/arch/arm64/kernel/kexec_image.c
@@ -41,7 +41,7 @@ static void *image_load(struct kimage *image,
struct arm64_image_header *h;
u64 flags, value;
bool be_image, be_kernel;
- struct kexec_buf kbuf;
+ struct kexec_buf kbuf = {};
unsigned long text_offset, kernel_segment_number;
struct kexec_segment *kernel_segment;
int ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 555/844] powerpc/pseries: Fix MSI-X allocation failure when quota is exceeded
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (553 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 554/844] arm64: kernel: initialize missing kexec_buf->random field Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 556/844] KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR Sasha Levin
` (297 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nam Cao, Nilay Shroff, Madhavan Srinivasan, Sasha Levin
From: Nam Cao <namcao@linutronix.de>
[ Upstream commit c0215e2d72debcd9cbc1c002fb012d50a3140387 ]
Nilay reported that since commit daaa574aba6f ("powerpc/pseries/msi: Switch
to msi_create_parent_irq_domain()"), the NVMe driver cannot enable MSI-X
when the device's MSI-X table size is larger than the firmware's MSI quota
for the device.
This is because the commit changes how rtas_prepare_msi_irqs() is called:
- Before, it is called when interrupts are allocated at the global
interrupt domain with nvec_in being the number of allocated interrupts.
rtas_prepare_msi_irqs() can return a positive number and the allocation
will be retried.
- Now, it is called at the creation of per-device interrupt domain with
nvec_in being the number of interrupts that the device supports. If
rtas_prepare_msi_irqs() returns positive, domain creation just fails.
For Nilay's NVMe driver case, rtas_prepare_msi_irqs() returns a positive
number (the quota). This causes per-device interrupt domain creation to
fail and thus the NVMe driver cannot enable MSI-X.
Rework to make this scenario works again:
- pseries_msi_ops_prepare() only prepares as many interrupts as the quota
permit.
- pseries_irq_domain_alloc() fails if the device's quota is exceeded.
Now, if the quota is exceeded, pseries_msi_ops_prepare() will only prepare
as allowed by the quota. If device drivers attempt to allocate more
interrupts than the quota permits, pseries_irq_domain_alloc() will return
an error code and msi_handle_pci_fail() will allow device drivers a retry.
Reported-by: Nilay Shroff <nilay@linux.ibm.com>
Closes: https://lore.kernel.org/linuxppc-dev/6af2c4c2-97f6-4758-be33-256638ef39e5@linux.ibm.com/
Fixes: daaa574aba6f ("powerpc/pseries/msi: Switch to msi_create_parent_irq_domain()")
Signed-off-by: Nam Cao <namcao@linutronix.de>
Cc: stable@vger.kernel.org
Tested-by: Nilay Shroff <nilay@linux.ibm.com>
Acked-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260107100230.1466093-1-namcao@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/msi.c | 44 ++++++++++++++++++++++++++--
1 file changed, 41 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
index a82aaa786e9e0..edc30cda5dbcb 100644
--- a/arch/powerpc/platforms/pseries/msi.c
+++ b/arch/powerpc/platforms/pseries/msi.c
@@ -19,6 +19,11 @@
#include "pseries.h"
+struct pseries_msi_device {
+ unsigned int msi_quota;
+ unsigned int msi_used;
+};
+
static int query_token, change_token;
#define RTAS_QUERY_FN 0
@@ -433,8 +438,28 @@ static int pseries_msi_ops_prepare(struct irq_domain *domain, struct device *dev
struct msi_domain_info *info = domain->host_data;
struct pci_dev *pdev = to_pci_dev(dev);
int type = (info->flags & MSI_FLAG_PCI_MSIX) ? PCI_CAP_ID_MSIX : PCI_CAP_ID_MSI;
+ int ret;
+
+ struct pseries_msi_device *pseries_dev __free(kfree)
+ = kmalloc(sizeof(*pseries_dev), GFP_KERNEL);
+ if (!pseries_dev)
+ return -ENOMEM;
+
+ while (1) {
+ ret = rtas_prepare_msi_irqs(pdev, nvec, type, arg);
+ if (!ret)
+ break;
+ else if (ret > 0)
+ nvec = ret;
+ else
+ return ret;
+ }
- return rtas_prepare_msi_irqs(pdev, nvec, type, arg);
+ pseries_dev->msi_quota = nvec;
+ pseries_dev->msi_used = 0;
+
+ arg->scratchpad[0].ptr = no_free_ptr(pseries_dev);
+ return 0;
}
/*
@@ -443,9 +468,13 @@ static int pseries_msi_ops_prepare(struct irq_domain *domain, struct device *dev
*/
static void pseries_msi_ops_teardown(struct irq_domain *domain, msi_alloc_info_t *arg)
{
+ struct pseries_msi_device *pseries_dev = arg->scratchpad[0].ptr;
struct pci_dev *pdev = to_pci_dev(domain->dev);
rtas_disable_msi(pdev);
+
+ WARN_ON(pseries_dev->msi_used);
+ kfree(pseries_dev);
}
static void pseries_msi_shutdown(struct irq_data *d)
@@ -546,12 +575,18 @@ static int pseries_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
unsigned int nr_irqs, void *arg)
{
struct pci_controller *phb = domain->host_data;
+ struct pseries_msi_device *pseries_dev;
msi_alloc_info_t *info = arg;
struct msi_desc *desc = info->desc;
struct pci_dev *pdev = msi_desc_to_pci_dev(desc);
int hwirq;
int i, ret;
+ pseries_dev = info->scratchpad[0].ptr;
+
+ if (pseries_dev->msi_used + nr_irqs > pseries_dev->msi_quota)
+ return -ENOSPC;
+
hwirq = rtas_query_irq_number(pci_get_pdn(pdev), desc->msi_index);
if (hwirq < 0) {
dev_err(&pdev->dev, "Failed to query HW IRQ: %d\n", hwirq);
@@ -567,9 +602,10 @@ static int pseries_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
goto out;
irq_domain_set_hwirq_and_chip(domain, virq + i, hwirq + i,
- &pseries_msi_irq_chip, domain->host_data);
+ &pseries_msi_irq_chip, pseries_dev);
}
+ pseries_dev->msi_used++;
return 0;
out:
@@ -582,9 +618,11 @@ static void pseries_irq_domain_free(struct irq_domain *domain, unsigned int virq
unsigned int nr_irqs)
{
struct irq_data *d = irq_domain_get_irq_data(domain, virq);
- struct pci_controller *phb = irq_data_get_irq_chip_data(d);
+ struct pseries_msi_device *pseries_dev = irq_data_get_irq_chip_data(d);
+ struct pci_controller *phb = domain->host_data;
pr_debug("%s bridge %pOF %d #%d\n", __func__, phb->dn, virq, nr_irqs);
+ pseries_dev->msi_used -= nr_irqs;
irq_domain_free_irqs_parent(domain, virq, nr_irqs);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 556/844] KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (554 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 555/844] powerpc/pseries: Fix MSI-X allocation failure when quota is exceeded Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 557/844] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding Sasha Levin
` (296 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sean Christopherson, Jim Mattson, Sasha Levin
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit 5bb9ac1865123356337a389af935d3913ee917ed ]
Return KVM_MSR_RET_UNSUPPORTED instead of '1' (which for all intents and
purposes means "invalid") when rejecting accesses to KVM PV MSRs to adhere
to KVM's ABI of allowing host reads and writes of '0' to MSRs that are
advertised to userspace via KVM_GET_MSR_INDEX_LIST, even if the vCPU model
doesn't support the MSR.
E.g. running a QEMU VM with
-cpu host,-kvmclock,kvm-pv-enforce-cpuid
yields:
qemu: error: failed to set MSR 0x12 to 0x0
qemu: target/i386/kvm/kvm.c:3301: kvm_buf_set_msrs:
Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
Fixes: 66570e966dd9 ("kvm: x86: only provide PV features if enabled in guest's CPUID")
Cc: stable@vger.kernel.org
Reviewed-by: Jim Mattson <jmattson@google.com>
Link: https://patch.msgid.link/20251230205948.4094097-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/x86.c | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 72d37c8930ad7..042ebda1a6576 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4096,47 +4096,47 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
break;
case MSR_KVM_WALL_CLOCK_NEW:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
vcpu->kvm->arch.wall_clock = data;
kvm_write_wall_clock(vcpu->kvm, data, 0);
break;
case MSR_KVM_WALL_CLOCK:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
vcpu->kvm->arch.wall_clock = data;
kvm_write_wall_clock(vcpu->kvm, data, 0);
break;
case MSR_KVM_SYSTEM_TIME_NEW:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
kvm_write_system_time(vcpu, data, false, msr_info->host_initiated);
break;
case MSR_KVM_SYSTEM_TIME:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
kvm_write_system_time(vcpu, data, true, msr_info->host_initiated);
break;
case MSR_KVM_ASYNC_PF_EN:
if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
if (kvm_pv_enable_async_pf(vcpu, data))
return 1;
break;
case MSR_KVM_ASYNC_PF_INT:
if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
if (kvm_pv_enable_async_pf_int(vcpu, data))
return 1;
break;
case MSR_KVM_ASYNC_PF_ACK:
if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
if (data & 0x1) {
/*
* Pairs with the smp_mb__after_atomic() in
@@ -4149,7 +4149,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
break;
case MSR_KVM_STEAL_TIME:
if (!guest_pv_has(vcpu, KVM_FEATURE_STEAL_TIME))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
if (unlikely(!sched_info_on()))
return 1;
@@ -4167,7 +4167,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
break;
case MSR_KVM_PV_EOI_EN:
if (!guest_pv_has(vcpu, KVM_FEATURE_PV_EOI))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
if (kvm_lapic_set_pv_eoi(vcpu, data, sizeof(u8)))
return 1;
@@ -4175,7 +4175,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
case MSR_KVM_POLL_CONTROL:
if (!guest_pv_has(vcpu, KVM_FEATURE_POLL_CONTROL))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
/* only enable bit supported */
if (data & (-1ULL << 1))
@@ -4476,61 +4476,61 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
break;
case MSR_KVM_WALL_CLOCK:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->kvm->arch.wall_clock;
break;
case MSR_KVM_WALL_CLOCK_NEW:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->kvm->arch.wall_clock;
break;
case MSR_KVM_SYSTEM_TIME:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.time;
break;
case MSR_KVM_SYSTEM_TIME_NEW:
if (!guest_pv_has(vcpu, KVM_FEATURE_CLOCKSOURCE2))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.time;
break;
case MSR_KVM_ASYNC_PF_EN:
if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.apf.msr_en_val;
break;
case MSR_KVM_ASYNC_PF_INT:
if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.apf.msr_int_val;
break;
case MSR_KVM_ASYNC_PF_ACK:
if (!guest_pv_has(vcpu, KVM_FEATURE_ASYNC_PF_INT))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = 0;
break;
case MSR_KVM_STEAL_TIME:
if (!guest_pv_has(vcpu, KVM_FEATURE_STEAL_TIME))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.st.msr_val;
break;
case MSR_KVM_PV_EOI_EN:
if (!guest_pv_has(vcpu, KVM_FEATURE_PV_EOI))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.pv_eoi.msr_val;
break;
case MSR_KVM_POLL_CONTROL:
if (!guest_pv_has(vcpu, KVM_FEATURE_POLL_CONTROL))
- return 1;
+ return KVM_MSR_RET_UNSUPPORTED;
msr_info->data = vcpu->arch.msr_kvm_poll_control;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 557/844] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (555 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 556/844] KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 558/844] arm64: Disable branch profiling for all arm64 code Sasha Levin
` (295 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sean Christopherson, Yosry Ahmed, Sasha Levin
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit fc3ba56385d03501eb582e4b86691ba378e556f9 ]
Drop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing
as it is trivially easy to trigger from userspace by modifying CPUID after
loading CR3. E.g. modifying the state restoration selftest like so:
--- tools/testing/selftests/kvm/x86/state_test.c
+++ tools/testing/selftests/kvm/x86/state_test.c
@@ -280,7 +280,16 @@ int main(int argc, char *argv[])
/* Restore state in a new VM. */
vcpu = vm_recreate_with_one_vcpu(vm);
- vcpu_load_state(vcpu, state);
+
+ if (stage == 4) {
+ state->sregs.cr3 = BIT(44);
+ vcpu_load_state(vcpu, state);
+
+ vcpu_set_cpuid_property(vcpu, X86_PROPERTY_MAX_PHY_ADDR, 36);
+ __vcpu_nested_state_set(vcpu, &state->nested);
+ } else {
+ vcpu_load_state(vcpu, state);
+ }
/*
* Restore XSAVE state in a dummy vCPU, first without doing
generates:
WARNING: CPU: 30 PID: 938 at arch/x86/kvm/svm/nested.c:1877 svm_set_nested_state+0x34a/0x360 [kvm_amd]
Modules linked in: kvm_amd kvm irqbypass [last unloaded: kvm]
CPU: 30 UID: 1000 PID: 938 Comm: state_test Tainted: G W 6.18.0-rc7-58e10b63777d-next-vm
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:svm_set_nested_state+0x34a/0x360 [kvm_amd]
Call Trace:
<TASK>
kvm_arch_vcpu_ioctl+0xf33/0x1700 [kvm]
kvm_vcpu_ioctl+0x4e6/0x8f0 [kvm]
__x64_sys_ioctl+0x8f/0xd0
do_syscall_64+0x61/0xad0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Simply delete the WARN instead of trying to prevent userspace from shoving
"illegal" state into CR3. For better or worse, KVM's ABI allows userspace
to set CPUID after SREGS, and vice versa, and KVM is very permissive when
it comes to guest CPUID. I.e. attempting to enforce the virtual CPU model
when setting CPUID could break userspace. Given that the WARN doesn't
provide any meaningful protection for KVM or benefit for userspace, simply
drop it even though the odds of breaking userspace are minuscule.
Opportunistically delete a spurious newline.
Fixes: b222b0b88162 ("KVM: nSVM: refactor the CR3 reload on migration")
Cc: stable@vger.kernel.org
Cc: Yosry Ahmed <yosry.ahmed@linux.dev>
Reviewed-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20251216161755.1775409-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/svm/nested.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index ba0f11c68372b..9be67040e94d9 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -1870,10 +1870,9 @@ static int svm_set_nested_state(struct kvm_vcpu *vcpu,
* thus MMU might not be initialized correctly.
* Set it again to fix this.
*/
-
ret = nested_svm_load_cr3(&svm->vcpu, vcpu->arch.cr3,
nested_npt_enabled(svm), false);
- if (WARN_ON_ONCE(ret))
+ if (ret)
goto out_free;
svm->nested.force_msr_bitmap_recalc = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 558/844] arm64: Disable branch profiling for all arm64 code
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (556 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 557/844] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 559/844] pinctrl: meson: amlogic-a4: mark the GPIO controller as sleeping Sasha Levin
` (294 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Breno Leitao, Mark Rutland, Will Deacon, Sasha Levin
From: Breno Leitao <leitao@debian.org>
[ Upstream commit f22c81bebf8bda6e54dc132df0ed54f6bf8756f9 ]
The arm64 kernel doesn't boot with annotated branches
(PROFILE_ANNOTATED_BRANCHES) enabled and CONFIG_DEBUG_VIRTUAL together.
Bisecting it, I found that disabling branch profiling in arch/arm64/mm
solved the problem. Narrowing down a bit further, I found that
physaddr.c is the file that needs to have branch profiling disabled to
get the machine to boot.
I suspect that it might invoke some ftrace helper very early in the boot
process and ftrace is still not enabled(!?).
Rather than playing whack-a-mole with individual files, disable branch
profiling for the entire arch/arm64 tree, similar to what x86 already
does in arch/x86/Kbuild.
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/Kbuild | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm64/Kbuild b/arch/arm64/Kbuild
index 5bfbf7d79c99b..d876bc0e54211 100644
--- a/arch/arm64/Kbuild
+++ b/arch/arm64/Kbuild
@@ -1,4 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
+
+# Branch profiling isn't noinstr-safe
+subdir-ccflags-$(CONFIG_TRACE_BRANCH_PROFILING) += -DDISABLE_BRANCH_PROFILING
+
obj-y += kernel/ mm/ net/
obj-$(CONFIG_KVM) += kvm/
obj-$(CONFIG_XEN) += xen/
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 559/844] pinctrl: meson: amlogic-a4: mark the GPIO controller as sleeping
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (557 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 558/844] arm64: Disable branch profiling for all arm64 code Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 560/844] HID: hid-pl: handle probe errors Sasha Levin
` (293 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bartosz Golaszewski, Martin Blumenstingl, Neil Armstrong,
Linus Walleij, Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit d6df4abe95a409e812c5d9af9657fe63ac299e3a ]
The GPIO controller is configured as non-sleeping but it uses generic
pinctrl helpers which use a mutex for synchronization. This will cause
lockdep splats when used together with shared GPIOs going through the
GPIO shared proxy driver.
Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs")
Cc: stable@vger.kernel.org
Reported-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Closes: https://lore.kernel.org/all/CAFBinCAc7CO8gfNQakCu3LfkYXuyTd2iRpMRm8EKXSL0mwOnJw@mail.gmail.com/
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/meson/pinctrl-amlogic-a4.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/meson/pinctrl-amlogic-a4.c b/drivers/pinctrl/meson/pinctrl-amlogic-a4.c
index f05d8261624a4..40542edd557e0 100644
--- a/drivers/pinctrl/meson/pinctrl-amlogic-a4.c
+++ b/drivers/pinctrl/meson/pinctrl-amlogic-a4.c
@@ -895,7 +895,7 @@ static const struct gpio_chip aml_gpio_template = {
.direction_input = aml_gpio_direction_input,
.direction_output = aml_gpio_direction_output,
.get_direction = aml_gpio_get_direction,
- .can_sleep = false,
+ .can_sleep = true,
};
static void init_bank_register_bit(struct aml_pinctrl *info,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 560/844] HID: hid-pl: handle probe errors
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (558 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 559/844] pinctrl: meson: amlogic-a4: mark the GPIO controller as sleeping Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 561/844] HID: magicmouse: Do not crash on missing msc->input Sasha Levin
` (292 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Oliver Neukum, Jiri Kosina, Sasha Levin
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit 3756a272d2cf356d2203da8474d173257f5f8521 ]
Errors in init must be reported back or we'll
follow a NULL pointer the first time FF is used.
Fixes: 20eb127906709 ("hid: force feedback driver for PantherLord USB/PS2 2in1 Adapter")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-pl.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
index 3c8827081deae..dc11d5322fc0f 100644
--- a/drivers/hid/hid-pl.c
+++ b/drivers/hid/hid-pl.c
@@ -194,9 +194,14 @@ static int pl_probe(struct hid_device *hdev, const struct hid_device_id *id)
goto err;
}
- plff_init(hdev);
+ ret = plff_init(hdev);
+ if (ret)
+ goto stop;
return 0;
+
+stop:
+ hid_hw_stop(hdev);
err:
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 561/844] HID: magicmouse: Do not crash on missing msc->input
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (559 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 560/844] HID: hid-pl: handle probe errors Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 562/844] HID: prodikeys: Check presence of pm->input_ep82 Sasha Levin
` (291 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Günther Noack, Jiri Kosina, Sasha Levin
From: Günther Noack <gnoack@google.com>
[ Upstream commit 17abd396548035fbd6179ee1a431bd75d49676a7 ]
Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called. In this case, msc->input stays NULL,
leading to a crash at a later time.
Detect this condition in the input_configured() hook and reject the device.
This is not supposed to happen with actual magic mouse devices, but can be
provoked by imposing as a magic mouse USB device.
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-magicmouse.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 7d4a25c6de0eb..91f621ceb924b 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -725,6 +725,11 @@ static int magicmouse_input_configured(struct hid_device *hdev,
struct magicmouse_sc *msc = hid_get_drvdata(hdev);
int ret;
+ if (!msc->input) {
+ hid_err(hdev, "magicmouse setup input failed (no input)");
+ return -EINVAL;
+ }
+
ret = magicmouse_setup_input(msc->input, hdev);
if (ret) {
hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 562/844] HID: prodikeys: Check presence of pm->input_ep82
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (560 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 561/844] HID: magicmouse: Do not crash on missing msc->input Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 563/844] HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() Sasha Levin
` (290 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Günther Noack, Jiri Kosina, Sasha Levin
From: Günther Noack <gnoack@google.com>
[ Upstream commit cee8337e1bad168136aecfe6416ecd7d3aa7529a ]
Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called. In this case, pm->input_ep82 stays
NULL, which leads to a crash later.
This does not happen with the real device, but can be provoked by imposing as
one.
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-prodikeys.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c
index 74bddb2c3e82e..6e413df38358a 100644
--- a/drivers/hid/hid-prodikeys.c
+++ b/drivers/hid/hid-prodikeys.c
@@ -378,6 +378,10 @@ static int pcmidi_handle_report4(struct pcmidi_snd *pm, u8 *data)
bit_mask = (bit_mask << 8) | data[2];
bit_mask = (bit_mask << 8) | data[3];
+ /* robustness in case input_mapping hook does not get called */
+ if (!pm->input_ep82)
+ return 0;
+
/* break keys */
for (bit_index = 0; bit_index < 24; bit_index++) {
if (!((0x01 << bit_index) & bit_mask)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 563/844] HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (561 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 562/844] HID: prodikeys: Check presence of pm->input_ep82 Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 564/844] fs: ensure that internal tmpfs mount gets mount id zero Sasha Levin
` (289 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Günther Noack, Jiri Kosina, Sasha Levin
From: Günther Noack <gnoack@google.com>
[ Upstream commit 1547d41f9f19d691c2c9ce4c29f746297baef9e9 ]
Do not crash when a report has no fields.
Fake USB gadgets can send their own HID report descriptors and can define report
structures without valid fields. This can be used to crash the kernel over USB.
Cc: stable@vger.kernel.org
Signed-off-by: Günther Noack <gnoack@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index ca96102121b85..02d83c3bd73d4 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4314,7 +4314,7 @@ static int hidpp_get_report_length(struct hid_device *hdev, int id)
re = &(hdev->report_enum[HID_OUTPUT_REPORT]);
report = re->report_id_hash[id];
- if (!report)
+ if (!report || !report->maxfield)
return 0;
return report->field[0]->report_count + 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 564/844] fs: ensure that internal tmpfs mount gets mount id zero
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (562 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 563/844] HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 565/844] arm64: dts: apple: t8112-j473: Keep the HDMI port powered on Sasha Levin
` (288 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Christian Brauner, Jeff Layton, Sasha Levin
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit a2062463e894039a6fdc2334b96afd91d44b64a8 ]
and the rootfs get mount id one as it always has. Before we actually
mount the rootfs we create an internal tmpfs mount which has mount id
zero but is never exposed anywhere. Continue that "tradition".
Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-1-88dd1c34a204@kernel.org
Fixes: 7f9bfafc5f49 ("fs: use xarray for old mount id")
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index f6879f282daec..ecf0e72ce6cfd 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -221,7 +221,7 @@ static int mnt_alloc_id(struct mount *mnt)
int res;
xa_lock(&mnt_id_xa);
- res = __xa_alloc(&mnt_id_xa, &mnt->mnt_id, mnt, XA_LIMIT(1, INT_MAX), GFP_KERNEL);
+ res = __xa_alloc(&mnt_id_xa, &mnt->mnt_id, mnt, xa_limit_31b, GFP_KERNEL);
if (!res)
mnt->mnt_id_unique = ++mnt_id_ctr;
xa_unlock(&mnt_id_xa);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 565/844] arm64: dts: apple: t8112-j473: Keep the HDMI port powered on
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (563 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 564/844] fs: ensure that internal tmpfs mount gets mount id zero Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:27 ` [PATCH 6.19 566/844] media: amphion: Drop min_queued_buffers assignment Sasha Levin
` (287 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Janne Grunau, Sven Peter, Sasha Levin
From: Janne Grunau <j@jannau.net>
[ Upstream commit 3e4e729325131fe6f7473a0673f7d8cdde53f5a0 ]
Add the display controller and DPTX phy power-domains to the framebuffer
node to keep the framebuffer and display out working after device probing
finished.
The OS has more control about the display pipeline used for the HDMI
output on M2 based devices. The HDMI output is driven by an integrated
DisplayPort to HDMI converter (Parade PS190). The DPTX phy is now
controlled by the OS and no longer by firmware running on the display
co-processor. This allows using the second display controller on the
second USB type-c port or tunneling 2 DisplayPort connections over
USB4/Thunderbolt.
The m1n1 bootloader uses the second display controller to drive the HDMI
output. Adjust for this difference compared to the notebooks as well.
Fixes: 2d5ce3fbef32 ("arm64: dts: apple: t8112: Initial t8112 (M2) device trees")
Cc: stable@vger.kernel.org
Signed-off-by: Janne Grunau <j@jannau.net>
Link: https://patch.msgid.link/20260108-apple-dt-pmgr-fixes-v1-1-cfdce629c0a8@jannau.net
Signed-off-by: Sven Peter <sven@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/apple/t8112-j473.dts | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/arch/arm64/boot/dts/apple/t8112-j473.dts b/arch/arm64/boot/dts/apple/t8112-j473.dts
index 06fe257f08be4..4ae1ce919dafc 100644
--- a/arch/arm64/boot/dts/apple/t8112-j473.dts
+++ b/arch/arm64/boot/dts/apple/t8112-j473.dts
@@ -21,6 +21,25 @@ aliases {
};
};
+/*
+ * Keep the power-domains used for the HDMI port on.
+ */
+&framebuffer0 {
+ power-domains = <&ps_dispext_cpu0>, <&ps_dptx_ext_phy>;
+};
+
+/*
+ * The M2 Mac mini uses dispext for the HDMI output so it's not necessary to
+ * keep disp0 power-domains always-on.
+ */
+&ps_disp0_sys {
+ /delete-property/ apple,always-on;
+};
+
+&ps_disp0_fe {
+ /delete-property/ apple,always-on;
+};
+
/*
* Force the bus number assignments so that we can declare some of the
* on-board devices and properties that are populated by the bootloader
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 566/844] media: amphion: Drop min_queued_buffers assignment
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (564 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 565/844] arm64: dts: apple: t8112-j473: Keep the HDMI port powered on Sasha Levin
@ 2026-02-28 17:27 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 567/844] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() Sasha Levin
` (286 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:27 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ming Qian, Nicolas Dufresne, Frank Li, Hans Verkuil, Sasha Levin
From: Ming Qian <ming.qian@oss.nxp.com>
[ Upstream commit 5633ec763a2a18cef6c5ac9250e4f4b8786e7999 ]
The min_queued_buffers field controls when start_streaming() is called
by the vb2 core (it delays the callback until at least N buffers are
queued). Setting it to 1 affects the timing of start_streaming(), which
breaks the seek flow in decoder scenarios and causes test failures.
The current driver implementation does not rely on this minimum buffer
requirement and handles streaming start correctly with the default
value of 0, so remove these assignments.
Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
Cc: stable@vger.kernel.org
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/amphion/vpu_v4l2.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
index 47dff9a35bb46..1fb887b9098c6 100644
--- a/drivers/media/platform/amphion/vpu_v4l2.c
+++ b/drivers/media/platform/amphion/vpu_v4l2.c
@@ -670,7 +670,6 @@ static int vpu_m2m_queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_q
src_vq->mem_ops = &vb2_vmalloc_memops;
src_vq->drv_priv = inst;
src_vq->buf_struct_size = sizeof(struct vpu_vb2_buffer);
- src_vq->min_queued_buffers = 1;
src_vq->dev = inst->vpu->dev;
src_vq->lock = &inst->lock;
ret = vb2_queue_init(src_vq);
@@ -687,7 +686,6 @@ static int vpu_m2m_queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_q
dst_vq->mem_ops = &vb2_vmalloc_memops;
dst_vq->drv_priv = inst;
dst_vq->buf_struct_size = sizeof(struct vpu_vb2_buffer);
- dst_vq->min_queued_buffers = 1;
dst_vq->dev = inst->vpu->dev;
dst_vq->lock = &inst->lock;
ret = vb2_queue_init(dst_vq);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 567/844] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (565 preceding siblings ...)
2026-02-28 17:27 ` [PATCH 6.19 566/844] media: amphion: Drop min_queued_buffers assignment Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 568/844] media: verisilicon: AV1: Set IDR flag for intra_only frame type Sasha Levin
` (285 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alper Ak, Michael Tretter, Nicolas Dufresne, Hans Verkuil,
Sasha Levin
From: Alper Ak <alperyasinak1@gmail.com>
[ Upstream commit 81f8e0e6a2e115df9274d0289779f8fca694479c ]
rga_get_frame() can return ERR_PTR(-EINVAL) when buffer type is
unsupported or invalid. rga_buf_init() does not check the return value
and unconditionally dereferences the pointer when accessing f->size.
Add proper ERR_PTR checking and return the error to prevent
dereferencing an invalid pointer.
Fixes: 6040702ade23 ("media: rockchip: rga: allocate DMA descriptors per buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rga/rga-buf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c
index 730bdf98565a5..bb575873f2b24 100644
--- a/drivers/media/platform/rockchip/rga/rga-buf.c
+++ b/drivers/media/platform/rockchip/rga/rga-buf.c
@@ -80,6 +80,9 @@ static int rga_buf_init(struct vb2_buffer *vb)
struct rga_frame *f = rga_get_frame(ctx, vb->vb2_queue->type);
size_t n_desc = 0;
+ if (IS_ERR(f))
+ return PTR_ERR(f);
+
n_desc = DIV_ROUND_UP(f->size, PAGE_SIZE);
rbuf->n_desc = n_desc;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 568/844] media: verisilicon: AV1: Set IDR flag for intra_only frame type
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (566 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 567/844] media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 569/844] media: tegra-video: Fix memory leak in __tegra_channel_try_format() Sasha Levin
` (284 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Benjamin Gaignard, Jianfeng Liu, Nicolas Dufresne, Hans Verkuil,
Sasha Levin
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
[ Upstream commit 1c1b79f40ee4444fa1ac96079751608b724c6b2b ]
Intra_only frame could be considered as a key frame so Instantaneous
Decoding Refresh (IDR) flag must be set of the both case and not only
for key frames.
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Reported-by: Jianfeng Liu <liujianfeng1994@gmail.com>
Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index f52b8208e6b93..500e94bcb0293 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -2018,7 +2018,7 @@ static void rockchip_vpu981_av1_dec_set_parameters(struct hantro_ctx *ctx)
!!(ctrls->frame->quantization.flags
& V4L2_AV1_QUANTIZATION_FLAG_DELTA_Q_PRESENT));
- hantro_reg_write(vpu, &av1_idr_pic_e, !ctrls->frame->frame_type);
+ hantro_reg_write(vpu, &av1_idr_pic_e, IS_INTRA(ctrls->frame->frame_type));
hantro_reg_write(vpu, &av1_quant_base_qindex, ctrls->frame->quantization.base_q_idx);
hantro_reg_write(vpu, &av1_bit_depth_y_minus8, ctx->bit_depth - 8);
hantro_reg_write(vpu, &av1_bit_depth_c_minus8, ctx->bit_depth - 8);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 569/844] media: tegra-video: Fix memory leak in __tegra_channel_try_format()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (567 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 568/844] media: verisilicon: AV1: Set IDR flag for intra_only frame type Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 570/844] media: radio-keene: fix memory leak in error path Sasha Levin
` (283 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zilin Guan, Hans Verkuil, Sasha Levin
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 43e5302d22334f1183dec3e0d5d8007eefe2817c ]
The state object allocated by __v4l2_subdev_state_alloc() must be freed
with __v4l2_subdev_state_free() when it is no longer needed.
In __tegra_channel_try_format(), two error paths return directly after
v4l2_subdev_call() fails, without freeing the allocated 'sd_state'
object. This violates the requirement and causes a memory leak.
Fix this by introducing a cleanup label and using goto statements in the
error paths to ensure that __v4l2_subdev_state_free() is always called
before the function returns.
Fixes: 56f64b82356b7 ("media: tegra-video: Use zero crop settings if subdev has no get_selection")
Fixes: 1ebaeb09830f3 ("media: tegra-video: Add support for external sensor capture")
Cc: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/tegra-video/vi.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c
index c9276ff76157f..14b327afe045e 100644
--- a/drivers/staging/media/tegra-video/vi.c
+++ b/drivers/staging/media/tegra-video/vi.c
@@ -438,7 +438,7 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan,
.target = V4L2_SEL_TGT_CROP_BOUNDS,
};
struct v4l2_rect *try_crop;
- int ret;
+ int ret = 0;
subdev = tegra_channel_get_remote_source_subdev(chan);
if (!subdev)
@@ -482,8 +482,10 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan,
} else {
ret = v4l2_subdev_call(subdev, pad, get_selection,
NULL, &sdsel);
- if (ret)
- return -EINVAL;
+ if (ret) {
+ ret = -EINVAL;
+ goto out_free;
+ }
try_crop->width = sdsel.r.width;
try_crop->height = sdsel.r.height;
@@ -495,14 +497,15 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan,
ret = v4l2_subdev_call(subdev, pad, set_fmt, sd_state, &fmt);
if (ret < 0)
- return ret;
+ goto out_free;
v4l2_fill_pix_format(pix, &fmt.format);
chan->vi->ops->vi_fmt_align(pix, fmtinfo->bpp);
+out_free:
__v4l2_subdev_state_free(sd_state);
- return 0;
+ return ret;
}
static int tegra_channel_try_format(struct file *file, void *fh,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 570/844] media: radio-keene: fix memory leak in error path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (568 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 569/844] media: tegra-video: Fix memory leak in __tegra_channel_try_format() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 571/844] media: cx88: Add missing unmap in snd_cx88_hw_params() Sasha Levin
` (282 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shaurya Rane, syzbot+a41b73dce23962a74c72, Hans Verkuil,
Sasha Levin
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
[ Upstream commit b8bf939d77c0cd01118e953bbf554e0fa15e9006 ]
Fix a memory leak in usb_keene_probe(). The v4l2 control handler is
initialized and controls are added, but if v4l2_device_register() or
video_register_device() fails afterward, the handler was never freed,
leaking memory.
Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure
the control handler is properly freed for all error paths after it is
initialized.
Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a41b73dce23962a74c72
Fixes: 1bf20c3a0c61 ("[media] radio-keene: add a driver for the Keene FM Transmitter")
Cc: stable@vger.kernel.org
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/radio/radio-keene.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/radio/radio-keene.c b/drivers/media/radio/radio-keene.c
index f3b57f0cb1ec4..c133305fd0194 100644
--- a/drivers/media/radio/radio-keene.c
+++ b/drivers/media/radio/radio-keene.c
@@ -338,7 +338,6 @@ static int usb_keene_probe(struct usb_interface *intf,
if (hdl->error) {
retval = hdl->error;
- v4l2_ctrl_handler_free(hdl);
goto err_v4l2;
}
retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);
@@ -384,6 +383,7 @@ static int usb_keene_probe(struct usb_interface *intf,
err_vdev:
v4l2_device_unregister(&radio->v4l2_dev);
err_v4l2:
+ v4l2_ctrl_handler_free(&radio->hdl);
kfree(radio->buffer);
kfree(radio);
err:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 571/844] media: cx88: Add missing unmap in snd_cx88_hw_params()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (569 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 570/844] media: radio-keene: fix memory leak in error path Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 572/844] media: cx23885: Add missing unmap in snd_cx23885_hw_params() Sasha Levin
` (281 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Hans Verkuil, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit dbc527d980f7ba8559de38f8c1e4158c71a78915 ]
In error path, add cx88_alsa_dma_unmap() to release
resource acquired by cx88_alsa_dma_map().
Fixes: b2c75abde0de ("[media] cx88: drop videobuf abuse in cx88-alsa")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx88/cx88-alsa.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/cx88/cx88-alsa.c b/drivers/media/pci/cx88/cx88-alsa.c
index 29fb1311e4434..4e574d8390b4d 100644
--- a/drivers/media/pci/cx88/cx88-alsa.c
+++ b/drivers/media/pci/cx88/cx88-alsa.c
@@ -483,8 +483,10 @@ static int snd_cx88_hw_params(struct snd_pcm_substream *substream,
ret = cx88_risc_databuffer(chip->pci, &buf->risc, buf->sglist,
chip->period_size, chip->num_periods, 1);
- if (ret < 0)
+ if (ret < 0) {
+ cx88_alsa_dma_unmap(chip);
goto error;
+ }
/* Loop back to start of program */
buf->risc.jmp[0] = cpu_to_le32(RISC_JUMP | RISC_IRQ1 | RISC_CNT_INC);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 572/844] media: cx23885: Add missing unmap in snd_cx23885_hw_params()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (570 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 571/844] media: cx88: Add missing unmap in snd_cx88_hw_params() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 573/844] media: cx25821: Add missing unmap in snd_cx25821_hw_params() Sasha Levin
` (280 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Hans Verkuil, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2 ]
In error path, add cx23885_alsa_dma_unmap() to release the
resource acquired by cx23885_alsa_dma_map().
Fixes: 9529a4b0cf49 ("[media] cx23885: drop videobuf abuse in cx23885-alsa")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx23885/cx23885-alsa.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c
index 25dc8d4dc5b73..717fc6c9ef21f 100644
--- a/drivers/media/pci/cx23885/cx23885-alsa.c
+++ b/drivers/media/pci/cx23885/cx23885-alsa.c
@@ -392,8 +392,10 @@ static int snd_cx23885_hw_params(struct snd_pcm_substream *substream,
ret = cx23885_risc_databuffer(chip->pci, &buf->risc, buf->sglist,
chip->period_size, chip->num_periods, 1);
- if (ret < 0)
+ if (ret < 0) {
+ cx23885_alsa_dma_unmap(chip);
goto error;
+ }
/* Loop back to start of program */
buf->risc.jmp[0] = cpu_to_le32(RISC_JUMP|RISC_IRQ1|RISC_CNT_INC);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 573/844] media: cx25821: Add missing unmap in snd_cx25821_hw_params()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (571 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 572/844] media: cx23885: Add missing unmap in snd_cx23885_hw_params() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 574/844] media: i2c/tw9903: Fix potential memory leak in tw9903_probe() Sasha Levin
` (279 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Hans Verkuil, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 863f50d583445c3c8b28a0fc4bb9c18fd9656f41 ]
In error path, add cx25821_alsa_dma_unmap() to release the
resource acquired by cx25821_alsa_dma_map()
Fixes: 8d8e6d6005de ("[media] cx28521: drop videobuf abuse in cx25821-alsa")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx25821/cx25821-alsa.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/pci/cx25821/cx25821-alsa.c b/drivers/media/pci/cx25821/cx25821-alsa.c
index a42f0c03a7ca8..f463365163b7e 100644
--- a/drivers/media/pci/cx25821/cx25821-alsa.c
+++ b/drivers/media/pci/cx25821/cx25821-alsa.c
@@ -535,6 +535,7 @@ static int snd_cx25821_hw_params(struct snd_pcm_substream *substream,
chip->period_size, chip->num_periods, 1);
if (ret < 0) {
pr_info("DEBUG: ERROR after cx25821_risc_databuffer_audio()\n");
+ cx25821_alsa_dma_unmap(chip);
goto error;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 574/844] media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (572 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 573/844] media: cx25821: Add missing unmap in snd_cx25821_hw_params() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 575/844] media: i2c/tw9906: Fix potential memory leak in tw9906_probe() Sasha Levin
` (278 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Abdun Nihaal, Hans Verkuil, Sasha Levin
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 9cea16fea47e5553f51d10957677ff735b1eff03 ]
In one of the error paths in tw9903_probe(), the memory allocated in
v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that
by calling v4l2_ctrl_handler_free() on the handler in that error path.
Cc: stable@vger.kernel.org
Fixes: 0890ec19c65d ("[media] tw9903: add new tw9903 video decoder")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/tw9903.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/tw9903.c b/drivers/media/i2c/tw9903.c
index b996a05e56f28..c3eafd5d5dc82 100644
--- a/drivers/media/i2c/tw9903.c
+++ b/drivers/media/i2c/tw9903.c
@@ -228,6 +228,7 @@ static int tw9903_probe(struct i2c_client *client)
if (write_regs(sd, initial_registers) < 0) {
v4l2_err(client, "error initializing TW9903\n");
+ v4l2_ctrl_handler_free(hdl);
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 575/844] media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (573 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 574/844] media: i2c/tw9903: Fix potential memory leak in tw9903_probe() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 576/844] media: i2c: ov01a10: Fix the horizontal flip control Sasha Levin
` (277 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Abdun Nihaal, Hans Verkuil, Sasha Levin
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit cad237b6c875fbee5d353a2b289e98d240d17ec8 ]
In one of the error paths in tw9906_probe(), the memory allocated in
v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that
by calling v4l2_ctrl_handler_free() on the handler in that error path.
Cc: stable@vger.kernel.org
Fixes: a000e9a02b58 ("[media] tw9906: add Techwell tw9906 video decoder")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/tw9906.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/tw9906.c b/drivers/media/i2c/tw9906.c
index 6220f4fddbabc..0ab43fe42d7f4 100644
--- a/drivers/media/i2c/tw9906.c
+++ b/drivers/media/i2c/tw9906.c
@@ -196,6 +196,7 @@ static int tw9906_probe(struct i2c_client *client)
if (write_regs(sd, initial_registers) < 0) {
v4l2_err(client, "error initializing TW9906\n");
+ v4l2_ctrl_handler_free(hdl);
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 576/844] media: i2c: ov01a10: Fix the horizontal flip control
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (574 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 575/844] media: i2c/tw9906: Fix potential memory leak in tw9906_probe() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 577/844] media: i2c: ov01a10: Fix reported pixel-rate value Sasha Levin
` (276 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Mehdi Djait, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit ada20c3db0db4f2834d9515f6105111871f04a4d ]
During sensor calibration I noticed that with the hflip control set
to false/disabled the image was mirrored.
So it seems that the horizontal flip control is inverted and needs to
be set to 1 to not flip (just like the similar problem recently fixed
on the ov08x40 sensor).
Invert the hflip control to fix the sensor mirroring by default.
As the comment above the newly added OV01A10_MEDIA_BUS_FMT define explains
the control being inverted also means that the native Bayer-order of
the sensor actually is GBRG not BGGR, but so as to not break userspace
the Bayer-order is kept at BGGR.
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index 141cb6f75b555..e5df01f979781 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -75,6 +75,15 @@
#define OV01A10_REG_X_WIN 0x3811
#define OV01A10_REG_Y_WIN 0x3813
+/*
+ * The native ov01a10 bayer-pattern is GBRG, but there was a driver bug enabling
+ * hflip/mirroring by default resulting in BGGR. Because of this bug Intel's
+ * proprietary IPU6 userspace stack expects BGGR. So we report BGGR to not break
+ * userspace and fix things up by shifting the crop window-x coordinate by 1
+ * when hflip is *disabled*.
+ */
+#define OV01A10_MEDIA_BUS_FMT MEDIA_BUS_FMT_SBGGR10_1X10
+
struct ov01a10_reg {
u16 address;
u8 val;
@@ -185,14 +194,14 @@ static const struct ov01a10_reg sensor_1280x800_setting[] = {
{0x380e, 0x03},
{0x380f, 0x80},
{0x3810, 0x00},
- {0x3811, 0x08},
+ {0x3811, 0x09},
{0x3812, 0x00},
{0x3813, 0x08},
{0x3814, 0x01},
{0x3815, 0x01},
{0x3816, 0x01},
{0x3817, 0x01},
- {0x3820, 0xa0},
+ {0x3820, 0xa8},
{0x3822, 0x13},
{0x3832, 0x28},
{0x3833, 0x10},
@@ -411,7 +420,7 @@ static int ov01a10_set_hflip(struct ov01a10 *ov01a10, u32 hflip)
int ret;
u32 val, offset;
- offset = hflip ? 0x9 : 0x8;
+ offset = hflip ? 0x8 : 0x9;
ret = ov01a10_write_reg(ov01a10, OV01A10_REG_X_WIN, 1, offset);
if (ret)
return ret;
@@ -420,8 +429,8 @@ static int ov01a10_set_hflip(struct ov01a10 *ov01a10, u32 hflip)
if (ret)
return ret;
- val = hflip ? val | FIELD_PREP(OV01A10_HFLIP_MASK, 0x1) :
- val & ~OV01A10_HFLIP_MASK;
+ val = hflip ? val & ~OV01A10_HFLIP_MASK :
+ val | FIELD_PREP(OV01A10_HFLIP_MASK, 0x1);
return ov01a10_write_reg(ov01a10, OV01A10_REG_FORMAT1, 1, val);
}
@@ -610,7 +619,7 @@ static void ov01a10_update_pad_format(const struct ov01a10_mode *mode,
{
fmt->width = mode->width;
fmt->height = mode->height;
- fmt->code = MEDIA_BUS_FMT_SBGGR10_1X10;
+ fmt->code = OV01A10_MEDIA_BUS_FMT;
fmt->field = V4L2_FIELD_NONE;
fmt->colorspace = V4L2_COLORSPACE_RAW;
}
@@ -751,7 +760,7 @@ static int ov01a10_enum_mbus_code(struct v4l2_subdev *sd,
if (code->index > 0)
return -EINVAL;
- code->code = MEDIA_BUS_FMT_SBGGR10_1X10;
+ code->code = OV01A10_MEDIA_BUS_FMT;
return 0;
}
@@ -761,7 +770,7 @@ static int ov01a10_enum_frame_size(struct v4l2_subdev *sd,
struct v4l2_subdev_frame_size_enum *fse)
{
if (fse->index >= ARRAY_SIZE(supported_modes) ||
- fse->code != MEDIA_BUS_FMT_SBGGR10_1X10)
+ fse->code != OV01A10_MEDIA_BUS_FMT)
return -EINVAL;
fse->min_width = supported_modes[fse->index].width;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 577/844] media: i2c: ov01a10: Fix reported pixel-rate value
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (575 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 576/844] media: i2c: ov01a10: Fix the horizontal flip control Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 578/844] media: i2c: ov01a10: Fix analogue gain range Sasha Levin
` (275 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Mehdi Djait, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 9c632eebf6af4cb7b0f85503fe1ebc5176ff0db1 ]
CSI lanes are double-clocked so with a single lane at 400MHZ the resulting
pixel-rate for 10-bits pixels is 400 MHz * 2 / 10 = 80 MHz, not 40 MHz.
This also matches with the observed frame-rate of 60 fps with the default
vblank setting: 80000000 / (1488 * 896) = 60.
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index e5df01f979781..0b1a1ecfffd0e 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -16,7 +16,7 @@
#include <media/v4l2-fwnode.h>
#define OV01A10_LINK_FREQ_400MHZ 400000000ULL
-#define OV01A10_SCLK 40000000LL
+#define OV01A10_SCLK 80000000LL
#define OV01A10_DATA_LANES 1
#define OV01A10_REG_CHIP_ID 0x300a
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 578/844] media: i2c: ov01a10: Fix analogue gain range
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (576 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 577/844] media: i2c: ov01a10: Fix reported pixel-rate value Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 579/844] media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls Sasha Levin
` (274 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Mehdi Djait, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 109e0feacaeca5ec2dd71d7d17c73232ce5cbddc ]
A analogue maximum gain of 0xffff / 65525 seems unlikely and testing
indeed shows that the gain control wraps-around at 16383, so set the
maximum gain to 0x3fff / 16383.
The minimum gain of 0x100 is correct. Setting bits 8-11 to 0x0 results
in the same gain values as setting these bits to 0x1, with bits 0-7
still increasing the gain when going from 0x000 - 0x0ff in the exact
same range as when going from 0x100 - 0x1ff.
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
[Sakari Ailus: mention analogue gain and update the limit from 4096.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index 0b1a1ecfffd0e..834ca46acb75f 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -48,7 +48,7 @@
/* analog gain controls */
#define OV01A10_REG_ANALOG_GAIN 0x3508
#define OV01A10_ANAL_GAIN_MIN 0x100
-#define OV01A10_ANAL_GAIN_MAX 0xffff
+#define OV01A10_ANAL_GAIN_MAX 0x3fff
#define OV01A10_ANAL_GAIN_STEP 1
/* digital gain controls */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 579/844] media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (577 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 578/844] media: i2c: ov01a10: Fix analogue gain range Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 580/844] media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() Sasha Levin
` (273 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Mehdi Djait, Bingbu Cao, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 0dfec6e30c334364145d0acb38bb8c216b9a7a78 ]
Add missing v4l2_subdev_cleanup() calls to cleanup after
v4l2_subdev_init_finalize().
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index 834ca46acb75f..1e22df12989ae 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -864,6 +864,7 @@ static void ov01a10_remove(struct i2c_client *client)
struct v4l2_subdev *sd = i2c_get_clientdata(client);
v4l2_async_unregister_subdev(sd);
+ v4l2_subdev_cleanup(sd);
media_entity_cleanup(&sd->entity);
v4l2_ctrl_handler_free(sd->ctrl_handler);
@@ -934,6 +935,7 @@ static int ov01a10_probe(struct i2c_client *client)
err_pm_disable:
pm_runtime_disable(dev);
pm_runtime_set_suspended(&client->dev);
+ v4l2_subdev_cleanup(&ov01a10->sd);
err_media_entity_cleanup:
media_entity_cleanup(&ov01a10->sd.entity);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 580/844] media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (578 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 579/844] media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 581/844] media: i2c: ov01a10: Fix test-pattern disabling Sasha Levin
` (272 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Mehdi Djait, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit f8563a375e7fba7c776eb591d4498be592c19098 ]
The 2 argument version of v4l2_subdev_state_get_format() takes the pad
as second argument, not the stream.
Fixes: bc0e8d91feec ("media: v4l: subdev: Switch to stream-aware state functions")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index 1e22df12989ae..dd2b6d381175a 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -731,7 +731,7 @@ static int ov01a10_set_format(struct v4l2_subdev *sd,
h_blank);
}
- format = v4l2_subdev_state_get_format(sd_state, fmt->stream);
+ format = v4l2_subdev_state_get_format(sd_state, fmt->pad);
*format = fmt->format;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 581/844] media: i2c: ov01a10: Fix test-pattern disabling
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (579 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 580/844] media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 582/844] media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() Sasha Levin
` (271 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Mehdi Djait, Bingbu Cao, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit 409fb57c1b3deada4b8e153eb6344afb3c2dfb9c ]
When the test-pattern control gets set to 0 (Disabled) 0 should be written
to the test-pattern register, rather then doing nothing.
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index dd2b6d381175a..3ad516e4d3698 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -249,9 +249,8 @@ static const struct ov01a10_reg sensor_1280x800_setting[] = {
static const char * const ov01a10_test_pattern_menu[] = {
"Disabled",
"Color Bar",
- "Top-Bottom Darker Color Bar",
- "Right-Left Darker Color Bar",
- "Color Bar type 4",
+ "Left-Right Darker Color Bar",
+ "Bottom-Top Darker Color Bar",
};
static const s64 link_freq_menu_items[] = {
@@ -406,10 +405,8 @@ static int ov01a10_update_digital_gain(struct ov01a10 *ov01a10, u32 d_gain)
static int ov01a10_test_pattern(struct ov01a10 *ov01a10, u32 pattern)
{
- if (!pattern)
- return 0;
-
- pattern = (pattern - 1) | OV01A10_TEST_PATTERN_ENABLE;
+ if (pattern)
+ pattern |= OV01A10_TEST_PATTERN_ENABLE;
return ov01a10_write_reg(ov01a10, OV01A10_REG_TEST_PATTERN, 1, pattern);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 582/844] media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (580 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 581/844] media: i2c: ov01a10: Fix test-pattern disabling Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 583/844] media: ccs: Avoid possible division by zero Sasha Levin
` (270 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alper Ak, Bryan O'Donoghue, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Alper Ak <alperyasinak1@gmail.com>
[ Upstream commit d965919af524e68cb2ab1a685872050ad2ee933d ]
vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop
bound and passes the index to vfe_isr_reg_update(). However,
vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):
struct vfe_line line[VFE_LINE_NUM_MAX];
When index is 4, 5, 6, the access to vfe->line[line_id] exceeds
the array bounds and resulting in out-of-bounds memory access.
Fix this by using separate loops for output lines and write masters.
Fixes: 4edc8eae715c ("media: camss: Add initial support for VFE hardware version Titan 480")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/camss/camss-vfe-480.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-480.c b/drivers/media/platform/qcom/camss/camss-vfe-480.c
index 4feea590a47bc..d73f733fde045 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-480.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-480.c
@@ -202,11 +202,13 @@ static irqreturn_t vfe_isr(int irq, void *dev)
writel_relaxed(status, vfe->base + VFE_BUS_IRQ_CLEAR(0));
writel_relaxed(1, vfe->base + VFE_BUS_IRQ_CLEAR_GLOBAL);
- /* Loop through all WMs IRQs */
- for (i = 0; i < MSM_VFE_IMAGE_MASTERS_NUM; i++) {
+ for (i = 0; i < MAX_VFE_OUTPUT_LINES; i++) {
if (status & BUS_IRQ_MASK_0_RDI_RUP(vfe, i))
vfe_isr_reg_update(vfe, i);
+ }
+ /* Loop through all WMs IRQs */
+ for (i = 0; i < MSM_VFE_IMAGE_MASTERS_NUM; i++) {
if (status & BUS_IRQ_MASK_0_COMP_DONE(vfe, RDI_COMP_GROUP(i)))
vfe_buf_done(vfe, i);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 583/844] media: ccs: Avoid possible division by zero
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (581 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 582/844] media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 584/844] media: i2c: ov5647: Initialize subdev before controls Sasha Levin
` (269 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sakari Ailus, Josh Poimboeuf, Nathan Chancellor, Hans Verkuil,
Sasha Levin
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 679f0b7b6a409750a25754c8833e268e5fdde742 ]
Calculating maximum M for scaler configuration involves dividing by
MIN_X_OUTPUT_SIZE limit register's value. Albeit the value is presumably
non-zero, the driver was missing the check it in fact was. Fix this.
Reported-by: Josh Poimboeuf <jpoimboe@kernel.org>
Closes: https://lore.kernel.org/all/ahukd6b3wonye3zgtptvwzvrxldcruazs2exfvll6etjhmcxyj@vq3eh6pd375b/
Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver")
Cc: stable@vger.kernel.org # for 5.15 and later
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org> # build
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ccs/ccs-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
index 43f7d515bab67..3cacc7d904935 100644
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -2346,7 +2346,7 @@ static void ccs_set_compose_scaler(struct v4l2_subdev *subdev,
* CCS_LIM(sensor, SCALER_N_MIN) / sel->r.height;
max_m = crops[CCS_PAD_SINK]->width
* CCS_LIM(sensor, SCALER_N_MIN)
- / CCS_LIM(sensor, MIN_X_OUTPUT_SIZE);
+ / (CCS_LIM(sensor, MIN_X_OUTPUT_SIZE) ?: 1);
a = clamp(a, CCS_LIM(sensor, SCALER_M_MIN),
CCS_LIM(sensor, SCALER_M_MAX));
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 584/844] media: i2c: ov5647: Initialize subdev before controls
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (582 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 583/844] media: ccs: Avoid possible division by zero Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 585/844] media: i2c: ov5647: Correct pixel array offset Sasha Levin
` (268 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jai Luthra, Jacopo Mondi, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Jai Luthra <jai.luthra@ideasonboard.com>
[ Upstream commit eee13cbccacb6d0a3120c126b8544030905b069d ]
In ov5647_init_controls() we call v4l2_get_subdevdata, but it is
initialized by v4l2_i2c_subdev_init() in the probe, which currently
happens after init_controls(). This can result in a segfault if the
error condition is hit, and we try to access i2c_client, so fix the
order.
Fixes: 4974c2f19fd8 ("media: ov5647: Support gain, exposure and AWB controls")
Cc: stable@vger.kernel.org
Suggested-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index e193fef4fcedf..f9fac858dc7ba 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -1420,15 +1420,15 @@ static int ov5647_probe(struct i2c_client *client)
sensor->mode = OV5647_DEFAULT_MODE;
- ret = ov5647_init_controls(sensor);
- if (ret)
- goto mutex_destroy;
-
sd = &sensor->sd;
v4l2_i2c_subdev_init(sd, client, &ov5647_subdev_ops);
sd->internal_ops = &ov5647_subdev_internal_ops;
sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+ ret = ov5647_init_controls(sensor);
+ if (ret)
+ goto mutex_destroy;
+
sensor->pad.flags = MEDIA_PAD_FL_SOURCE;
sd->entity.function = MEDIA_ENT_F_CAM_SENSOR;
ret = media_entity_pads_init(&sd->entity, 1, &sensor->pad);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 585/844] media: i2c: ov5647: Correct pixel array offset
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (583 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 584/844] media: i2c: ov5647: Initialize subdev before controls Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 586/844] media: i2c: ov5647: Correct minimum VBLANK value Sasha Levin
` (267 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Plowman, Jacopo Mondi, Jai Luthra, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: David Plowman <david.plowman@raspberrypi.com>
[ Upstream commit a4e62e597f21bb37db0ad13aca486094e9188167 ]
The top offset in the pixel array is actually 6 (see page 3-1 of the
OV5647 data sheet).
Fixes: 14f70a3232aa ("media: ov5647: Add support for get_selection()")
Cc: stable@vger.kernel.org
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index f9fac858dc7ba..d9e300406f58e 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -69,7 +69,7 @@
#define OV5647_NATIVE_HEIGHT 1956U
#define OV5647_PIXEL_ARRAY_LEFT 16U
-#define OV5647_PIXEL_ARRAY_TOP 16U
+#define OV5647_PIXEL_ARRAY_TOP 6U
#define OV5647_PIXEL_ARRAY_WIDTH 2592U
#define OV5647_PIXEL_ARRAY_HEIGHT 1944U
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 586/844] media: i2c: ov5647: Correct minimum VBLANK value
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (584 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 585/844] media: i2c: ov5647: Correct pixel array offset Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 587/844] media: i2c: ov5647: Sensor should report RAW color space Sasha Levin
` (266 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Plowman, Jacopo Mondi, Jai Luthra, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: David Plowman <david.plowman@raspberrypi.com>
[ Upstream commit 1438248c5a82c86b4e1f0311c3bb827af747a8cf ]
Trial and error reveals that the minimum vblank value appears to be 24
(the OV5647 data sheet does not give any clues). This fixes streaming
lock-ups in full resolution mode.
Fixes: 2512c06441e3 ("media: ov5647: Support V4L2_CID_VBLANK control")
Cc: stable@vger.kernel.org
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index d9e300406f58e..191954497e3db 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -73,7 +73,7 @@
#define OV5647_PIXEL_ARRAY_WIDTH 2592U
#define OV5647_PIXEL_ARRAY_HEIGHT 1944U
-#define OV5647_VBLANK_MIN 4
+#define OV5647_VBLANK_MIN 24
#define OV5647_VTS_MAX 32767
#define OV5647_EXPOSURE_MIN 4
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 587/844] media: i2c: ov5647: Sensor should report RAW color space
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (585 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 586/844] media: i2c: ov5647: Correct minimum VBLANK value Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 588/844] media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode Sasha Levin
` (265 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Plowman, Jacopo Mondi, Jai Luthra, Sakari Ailus,
Hans Verkuil, Sasha Levin
From: David Plowman <david.plowman@raspberrypi.com>
[ Upstream commit f007586b1e89dcea40168415d0422cb7a0fc31b1 ]
As this sensor captures RAW bayer frames, the colorspace should be
V4L2_COLORSPACE_RAW instead of SRGB.
Fixes: a8df5af695a1 ("media: ov5647: Add SGGBR10_1X10 modes")
Cc: stable@vger.kernel.org
Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index 191954497e3db..c0f1121b025e5 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -508,7 +508,7 @@ static const struct ov5647_mode ov5647_modes[] = {
{
.format = {
.code = MEDIA_BUS_FMT_SBGGR10_1X10,
- .colorspace = V4L2_COLORSPACE_SRGB,
+ .colorspace = V4L2_COLORSPACE_RAW,
.field = V4L2_FIELD_NONE,
.width = 2592,
.height = 1944
@@ -529,7 +529,7 @@ static const struct ov5647_mode ov5647_modes[] = {
{
.format = {
.code = MEDIA_BUS_FMT_SBGGR10_1X10,
- .colorspace = V4L2_COLORSPACE_SRGB,
+ .colorspace = V4L2_COLORSPACE_RAW,
.field = V4L2_FIELD_NONE,
.width = 1920,
.height = 1080
@@ -550,7 +550,7 @@ static const struct ov5647_mode ov5647_modes[] = {
{
.format = {
.code = MEDIA_BUS_FMT_SBGGR10_1X10,
- .colorspace = V4L2_COLORSPACE_SRGB,
+ .colorspace = V4L2_COLORSPACE_RAW,
.field = V4L2_FIELD_NONE,
.width = 1296,
.height = 972
@@ -571,7 +571,7 @@ static const struct ov5647_mode ov5647_modes[] = {
{
.format = {
.code = MEDIA_BUS_FMT_SBGGR10_1X10,
- .colorspace = V4L2_COLORSPACE_SRGB,
+ .colorspace = V4L2_COLORSPACE_RAW,
.field = V4L2_FIELD_NONE,
.width = 640,
.height = 480
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 588/844] media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (586 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 587/844] media: i2c: ov5647: Sensor should report RAW color space Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 589/844] media: ccs: Fix setting initial sub-device state Sasha Levin
` (264 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jai Luthra, Dave Stevenson, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Jai Luthra <jai.luthra@ideasonboard.com>
[ Upstream commit c063632b494b02e891442d10f17e37b7fcfab9b3 ]
The pixel rate for VGA (640x480) mode is configured in the mode's table
to be 58.333 MPix/s instead of 55 MPix/s, so fix it.
Fixes: 911f4516ee2b ("media: ov5647: Support V4L2_CID_PIXEL_RATE")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/CAPY8ntA2TCf9FuB6Nk%2BOn%2By6N_PMuYPAOAr3Yx8YESwe4skWvw@mail.gmail.com/
Suggested-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index c0f1121b025e5..bf5b0bd8d6acb 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -582,7 +582,7 @@ static const struct ov5647_mode ov5647_modes[] = {
.width = 2560,
.height = 1920,
},
- .pixel_rate = 55000000,
+ .pixel_rate = 58333000,
.hts = 1852,
.vts = 0x1f8,
.reg_list = ov5647_640x480_10bpp,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 589/844] media: ccs: Fix setting initial sub-device state
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (587 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 588/844] media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 590/844] media: i2c: ov5647: use our own mutex for the ctrl lock Sasha Levin
` (263 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sakari Ailus, Hans Verkuil, Sasha Levin
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 31e5191aa11931b53e1242acef4f4375f00ca523 ]
Fix setting sub-device state for non-source sub-devices.
Fixes: 5755be5f15d9 ("media: v4l2-subdev: Rename .init_cfg() operation to .init_state()")
Cc: stable@vger.kernel.org # for v6.8 and later
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ccs/ccs-core.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
index 3cacc7d904935..8d30e808a635b 100644
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -2940,6 +2940,8 @@ static void ccs_cleanup(struct ccs_sensor *sensor)
ccs_free_controls(sensor);
}
+static const struct v4l2_subdev_internal_ops ccs_internal_ops;
+
static int ccs_init_subdev(struct ccs_sensor *sensor,
struct ccs_subdev *ssd, const char *name,
unsigned short num_pads, u32 function,
@@ -2952,8 +2954,10 @@ static int ccs_init_subdev(struct ccs_sensor *sensor,
if (!ssd)
return 0;
- if (ssd != sensor->src)
+ if (ssd != sensor->src) {
v4l2_subdev_init(&ssd->sd, &ccs_ops);
+ ssd->sd.internal_ops = &ccs_internal_ops;
+ }
ssd->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
ssd->sd.entity.function = function;
@@ -3062,6 +3066,10 @@ static const struct media_entity_operations ccs_entity_ops = {
.link_validate = v4l2_subdev_link_validate,
};
+static const struct v4l2_subdev_internal_ops ccs_internal_ops = {
+ .init_state = ccs_init_state,
+};
+
static const struct v4l2_subdev_internal_ops ccs_internal_src_ops = {
.init_state = ccs_init_state,
.registered = ccs_registered,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 590/844] media: i2c: ov5647: use our own mutex for the ctrl lock
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (588 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 589/844] media: ccs: Fix setting initial sub-device state Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 591/844] media: dw9714: Fix powerup sequence Sasha Levin
` (262 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xiaolei Wang, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit 973e42fd5d2b397bff34f0c249014902dbf65912 ]
__v4l2_ctrl_handler_setup() and __v4l2_ctrl_modify_range() contains an
assertion to verify that the v4l2_ctrl_handler::lock is held, as it should
only be called when the lock has already been acquired. Therefore use our
own mutex for the ctrl lock, otherwise a warning will be reported.
Fixes: 4974c2f19fd8 ("media: ov5647: Support gain, exposure and AWB controls")
Cc: stable@vger.kernel.org
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
[Sakari Ailus: Fix a minor conflict.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5647.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/i2c/ov5647.c b/drivers/media/i2c/ov5647.c
index bf5b0bd8d6acb..5fb10e02ba6e2 100644
--- a/drivers/media/i2c/ov5647.c
+++ b/drivers/media/i2c/ov5647.c
@@ -1291,6 +1291,8 @@ static int ov5647_init_controls(struct ov5647 *sensor)
v4l2_ctrl_handler_init(&sensor->ctrls, 9);
+ sensor->ctrls.lock = &sensor->lock;
+
v4l2_ctrl_new_std(&sensor->ctrls, &ov5647_ctrl_ops,
V4L2_CID_AUTOGAIN, 0, 1, 1, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 591/844] media: dw9714: Fix powerup sequence
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (589 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 590/844] media: i2c: ov5647: use our own mutex for the ctrl lock Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 592/844] media: ipu6: Fix typo and wrong constant in ipu6-mmu.c Sasha Levin
` (261 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ricardo Ribalda, Hans de Goede, Neil Sun, Naomi Huang,
Sakari Ailus, Hans Verkuil, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 401aec35ac7bd04b4018a519257b945abb88e26c ]
We have experienced seen multiple I2C errors while doing stress test on
the module:
dw9714 i2c-PRP0001:01: dw9714_vcm_resume I2C failure: -5
dw9714 i2c-PRP0001:01: I2C write fail
Inspecting the powerup sequence we found that it does not match the
documentation at:
https://blog.arducam.com/downloads/DW9714A-DONGWOON(Autofocus_motor_manual).pdf
"""
(2) DW9714A requires waiting time of 12ms after power on. During this
waiting time, the offset calibration of internal amplifier is
operating for minimization of output offset current .
"""
This patch increases the powerup delay to follow the documentation.
Fixes: 9d00ccabfbb5 ("media: i2c: dw9714: Fix occasional probe errors")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Tested-by: Neil Sun <neil.sun@lcfuturecenter.com>
Reported-by: Naomi Huang <naomi.huang@lcfuturecenter.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/dw9714.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/dw9714.c b/drivers/media/i2c/dw9714.c
index 1e7ad355a388c..3288de539452e 100644
--- a/drivers/media/i2c/dw9714.c
+++ b/drivers/media/i2c/dw9714.c
@@ -149,7 +149,7 @@ static int dw9714_power_up(struct dw9714_device *dw9714_dev)
gpiod_set_value_cansleep(dw9714_dev->powerdown_gpio, 0);
- usleep_range(1000, 2000);
+ usleep_range(12000, 14000);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 592/844] media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (590 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 591/844] media: dw9714: Fix powerup sequence Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 593/844] media: ipu6: Fix RPM reference leak in probe error paths Sasha Levin
` (260 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bingbu Cao, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 3e0fcc91277d5af114a58aaa68f34b44e8d8a411 ]
Fix two coding errors in ipu6-mmu.c:
1. Fix syntax error in page_table_dump() where the closing parenthesis
and semicolon were swapped in the TBL_PHYS_ADDR macro call.
2. Fix incorrect loop bound in alloc_l2_pt(). When initializing L2 page
table entries, the loop was incorrectly using ISP_L1PT_PTES instead
of ISP_L2PT_PTES.
Fixes: 9163d83573e4 ("media: intel/ipu6: add IPU6 DMA mapping API and MMU table")
Cc: stable@vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu6/ipu6-mmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/intel/ipu6/ipu6-mmu.c b/drivers/media/pci/intel/ipu6/ipu6-mmu.c
index 6d1c0b90169d4..85cc6d5b4dd11 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-mmu.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-mmu.c
@@ -102,7 +102,7 @@ static void page_table_dump(struct ipu6_mmu_info *mmu_info)
if (mmu_info->l1_pt[l1_idx] == mmu_info->dummy_l2_pteval)
continue;
- l2_phys = TBL_PHYS_ADDR(mmu_info->l1_pt[l1_idx];)
+ l2_phys = TBL_PHYS_ADDR(mmu_info->l1_pt[l1_idx]);
dev_dbg(mmu_info->dev,
"l1 entry %u; iovas 0x%8.8x-0x%8.8x, at %pap\n",
l1_idx, iova, iova + ISP_PAGE_SIZE, &l2_phys);
@@ -248,7 +248,7 @@ static u32 *alloc_l2_pt(struct ipu6_mmu_info *mmu_info)
dev_dbg(mmu_info->dev, "alloc_l2: get_zeroed_page() = %p\n", pt);
- for (i = 0; i < ISP_L1PT_PTES; i++)
+ for (i = 0; i < ISP_L2PT_PTES; i++)
pt[i] = mmu_info->dummy_page_pteval;
return pt;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 593/844] media: ipu6: Fix RPM reference leak in probe error paths
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (591 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 592/844] media: ipu6: Fix typo and wrong constant in ipu6-mmu.c Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 594/844] media: staging/ipu7: Ignore interrupts when device is suspended Sasha Levin
` (259 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bingbu Cao, Stable, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 6099f78e4c9223f4de4169d2fd1cded01279da1a ]
Several error paths in ipu6_pci_probe() were jumping directly to
out_ipu6_bus_del_devices without releasing the runtime PM reference.
Add pm_runtime_put_sync() before cleaning up other resources.
Cc: Stable@vger.kernel.org
Fixes: 25fedc021985 ("media: intel/ipu6: add Intel IPU6 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/intel/ipu6/ipu6.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
index 1f4f20b9c94dc..a2768f44017a5 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -630,21 +630,21 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
if (ret) {
dev_err_probe(&isp->pdev->dev, ret,
"Failed to set MMU hardware\n");
- goto out_ipu6_bus_del_devices;
+ goto out_ipu6_rpm_put;
}
ret = ipu6_buttress_map_fw_image(isp->psys, isp->cpd_fw,
&isp->psys->fw_sgt);
if (ret) {
dev_err_probe(&isp->pdev->dev, ret, "failed to map fw image\n");
- goto out_ipu6_bus_del_devices;
+ goto out_ipu6_rpm_put;
}
ret = ipu6_cpd_create_pkg_dir(isp->psys, isp->cpd_fw->data);
if (ret) {
dev_err_probe(&isp->pdev->dev, ret,
"failed to create pkg dir\n");
- goto out_ipu6_bus_del_devices;
+ goto out_ipu6_rpm_put;
}
ret = devm_request_threaded_irq(dev, pdev->irq, ipu6_buttress_isr,
@@ -652,7 +652,7 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
IRQF_SHARED, IPU6_NAME, isp);
if (ret) {
dev_err_probe(dev, ret, "Requesting irq failed\n");
- goto out_ipu6_bus_del_devices;
+ goto out_ipu6_rpm_put;
}
ret = ipu6_buttress_authenticate(isp);
@@ -683,6 +683,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
out_free_irq:
devm_free_irq(dev, pdev->irq, isp);
+out_ipu6_rpm_put:
+ pm_runtime_put_sync(&isp->psys->auxdev.dev);
out_ipu6_bus_del_devices:
if (isp->psys) {
ipu6_cpd_free_pkg_dir(isp->psys);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 594/844] media: staging/ipu7: Ignore interrupts when device is suspended
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (592 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 593/844] media: ipu6: Fix RPM reference leak in probe error paths Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 595/844] media: staging/ipu7: Call synchronous RPM suspend in probe failure Sasha Levin
` (258 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bingbu Cao, Stable, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 9ad65684b9285c5d66fb417d50e91a25ef8c994d ]
IPU7 devices have shared interrupts with others. In some case when IPU7
device is suspended, driver get unexpected interrupt and invalid irq
status 0xffffffff from ISR_STATUS and PB LOCAL_STATUS registers as
interrupt is triggered from other device on shared irq line.
In order to avoid this issue use pm_runtime_get_if_active() to check if
IPU7 device is resumed, ignore the invalid irq status and use
synchronize_irq() in suspend.
Cc: Stable@vger.kernel.org
Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7-buttress.c | 17 ++++++++++++++++-
drivers/staging/media/ipu7/ipu7.c | 4 ++++
2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/ipu7/ipu7-buttress.c b/drivers/staging/media/ipu7/ipu7-buttress.c
index e5707f5e300ba..40c6c8473357c 100644
--- a/drivers/staging/media/ipu7/ipu7-buttress.c
+++ b/drivers/staging/media/ipu7/ipu7-buttress.c
@@ -342,14 +342,23 @@ irqreturn_t ipu_buttress_isr(int irq, void *isp_ptr)
u32 disable_irqs = 0;
u32 irq_status;
unsigned int i;
+ int active;
- pm_runtime_get_noresume(dev);
+ active = pm_runtime_get_if_active(dev);
+ if (active <= 0)
+ return IRQ_NONE;
pb_irq = readl(isp->pb_base + INTERRUPT_STATUS);
writel(pb_irq, isp->pb_base + INTERRUPT_STATUS);
/* check btrs ATS, CFI and IMR errors, BIT(0) is unused for IPU */
pb_local_irq = readl(isp->pb_base + BTRS_LOCAL_INTERRUPT_MASK);
+ if (pb_local_irq == 0xffffffff) {
+ dev_warn_once(dev, "invalid PB irq status\n");
+ pm_runtime_put_noidle(dev);
+ return IRQ_NONE;
+ }
+
if (pb_local_irq & ~BIT(0)) {
dev_warn(dev, "PB interrupt status 0x%x local 0x%x\n", pb_irq,
pb_local_irq);
@@ -370,6 +379,12 @@ irqreturn_t ipu_buttress_isr(int irq, void *isp_ptr)
return IRQ_NONE;
}
+ if (irq_status == 0xffffffff) {
+ dev_warn_once(dev, "invalid irq status 0x%08x\n", irq_status);
+ pm_runtime_put_noidle(dev);
+ return IRQ_NONE;
+ }
+
do {
writel(irq_status, isp->base + BUTTRESS_REG_IRQ_CLEAR);
diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
index 5cddc09c72bf2..6c8c3eea44acb 100644
--- a/drivers/staging/media/ipu7/ipu7.c
+++ b/drivers/staging/media/ipu7/ipu7.c
@@ -2684,6 +2684,10 @@ static void ipu7_pci_reset_done(struct pci_dev *pdev)
*/
static int ipu7_suspend(struct device *dev)
{
+ struct pci_dev *pdev = to_pci_dev(dev);
+
+ synchronize_irq(pdev->irq);
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 595/844] media: staging/ipu7: Call synchronous RPM suspend in probe failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (593 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 594/844] media: staging/ipu7: Ignore interrupts when device is suspended Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 596/844] media: staging/ipu7: Update CDPHY register settings Sasha Levin
` (257 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bingbu Cao, Stable, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 1433e6ccc25e9ea596683ab66e1c51f37fc7d491 ]
If firmware authentication failed during driver probe, driver call an
asynchronous API to suspend the psys device but the bus device will be
removed soon, thus runtime PM of bus device will be disabled soon, that
will cancel the suspend request, so use synchronous suspend to make
sure the runtime suspend before disabling its RPM.
IPU7 hardware has constraints that the PSYS device must be powered off
before ISYS, otherwise it will cause machine check error.
Cc: Stable@vger.kernel.org
Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
index 6c8c3eea44acb..fa5a1867626f8 100644
--- a/drivers/staging/media/ipu7/ipu7.c
+++ b/drivers/staging/media/ipu7/ipu7.c
@@ -2620,7 +2620,7 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
if (!IS_ERR_OR_NULL(isp->isys) && !IS_ERR_OR_NULL(isp->isys->mmu))
ipu7_mmu_cleanup(isp->isys->mmu);
if (!IS_ERR_OR_NULL(isp->psys))
- pm_runtime_put(&isp->psys->auxdev.dev);
+ pm_runtime_put_sync(&isp->psys->auxdev.dev);
ipu7_bus_del_devices(pdev);
release_firmware(isp->cpd_fw);
buttress_exit:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 596/844] media: staging/ipu7: Update CDPHY register settings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (594 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 595/844] media: staging/ipu7: Call synchronous RPM suspend in probe failure Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 597/844] media: staging/ipu7: Fix the loop bound in l2 table alloc Sasha Levin
` (256 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bingbu Cao, Stable, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit f7923e6bafcad686adb51cc100ba1860f8b43922 ]
Some CPHY settings needs to updated according to the latest guide from
SNPS. This patch program 45ohm for tuning resistance to fix CPHY problem
and update the ITMINRX and GMODE for CPHY.
Cc: Stable@vger.kernel.org
Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7-isys-csi-phy.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/media/ipu7/ipu7-isys-csi-phy.c b/drivers/staging/media/ipu7/ipu7-isys-csi-phy.c
index 2d57178835188..3f15af3b4c799 100644
--- a/drivers/staging/media/ipu7/ipu7-isys-csi-phy.c
+++ b/drivers/staging/media/ipu7/ipu7-isys-csi-phy.c
@@ -124,6 +124,7 @@ static const struct cdr_fbk_cap_prog_params table7[] = {
{ 1350, 1589, 4 },
{ 1590, 1949, 5 },
{ 1950, 2499, 6 },
+ { 2500, 3500, 7 },
{ }
};
@@ -838,9 +839,10 @@ static void ipu7_isys_cphy_config(struct ipu7_isys *isys, u8 id, u8 lanes,
dwc_phy_write_mask(isys, id, reg + 0x400 * i,
reset_thresh, 9, 11);
+ /* Tuning ITMINRX to 2 for CPHY */
reg = CORE_DIG_CLANE_0_RW_LP_0;
for (i = 0; i < trios; i++)
- dwc_phy_write_mask(isys, id, reg + 0x400 * i, 1, 12, 15);
+ dwc_phy_write_mask(isys, id, reg + 0x400 * i, 2, 12, 15);
reg = CORE_DIG_CLANE_0_RW_LP_2;
for (i = 0; i < trios; i++)
@@ -860,7 +862,11 @@ static void ipu7_isys_cphy_config(struct ipu7_isys *isys, u8 id, u8 lanes,
for (i = 0; i < (lanes + 1); i++) {
reg = CORE_DIG_IOCTRL_RW_AFE_LANE0_CTRL_2_9 + 0x400 * i;
dwc_phy_write_mask(isys, id, reg, 4U, 0, 2);
- dwc_phy_write_mask(isys, id, reg, 0U, 3, 4);
+ /* Set GMODE to 2 when CPHY >= 1.5Gsps */
+ if (mbps >= 1500)
+ dwc_phy_write_mask(isys, id, reg, 2U, 3, 4);
+ else
+ dwc_phy_write_mask(isys, id, reg, 0U, 3, 4);
reg = CORE_DIG_IOCTRL_RW_AFE_LANE0_CTRL_2_7 + 0x400 * i;
dwc_phy_write_mask(isys, id, reg, cap_prog, 10, 12);
@@ -930,8 +936,9 @@ static int ipu7_isys_phy_config(struct ipu7_isys *isys, u8 id, u8 lanes,
7, 12, 14);
dwc_phy_write_mask(isys, id, CORE_DIG_IOCTRL_RW_AFE_CB_CTRL_2_7,
0, 8, 10);
+ /* resistance tuning: 1 for 45ohm, 0 for 50ohm */
dwc_phy_write_mask(isys, id, CORE_DIG_IOCTRL_RW_AFE_CB_CTRL_2_5,
- 0, 8, 8);
+ 1, 8, 8);
if (aggregation)
phy_mode = isys->csi2[0].phy_mode;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 597/844] media: staging/ipu7: Fix the loop bound in l2 table alloc
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (595 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 596/844] media: staging/ipu7: Update CDPHY register settings Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 598/844] platform/x86: ISST: Add missing write block check Sasha Levin
` (255 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bingbu Cao, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Bingbu Cao <bingbu.cao@intel.com>
[ Upstream commit 98cc19a353abc8b48b7d58fd7a455e09e7c3aba3 ]
This patch fixes the incorrect loop bound in alloc_l2_pt(). When
initializing L2 page table entries, the loop was incorrectly using
ISP_L1PT_PTES instead of ISP_L2PT_PTES though the ISP_L1PT_PTES is
equal to ISP_L2PT_PTES.
Fixes: 71d81c25683a ("media: staging/ipu7: add IPU7 DMA APIs and MMU mapping")
Cc: stable@vger.kernel.org
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/ipu7/ipu7-mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/ipu7/ipu7-mmu.c b/drivers/staging/media/ipu7/ipu7-mmu.c
index ded1986eb8ba3..ea35cce4830ad 100644
--- a/drivers/staging/media/ipu7/ipu7-mmu.c
+++ b/drivers/staging/media/ipu7/ipu7-mmu.c
@@ -231,7 +231,7 @@ static u32 *alloc_l2_pt(struct ipu7_mmu_info *mmu_info)
dev_dbg(mmu_info->dev, "alloc_l2: get_zeroed_page() = %p\n", pt);
- for (i = 0; i < ISP_L1PT_PTES; i++)
+ for (i = 0; i < ISP_L2PT_PTES; i++)
pt[i] = mmu_info->dummy_page_pteval;
return pt;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 598/844] platform/x86: ISST: Add missing write block check
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (596 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 597/844] media: staging/ipu7: Fix the loop bound in l2 table alloc Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 599/844] platform/x86: ISST: Store and restore all domains data Sasha Levin
` (254 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Srinivas Pandruvada, Ilpo Järvinen, Sasha Levin
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ Upstream commit 0e5aef2795008c80c515f6fa04e377c6e5715958 ]
If writes are blocked, then return error during SST-CP enable command.
Add missing write block check in this code path.
Fixes: 8bed9ff7dbcc ("platform/x86: ISST: Process read/write blocked feature status")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260107060256.1634188-2-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
index 34bff2f65a835..f587709ddd473 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -612,6 +612,9 @@ static long isst_if_core_power_state(void __user *argp)
return -EINVAL;
if (core_power.get_set) {
+ if (power_domain_info->write_blocked)
+ return -EPERM;
+
_write_cp_info("cp_enable", core_power.enable, SST_CP_CONTROL_OFFSET,
SST_CP_ENABLE_START, SST_CP_ENABLE_WIDTH, SST_MUL_FACTOR_NONE)
_write_cp_info("cp_prio_type", core_power.priority_type, SST_CP_CONTROL_OFFSET,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 599/844] platform/x86: ISST: Store and restore all domains data
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (597 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 598/844] platform/x86: ISST: Add missing write block check Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 600/844] KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() Sasha Levin
` (253 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Srinivas Pandruvada, Ilpo Järvinen, Sasha Levin
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ Upstream commit dc7901b5a1563a9c9eb29b3b0b0dac3162065cd8 ]
The suspend/resume callbacks currently only store and restore the
configuration for power domain 0. However, other power domains may also
have modified configurations that need to be preserved across suspend/
resume cycles.
Extend the store/restore functionality to handle all power domains.
Fixes: 91576acab020 ("platform/x86: ISST: Add suspend/resume callbacks")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/20260107060256.1634188-3-srinivas.pandruvada@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/speed_select_if/isst_tpmi_core.c | 54 +++++++++++--------
1 file changed, 33 insertions(+), 21 deletions(-)
diff --git a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
index f587709ddd473..13b11c3a2ec4e 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c
@@ -1723,55 +1723,67 @@ EXPORT_SYMBOL_NS_GPL(tpmi_sst_dev_remove, "INTEL_TPMI_SST");
void tpmi_sst_dev_suspend(struct auxiliary_device *auxdev)
{
struct tpmi_sst_struct *tpmi_sst = auxiliary_get_drvdata(auxdev);
- struct tpmi_per_power_domain_info *power_domain_info;
+ struct tpmi_per_power_domain_info *power_domain_info, *pd_info;
struct oobmsm_plat_info *plat_info;
void __iomem *cp_base;
+ int num_resources, i;
plat_info = tpmi_get_platform_data(auxdev);
if (!plat_info)
return;
power_domain_info = tpmi_sst->power_domain_info[plat_info->partition];
+ num_resources = tpmi_sst->number_of_power_domains[plat_info->partition];
- cp_base = power_domain_info->sst_base + power_domain_info->sst_header.cp_offset;
- power_domain_info->saved_sst_cp_control = readq(cp_base + SST_CP_CONTROL_OFFSET);
-
- memcpy_fromio(power_domain_info->saved_clos_configs, cp_base + SST_CLOS_CONFIG_0_OFFSET,
- sizeof(power_domain_info->saved_clos_configs));
+ for (i = 0; i < num_resources; i++) {
+ pd_info = &power_domain_info[i];
+ if (!pd_info || !pd_info->sst_base)
+ continue;
- memcpy_fromio(power_domain_info->saved_clos_assocs, cp_base + SST_CLOS_ASSOC_0_OFFSET,
- sizeof(power_domain_info->saved_clos_assocs));
+ cp_base = pd_info->sst_base + pd_info->sst_header.cp_offset;
+ pd_info->saved_sst_cp_control = readq(cp_base + SST_CP_CONTROL_OFFSET);
+ memcpy_fromio(pd_info->saved_clos_configs, cp_base + SST_CLOS_CONFIG_0_OFFSET,
+ sizeof(pd_info->saved_clos_configs));
+ memcpy_fromio(pd_info->saved_clos_assocs, cp_base + SST_CLOS_ASSOC_0_OFFSET,
+ sizeof(pd_info->saved_clos_assocs));
- power_domain_info->saved_pp_control = readq(power_domain_info->sst_base +
- power_domain_info->sst_header.pp_offset +
- SST_PP_CONTROL_OFFSET);
+ pd_info->saved_pp_control = readq(pd_info->sst_base +
+ pd_info->sst_header.pp_offset +
+ SST_PP_CONTROL_OFFSET);
+ }
}
EXPORT_SYMBOL_NS_GPL(tpmi_sst_dev_suspend, "INTEL_TPMI_SST");
void tpmi_sst_dev_resume(struct auxiliary_device *auxdev)
{
struct tpmi_sst_struct *tpmi_sst = auxiliary_get_drvdata(auxdev);
- struct tpmi_per_power_domain_info *power_domain_info;
+ struct tpmi_per_power_domain_info *power_domain_info, *pd_info;
struct oobmsm_plat_info *plat_info;
void __iomem *cp_base;
+ int num_resources, i;
plat_info = tpmi_get_platform_data(auxdev);
if (!plat_info)
return;
power_domain_info = tpmi_sst->power_domain_info[plat_info->partition];
+ num_resources = tpmi_sst->number_of_power_domains[plat_info->partition];
- cp_base = power_domain_info->sst_base + power_domain_info->sst_header.cp_offset;
- writeq(power_domain_info->saved_sst_cp_control, cp_base + SST_CP_CONTROL_OFFSET);
-
- memcpy_toio(cp_base + SST_CLOS_CONFIG_0_OFFSET, power_domain_info->saved_clos_configs,
- sizeof(power_domain_info->saved_clos_configs));
+ for (i = 0; i < num_resources; i++) {
+ pd_info = &power_domain_info[i];
+ if (!pd_info || !pd_info->sst_base)
+ continue;
- memcpy_toio(cp_base + SST_CLOS_ASSOC_0_OFFSET, power_domain_info->saved_clos_assocs,
- sizeof(power_domain_info->saved_clos_assocs));
+ cp_base = pd_info->sst_base + pd_info->sst_header.cp_offset;
+ writeq(pd_info->saved_sst_cp_control, cp_base + SST_CP_CONTROL_OFFSET);
+ memcpy_toio(cp_base + SST_CLOS_CONFIG_0_OFFSET, pd_info->saved_clos_configs,
+ sizeof(pd_info->saved_clos_configs));
+ memcpy_toio(cp_base + SST_CLOS_ASSOC_0_OFFSET, pd_info->saved_clos_assocs,
+ sizeof(pd_info->saved_clos_assocs));
- writeq(power_domain_info->saved_pp_control, power_domain_info->sst_base +
- power_domain_info->sst_header.pp_offset + SST_PP_CONTROL_OFFSET);
+ writeq(pd_info->saved_pp_control, power_domain_info->sst_base +
+ pd_info->sst_header.pp_offset + SST_PP_CONTROL_OFFSET);
+ }
}
EXPORT_SYMBOL_NS_GPL(tpmi_sst_dev_resume, "INTEL_TPMI_SST");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 600/844] KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (598 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 599/844] platform/x86: ISST: Store and restore all domains data Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 601/844] dm-integrity: fix a typo in the code for write/discard race Sasha Levin
` (252 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sean Christopherson, Alessandro Ratti,
syzbot+1522459a74d26b0ac33a, Sasha Levin
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit ead63640d4e72e6f6d464f4e31f7fecb79af8869 ]
Ignore -EBUSY when checking nested events after exiting a blocking state
while L2 is active, as exiting to userspace will generate a spurious
userspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's
demise. Continuing with the wakeup isn't perfect either, as *something*
has gone sideways if a vCPU is awakened in L2 with an injected event (or
worse, a nested run pending), but continuing on gives the VM a decent
chance of surviving without any major side effects.
As explained in the Fixes commits, it _should_ be impossible for a vCPU to
be put into a blocking state with an already-injected event (exception,
IRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected
events, and thus put the vCPU into what should be an impossible state.
Don't bother trying to preserve the WARN, e.g. with an anti-syzkaller
Kconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be
violating x86 architecture, e.g. by WARNing if KVM attempts to inject an
exception or interrupt while the vCPU isn't running.
Cc: Alessandro Ratti <alessandro@0x65c.net>
Cc: stable@vger.kernel.org
Fixes: 26844fee6ade ("KVM: x86: never write to memory from kvm_vcpu_check_block()")
Fixes: 45405155d876 ("KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject")
Link: https://syzkaller.appspot.com/text?tag=ReproC&x=10d4261a580000
Reported-by: syzbot+1522459a74d26b0ac33a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/671bc7a7.050a0220.455e8.022a.GAE@google.com
Link: https://patch.msgid.link/20260109030657.994759-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/x86.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 042ebda1a6576..d65ebaed18986 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11609,8 +11609,7 @@ static inline int vcpu_block(struct kvm_vcpu *vcpu)
if (is_guest_mode(vcpu)) {
int r = kvm_check_nested_events(vcpu);
- WARN_ON_ONCE(r == -EBUSY);
- if (r < 0)
+ if (r < 0 && r != -EBUSY)
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 601/844] dm-integrity: fix a typo in the code for write/discard race
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (599 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 600/844] KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 602/844] dm: clear cloned request bio pointer when last clone bio completes Sasha Levin
` (251 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Mikulas Patocka, Sasha Levin
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit c698b7f417801fcd79f0dc844250b3361d38e6b8 ]
If we send a write followed by a discard, it may be possible that the
discarded data end up being overwritten by the previous write from the
journal. The code tries to prevent that, but there was a typo in this
logic that made it not being activated as it should be.
Note that if we end up here the second time (when discard_retried is
true), it means that the write bio is actually racing with the discard
bio, and in this situation it is not specified which of them should win.
Cc: stable@vger.kernel.org
Fixes: 31843edab7cb ("dm integrity: improve discard in journal mode")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-integrity.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 170bf67a2edd9..79d60495454a5 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2411,7 +2411,7 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map
new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
if (unlikely(new_pos != NOT_FOUND) ||
- unlikely(next_sector < dio->range.logical_sector - dio->range.n_sectors)) {
+ unlikely(next_sector < dio->range.logical_sector + dio->range.n_sectors)) {
remove_range_unlocked(ic, &dio->range);
spin_unlock_irq(&ic->endio_wait.lock);
queue_work(ic->commit_wq, &ic->commit_work);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 602/844] dm: clear cloned request bio pointer when last clone bio completes
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (600 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 601/844] dm-integrity: fix a typo in the code for write/discard race Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 603/844] drm/tegra: dsi: fix device leak on probe Sasha Levin
` (250 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michael Liang, Mohamed Khalfella, Mikulas Patocka, Sasha Levin
From: Michael Liang <mliang@purestorage.com>
[ Upstream commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd ]
Stale rq->bio values have been observed to cause double-initialization of
cloned bios in request-based device-mapper targets, leading to
use-after-free and double-free scenarios.
One such case occurs when using dm-multipath on top of a PCIe NVMe
namespace, where cloned request bios are freed during
blk_complete_request(), but rq->bio is left intact. Subsequent clone
teardown then attempts to free the same bios again via
blk_rq_unprep_clone().
The resulting double-free path looks like:
nvme_pci_complete_batch()
nvme_complete_batch()
blk_mq_end_request_batch()
blk_complete_request() // called on a DM clone request
bio_endio() // first free of all clone bios
...
rq->end_io() // end_clone_request()
dm_complete_request(tio->orig)
dm_softirq_done()
dm_done()
dm_end_request()
blk_rq_unprep_clone() // second free of clone bios
Fix this by clearing the clone request's bio pointer when the last cloned
bio completes, ensuring that later teardown paths do not attempt to free
already-released bios.
Signed-off-by: Michael Liang <mliang@purestorage.com>
Reviewed-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-rq.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 5e08546696145..923252fb57aec 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -109,14 +109,21 @@ static void end_clone_bio(struct bio *clone)
*/
tio->completed += nr_bytes;
+ if (!is_last)
+ return;
+ /*
+ * At this moment we know this is the last bio of the cloned request,
+ * and all cloned bios have been released, so reset the clone request's
+ * bio pointer to avoid double free.
+ */
+ tio->clone->bio = NULL;
+ exit:
/*
* Update the original request.
* Do not use blk_mq_end_request() here, because it may complete
* the original request before the clone, and break the ordering.
*/
- if (is_last)
- exit:
- blk_update_request(tio->orig, BLK_STS_OK, tio->completed);
+ blk_update_request(tio->orig, BLK_STS_OK, tio->completed);
}
static struct dm_rq_target_io *tio_from_request(struct request *rq)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 603/844] drm/tegra: dsi: fix device leak on probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (601 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 602/844] dm: clear cloned request bio pointer when last clone bio completes Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 604/844] soc: ti: k3-socinfo: Fix regmap leak on probe failure Sasha Levin
` (249 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Johan Hovold, Thierry Reding, Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit bfef062695570842cf96358f2f46f4c6642c6689 ]
Make sure to drop the reference taken when looking up the companion
(ganged) device and its driver data during probe().
Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
Fixes: 221e3638feb8 ("drm/tegra: Fix reference leak in tegra_dsi_ganged_probe")
Cc: stable@vger.kernel.org # 3.19: 221e3638feb8
Cc: Thierry Reding <treding@nvidia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251121164201.13188-1-johan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dsi.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 175f5f9937b01..8ee96b59fdbc8 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -1542,11 +1542,9 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
return -EPROBE_DEFER;
dsi->slave = platform_get_drvdata(gangster);
-
- if (!dsi->slave) {
- put_device(&gangster->dev);
+ put_device(&gangster->dev);
+ if (!dsi->slave)
return -EPROBE_DEFER;
- }
dsi->slave->master = dsi;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 604/844] soc: ti: k3-socinfo: Fix regmap leak on probe failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (602 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 603/844] drm/tegra: dsi: fix device leak on probe Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 605/844] soc: ti: pruss: Fix double free in pruss_clk_mux_setup() Sasha Levin
` (248 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Andrew Davis, Nishanth Menon, Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit c933138d45176780fabbbe7da263e04d5b3e525d ]
The mmio regmap allocated during probe is never freed.
Switch to using the device managed allocator so that the regmap is
released on probe failures (e.g. probe deferral) and on driver unbind.
Fixes: a5caf03188e4 ("soc: ti: k3-socinfo: Do not use syscon helper to build regmap")
Cc: stable@vger.kernel.org # 6.15
Cc: Andrew Davis <afd@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Andrew Davis <afd@ti.com>
Link: https://patch.msgid.link/20251127134942.2121-1-johan@kernel.org
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/k3-socinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/ti/k3-socinfo.c b/drivers/soc/ti/k3-socinfo.c
index 50c170a995f90..42275cb5ba1c8 100644
--- a/drivers/soc/ti/k3-socinfo.c
+++ b/drivers/soc/ti/k3-socinfo.c
@@ -141,7 +141,7 @@ static int k3_chipinfo_probe(struct platform_device *pdev)
if (IS_ERR(base))
return PTR_ERR(base);
- regmap = regmap_init_mmio(dev, base, &k3_chipinfo_regmap_cfg);
+ regmap = devm_regmap_init_mmio(dev, base, &k3_chipinfo_regmap_cfg);
if (IS_ERR(regmap))
return PTR_ERR(regmap);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 605/844] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (603 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 604/844] soc: ti: k3-socinfo: Fix regmap leak on probe failure Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 606/844] arm64: dts: ti: k3-am69-aquila: Change main_spi0/2 CS to GPIO mode Sasha Levin
` (247 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Wentao Liang, Nishanth Menon, Sasha Levin
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit 80db65d4acfb9ff12d00172aed39ea8b98261aad ]
In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly
calls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)
on the error path. However, after the devm_add_action_or_reset()
returns, the of_node_put(clk_mux_np) is called again, causing a double
free.
Fix by returning directly, to avoid the duplicate of_node_put().
Fixes: ba59c9b43c86 ("soc: ti: pruss: support CORECLK_MUX and IEPCLK_MUX")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260113014716.2464741-1-vulab@iscas.ac.cn
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/pruss.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
index 038576805bfa0..0fd59c73f585d 100644
--- a/drivers/soc/ti/pruss.c
+++ b/drivers/soc/ti/pruss.c
@@ -366,12 +366,10 @@ static int pruss_clk_mux_setup(struct pruss *pruss, struct clk *clk_mux,
ret = devm_add_action_or_reset(dev, pruss_of_free_clk_provider,
clk_mux_np);
- if (ret) {
+ if (ret)
dev_err(dev, "failed to add clkmux free action %d", ret);
- goto put_clk_mux_np;
- }
- return 0;
+ return ret;
put_clk_mux_np:
of_node_put(clk_mux_np);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 606/844] arm64: dts: ti: k3-am69-aquila: Change main_spi0/2 CS to GPIO mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (604 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 605/844] soc: ti: pruss: Fix double free in pruss_clk_mux_setup() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 607/844] arm64: dts: ti: k3-am69-aquila-clover: Change main_spi2 CS0 " Sasha Levin
` (246 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vitor Soares, Francesco Dolcini, Nishanth Menon, Sasha Levin
From: Vitor Soares <vitor.soares@toradex.com>
[ Upstream commit 78a123f45a7e9ac2a59f0eff8a37d31773e7a021 ]
Hardware chip select does not work correctly on main_spi0 and
main_spi2 controllers. Testing shows main_spi2 loses CS state
during runtime PM suspend, while main_spi0 cannot drive CS HIGH
when bus is idle.
Use GPIO-based chip select for both controllers.
Fixes: 39ac6623b1d8 ("arm64: dts: ti: Add Aquila AM69 Support")
Cc: stable@vger.kernel.org
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260112175350.79270-2-ivitro@gmail.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am69-aquila.dtsi | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am69-aquila.dtsi b/arch/arm64/boot/dts/ti/k3-am69-aquila.dtsi
index 0866eb8a6f348..5119baf62a4c2 100644
--- a/arch/arm64/boot/dts/ti/k3-am69-aquila.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am69-aquila.dtsi
@@ -479,7 +479,7 @@ J784S4_IOPAD(0x0dc, PIN_OUTPUT, 0) /* (AM36) SPI0_D1 */ /* AQUILA D17 */
/* Aquila SPI_2 CS */
pinctrl_main_spi0_cs0: main-spi0-cs0-default-pins {
pinctrl-single,pins = <
- J784S4_IOPAD(0x0cc, PIN_OUTPUT, 0) /* (AM37) SPI0_CS0 */ /* AQUILA D16 */
+ J784S4_IOPAD(0x0cc, PIN_OUTPUT, 7) /* (AM37) SPI0_CS0.GPIO0_51 */ /* AQUILA D16 */
>;
};
@@ -495,7 +495,7 @@ J784S4_IOPAD(0x0ac, PIN_OUTPUT, 10) /* (AE34) MCASP0_AXR15.SPI2_D1 */ /* AQUILA
/* Aquila SPI_1 CS */
pinctrl_main_spi2_cs0: main-spi2-cs0-default-pins {
pinctrl-single,pins = <
- J784S4_IOPAD(0x09c, PIN_OUTPUT, 10) /* (AF35) MCASP0_AXR11.SPI2_CS1 */ /* AQUILA D9 */
+ J784S4_IOPAD(0x09c, PIN_OUTPUT, 7) /* (AF35) MCASP0_AXR11.GPIO0_39 */ /* AQUILA D9 */
>;
};
@@ -1204,6 +1204,7 @@ &main_sdhci1 {
&main_spi0 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_main_spi0>, <&pinctrl_main_spi0_cs0>;
+ cs-gpios = <&main_gpio0 51 GPIO_ACTIVE_LOW>;
status = "disabled";
};
@@ -1211,6 +1212,7 @@ &main_spi0 {
&main_spi2 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_main_spi2>, <&pinctrl_main_spi2_cs0>;
+ cs-gpios = <&main_gpio0 39 GPIO_ACTIVE_LOW>;
status = "disabled";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 607/844] arm64: dts: ti: k3-am69-aquila-clover: Change main_spi2 CS0 to GPIO mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (605 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 606/844] arm64: dts: ti: k3-am69-aquila: Change main_spi0/2 CS to GPIO mode Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 608/844] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Sasha Levin
` (245 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vitor Soares, Francesco Dolcini, Nishanth Menon, Sasha Levin
From: Vitor Soares <vitor.soares@toradex.com>
[ Upstream commit 319fff9c7d620af83d8ab67050a54f63f16ae4e8 ]
Change CS0 from hardware chip select to GPIO-based chip select to
align with the base aquila device tree configuration.
Fixes: 9f748a6177e1 ("arm64: dts: ti: am69-aquila: Add Clover")
Cc: stable@vger.kernel.org
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260112175350.79270-3-ivitro@gmail.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts b/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts
index c816ba3bfbdf7..ec8ff45877157 100644
--- a/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts
+++ b/arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts
@@ -208,7 +208,8 @@ &main_spi2 {
pinctrl-0 = <&pinctrl_main_spi2>,
<&pinctrl_main_spi2_cs0>,
<&pinctrl_gpio_05>;
- cs-gpios = <0>, <&wkup_gpio0 29 GPIO_ACTIVE_LOW>;
+ cs-gpios = <&main_gpio0 39 GPIO_ACTIVE_LOW>,
+ <&wkup_gpio0 29 GPIO_ACTIVE_LOW>;
status = "okay";
tpm@1 {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 608/844] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (606 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 607/844] arm64: dts: ti: k3-am69-aquila-clover: Change main_spi2 CS0 " Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 609/844] bus: omap-ocp2scp: fix OF populate on driver rebind Sasha Levin
` (244 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yosry Ahmed, Maxim Levitsky, Sean Christopherson, Sasha Levin
From: Yosry Ahmed <yosry.ahmed@linux.dev>
[ Upstream commit 127ccae2c185f62e6ecb4bf24f9cb307e9b9c619 ]
Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload
of guest state") made KVM always use vmcb01 for the fields controlled by
VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code
to always use vmcb01.
As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not
intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01
instead of the current VMCB.
Fixes: cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state")
Cc: Maxim Levitsky <mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Link: https://patch.msgid.link/20260110004821.3411245-2-yosry.ahmed@linux.dev
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/svm/svm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 4394be40fe78d..a58548b35b858 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2099,12 +2099,13 @@ static int vmload_vmsave_interception(struct kvm_vcpu *vcpu, bool vmload)
ret = kvm_skip_emulated_instruction(vcpu);
+ /* KVM always performs VMLOAD/VMSAVE on VMCB01 (see __svm_vcpu_run()) */
if (vmload) {
- svm_copy_vmloadsave_state(svm->vmcb, vmcb12);
+ svm_copy_vmloadsave_state(svm->vmcb01.ptr, vmcb12);
svm->sysenter_eip_hi = 0;
svm->sysenter_esp_hi = 0;
} else {
- svm_copy_vmloadsave_state(vmcb12, svm->vmcb);
+ svm_copy_vmloadsave_state(vmcb12, svm->vmcb01.ptr);
}
kvm_vcpu_unmap(vcpu, &map);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 609/844] bus: omap-ocp2scp: fix OF populate on driver rebind
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (607 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 608/844] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 610/844] clk: clk-apple-nco: Add "apple,t8103-nco" compatible Sasha Levin
` (243 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Johan Hovold, Kevin Hilman, Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 5eb63e9bb65d88abde647ced50fe6ad40c11de1a ]
Since commit c6e126de43e7 ("of: Keep track of populated platform
devices") child devices will not be created by of_platform_populate()
if the devices had previously been deregistered individually so that the
OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that
the child devices are created if the driver is rebound.
Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251219110119.23507-1-johan@kernel.org
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/omap-ocp2scp.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
index e4dfda7b3b102..eee5ad191ea9c 100644
--- a/drivers/bus/omap-ocp2scp.c
+++ b/drivers/bus/omap-ocp2scp.c
@@ -17,15 +17,6 @@
#define OCP2SCP_TIMING 0x18
#define SYNC2_MASK 0xf
-static int ocp2scp_remove_devices(struct device *dev, void *c)
-{
- struct platform_device *pdev = to_platform_device(dev);
-
- platform_device_unregister(pdev);
-
- return 0;
-}
-
static int omap_ocp2scp_probe(struct platform_device *pdev)
{
int ret;
@@ -79,7 +70,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)
pm_runtime_disable(&pdev->dev);
err0:
- device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
+ of_platform_depopulate(&pdev->dev);
return ret;
}
@@ -87,7 +78,7 @@ static int omap_ocp2scp_probe(struct platform_device *pdev)
static void omap_ocp2scp_remove(struct platform_device *pdev)
{
pm_runtime_disable(&pdev->dev);
- device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
+ of_platform_depopulate(&pdev->dev);
}
#ifdef CONFIG_OF
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 610/844] clk: clk-apple-nco: Add "apple,t8103-nco" compatible
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (608 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 609/844] bus: omap-ocp2scp: fix OF populate on driver rebind Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 611/844] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition Sasha Levin
` (242 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Janne Grunau, Stephen Boyd, Neal Gompa, Sasha Levin
From: Janne Grunau <j@jannau.net>
[ Upstream commit ef9b3b4dbe767e4ac642a88dc0507927ac545047 ]
After discussion with the devicetree maintainers we agreed to not extend
lists with the generic compatible "apple,nco" anymore [1]. Use
"apple,t8103-nco" as base compatible as it is the SoC the driver and
bindings were written for.
[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
Fixes: 6641057d5dba ("clk: clk-apple-nco: Add driver for Apple NCO")
Cc: stable@vger.kernel.org
Acked-by: Stephen Boyd <sboyd@kernel.org>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-apple-nco.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/clk-apple-nco.c b/drivers/clk/clk-apple-nco.c
index d3ced4a0f029e..434c067968bbc 100644
--- a/drivers/clk/clk-apple-nco.c
+++ b/drivers/clk/clk-apple-nco.c
@@ -320,6 +320,7 @@ static int applnco_probe(struct platform_device *pdev)
}
static const struct of_device_id applnco_ids[] = {
+ { .compatible = "apple,t8103-nco" },
{ .compatible = "apple,nco" },
{ }
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 611/844] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (609 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 610/844] clk: clk-apple-nco: Add "apple,t8103-nco" compatible Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 612/844] soc: rockchip: grf: Support multiple grf to be handled Sasha Levin
` (241 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shawn Lin, Detlev Casanova, Chaoyi Chen, Marco Schirrmeister,
Heiko Stuebner, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 3cdc30c42d4a87444f6c7afbefd6a9381c4caa27 ]
RK3576_IOCGRF_MISC_CON is IOC_GRF + 0x40F0, fix it.
Fixes: e1aaecacfa13 ("soc: rockchip: grf: Add rk3576 default GRF values")
Cc: stable@vger.kernel.org
Cc: Detlev Casanova <detlev.casanova@collabora.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Reviewed-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
Tested-by: Marco Schirrmeister <mschirrmeister@gmail.com>
Link: https://patch.msgid.link/1768524932-163929-2-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/rockchip/grf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/rockchip/grf.c b/drivers/soc/rockchip/grf.c
index 27bfa09ff2516..8974d1c6b35dc 100644
--- a/drivers/soc/rockchip/grf.c
+++ b/drivers/soc/rockchip/grf.c
@@ -146,7 +146,7 @@ static const struct rockchip_grf_info rk3576_sysgrf __initconst = {
.num_values = ARRAY_SIZE(rk3576_defaults_sys_grf),
};
-#define RK3576_IOCGRF_MISC_CON 0x04F0
+#define RK3576_IOCGRF_MISC_CON 0x40F0
static const struct rockchip_grf_value rk3576_defaults_ioc_grf[] __initconst = {
{ "jtag switching", RK3576_IOCGRF_MISC_CON, FIELD_PREP_WM16_CONST(BIT(1), 0) },
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 612/844] soc: rockchip: grf: Support multiple grf to be handled
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (610 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 611/844] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 613/844] media: stm32: dcmipp: avoid naming clock if only one is needed Sasha Levin
` (240 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shawn Lin, Detlev Casanova, Marco Schirrmeister, Heiko Stuebner,
Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 75fb63ae031211e9264ac888fabc2ca9cd3fcccf ]
Currently, only the first matched node will be handled. This leads
to jtag switching broken for RK3576, as rk3576-sys-grf is found before
rk3576-ioc-grf. Change the code to scan all the possible node to fix
the problem.
Fixes: e1aaecacfa13 ("soc: rockchip: grf: Add rk3576 default GRF values")
Cc: stable@vger.kernel.org
Cc: Detlev Casanova <detlev.casanova@collabora.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Marco Schirrmeister <mschirrmeister@gmail.com>
Link: https://patch.msgid.link/1768524932-163929-3-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/rockchip/grf.c | 55 +++++++++++++++++++-------------------
1 file changed, 27 insertions(+), 28 deletions(-)
diff --git a/drivers/soc/rockchip/grf.c b/drivers/soc/rockchip/grf.c
index 8974d1c6b35dc..04937c40da471 100644
--- a/drivers/soc/rockchip/grf.c
+++ b/drivers/soc/rockchip/grf.c
@@ -217,34 +217,33 @@ static int __init rockchip_grf_init(void)
struct regmap *grf;
int ret, i;
- np = of_find_matching_node_and_match(NULL, rockchip_grf_dt_match,
- &match);
- if (!np)
- return -ENODEV;
- if (!match || !match->data) {
- pr_err("%s: missing grf data\n", __func__);
- of_node_put(np);
- return -EINVAL;
- }
-
- grf_info = match->data;
-
- grf = syscon_node_to_regmap(np);
- of_node_put(np);
- if (IS_ERR(grf)) {
- pr_err("%s: could not get grf syscon\n", __func__);
- return PTR_ERR(grf);
- }
-
- for (i = 0; i < grf_info->num_values; i++) {
- const struct rockchip_grf_value *val = &grf_info->values[i];
-
- pr_debug("%s: adjusting %s in %#6x to %#10x\n", __func__,
- val->desc, val->reg, val->val);
- ret = regmap_write(grf, val->reg, val->val);
- if (ret < 0)
- pr_err("%s: write to %#6x failed with %d\n",
- __func__, val->reg, ret);
+ for_each_matching_node_and_match(np, rockchip_grf_dt_match, &match) {
+ if (!of_device_is_available(np))
+ continue;
+ if (!match || !match->data) {
+ pr_err("%s: missing grf data\n", __func__);
+ of_node_put(np);
+ return -EINVAL;
+ }
+
+ grf_info = match->data;
+
+ grf = syscon_node_to_regmap(np);
+ if (IS_ERR(grf)) {
+ pr_err("%s: could not get grf syscon\n", __func__);
+ return PTR_ERR(grf);
+ }
+
+ for (i = 0; i < grf_info->num_values; i++) {
+ const struct rockchip_grf_value *val = &grf_info->values[i];
+
+ pr_debug("%s: adjusting %s in %#6x to %#10x\n", __func__,
+ val->desc, val->reg, val->val);
+ ret = regmap_write(grf, val->reg, val->val);
+ if (ret < 0)
+ pr_err("%s: write to %#6x failed with %d\n",
+ __func__, val->reg, ret);
+ }
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 613/844] media: stm32: dcmipp: avoid naming clock if only one is needed
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (611 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 612/844] soc: rockchip: grf: Support multiple grf to be handled Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 614/844] media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop Sasha Levin
` (239 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alain Volmat, Stable, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Alain Volmat <alain.volmat@foss.st.com>
[ Upstream commit 2f130245f2143fa8f4da77071f844911d2c69319 ]
When DCMIPP requires only a single clock (kclk), avoid relying on its
name to obtain it. The introduction of MP25 support added the mclk,
which necessitated naming the first clock kclk. However, this breaks
backward compatibility with existing MP13 device trees that do not
specify clock names.
Fixes: 686f27f7ea37 ("media: stm32: dcmipp: add core support for the stm32mp25")
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Cc: Stable@vger.kernel.org # 6.14.x: 7f487562af49 media: stm32: dcmipp: correct ret type in dcmipp_graph_notify_bound
Cc: Stable@vger.kernel.org # 6.14.x: c715dd62da30 media: stm32: dcmipp: add has_csi2 & needs_mclk in match data
Cc: Stable@vger.kernel.org # 6.14.x:
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
index 1b7bae3266c8d..49398d0777646 100644
--- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
+++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
@@ -526,7 +526,12 @@ static int dcmipp_probe(struct platform_device *pdev)
return ret;
}
- kclk = devm_clk_get(&pdev->dev, "kclk");
+ /*
+ * In case of the DCMIPP has only 1 clock (such as on MP13), the
+ * clock might not be named.
+ */
+ kclk = devm_clk_get(&pdev->dev,
+ dcmipp->pipe_cfg->needs_mclk ? "kclk" : NULL);
if (IS_ERR(kclk))
return dev_err_probe(&pdev->dev, PTR_ERR(kclk),
"Unable to get kclk\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 614/844] media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (612 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 613/844] media: stm32: dcmipp: avoid naming clock if only one is needed Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 615/844] media: stm32: dcmipp: byteproc: disable compose for all bayers Sasha Levin
` (238 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alain Volmat, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Alain Volmat <alain.volmat@foss.st.com>
[ Upstream commit 222f1279edd9008ee35b62de156ddac84e31443c ]
Ensure that there are no pending interrupts after we have stopped the
pipeline. Indeed, it could happen that new interrupt has been generated
during the stop_streaming processing hence clear them in order to avoid
getting a new interrupt right from the start of a next start_streaming.
Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c
index 1c1b6b48918ee..b18e273ef4a3e 100644
--- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c
+++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c
@@ -512,6 +512,9 @@ static void dcmipp_bytecap_stop_streaming(struct vb2_queue *vq)
/* Disable pipe */
reg_clear(vcap, DCMIPP_P0FSCR, DCMIPP_P0FSCR_PIPEN);
+ /* Clear any pending interrupts */
+ reg_write(vcap, DCMIPP_CMFCR, DCMIPP_CMIER_P0ALL);
+
spin_lock_irq(&vcap->irqlock);
/* Return all queued buffers to vb2 in ERROR state */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 615/844] media: stm32: dcmipp: byteproc: disable compose for all bayers
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (613 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 614/844] media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 616/844] media: i2c: ov01a10: Fix digital gain range Sasha Levin
` (237 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alain Volmat, Sakari Ailus, Hans Verkuil, Sasha Levin
From: Alain Volmat <alain.volmat@foss.st.com>
[ Upstream commit 3363aa2640f1738ad7fc56ea56f5e0301ad97196 ]
Avoid possibility to perform compose on all frames which mbus code is
within the bayer range or jpeg format.
Fixes: 822c72eb1519 ("media: stm32: dcmipp: add bayer 10~14 bits formats")
Cc: stable@vger.kernel.org
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/st/stm32/stm32-dcmipp/dcmipp-byteproc.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-byteproc.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-byteproc.c
index db76a02a1848a..ec1d773d5ad12 100644
--- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-byteproc.c
+++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-byteproc.c
@@ -130,11 +130,8 @@ static void dcmipp_byteproc_adjust_compose(struct v4l2_rect *r,
r->left = 0;
/* Compose is not possible for JPEG or Bayer formats */
- if (fmt->code == MEDIA_BUS_FMT_JPEG_1X8 ||
- fmt->code == MEDIA_BUS_FMT_SBGGR8_1X8 ||
- fmt->code == MEDIA_BUS_FMT_SGBRG8_1X8 ||
- fmt->code == MEDIA_BUS_FMT_SGRBG8_1X8 ||
- fmt->code == MEDIA_BUS_FMT_SRGGB8_1X8) {
+ if (fmt->code >= MEDIA_BUS_FMT_SBGGR8_1X8 &&
+ fmt->code <= MEDIA_BUS_FMT_JPEG_1X8) {
r->width = fmt->width;
r->height = fmt->height;
return;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 616/844] media: i2c: ov01a10: Fix digital gain range
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (614 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 615/844] media: stm32: dcmipp: byteproc: disable compose for all bayers Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 617/844] arm64: dts: rockchip: Fix SD card support for RK3576 EVB1 Sasha Levin
` (236 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mehdi Djait, Hans de Goede, Sakari Ailus, Hans Verkuil,
Sasha Levin
From: Mehdi Djait <mehdi.djait@linux.intel.com>
[ Upstream commit 91848c99ed6a98daf77f4cb7d44cf3f13bc6998f ]
Digital gain wraps-around at the maximum of 16838 / 0x3fff.
Fix the maximum digital gain by setting it to 0x3fff.
Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Fixes: 0827b58dabff ("media: i2c: add ov01a10 image sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov01a10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov01a10.c b/drivers/media/i2c/ov01a10.c
index 3ad516e4d3698..c1a7373a6311c 100644
--- a/drivers/media/i2c/ov01a10.c
+++ b/drivers/media/i2c/ov01a10.c
@@ -57,7 +57,7 @@
#define OV01A10_REG_DIGITAL_GAIN_GR 0x3513
#define OV01A10_REG_DIGITAL_GAIN_R 0x3516
#define OV01A10_DGTL_GAIN_MIN 0
-#define OV01A10_DGTL_GAIN_MAX 0x3ffff
+#define OV01A10_DGTL_GAIN_MAX 0x3fff
#define OV01A10_DGTL_GAIN_STEP 1
#define OV01A10_DGTL_GAIN_DEFAULT 1024
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 617/844] arm64: dts: rockchip: Fix SD card support for RK3576 EVB1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (615 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 616/844] media: i2c: ov01a10: Fix digital gain range Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 618/844] arm64: dts: rockchip: Fix SD card support for RK3576 Nanopi R76s Sasha Levin
` (235 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shawn Lin, Heiko Stuebner, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 7226664bf952c4cfddccd74b154a7d994608d153 ]
When runtime suspend is enabled, the associated power domain is powered
off, which resets the registers, including the power control bit. As a result,
the card loses power during runtime suspend. The card should still be able
to process I/O with the help of mmc_blk_mq_rw_recovery(), which is suboptimal.
To address this issue, we must use vmmc-supply with a GPIO based method to
maintain power to the card. Also, add cd-gpios method to make hot-plug work
correctly during idle periods.
Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/1768524932-163929-5-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3576-evb1-v10.dts | 22 +++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
index db8fef7a4f1b9..ffe55f970f461 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
@@ -223,6 +223,18 @@ vcc_3v3_s0: regulator-vcc-3v3-s0 {
vin-supply = <&vcc_3v3_s3>;
};
+ vcc3v3_sd: regulator-vcc-3v3-sd {
+ compatible = "regulator-fixed";
+ enable-active-high;
+ gpios = <&gpio0 RK_PB6 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc_pwren>;
+ regulator-name = "vcc3v3_sd";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ vin-supply = <&vcc_3v3_s0>;
+ };
+
vcc_ufs_s0: regulator-vcc-ufs-s0 {
compatible = "regulator-fixed";
regulator-name = "vcc_ufs_s0";
@@ -810,6 +822,12 @@ pcie0_rst: pcie0-rst {
};
};
+ sdmmc {
+ sdmmc_pwren: sdmmc-pwren {
+ rockchip,pins = <0 RK_PB6 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+ };
+
usb {
usb_host_pwren: usb-host-pwren {
rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
@@ -851,11 +869,15 @@ &sdmmc {
bus-width = <4>;
cap-mmc-highspeed;
cap-sd-highspeed;
+ cd-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>;
disable-wp;
max-frequency = <200000000>;
no-sdio;
no-mmc;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc0_clk &sdmmc0_cmd &sdmmc0_det &sdmmc0_bus4>;
sd-uhs-sdr104;
+ vmmc-supply = <&vcc3v3_sd>;
vqmmc-supply = <&vccio_sd_s0>;
status = "okay";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 618/844] arm64: dts: rockchip: Fix SD card support for RK3576 Nanopi R76s
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (616 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 617/844] arm64: dts: rockchip: Fix SD card support for RK3576 EVB1 Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 619/844] x86/uprobes: Fix XOL allocation failure for 32-bit tasks Sasha Levin
` (234 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shawn Lin, Marco Schirrmeister, Heiko Stuebner, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit a9c1acebfe0484343a443d082e039ca77186ed22 ]
When runtime suspend is enabled, the associated power domain is powered
off, which resets the registers, including the power control bit. As a result,
the card loses power during runtime suspend. The card should still be able
to process I/O with the help of mmc_blk_mq_rw_recovery(), which is suboptimal.
To address this issue, we must use vmmc-supply with a GPIO based method to
maintain power to the card and store valid tuning phases. Also, add cd-gpios
method to make hot-plug work correctly during idle periods.
Fixes: 7fee88882704 ("arm64: dts: rockchip: Add devicetree for the FriendlyElec NanoPi R76S")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Marco Schirrmeister <mschirrmeister@gmail.com>
Link: https://patch.msgid.link/1768524932-163929-6-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/rockchip/rk3576-nanopi-r76s.dts | 23 ++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-nanopi-r76s.dts b/arch/arm64/boot/dts/rockchip/rk3576-nanopi-r76s.dts
index 31fbefaeceab4..7ec27b05ff10e 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-nanopi-r76s.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-nanopi-r76s.dts
@@ -192,6 +192,18 @@ vcc_3v3_s0: regulator-vcc-3v3-s0 {
regulator-name = "vcc_3v3_s0";
vin-supply = <&vcc_3v3_s3>;
};
+
+ vcc3v3_sd: regulator-vcc-3v3-sd {
+ compatible = "regulator-fixed";
+ enable-active-high;
+ gpios = <&gpio0 RK_PB6 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc_pwren>;
+ regulator-name = "vcc3v3_sd";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ vin-supply = <&vcc_3v3_s0>;
+ };
};
&combphy0_ps {
@@ -726,6 +738,12 @@ pcie1_perstn: pcie1-perstn {
};
};
+ sdmmc {
+ sdmmc_pwren: sdmmc-pwren {
+ rockchip,pins = <0 RK_PB6 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+ };
+
usb {
usb_otg0_pwren_h: usb-otg0-pwren-h {
rockchip,pins = <0 RK_PD1 RK_FUNC_GPIO &pcfg_pull_none>;
@@ -751,11 +769,14 @@ &sdmmc {
bus-width = <4>;
cap-mmc-highspeed;
cap-sd-highspeed;
+ cd-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>;
disable-wp;
no-mmc;
no-sdio;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc0_clk &sdmmc0_cmd &sdmmc0_det &sdmmc0_bus4>;
sd-uhs-sdr104;
- vmmc-supply = <&vcc_3v3_s3>;
+ vmmc-supply = <&vcc3v3_sd>;
vqmmc-supply = <&vccio_sd_s0>;
status = "okay";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 619/844] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (617 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 618/844] arm64: dts: rockchip: Fix SD card support for RK3576 Nanopi R76s Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 620/844] clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() Sasha Levin
` (233 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oleg Nesterov, Paulo Andrade, Peter Zijlstra (Intel), Sasha Levin
From: Oleg Nesterov <oleg@redhat.com>
[ Upstream commit d55c571e4333fac71826e8db3b9753fadfbead6a ]
This script
#!/usr/bin/bash
echo 0 > /proc/sys/kernel/randomize_va_space
echo 'void main(void) {}' > TEST.c
# -fcf-protection to ensure that the 1st endbr32 insn can't be emulated
gcc -m32 -fcf-protection=branch TEST.c -o test
bpftrace -e 'uprobe:./test:main {}' -c ./test
"hangs", the probed ./test task enters an endless loop.
The problem is that with randomize_va_space == 0
get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not
just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used
by the stack vma.
arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and
in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE.
vm_unmapped_area() happily returns the high address > TASK_SIZE and then
get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)"
check.
handle_swbp() doesn't report this failure (probably it should) and silently
restarts the probed insn. Endless loop.
I think that the right fix should change the x86 get_unmapped_area() paths
to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if
CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case
because ->orig_ax = -1.
But we need a simple fix for -stable, so this patch just sets TS_COMPAT if
the probed task is 32-bit to make in_ia32_syscall() true.
Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()")
Reported-by: Paulo Andrade <pandrade@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/uprobes.c | 24 ++++++++++++++++++++++++
include/linux/uprobes.h | 1 +
kernel/events/uprobes.c | 10 +++++++---
3 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 7be8e361ca55b..619dddf54424e 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -1823,3 +1823,27 @@ bool is_uprobe_at_func_entry(struct pt_regs *regs)
return false;
}
+
+#ifdef CONFIG_IA32_EMULATION
+unsigned long arch_uprobe_get_xol_area(void)
+{
+ struct thread_info *ti = current_thread_info();
+ unsigned long vaddr;
+
+ /*
+ * HACK: we are not in a syscall, but x86 get_unmapped_area() paths
+ * ignore TIF_ADDR32 and rely on in_32bit_syscall() to calculate
+ * vm_unmapped_area_info.high_limit.
+ *
+ * The #ifdef above doesn't cover the CONFIG_X86_X32_ABI=y case,
+ * but in this case in_32bit_syscall() -> in_x32_syscall() always
+ * (falsely) returns true because ->orig_ax == -1.
+ */
+ if (test_thread_flag(TIF_ADDR32))
+ ti->status |= TS_COMPAT;
+ vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0);
+ ti->status &= ~TS_COMPAT;
+
+ return vaddr;
+}
+#endif
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index ee3d36eda45dd..f548fea2adec8 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -242,6 +242,7 @@ extern void arch_uprobe_clear_state(struct mm_struct *mm);
extern void arch_uprobe_init_state(struct mm_struct *mm);
extern void handle_syscall_uprobe(struct pt_regs *regs, unsigned long bp_vaddr);
extern void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr);
+extern unsigned long arch_uprobe_get_xol_area(void);
#else /* !CONFIG_UPROBES */
struct uprobes_state {
};
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index d546d32390a81..1ab7a7e4efb63 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1694,6 +1694,12 @@ static const struct vm_special_mapping xol_mapping = {
.mremap = xol_mremap,
};
+unsigned long __weak arch_uprobe_get_xol_area(void)
+{
+ /* Try to map as high as possible, this is only a hint. */
+ return get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0);
+}
+
/* Slot allocation for XOL */
static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
{
@@ -1709,9 +1715,7 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area)
}
if (!area->vaddr) {
- /* Try to map as high as possible, this is only a hint. */
- area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE,
- PAGE_SIZE, 0, 0);
+ area->vaddr = arch_uprobe_get_xol_area();
if (IS_ERR_VALUE(area->vaddr)) {
ret = area->vaddr;
goto fail;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 620/844] clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (618 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 619/844] x86/uprobes: Fix XOL allocation failure for 32-bit tasks Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 621/844] s390/pci: Handle futile config accesses of disabled devices directly Sasha Levin
` (232 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Haoxiang Li, Brian Masney, Thierry Reding, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit fce0d0bd9c20fefd180ea9e8362d619182f97a1d ]
If clk_register() fails, call kfree to release "tegra".
Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-tegra124-emc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index 2a6db04342815..0f6fb776b2298 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -538,8 +538,10 @@ struct clk *tegra124_clk_register_emc(void __iomem *base, struct device_node *np
tegra->hw.init = &init;
clk = clk_register(NULL, &tegra->hw);
- if (IS_ERR(clk))
+ if (IS_ERR(clk)) {
+ kfree(tegra);
return clk;
+ }
tegra->prev_parent = clk_hw_get_parent_by_index(
&tegra->hw, emc_get_parent(&tegra->hw))->clk;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 621/844] s390/pci: Handle futile config accesses of disabled devices directly
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (619 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 620/844] clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 622/844] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Sasha Levin
` (231 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Schnelle, Benjamin Block, Farhan Ali, Heiko Carstens,
Sasha Levin
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit 84d875e69818bed600edccb09be4a64b84a34a54 ]
On s390 PCI busses and slots with multiple functions may have holes
because PCI functions are passed-through by the hypervisor on a per
function basis and some functions may be in standby or reserved. This
fact is indicated by returning true from the
hypervisor_isolated_pci_functions() helper and triggers common code to
scan all possible devfn values. Via pci_scan_single_device() this in
turn causes config reads for the device and vendor IDs, even for PCI
functions which are in standby and thereofore disabled.
So far these futile config reads, as well as potentially writes, which
can never succeed were handled by the PCI load/store instructions
themselves. This works as the platform just returns an error for
a disabled and thus not usable function handle. It does cause spamming
of error logs and additional overhead though.
Instead check if the used function handle is enabled in zpci_cfg_load()
and zpci_cfg_write() and if not enable directly return -ENODEV. Also
refactor zpci_cfg_load() and zpci_cfg_store() slightly to accommodate
the new logic while meeting modern kernel style guidelines.
Cc: stable@vger.kernel.org
Fixes: a50297cf8235 ("s390/pci: separate zbus creation from scanning")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/pci/pci.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 57f3980b98a92..7f44b0644a20e 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -231,24 +231,33 @@ int zpci_fmb_disable_device(struct zpci_dev *zdev)
static int zpci_cfg_load(struct zpci_dev *zdev, int offset, u32 *val, u8 len)
{
u64 req = ZPCI_CREATE_REQ(zdev->fh, ZPCI_PCIAS_CFGSPC, len);
+ int rc = -ENODEV;
u64 data;
- int rc;
+
+ if (!zdev_enabled(zdev))
+ goto out_err;
rc = __zpci_load(&data, req, offset);
- if (!rc) {
- data = le64_to_cpu((__force __le64) data);
- data >>= (8 - len) * 8;
- *val = (u32) data;
- } else
- *val = 0xffffffff;
+ if (rc)
+ goto out_err;
+ data = le64_to_cpu((__force __le64)data);
+ data >>= (8 - len) * 8;
+ *val = (u32)data;
+ return 0;
+
+out_err:
+ PCI_SET_ERROR_RESPONSE(val);
return rc;
}
static int zpci_cfg_store(struct zpci_dev *zdev, int offset, u32 val, u8 len)
{
u64 req = ZPCI_CREATE_REQ(zdev->fh, ZPCI_PCIAS_CFGSPC, len);
+ int rc = -ENODEV;
u64 data = val;
- int rc;
+
+ if (!zdev_enabled(zdev))
+ return rc;
data <<= (8 - len) * 8;
data = (__force u64) cpu_to_le64(data);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 622/844] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (620 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 621/844] s390/pci: Handle futile config accesses of disabled devices directly Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 623/844] drm/i915/psr: Don't enable Panel Replay on sink if globally disabled Sasha Levin
` (230 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Joonwon Kang, Jassi Brar, Sasha Levin
From: Joonwon Kang <joonwonkang@google.com>
[ Upstream commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 ]
Although it is guided that `#mbox-cells` must be at least 1, there are
many instances of `#mbox-cells = <0>;` in the device tree. If that is
the case and the corresponding mailbox controller does not provide
`fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will
be used by default and out-of-bounds accesses could occur due to lack of
bounds check in that function.
Cc: stable@vger.kernel.org
Signed-off-by: Joonwon Kang <joonwonkang@google.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
index 2acc6ec229a45..617ba505691d3 100644
--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -489,12 +489,10 @@ EXPORT_SYMBOL_GPL(mbox_free_channel);
static struct mbox_chan *fw_mbox_index_xlate(struct mbox_controller *mbox,
const struct fwnode_reference_args *sp)
{
- int ind = sp->args[0];
-
- if (ind >= mbox->num_chans)
+ if (sp->nargs < 1 || sp->args[0] >= mbox->num_chans)
return ERR_PTR(-EINVAL);
- return &mbox->chans[ind];
+ return &mbox->chans[sp->args[0]];
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 623/844] drm/i915/psr: Don't enable Panel Replay on sink if globally disabled
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (621 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 622/844] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 624/844] reset: gpio: suppress bind attributes in sysfs Sasha Levin
` (229 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jouni Högander, Mika Kahola, Jani Nikula, Rodrigo Vivi,
Joonas Lahtinen, Sasha Levin
From: Jouni Högander <jouni.hogander@intel.com>
[ Upstream commit 69f83f167463bad26104af7fbc114ce1f80366b0 ]
With some panels informing support for Panel Replay we are observing
problems if having Panel Replay enable bit set on sink when forced to use
PSR instead of Panel Replay. Avoid these problems by not setting Panel
Replay enable bit in sink when Panel Replay is globally disabled during
link training. I.e. disabled by module parameter.
The enable bit is still set when disabling Panel Replay via debugfs
interface. Added note comment about this.
Fixes: 68f3a505b367 ("drm/i915/psr: Enable Panel Replay on sink always when it's supported")
Cc: Mika Kahola <mika.kahola@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: <stable@vger.kernel.org> # v6.15+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Mika Kahola <mika.kahola@intel.com>
Link: https://patch.msgid.link/20260115070039.368965-1-jouni.hogander@intel.com
(cherry picked from commit c5a52cd04e24f0ae53fda26f74ab027b8c548e0e)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_psr.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
index 08bca45739749..44063b578354e 100644
--- a/drivers/gpu/drm/i915/display/intel_psr.c
+++ b/drivers/gpu/drm/i915/display/intel_psr.c
@@ -857,7 +857,12 @@ static void intel_psr_enable_sink(struct intel_dp *intel_dp,
void intel_psr_panel_replay_enable_sink(struct intel_dp *intel_dp)
{
- if (CAN_PANEL_REPLAY(intel_dp))
+ /*
+ * NOTE: We might want to trigger mode set when
+ * disabling/enabling Panel Replay via debugfs interface to
+ * ensure this bit is cleared/set accordingly.
+ */
+ if (CAN_PANEL_REPLAY(intel_dp) && panel_replay_global_enabled(intel_dp))
drm_dp_dpcd_writeb(&intel_dp->aux, PANEL_REPLAY_CONFIG,
DP_PANEL_REPLAY_ENABLE);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 624/844] reset: gpio: suppress bind attributes in sysfs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (622 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 623/844] drm/i915/psr: Don't enable Panel Replay on sink if globally disabled Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 625/844] dm-integrity: fix recalculation in bitmap mode Sasha Levin
` (228 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bartosz Golaszewski, Krzysztof Kozlowski, Philipp Zabel,
Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit 16de4c6a8fe9ff497ca1aba33ef0dbee09f11952 ]
This is a special device that's created dynamically and is supposed to
stay in memory forever. We also currently don't have a devlink between
it and the actual reset consumer. Suppress sysfs bind attributes so that
user-space can't unbind the device because - as of now - it will cause a
use-after-free splat from any user that puts the reset control handle.
Fixes: cee544a40e44 ("reset: gpio: Add GPIO-based reset controller")
Cc: stable@vger.kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/reset/reset-gpio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/reset/reset-gpio.c b/drivers/reset/reset-gpio.c
index e5512b3b596b5..626c4c639c155 100644
--- a/drivers/reset/reset-gpio.c
+++ b/drivers/reset/reset-gpio.c
@@ -111,6 +111,7 @@ static struct auxiliary_driver reset_gpio_driver = {
.id_table = reset_gpio_ids,
.driver = {
.name = "reset-gpio",
+ .suppress_bind_attrs = true,
},
};
module_auxiliary_driver(reset_gpio_driver);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 625/844] dm-integrity: fix recalculation in bitmap mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (623 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 624/844] reset: gpio: suppress bind attributes in sysfs Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:28 ` [PATCH 6.19 626/844] dm-unstripe: fix mapping bug when there are multiple targets in a table Sasha Levin
` (227 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Mikulas Patocka, Ondrej Kozina, Sasha Levin
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 118ba36e446c01e3cd34b3eedabf1d9436525e1d ]
There's a logic quirk in the handling of suspend in the bitmap mode:
This is the sequence of calls if we are reloading a dm-integrity table:
* dm_integrity_ctr reads a superblock with the flag SB_FLAG_DIRTY_BITMAP
set.
* dm_integrity_postsuspend initializes a journal and clears the flag
SB_FLAG_DIRTY_BITMAP.
* dm_integrity_resume sees the superblock with SB_FLAG_DIRTY_BITMAP set -
thus it interprets the journal as if it were a bitmap.
This quirk causes recalculation problem if the user increases the size of
the device in the bitmap mode.
Fix this by reading a fresh copy on the superblock in
dm_integrity_resume. This commit also fixes another logic quirk - the
branch that sets bitmap bits if the device was extended should only be
executed if the flag SB_FLAG_DIRTY_BITMAP is set.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Tested-by: Ondrej Kozina <okozina@redhat.com>
Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode")
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-integrity.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 79d60495454a5..ba52631052503 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -3788,14 +3788,27 @@ static void dm_integrity_resume(struct dm_target *ti)
struct dm_integrity_c *ic = ti->private;
__u64 old_provided_data_sectors = le64_to_cpu(ic->sb->provided_data_sectors);
int r;
+ __le32 flags;
DEBUG_print("resume\n");
ic->wrote_to_journal = false;
+ flags = ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING);
+ r = sync_rw_sb(ic, REQ_OP_READ);
+ if (r)
+ dm_integrity_io_error(ic, "reading superblock", r);
+ if ((ic->sb->flags & flags) != flags) {
+ ic->sb->flags |= flags;
+ r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
+ if (unlikely(r))
+ dm_integrity_io_error(ic, "writing superblock", r);
+ }
+
if (ic->provided_data_sectors != old_provided_data_sectors) {
if (ic->provided_data_sectors > old_provided_data_sectors &&
ic->mode == 'B' &&
+ ic->sb->flags & cpu_to_le32(SB_FLAG_DIRTY_BITMAP) &&
ic->sb->log2_blocks_per_bitmap_bit == ic->log2_blocks_per_bitmap_bit) {
rw_journal_sectors(ic, REQ_OP_READ, 0,
ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 626/844] dm-unstripe: fix mapping bug when there are multiple targets in a table
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (624 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 625/844] dm-integrity: fix recalculation in bitmap mode Sasha Levin
@ 2026-02-28 17:28 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 627/844] rtc: pcf8563: use correct of_node for output clock Sasha Levin
` (226 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:28 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Matt Whitlock, Mikulas Patocka, Sasha Levin
From: Matt Whitlock <kernel@mattwhitlock.name>
[ Upstream commit 83c10e8dd43628d0bf86486616556cd749a3c310 ]
The "unstriped" device-mapper target incorrectly calculates the sector
offset on the mapped device when the target's origin is not zero.
Take for example this hypothetical concatenation of the members of a
two-disk RAID0:
linearized: 0 2097152 unstriped 2 128 0 /dev/md/raid0 0
linearized: 2097152 2097152 unstriped 2 128 1 /dev/md/raid0 0
The intent in this example is to create a single device named
/dev/mapper/linearized that comprises all of the chunks of the first disk
of the RAID0 set, followed by all of the chunks of the second disk of the
RAID0 set.
This fails because dm-unstripe.c's map_to_core function does its
computations based on the sector number within the mapper device rather
than the sector number within the target. The bug turns invisible when
the target's origin is at sector zero of the mapper device, as is the
common case. In the example above, however, what happens is that the
first half of the mapper device gets mapped correctly to the first disk
of the RAID0, but the second half of the mapper device gets mapped past
the end of the RAID0 device, and accesses to any of those sectors return
errors.
Signed-off-by: Matt Whitlock <kernel@mattwhitlock.name>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 18a5bf270532 ("dm: add unstriped target")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-unstripe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-unstripe.c b/drivers/md/dm-unstripe.c
index e8a9432057dce..17be483595642 100644
--- a/drivers/md/dm-unstripe.c
+++ b/drivers/md/dm-unstripe.c
@@ -117,7 +117,7 @@ static void unstripe_dtr(struct dm_target *ti)
static sector_t map_to_core(struct dm_target *ti, struct bio *bio)
{
struct unstripe_c *uc = ti->private;
- sector_t sector = bio->bi_iter.bi_sector;
+ sector_t sector = dm_target_offset(ti, bio->bi_iter.bi_sector);
sector_t tmp_sector = sector;
/* Shift us up to the right "row" on the stripe */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 627/844] rtc: pcf8563: use correct of_node for output clock
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (625 preceding siblings ...)
2026-02-28 17:28 ` [PATCH 6.19 626/844] dm-unstripe: fix mapping bug when there are multiple targets in a table Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 628/844] drm/tyr: fix register name in error print Sasha Levin
` (225 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: John Keeping, Alexandre Belloni, Sasha Levin
From: John Keeping <jkeeping@inmusicbrands.com>
[ Upstream commit a380a02ea3ddc69c1c1ccca3882748dee33ec3d3 ]
When switching to regmap, the i2c_client pointer was removed from struct
pcf8563 so this function switched to using the RTC device instead. But
the RTC device is a child of the original I2C device and does not have
an associated of_node.
Reference the correct device's of_node to ensure that the output clock
can be found when referenced by other devices and so that the override
clock name is read correctly.
Cc: stable@vger.kernel.org
Fixes: 00f1bb9b8486b ("rtc: pcf8563: Switch to regmap")
Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
Link: https://patch.msgid.link/20260108184749.3413348-1-jkeeping@inmusicbrands.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-pcf8563.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 4e61011fb7a96..b281e9489df1d 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -424,7 +424,7 @@ static const struct clk_ops pcf8563_clkout_ops = {
static struct clk *pcf8563_clkout_register_clk(struct pcf8563 *pcf8563)
{
- struct device_node *node = pcf8563->rtc->dev.of_node;
+ struct device_node *node = pcf8563->rtc->dev.parent->of_node;
struct clk_init_data init;
struct clk *clk;
int ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 628/844] drm/tyr: fix register name in error print
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (626 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 627/844] rtc: pcf8563: use correct of_node for output clock Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 629/844] arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro Sasha Levin
` (224 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Dirk Behme, Alice Ryhl, Sasha Levin
From: Dirk Behme <dirk.behme@de.bosch.com>
[ Upstream commit 793e8f7d52814e096f63373eca643d2672366a5a ]
The `..IRQ..` register is printed here. Not the `..INT..` one.
Correct this.
Cc: stable@vger.kernel.org
Fixes: cf4fd52e3236 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs")
Link: https://lore.kernel.org/rust-for-linux/A04F0357-896E-4ACC-BC0E-DEE8608CE518@collabora.com/
Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
Link: https://patch.msgid.link/20260119070838.3219739-1-dirk.behme@de.bosch.com
[aliceryhl: update commit message prefix]
[aliceryhl: add cc stable as per Miguel's suggestion]
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tyr/driver.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tyr/driver.rs b/drivers/gpu/drm/tyr/driver.rs
index 0389c558c0367..3047fd12fd849 100644
--- a/drivers/gpu/drm/tyr/driver.rs
+++ b/drivers/gpu/drm/tyr/driver.rs
@@ -76,7 +76,7 @@ fn issue_soft_reset(dev: &Device<Bound>, iomem: &Devres<IoMem>) -> Result {
dev_err!(dev, "GPU reset failed with errno\n");
dev_err!(
dev,
- "GPU_INT_RAWSTAT is {}\n",
+ "GPU_IRQ_RAWSTAT is {}\n",
regs::GPU_IRQ_RAWSTAT.read(dev, iomem)?
);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 629/844] arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (627 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 628/844] drm/tyr: fix register name in error print Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 630/844] media: venus: vdec: fix error state assignment for zero bytesused Sasha Levin
` (223 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jun Yan, Peter Robinson, Dragan Simic, Heiko Stuebner,
Sasha Levin
From: Jun Yan <jerrysteve1101@gmail.com>
[ Upstream commit b18247f9dab735c9c2d63823d28edc9011e7a1ad ]
Remove the redundant enabling of the hdmi_sound node in the Pinebook Pro
board dts file, because the HDMI output is unused on this device. [1][2]
This change also eliminates the following kernel log warning, which is
caused by the unenabled dependent node of hdmi_sound that ultimately
results in the node's probe failure:
platform hdmi-sound: deferred probe pending: asoc-simple-card: parse error
[1] https://files.pine64.org/doc/PinebookPro/pinebookpro_v2.1_mainboard_schematic.pdf
[2] https://files.pine64.org/doc/PinebookPro/pinebookpro_schematic_v21a_20220419.pdf
Cc: stable@vger.kernel.org
Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro")
Signed-off-by: Jun Yan <jerrysteve1101@gmail.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Link: https://patch.msgid.link/20260116151253.9223-1-jerrysteve1101@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 4 ----
1 file changed, 4 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
index 810ab6ff4e670..753d513449540 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts
@@ -421,10 +421,6 @@ &gpu {
status = "okay";
};
-&hdmi_sound {
- status = "okay";
-};
-
&i2c0 {
clock-frequency = <400000>;
i2c-scl-falling-time-ns = <4>;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 630/844] media: venus: vdec: fix error state assignment for zero bytesused
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (628 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 629/844] arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 631/844] media: venus: vdec: restrict EOS addr quirk to IRIS2 only Sasha Levin
` (222 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Renjiang Han, Vikash Garodia, Bryan O'Donoghue, Hans Verkuil,
Sasha Levin
From: Renjiang Han <renjiang.han@oss.qualcomm.com>
[ Upstream commit 93ecd6ee95c38cb533fa25f48d3c1c8cb69f410f ]
When hfi_session_flush is issued, all queued buffers are returned to
the V4L2 driver. Some of these buffers are not processed and have
bytesused = 0. Currently, the driver marks such buffers as error even
during drain operations, which can incorrectly flag EOS buffers.
Only capture buffers with zero payload (and not EOS) should be marked
with VB2_BUF_STATE_ERROR. The check is performed inside the non-EOS
branch to ensure correct handling.
Fixes: 51df3c81ba10b ("media: venus: vdec: Mark flushed buffers with error state")
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/vdec.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
index 4a6641fdffcf7..d0bd2d86a31f9 100644
--- a/drivers/media/platform/qcom/venus/vdec.c
+++ b/drivers/media/platform/qcom/venus/vdec.c
@@ -1440,10 +1440,10 @@ static void vdec_buf_done(struct venus_inst *inst, unsigned int buf_type,
inst->drain_active = false;
inst->codec_state = VENUS_DEC_STATE_STOPPED;
}
+ } else {
+ if (!bytesused)
+ state = VB2_BUF_STATE_ERROR;
}
-
- if (!bytesused)
- state = VB2_BUF_STATE_ERROR;
} else {
vbuf->sequence = inst->sequence_out++;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 631/844] media: venus: vdec: restrict EOS addr quirk to IRIS2 only
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (629 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 630/844] media: venus: vdec: fix error state assignment for zero bytesused Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 632/844] Revert "media: iris: Add sanity check for stop streaming" Sasha Levin
` (221 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Mecid, Renjiang Han, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 63c072e2937e6c9995df1b6a28523ed2ae68d364 ]
On SM8250 (IRIS2) with firmware older than 1.0.087, the firmware could
not handle a dummy device address for EOS buffers, so a NULL device
address is sent instead. The existing check used IS_V6() alongside a
firmware version gate:
if (IS_V6(core) && is_fw_rev_or_older(core, 1, 0, 87))
fdata.device_addr = 0;
else
fdata.device_addr = 0xdeadb000;
However, SC7280 which is also V6, uses a firmware string of the form
"1.0.<commit-hash>", which the version parser translates to 1.0.0. This
unintentionally satisfies the `is_fw_rev_or_older(..., 1, 0, 87)`
condition on SC7280. Combined with IS_V6() matching there as well, the
quirk is incorrectly applied to SC7280, causing VP9 decode failures.
Constrain the check to IRIS2 (SM8250) only, which is the only platform
that needed this quirk, by replacing IS_V6() with IS_IRIS2(). This
restores correct behavior on SC7280 (no forced NULL EOS buffer address).
Fixes: 47f867cb1b63 ("media: venus: fix EOS handling in decoder stop command")
Cc: stable@vger.kernel.org
Reported-by: Mecid <mecid@mecomediagroup.de>
Closes: https://github.com/qualcomm-linux/kernel-topics/issues/222
Co-developed-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Tested-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/vdec.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
index d0bd2d86a31f9..4cd69440e8753 100644
--- a/drivers/media/platform/qcom/venus/vdec.c
+++ b/drivers/media/platform/qcom/venus/vdec.c
@@ -565,7 +565,13 @@ vdec_decoder_cmd(struct file *file, void *fh, struct v4l2_decoder_cmd *cmd)
fdata.buffer_type = HFI_BUFFER_INPUT;
fdata.flags |= HFI_BUFFERFLAG_EOS;
- if (IS_V6(inst->core) && is_fw_rev_or_older(inst->core, 1, 0, 87))
+
+ /* Send NULL EOS addr for only IRIS2 (SM8250),for firmware <= 1.0.87.
+ * SC7280 also reports "1.0.<hash>" parsed as 1.0.0; restricting to IRIS2
+ * avoids misapplying this quirk and breaking VP9 decode on SC7280.
+ */
+
+ if (IS_IRIS2(inst->core) && is_fw_rev_or_older(inst->core, 1, 0, 87))
fdata.device_addr = 0;
else
fdata.device_addr = 0xdeadb000;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 632/844] Revert "media: iris: Add sanity check for stop streaming"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (630 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 631/844] media: venus: vdec: restrict EOS addr quirk to IRIS2 only Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 633/844] media: iris: Fix ffmpeg corrupted frame error Sasha Levin
` (220 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Vikash Garodia, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 370e19042fb8ac68109f8bdb0fdd8118baf39318 ]
This reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.
Revert the check that skipped stop_streaming when the instance was in
IRIS_INST_ERROR, as it caused multiple regressions:
1. Buffers were not returned to vb2 when the instance was already in
error state, triggering warnings in the vb2 core because buffer
completion was skipped.
2. If a session failed early (e.g. unsupported configuration), the
instance transitioned to IRIS_INST_ERROR. When userspace attempted
to stop streaming for cleanup, stop_streaming was skipped due to the
added check, preventing proper teardown and leaving the firmware
in an inconsistent state.
Fixes: ad699fa78b59 ("media: iris: Add sanity check for stop streaming")
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vb2.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
index db8768d8a8f61..139b821f7952f 100644
--- a/drivers/media/platform/qcom/iris/iris_vb2.c
+++ b/drivers/media/platform/qcom/iris/iris_vb2.c
@@ -231,8 +231,6 @@ void iris_vb2_stop_streaming(struct vb2_queue *q)
return;
mutex_lock(&inst->lock);
- if (inst->state == IRIS_INST_ERROR)
- goto exit;
if (!V4L2_TYPE_IS_OUTPUT(q->type) &&
!V4L2_TYPE_IS_CAPTURE(q->type))
@@ -243,10 +241,10 @@ void iris_vb2_stop_streaming(struct vb2_queue *q)
goto exit;
exit:
- if (ret) {
- iris_helper_buffers_done(inst, q->type, VB2_BUF_STATE_ERROR);
+ iris_helper_buffers_done(inst, q->type, VB2_BUF_STATE_ERROR);
+ if (ret)
iris_inst_change_state(inst, IRIS_INST_ERROR);
- }
+
mutex_unlock(&inst->lock);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 633/844] media: iris: Fix ffmpeg corrupted frame error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (631 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 632/844] Revert "media: iris: Add sanity check for stop streaming" Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 634/844] media: iris: Fix fps calculation Sasha Levin
` (219 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vishnu Reddy, Dikshita Agarwal, Bryan O'Donoghue,
Vikash Garodia, Bryan O'Donoghue, Hans Verkuil, Sasha Levin
From: Vishnu Reddy <quic_bvisredd@quicinc.com>
[ Upstream commit 89f7cf35901138d9828d981ce64c131a3da6e867 ]
When the ffmpeg decoder is running, the driver receives the
V4L2_BUF_FLAG_KEYFRAME flag in the input buffer. The driver then forwards
this flag information to the firmware. The firmware, in turn, copies the
input buffer flags directly into the output buffer flags. Upon receiving
the output buffer from the firmware, the driver observes that the buffer
contains the HFI_BUFFERFLAG_DATACORRUPT flag. The root cause is that both
V4L2_BUF_FLAG_KEYFRAME and HFI_BUFFERFLAG_DATACORRUPT are the same value.
As a result, the driver incorrectly interprets the output frame as
corrupted, even though the frame is actually valid. This misinterpretation
causes the driver to report an error and skip good frames, leading to
missing frames in the final video output and triggering ffmpeg's "corrupt
decoded frame" error.
To resolve this issue, the input buffer flags should not be sent to the
firmware during decoding, since the firmware does not require this
information.
Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
Cc: stable@vger.kernel.org
Signed-off-by: Vishnu Reddy <quic_bvisredd@quicinc.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
index 52da7ef7bab08..b6261d186d215 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
@@ -282,7 +282,7 @@ static int iris_hfi_gen1_queue_input_buffer(struct iris_inst *inst, struct iris_
com_ip_pkt.shdr.session_id = inst->session_id;
com_ip_pkt.time_stamp_hi = upper_32_bits(buf->timestamp);
com_ip_pkt.time_stamp_lo = lower_32_bits(buf->timestamp);
- com_ip_pkt.flags = buf->flags;
+ com_ip_pkt.flags = 0;
com_ip_pkt.mark_target = 0;
com_ip_pkt.mark_data = 0;
com_ip_pkt.offset = buf->data_offset;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 634/844] media: iris: Fix fps calculation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (632 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 633/844] media: iris: Fix ffmpeg corrupted frame error Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 635/844] media: iris: use fallback size when S_FMT is called without width/height Sasha Levin
` (218 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ricardo Ribalda, Dikshita Agarwal, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Ricardo Ribalda <ribalda@chromium.org>
[ Upstream commit 71fe80364a6584f404556ac9a6a4aca4ab80fb5b ]
iris_venc_s_param() uses do_div to divide two 64 bits operators, this is
wrong. Luckily for us, both of the operators fit in 32 bits, so we can use
a normal division.
Now that we are at it, mark the fps smaller than 1 as invalid, the code
does not seem to handle them properly.
The following cocci warning is fixed with this patch:
./platform/qcom/iris/iris_venc.c:378:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead
Fixes: 4ff586ff28e3 ("media: iris: Add support for G/S_PARM for encoder video device")
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_venc.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_venc.c b/drivers/media/platform/qcom/iris/iris_venc.c
index 5830eba93c68b..0ed5018f9fe33 100644
--- a/drivers/media/platform/qcom/iris/iris_venc.c
+++ b/drivers/media/platform/qcom/iris/iris_venc.c
@@ -382,8 +382,7 @@ int iris_venc_s_param(struct iris_inst *inst, struct v4l2_streamparm *s_parm)
struct v4l2_fract *timeperframe = NULL;
u32 default_rate = DEFAULT_FPS;
bool is_frame_rate = false;
- u64 us_per_frame, fps;
- u32 max_rate;
+ u32 fps, max_rate;
int ret = 0;
@@ -405,23 +404,19 @@ int iris_venc_s_param(struct iris_inst *inst, struct v4l2_streamparm *s_parm)
timeperframe->denominator = default_rate;
}
- us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
- do_div(us_per_frame, timeperframe->denominator);
-
- if (!us_per_frame)
+ fps = timeperframe->denominator / timeperframe->numerator;
+ if (!fps)
return -EINVAL;
- fps = (u64)USEC_PER_SEC;
- do_div(fps, us_per_frame);
if (fps > max_rate) {
ret = -ENOMEM;
goto reset_rate;
}
if (is_frame_rate)
- inst->frame_rate = (u32)fps;
+ inst->frame_rate = fps;
else
- inst->operating_rate = (u32)fps;
+ inst->operating_rate = fps;
if ((s_parm->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE && vb2_is_streaming(src_q)) ||
(s_parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE && vb2_is_streaming(dst_q))) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 635/844] media: iris: use fallback size when S_FMT is called without width/height
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (633 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 634/844] media: iris: Fix fps calculation Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 636/844] media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handling Sasha Levin
` (217 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Val Packett, Dikshita Agarwal, Bryan O'Donoghue, Hans Verkuil,
Sasha Levin
From: Val Packett <val@packett.cool>
[ Upstream commit 4980721cb97d6c47700ab61a048ac8819cfeec87 ]
According to 4.5.1.5 of the M2M stateful decoder UAPI documentation,
providing the width and the height to S_FMT is "required only if it
cannot be parsed from the stream", otherwise they can be left as 0
and the S_FMT implementation is expected to return a valid placeholder
resolution that would let REQBUFS succeed.
iris was missing the fallback, so clients like rpi-ffmpeg wouldn't work.
Fix by adding an explicit fallback to defaults.
Fixes: b530b95de22c ("media: iris: implement s_fmt, g_fmt and try_fmt ioctls")
Link: https://github.com/jc-kynesim/rpi-ffmpeg/issues/103
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Signed-off-by: Val Packett <val@packett.cool>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vdec.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/platform/qcom/iris/iris_vdec.c
index 69ffe52590d3a..227e4e5a326fd 100644
--- a/drivers/media/platform/qcom/iris/iris_vdec.c
+++ b/drivers/media/platform/qcom/iris/iris_vdec.c
@@ -231,6 +231,14 @@ int iris_vdec_s_fmt(struct iris_inst *inst, struct v4l2_format *f)
if (vb2_is_busy(q))
return -EBUSY;
+ /* Width and height are optional, so fall back to a valid placeholder
+ * resolution until the real one is decoded from the bitstream.
+ */
+ if (f->fmt.pix_mp.width == 0 && f->fmt.pix_mp.height == 0) {
+ f->fmt.pix_mp.width = DEFAULT_WIDTH;
+ f->fmt.pix_mp.height = DEFAULT_HEIGHT;
+ }
+
iris_vdec_try_fmt(inst, f);
switch (f->type) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 636/844] media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handling
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (634 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 635/844] media: iris: use fallback size when S_FMT is called without width/height Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 637/844] media: iris: Add missing platform data entries for SM8750 Sasha Levin
` (216 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Vikash Garodia, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 8fc707d13df517222db12b465af4aa9df05c99e1 ]
Currently v4l2_m2m_ioctl_{de,enc}coder_cmd is being invoked during STOP
command handling. However, this is not required as the iris driver has
its own drain and stop handling mechanism in place.
Using the m2m command API in this context leads to incorrect behavior,
where the LAST flag is prematurely attached to a capture buffer,
when there are no buffers in m2m source queue. But, in this scenario
even though the source buffers are returned to client, hardware might
still need to process the pending capture buffers.
Attaching LAST flag prematurely can result in the capture buffer being
removed from the destination queue before the hardware has finished
processing it, causing issues when the buffer is eventually returned by
the hardware.
To prevent this, remove the m2m API usage in stop handling.
Fixes: d09100763bed ("media: iris: add support for drain sequence")
Fixes: 75db90ae067d ("media: iris: Add support for drain sequence in encoder video device")
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vidc.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index c9b881923ef18..0c9c23ef2d180 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -572,9 +572,10 @@ static int iris_dec_cmd(struct file *filp, void *fh,
mutex_lock(&inst->lock);
- ret = v4l2_m2m_ioctl_decoder_cmd(filp, fh, dec);
- if (ret)
+ if (dec->cmd != V4L2_DEC_CMD_STOP && dec->cmd != V4L2_DEC_CMD_START) {
+ ret = -EINVAL;
goto unlock;
+ }
if (inst->state == IRIS_INST_DEINIT)
goto unlock;
@@ -605,9 +606,10 @@ static int iris_enc_cmd(struct file *filp, void *fh,
mutex_lock(&inst->lock);
- ret = v4l2_m2m_ioctl_encoder_cmd(filp, fh, enc);
- if (ret)
+ if (enc->cmd != V4L2_ENC_CMD_STOP && enc->cmd != V4L2_ENC_CMD_START) {
+ ret = -EINVAL;
goto unlock;
+ }
if (inst->state == IRIS_INST_DEINIT)
goto unlock;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 637/844] media: iris: Add missing platform data entries for SM8750
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (635 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 636/844] media: iris: remove v4l2_m2m_ioctl_{de,en}coder_cmd API usage during STOP handling Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 638/844] media: iris: Add buffer to list only after successful allocation Sasha Levin
` (215 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Vikash Garodia, Konrad Dybcio,
Bryan O'Donoghue, Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit bbef55f414100853d5bcea56a41f8b171bac8fcb ]
Two platform-data fields for SM8750 were missed:
- get_vpu_buffer_size = iris_vpu33_buf_size
Without this, the driver fails to allocate the required internal
buffers, leading to basic decode/encode failures during session
bring-up.
- max_core_mbps = ((7680 * 4320) / 256) * 60
Without this capability exposed, capability checks are incomplete and
v4l2-compliance for encoder fails.
Fixes: a5925a2ce077 ("media: iris: add VPU33 specific encoding buffer calculation")
Fixes: a6882431a138 ("media: iris: Add support for ENUM_FRAMESIZES/FRAMEINTERVALS for encoder")
Cc: stable@vger.kernel.org
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_platform_gen2.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_platform_gen2.c b/drivers/media/platform/qcom/iris/iris_platform_gen2.c
index c1989240c2486..00d1d55463179 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_gen2.c
+++ b/drivers/media/platform/qcom/iris/iris_platform_gen2.c
@@ -915,6 +915,7 @@ const struct iris_platform_data sm8750_data = {
.get_instance = iris_hfi_gen2_get_instance,
.init_hfi_command_ops = iris_hfi_gen2_command_ops_init,
.init_hfi_response_ops = iris_hfi_gen2_response_ops_init,
+ .get_vpu_buffer_size = iris_vpu33_buf_size,
.vpu_ops = &iris_vpu35_ops,
.set_preset_registers = iris_set_sm8550_preset_registers,
.icc_tbl = sm8550_icc_table,
@@ -945,6 +946,7 @@ const struct iris_platform_data sm8750_data = {
.num_vpp_pipe = 4,
.max_session_count = 16,
.max_core_mbpf = NUM_MBS_8K * 2,
+ .max_core_mbps = ((7680 * 4320) / 256) * 60,
.dec_input_config_params_default =
sm8550_vdec_input_config_params_default,
.dec_input_config_params_default_size =
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 638/844] media: iris: Add buffer to list only after successful allocation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (636 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 637/844] media: iris: Add missing platform data entries for SM8750 Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 639/844] media: iris: Skip resolution set on first IPSC Sasha Levin
` (214 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Bryan O'Donoghue, Vikash Garodia,
Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 2d0bbd982dfdd67da488a772f7a8a1bdca7642bf ]
Move `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating
internal buffers. Previously, the buffer was enqueued in `buffers->list`
before the DMA allocation. If the allocation failed, the function returned
`-ENOMEM` while leaving a partially initialized buffer in the list, which
could lead to inconsistent state and potential leaks.
By adding the buffer to the list only after `dma_alloc_attrs()` succeeds,
we ensure the list contains only valid, fully initialized buffers.
Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers")
Reviewed-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_buffer.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
index b89b1ee06cce1..f1f003a787bf2 100644
--- a/drivers/media/platform/qcom/iris/iris_buffer.c
+++ b/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -351,12 +351,15 @@ static int iris_create_internal_buffer(struct iris_inst *inst,
buffer->index = index;
buffer->buffer_size = buffers->size;
buffer->dma_attrs = DMA_ATTR_WRITE_COMBINE | DMA_ATTR_NO_KERNEL_MAPPING;
- list_add_tail(&buffer->list, &buffers->list);
buffer->kvaddr = dma_alloc_attrs(core->dev, buffer->buffer_size,
&buffer->device_addr, GFP_KERNEL, buffer->dma_attrs);
- if (!buffer->kvaddr)
+ if (!buffer->kvaddr) {
+ kfree(buffer);
return -ENOMEM;
+ }
+
+ list_add_tail(&buffer->list, &buffers->list);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 639/844] media: iris: Skip resolution set on first IPSC
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (637 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 638/844] media: iris: Add buffer to list only after successful allocation Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 640/844] media: iris: gen1: Destroy internal buffers after FW releases Sasha Levin
` (213 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Bryan O'Donoghue, Vikash Garodia,
Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 811dbc546f47559dc9d2098c612acfd47e32479e ]
The resolution property is not supposed to be set during reconfig.
Existing iris_drc_pending(inst) check is insufficient, as it doesn't
cover the first port setting change.
Extend the conditional check to also skip resolution setting when
the instance is in IRIS_INST_SUB_FIRST_IPSC.
Fixes: caf205548769 ("media: iris: Avoid updating frame size to firmware during reconfig")
Reviewed-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
index b6261d186d215..1c107daca9e89 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
@@ -733,7 +733,7 @@ static int iris_hfi_gen1_set_resolution(struct iris_inst *inst, u32 plane)
struct hfi_framesize fs;
int ret;
- if (!iris_drc_pending(inst)) {
+ if (!iris_drc_pending(inst) && !(inst->sub_state & IRIS_INST_SUB_FIRST_IPSC)) {
fs.buffer_type = HFI_BUFFER_INPUT;
fs.width = inst->fmt_src->fmt.pix_mp.width;
fs.height = inst->fmt_src->fmt.pix_mp.height;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 640/844] media: iris: gen1: Destroy internal buffers after FW releases
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (638 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 639/844] media: iris: Skip resolution set on first IPSC Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 641/844] media: iris: gen2: Add sanity check for session stop Sasha Levin
` (212 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Bryan O'Donoghue, Vikash Garodia,
Bryan O'Donoghue, Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 1dabf00ee206eceb0f08a1fe5d1ce635f9064338 ]
After the firmware releases internal buffers, the driver was not
destroying them. This left stale allocations that were no longer used,
especially across resolution changes where new buffers are allocated per
the updated requirements. As a result, memory was wasted until session
close.
Destroy internal buffers once the release response is received from the
firmware.
Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
index 1c107daca9e89..11815f6f5bacd 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
@@ -441,6 +441,8 @@ static int iris_hfi_gen1_session_unset_buffers(struct iris_inst *inst, struct ir
goto exit;
ret = iris_wait_for_session_response(inst, false);
+ if (!ret)
+ ret = iris_destroy_internal_buffer(inst, buf);
exit:
kfree(pkt);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 641/844] media: iris: gen2: Add sanity check for session stop
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (639 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 640/844] media: iris: gen1: Destroy internal buffers after FW releases Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 642/844] media: iris: Prevent output buffer queuing before stream-on completes Sasha Levin
` (211 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dikshita Agarwal, Vikash Garodia, Bryan O'Donoghue,
Hans Verkuil, Sasha Levin
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
[ Upstream commit 9aa8d63d09cfc44d879427cc5ba308012ca4ab8e ]
In iris_kill_session, inst->state is set to IRIS_INST_ERROR and
session_close is executed, which will kfree(inst_hfi_gen2->packet).
If stop_streaming is called afterward, it will cause a crash.
Add a NULL check for inst_hfi_gen2->packet before sendling STOP packet
to firmware to fix that.
Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
index f912955320992..31e8fc7f8295d 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
@@ -963,6 +963,9 @@ static int iris_hfi_gen2_session_stop(struct iris_inst *inst, u32 plane)
struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst);
int ret = 0;
+ if (!inst_hfi_gen2->packet)
+ return -EINVAL;
+
reinit_completion(&inst->completion);
iris_hfi_gen2_packet_session_command(inst,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 642/844] media: iris: Prevent output buffer queuing before stream-on completes
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (640 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 641/844] media: iris: gen2: Add sanity check for session stop Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 643/844] drm: of: drm_of_panel_bridge_remove(): fix device_node leak Sasha Levin
` (210 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vishnu Reddy, Dikshita Agarwal, Vikash Garodia,
Bryan O'Donoghue, Hans Verkuil, Sasha Levin
From: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
[ Upstream commit 2c73cfd0cfc44ffe331ccb81f6ac45fc399d9ddb ]
During normal playback, stream-on for input is followed by output, and
only after input stream-on does actual streaming begin. However, when
gst-play performs a seek, both input and output streams are stopped,
and on restart, output stream-on occurs first. At this point, firmware
has not yet started streaming. Queuing output buffers before the firmware
begins streaming causes it to process buffers in an invalid state, leading
to an error response. These buffers are returned to the driver as errors,
forcing the driver into an error state and stopping playback.
Fix this by deferring output buffer queuing until stream-on completes.
Input buffers can still be queued before stream-on as required.
Fixes: 92e007ca5ab6 ("media: iris: Add V4L2 streaming support for encoder video device")
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/iris/iris_vb2.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
index 139b821f7952f..bf0b8400996ec 100644
--- a/drivers/media/platform/qcom/iris/iris_vb2.c
+++ b/drivers/media/platform/qcom/iris/iris_vb2.c
@@ -193,10 +193,14 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
buf_type = iris_v4l2_type_to_driver(q->type);
if (inst->domain == DECODER) {
- if (inst->state == IRIS_INST_STREAMING)
+ if (buf_type == BUF_INPUT)
+ ret = iris_queue_deferred_buffers(inst, BUF_INPUT);
+
+ if (!ret && inst->state == IRIS_INST_STREAMING) {
ret = iris_queue_internal_deferred_buffers(inst, BUF_DPB);
- if (!ret)
- ret = iris_queue_deferred_buffers(inst, buf_type);
+ if (!ret)
+ ret = iris_queue_deferred_buffers(inst, BUF_OUTPUT);
+ }
} else {
if (inst->state == IRIS_INST_STREAMING) {
ret = iris_queue_deferred_buffers(inst, BUF_INPUT);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 643/844] drm: of: drm_of_panel_bridge_remove(): fix device_node leak
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (641 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 642/844] media: iris: Prevent output buffer queuing before stream-on completes Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 644/844] docs: kdoc: fix logic to handle unissued warnings Sasha Levin
` (209 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Luca Ceresoli, Maxime Ripard, Sasha Levin
From: Luca Ceresoli <luca.ceresoli@bootlin.com>
[ Upstream commit a4b4385d0523e39a7c058cb5a6c8269e513126ca ]
drm_of_panel_bridge_remove() uses of_graph_get_remote_node() to get a
device_node but does not put the node reference.
Fixes: c70087e8f16f ("drm/drm_of: add drm_of_panel_bridge_remove function")
Cc: stable@vger.kernel.org # v4.15
Acked-by: Maxime Ripard <mripard@kernel.org>
Link: https://patch.msgid.link/20260109-drm-bridge-alloc-getput-drm_of_find_bridge-2-v2-1-8bad3ef90b9f@bootlin.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/drm/drm_of.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/include/drm/drm_of.h b/include/drm/drm_of.h
index 7f0256dae3f13..f3e55ea2174c0 100644
--- a/include/drm/drm_of.h
+++ b/include/drm/drm_of.h
@@ -5,6 +5,7 @@
#include <linux/err.h>
#include <linux/of_graph.h>
#if IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_DRM_PANEL_BRIDGE)
+#include <linux/of.h>
#include <drm/drm_bridge.h>
#endif
@@ -173,6 +174,8 @@ static inline int drm_of_panel_bridge_remove(const struct device_node *np,
bridge = of_drm_find_bridge(remote);
drm_panel_bridge_remove(bridge);
+ of_node_put(remote);
+
return 0;
#else
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 644/844] docs: kdoc: fix logic to handle unissued warnings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (642 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 643/844] drm: of: drm_of_panel_bridge_remove(): fix device_node leak Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 645/844] docs: kdoc: avoid error_count overflows Sasha Levin
` (208 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mauro Carvalho Chehab, Andy Shevchenko, Jonathan Corbet,
Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit 292eca3163218f2185a8eabe59f4a576bb9e05f8 ]
Changeset 469c1c9eb6c9 ("kernel-doc: Issue warnings that were silently discarded")
didn't properly addressed the missing messages behavior, as
it was calling directly python logger low-level function,
instead of using the expected method to emit warnings.
Basically, there are two methods to log messages:
- self.config.log.warning() - This is the raw level to emit a
warning. It just writes the a message at stderr, via python
logging, as it is initialized as:
self.config.log = logging.getLogger("kernel-doc")
- self.config.warning() - This is where we actually consider a
message as a warning, properly incrementing error count.
Due to that, several parsing error messages are internally considered
as success, causing -Werror to not work on such messages.
While here, ensure that the last ignored entry will also be handled
by adding an extra check at the end of the parse handler.
Fixes: 469c1c9eb6c9 ("kernel-doc: Issue warnings that were silently discarded")
Closes: https://lore.kernel.org/linux-doc/20260112091053.00cee29a@foz.lan/
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <95109a6585171da4d6900049deaa2634b41ee743.1768823489.git.mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/python/kdoc/kdoc_parser.py | 35 ++++++++++++++++++++++------
1 file changed, 28 insertions(+), 7 deletions(-)
diff --git a/tools/lib/python/kdoc/kdoc_parser.py b/tools/lib/python/kdoc/kdoc_parser.py
index 500aafc500322..2168d623f7867 100644
--- a/tools/lib/python/kdoc/kdoc_parser.py
+++ b/tools/lib/python/kdoc/kdoc_parser.py
@@ -295,7 +295,7 @@ class KernelEntry:
# TODO: rename to emit_message after removal of kernel-doc.pl
def emit_msg(self, ln, msg, *, warning=True):
- """Emit a message"""
+ """Emit a message."""
log_msg = f"{self.fname}:{ln} {msg}"
@@ -448,18 +448,37 @@ class KernelDoc:
self.config.log.debug("Output: %s:%s = %s", dtype, name, pformat(args))
+ def emit_unused_warnings(self):
+ """
+ When the parser fails to produce a valid entry, it places some
+ warnings under `entry.warnings` that will be discarded when resetting
+ the state.
+
+ Ensure that those warnings are not lost.
+
+ .. note::
+
+ Because we are calling `config.warning()` here, those
+ warnings are not filtered by the `-W` parameters: they will all
+ be produced even when `-Wreturn`, `-Wshort-desc`, and/or
+ `-Wcontents-before-sections` are used.
+
+ Allowing those warnings to be filtered is complex, because it
+ would require storing them in a buffer and then filtering them
+ during the output step of the code, depending on the
+ selected symbols.
+ """
+ if self.entry and self.entry not in self.entries:
+ for log_msg in self.entry.warnings:
+ self.config.warning(log_msg)
+
def reset_state(self, ln):
"""
Ancillary routine to create a new entry. It initializes all
variables used by the state machine.
"""
- #
- # Flush the warnings out before we proceed further
- #
- if self.entry and self.entry not in self.entries:
- for log_msg in self.entry.warnings:
- self.config.log.warning(log_msg)
+ self.emit_unused_warnings()
self.entry = KernelEntry(self.config, self.fname, ln)
@@ -1664,6 +1683,8 @@ class KernelDoc:
# Hand this line to the appropriate state handler
self.state_actions[self.state](self, ln, line)
+ self.emit_unused_warnings()
+
except OSError:
self.config.log.error(f"Error: Cannot open file {self.fname}")
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 645/844] docs: kdoc: avoid error_count overflows
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (643 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 644/844] docs: kdoc: fix logic to handle unissued warnings Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 646/844] mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations Sasha Levin
` (207 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Mauro Carvalho Chehab, Jonathan Corbet, Sasha Levin
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit 802774d8539fa73487190ec45438777a3c38d424 ]
The glibc library limits the return code to 8 bits. We need to
stick to this limit when using sys.exit(error_count).
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <233d1674db99ed8feb405a2f781de350f0fba0ac.1768823489.git.mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kernel-doc.py | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/scripts/kernel-doc.py b/scripts/kernel-doc.py
index 7a1eaf986bcd4..1ebb16b9bb087 100755
--- a/scripts/kernel-doc.py
+++ b/scripts/kernel-doc.py
@@ -116,6 +116,8 @@ SRC_DIR = os.path.dirname(os.path.realpath(__file__))
sys.path.insert(0, os.path.join(SRC_DIR, LIB_DIR))
+WERROR_RETURN_CODE = 3
+
DESC = """
Read C language source or header FILEs, extract embedded documentation comments,
and print formatted documentation to standard output.
@@ -176,7 +178,21 @@ class MsgFormatter(logging.Formatter):
return logging.Formatter.format(self, record)
def main():
- """Main program"""
+ """
+ Main program.
+
+ By default, the return value is:
+
+ - 0: success or Python version is not compatible with
+ kernel-doc. If -Werror is not used, it will also
+ return 0 if there are issues at kernel-doc markups;
+
+ - 1: an abnormal condition happened;
+
+ - 2: argparse issued an error;
+
+ - 3: -Werror is used, and one or more unfiltered parse warnings happened.
+ """
parser = argparse.ArgumentParser(formatter_class=argparse.RawTextHelpFormatter,
description=DESC)
@@ -323,16 +339,12 @@ def main():
if args.werror:
print("%s warnings as errors" % error_count) # pylint: disable=C0209
- sys.exit(error_count)
+ sys.exit(WERROR_RETURN_CODE)
if args.verbose:
print("%s errors" % error_count) # pylint: disable=C0209
- if args.none:
- sys.exit(0)
-
- sys.exit(error_count)
-
+ sys.exit(0)
# Call main method
if __name__ == "__main__":
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 646/844] mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (644 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 645/844] docs: kdoc: avoid error_count overflows Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 647/844] selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs Sasha Levin
` (206 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vlastimil Babka, Michal Hocko, Johannes Weiner, Pedro Falcato,
Zi Yan, Brendan Jackman, David Hildenbrand (Red Hat),
David Rientjes, Joshua Hahn, Liam Howlett, Lorenzo Stoakes,
Mike Rapoport, Suren Baghdasaryan, Andrew Morton, Sasha Levin
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit 9c9828d3ead69416d731b1238802af31760c823e ]
Since commit cc638f329ef6 ("mm, thp: tweak reclaim/compaction effort of
local-only and all-node allocations"), THP page fault allocations have
settled on the following scheme (from the commit log):
1. local node only THP allocation with no reclaim, just compaction.
2. for madvised VMA's or when synchronous compaction is enabled always - THP
allocation from any node with effort determined by global defrag setting
and VMA madvise
3. fallback to base pages on any node
Recent customer reports however revealed we have a gap in step 1 above.
What we have seen is excessive reclaim due to THP page faults on a NUMA
node that's close to its high watermark, while other nodes have plenty of
free memory.
The problem with step 1 is that it promises no reclaim after the
compaction attempt, however reclaim is only avoided for certain compaction
outcomes (deferred, or skipped due to insufficient free base pages), and
not e.g. when compaction is actually performed but fails (we did see
compact_fail vmstat counter increasing).
THP page faults can therefore exhibit a zone_reclaim_mode-like behavior,
which is not the intention.
Thus add a check for __GFP_THISNODE that corresponds to this exact
situation and prevents continuing with reclaim/compaction once the initial
compaction attempt isn't successful in allocating the page.
Note that commit cc638f329ef6 has not introduced this over-reclaim
possibility; it appears to exist in some form since commit 2f0799a0ffc0
("mm, thp: restore node-local hugepage allocations"). Followup commits
b39d0ee2632d ("mm, page_alloc: avoid expensive reclaim when compaction may
not succeed") and cc638f329ef6 have moved in the right direction, but left
the abovementioned gap.
Link: https://lkml.kernel.org/r/20251219-costly-noretry-thisnode-fix-v1-1-e1085a4a0c34@suse.cz
Fixes: 2f0799a0ffc0 ("mm, thp: restore node-local hugepage allocations")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Pedro Falcato <pfalcato@suse.de>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: "David Hildenbrand (Red Hat)" <david@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index cbf758e27aa2c..1af52f568f22d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4818,6 +4818,20 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
compact_result == COMPACT_DEFERRED)
goto nopage;
+ /*
+ * THP page faults may attempt local node only first,
+ * but are then allowed to only compact, not reclaim,
+ * see alloc_pages_mpol().
+ *
+ * Compaction can fail for other reasons than those
+ * checked above and we don't want such THP allocations
+ * to put reclaim pressure on a single node in a
+ * situation where other nodes might have plenty of
+ * available memory.
+ */
+ if (gfp_mask & __GFP_THISNODE)
+ goto nopage;
+
/*
* Looks like reclaim/compaction is worth trying, but
* sync compaction could be very expensive, so keep
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 647/844] selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (645 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 646/844] mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 648/844] drm/buddy: Prevent BUG_ON by validating rounded allocation Sasha Levin
` (205 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Li Wang, David Hildenbrand (Red Hat), Waiman Long, Mark Brown,
Shuah Khan, Andrew Morton, Sasha Levin
From: Li Wang <liwang@redhat.com>
[ Upstream commit 1aa1dd9cc595917882fb6db67725442956f79607 ]
charge_reserved_hugetlb.sh mounts a hugetlbfs instance at /mnt/huge with a
fixed size of 256M. On systems with large base hugepages (e.g. 512MB),
this is smaller than a single hugepage, so the hugetlbfs mount ends up
with zero capacity (often visible as size=0 in mount output).
As a result, write_to_hugetlbfs fails with ENOMEM and the test can hang
waiting for progress.
=== Error log ===
# uname -r
6.12.0-xxx.el10.aarch64+64k
#./charge_reserved_hugetlb.sh -cgroup-v2
# -----------------------------------------
...
# nr hugepages = 10
# writing cgroup limit: 5368709120
# writing reseravation limit: 5368709120
...
# write_to_hugetlbfs: Error mapping the file: Cannot allocate memory
# Waiting for hugetlb memory reservation to reach size 2684354560.
# 0
# Waiting for hugetlb memory reservation to reach size 2684354560.
# 0
...
# mount |grep /mnt/huge
none on /mnt/huge type hugetlbfs (rw,relatime,seclabel,pagesize=512M,size=0)
# grep -i huge /proc/meminfo
...
HugePages_Total: 10
HugePages_Free: 10
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 524288 kB
Hugetlb: 5242880 kB
Drop the mount args with 'size=256M', so the filesystem capacity is sufficient
regardless of HugeTLB page size.
Link: https://lkml.kernel.org/r/20251221122639.3168038-3-liwang@redhat.com
Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests")
Signed-off-by: Li Wang <liwang@redhat.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Acked-by: Waiman Long <longman@redhat.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/mm/charge_reserved_hugetlb.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/mm/charge_reserved_hugetlb.sh b/tools/testing/selftests/mm/charge_reserved_hugetlb.sh
index e1fe16bcbbe88..fa6713892d82d 100755
--- a/tools/testing/selftests/mm/charge_reserved_hugetlb.sh
+++ b/tools/testing/selftests/mm/charge_reserved_hugetlb.sh
@@ -290,7 +290,7 @@ function run_test() {
setup_cgroup "hugetlb_cgroup_test" "$cgroup_limit" "$reservation_limit"
mkdir -p /mnt/huge
- mount -t hugetlbfs -o pagesize=${MB}M,size=256M none /mnt/huge
+ mount -t hugetlbfs -o pagesize=${MB}M none /mnt/huge
write_hugetlbfs_and_get_usage "hugetlb_cgroup_test" "$size" "$populate" \
"$write" "/mnt/huge/test" "$method" "$private" "$expect_failure" \
@@ -344,7 +344,7 @@ function run_multiple_cgroup_test() {
setup_cgroup "hugetlb_cgroup_test2" "$cgroup_limit2" "$reservation_limit2"
mkdir -p /mnt/huge
- mount -t hugetlbfs -o pagesize=${MB}M,size=256M none /mnt/huge
+ mount -t hugetlbfs -o pagesize=${MB}M none /mnt/huge
write_hugetlbfs_and_get_usage "hugetlb_cgroup_test1" "$size1" \
"$populate1" "$write1" "/mnt/huge/test1" "$method" "$private" \
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 648/844] drm/buddy: Prevent BUG_ON by validating rounded allocation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (646 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 647/844] selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 649/844] drm/bridge: anx7625: Fix invalid EDID size Sasha Levin
` (204 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sanjay Yadav, Christian König, Arunpravin Paneer Selvam,
Matthew Auld, Sasha Levin
From: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
[ Upstream commit 5488a29596cdba93a60a79398dc9b69d5bdadf92 ]
When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is
rounded up to the next power-of-two via roundup_pow_of_two().
Similarly, for non-contiguous allocations with large min_block_size,
the size is aligned up via round_up(). Both operations can produce a
rounded size that exceeds mm->size, which later triggers
BUG_ON(order > mm->max_order).
Example scenarios:
- 9G CONTIGUOUS allocation on 10G VRAM memory:
roundup_pow_of_two(9G) = 16G > 10G
- 9G allocation with 8G min_block_size on 10G VRAM memory:
round_up(9G, 8G) = 16G > 10G
Fix this by checking the rounded size against mm->size. For
non-contiguous or range allocations where size > mm->size is invalid,
return -EINVAL immediately. For contiguous allocations without range
restrictions, allow the request to fall through to the existing
__alloc_contig_try_harder() fallback.
This ensures invalid user input returns an error or uses the fallback
path instead of hitting BUG_ON.
v2: (Matt A)
- Add Fixes, Cc stable, and Closes tags for context
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6712
Fixes: 0a1844bf0b53 ("drm/buddy: Improve contiguous memory allocation")
Cc: <stable@vger.kernel.org> # v6.7+
Cc: Christian König <christian.koenig@amd.com>
Cc: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Suggested-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://patch.msgid.link/20260108113227.2101872-5-sanjay.kumar.yadav@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_buddy.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/drm_buddy.c b/drivers/gpu/drm/drm_buddy.c
index 8308116058cc1..fd34d3755f7c5 100644
--- a/drivers/gpu/drm/drm_buddy.c
+++ b/drivers/gpu/drm/drm_buddy.c
@@ -1156,6 +1156,15 @@ int drm_buddy_alloc_blocks(struct drm_buddy *mm,
order = fls(pages) - 1;
min_order = ilog2(min_block_size) - ilog2(mm->chunk_size);
+ if (order > mm->max_order || size > mm->size) {
+ if ((flags & DRM_BUDDY_CONTIGUOUS_ALLOCATION) &&
+ !(flags & DRM_BUDDY_RANGE_ALLOCATION))
+ return __alloc_contig_try_harder(mm, original_size,
+ original_min_size, blocks);
+
+ return -EINVAL;
+ }
+
do {
order = min(order, (unsigned int)fls(pages) - 1);
BUG_ON(order > mm->max_order);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 649/844] drm/bridge: anx7625: Fix invalid EDID size
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (647 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 648/844] drm/buddy: Prevent BUG_ON by validating rounded allocation Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 650/844] phy: fsl-imx8mq-usb: set platform driver data Sasha Levin
` (203 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Loic Poulain, stable, Dmitry Baryshkov, Sasha Levin
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 1d5362145de96b5d00d590605cc94cdfa572b405 ]
DRM checks EDID block count against allocated size in drm_edid_valid
function. We have to allocate the right EDID size instead of the max
size to prevent the EDID to be reported as invalid.
Cc: stable@kernel.org
Fixes: 7c585f9a71aa ("drm/bridge: anx7625: use struct drm_edid more")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20251218151307.95491-1-loic.poulain@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index 6f3fdcb6afdb9..4e49e4f28d552 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -1801,7 +1801,7 @@ static const struct drm_edid *anx7625_edid_read(struct anx7625_data *ctx)
return NULL;
}
- ctx->cached_drm_edid = drm_edid_alloc(edid_buf, FOUR_BLOCK_SIZE);
+ ctx->cached_drm_edid = drm_edid_alloc(edid_buf, edid_num * ONE_BLOCK_SIZE);
kfree(edid_buf);
out:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 650/844] phy: fsl-imx8mq-usb: set platform driver data
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (648 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 649/844] drm/bridge: anx7625: Fix invalid EDID size Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 651/844] PCI: dwc: Skip waiting for L2/L3 Ready if dw_pcie_rp::skip_l23_wait is true Sasha Levin
` (202 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Xu Yang, Frank Li, Vinod Koul, Sasha Levin
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit debf8326a435ac746f48173e4742a574810f1ff4 ]
Add missing platform_set_drvdata() as the data will be used in remove().
Fixes: b58f0f86fd61 ("phy: fsl-imx8mq-usb: add tca function driver for imx95")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260120111646.3159766-1-xu.yang_2@nxp.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
index b30d01f345d20..9c340c889c80c 100644
--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
@@ -676,6 +676,8 @@ static int imx8mq_usb_phy_probe(struct platform_device *pdev)
if (!imx_phy)
return -ENOMEM;
+ platform_set_drvdata(pdev, imx_phy);
+
imx_phy->clk = devm_clk_get(dev, "phy");
if (IS_ERR(imx_phy->clk)) {
dev_err(dev, "failed to get imx8mq usb phy clock\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 651/844] PCI: dwc: Skip waiting for L2/L3 Ready if dw_pcie_rp::skip_l23_wait is true
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (649 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 650/844] phy: fsl-imx8mq-usb: set platform driver data Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 652/844] xfs: mark data structures corrupt on EIO and ENODATA Sasha Levin
` (201 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Richard Zhu, Manivannan Sadhasivam, Frank Li, Sasha Levin
From: Richard Zhu <hongxing.zhu@nxp.com>
[ Upstream commit 58a17b2647ba5aac47e3ffafd0a9b92bf4a9bcbe ]
In NXP i.MX6QP and i.MX7D SoCs, LTSSM registers are not accessible once
PME_Turn_Off message is broadcasted to the link. So there is no way to
verify whether the link has entered L2/L3 Ready state or not.
Hence, add a new flag 'dw_pcie_rp::skip_l23_ready' and set it to 'true' for
the above mentioned SoCs. This flag when set, will allow the DWC core to
skip polling for L2/L3 Ready state and just wait for 10ms as recommended in
the PCIe spec r6.0, sec 5.3.3.2.1.
Fixes: a528d1a72597 ("PCI: imx6: Use DWC common suspend resume method")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
[mani: renamed flag to skip_l23_ready and reworded description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260114083300.3689672-2-hongxing.zhu@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-imx6.c | 5 +++++
drivers/pci/controller/dwc/pcie-designware-host.c | 10 ++++++++++
drivers/pci/controller/dwc/pcie-designware.h | 1 +
3 files changed, 16 insertions(+)
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index dd69af0f195ff..c6dfbd57880ea 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -116,6 +116,7 @@ enum imx_pcie_variants {
#define IMX_PCIE_FLAG_BROKEN_SUSPEND BIT(9)
#define IMX_PCIE_FLAG_HAS_LUT BIT(10)
#define IMX_PCIE_FLAG_8GT_ECN_ERR051586 BIT(11)
+#define IMX_PCIE_FLAG_SKIP_L23_READY BIT(12)
#define imx_check_flag(pci, val) (pci->drvdata->flags & val)
@@ -1798,6 +1799,8 @@ static int imx_pcie_probe(struct platform_device *pdev)
*/
imx_pcie_add_lut_by_rid(imx_pcie, 0);
} else {
+ if (imx_check_flag(imx_pcie, IMX_PCIE_FLAG_SKIP_L23_READY))
+ pci->pp.skip_l23_ready = true;
pci->pp.use_atu_msg = true;
ret = dw_pcie_host_init(&pci->pp);
if (ret < 0)
@@ -1859,6 +1862,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
.variant = IMX6QP,
.flags = IMX_PCIE_FLAG_IMX_PHY |
IMX_PCIE_FLAG_SPEED_CHANGE_WORKAROUND |
+ IMX_PCIE_FLAG_SKIP_L23_READY |
IMX_PCIE_FLAG_SUPPORTS_SUSPEND,
.dbi_length = 0x200,
.gpr = "fsl,imx6q-iomuxc-gpr",
@@ -1875,6 +1879,7 @@ static const struct imx_pcie_drvdata drvdata[] = {
.variant = IMX7D,
.flags = IMX_PCIE_FLAG_SUPPORTS_SUSPEND |
IMX_PCIE_FLAG_HAS_APP_RESET |
+ IMX_PCIE_FLAG_SKIP_L23_READY |
IMX_PCIE_FLAG_HAS_PHY_RESET,
.gpr = "fsl,imx7d-iomuxc-gpr",
.mode_off[0] = IOMUXC_GPR12,
diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index f1c7d50eba746..af2eeed55f9e5 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -1173,6 +1173,16 @@ int dw_pcie_suspend_noirq(struct dw_pcie *pci)
return ret;
}
+ /*
+ * Some SoCs do not support reading the LTSSM register after
+ * PME_Turn_Off broadcast. For those SoCs, skip waiting for L2/L3 Ready
+ * state and wait 10ms as recommended in PCIe spec r6.0, sec 5.3.3.2.1.
+ */
+ if (pci->pp.skip_l23_ready) {
+ mdelay(PCIE_PME_TO_L2_TIMEOUT_US/1000);
+ goto stop_link;
+ }
+
ret = read_poll_timeout(dw_pcie_get_ltssm, val,
val == DW_PCIE_LTSSM_L2_IDLE ||
val <= DW_PCIE_LTSSM_DETECT_WAIT,
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index 6f0dfdde1d577..ca3ff1fefab5d 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -446,6 +446,7 @@ struct dw_pcie_rp {
struct pci_config_window *cfg;
bool ecam_enabled;
bool native_ecam;
+ bool skip_l23_ready;
};
struct dw_pcie_ep_ops {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 652/844] xfs: mark data structures corrupt on EIO and ENODATA
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (650 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 651/844] PCI: dwc: Skip waiting for L2/L3 Ready if dw_pcie_rp::skip_l23_wait is true Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 653/844] xfs: remove xfs_attr_leaf_hasname Sasha Levin
` (200 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Darrick J. Wong, Christoph Hellwig, Carlos Maiolino, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit f39854a3fb2f06dc69b81ada002b641ba5b4696b ]
I learned a few things this year: first, blk_status_to_errno can return
ENODATA for critical media errors; and second, the scrub code doesn't
mark data structures as corrupt on ENODATA or EIO.
Currently, scrub failing to capture these errors isn't all that
impactful -- the checking code will exit to userspace with EIO/ENODATA,
and xfs_scrub will log a complaint and exit with nonzero status. Most
people treat fsck tools failing as a sign that the fs is corrupt, but
online fsck should mark the metadata bad and keep moving.
Cc: stable@vger.kernel.org # v4.15
Fixes: 4700d22980d459 ("xfs: create helpers to record and deal with scrub problems")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/btree.c | 2 ++
fs/xfs/scrub/common.c | 4 ++++
fs/xfs/scrub/dabtree.c | 2 ++
3 files changed, 8 insertions(+)
diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index acade92c5fce1..b497f6a474c77 100644
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -42,6 +42,8 @@ __xchk_btree_process_error(
break;
case -EFSBADCRC:
case -EFSCORRUPTED:
+ case -EIO:
+ case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= errflag;
*error = 0;
diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c
index 7bfa37c99480f..5f9be4151d722 100644
--- a/fs/xfs/scrub/common.c
+++ b/fs/xfs/scrub/common.c
@@ -103,6 +103,8 @@ __xchk_process_error(
break;
case -EFSBADCRC:
case -EFSCORRUPTED:
+ case -EIO:
+ case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= errflag;
*error = 0;
@@ -177,6 +179,8 @@ __xchk_fblock_process_error(
break;
case -EFSBADCRC:
case -EFSCORRUPTED:
+ case -EIO:
+ case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= errflag;
*error = 0;
diff --git a/fs/xfs/scrub/dabtree.c b/fs/xfs/scrub/dabtree.c
index 056de4819f866..a6a5d3a75d994 100644
--- a/fs/xfs/scrub/dabtree.c
+++ b/fs/xfs/scrub/dabtree.c
@@ -45,6 +45,8 @@ xchk_da_process_error(
break;
case -EFSBADCRC:
case -EFSCORRUPTED:
+ case -EIO:
+ case -ENODATA:
/* Note the badness but don't abort. */
sc->sm->sm_flags |= XFS_SCRUB_OFLAG_CORRUPT;
*error = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 653/844] xfs: remove xfs_attr_leaf_hasname
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (651 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 652/844] xfs: mark data structures corrupt on EIO and ENODATA Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 654/844] media: verisilicon: AV1: Fix tile info buffer size Sasha Levin
` (199 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Christoph Hellwig, Mark Tinguely, Darrick J. Wong,
Carlos Maiolino, Sasha Levin
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 ]
The calling convention of xfs_attr_leaf_hasname() is problematic, because
it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer
when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a
non-NULL buffer pointer for an already released buffer when
xfs_attr3_leaf_lookup_int fails with other error values.
Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so
that the buffer release code is done by each caller of
xfs_attr3_leaf_read.
Cc: stable@vger.kernel.org # v5.19+
Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines")
Reported-by: Mark Tinguely <mark.tinguely@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_attr.c | 75 +++++++++++++---------------------------
1 file changed, 24 insertions(+), 51 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index 8c04acd30d489..b88e65c7e45de 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -50,7 +50,6 @@ STATIC int xfs_attr_shortform_addname(xfs_da_args_t *args);
*/
STATIC int xfs_attr_leaf_get(xfs_da_args_t *args);
STATIC int xfs_attr_leaf_removename(xfs_da_args_t *args);
-STATIC int xfs_attr_leaf_hasname(struct xfs_da_args *args, struct xfs_buf **bp);
/*
* Internal routines when attribute list is more than one block.
@@ -979,11 +978,12 @@ xfs_attr_lookup(
return error;
if (xfs_attr_is_leaf(dp)) {
- error = xfs_attr_leaf_hasname(args, &bp);
-
- if (bp)
- xfs_trans_brelse(args->trans, bp);
-
+ error = xfs_attr3_leaf_read(args->trans, args->dp, args->owner,
+ 0, &bp);
+ if (error)
+ return error;
+ error = xfs_attr3_leaf_lookup_int(bp, args);
+ xfs_trans_brelse(args->trans, bp);
return error;
}
@@ -1222,27 +1222,6 @@ xfs_attr_shortform_addname(
* External routines when attribute list is one block
*========================================================================*/
-/*
- * Return EEXIST if attr is found, or ENOATTR if not
- */
-STATIC int
-xfs_attr_leaf_hasname(
- struct xfs_da_args *args,
- struct xfs_buf **bp)
-{
- int error = 0;
-
- error = xfs_attr3_leaf_read(args->trans, args->dp, args->owner, 0, bp);
- if (error)
- return error;
-
- error = xfs_attr3_leaf_lookup_int(*bp, args);
- if (error != -ENOATTR && error != -EEXIST)
- xfs_trans_brelse(args->trans, *bp);
-
- return error;
-}
-
/*
* Remove a name from the leaf attribute list structure
*
@@ -1253,25 +1232,22 @@ STATIC int
xfs_attr_leaf_removename(
struct xfs_da_args *args)
{
- struct xfs_inode *dp;
- struct xfs_buf *bp;
+ struct xfs_inode *dp = args->dp;
int error, forkoff;
+ struct xfs_buf *bp;
trace_xfs_attr_leaf_removename(args);
- /*
- * Remove the attribute.
- */
- dp = args->dp;
-
- error = xfs_attr_leaf_hasname(args, &bp);
- if (error == -ENOATTR) {
+ error = xfs_attr3_leaf_read(args->trans, args->dp, args->owner, 0, &bp);
+ if (error)
+ return error;
+ error = xfs_attr3_leaf_lookup_int(bp, args);
+ if (error != -EEXIST) {
xfs_trans_brelse(args->trans, bp);
- if (args->op_flags & XFS_DA_OP_RECOVERY)
+ if (error == -ENOATTR && (args->op_flags & XFS_DA_OP_RECOVERY))
return 0;
return error;
- } else if (error != -EEXIST)
- return error;
+ }
xfs_attr3_leaf_remove(bp, args);
@@ -1295,23 +1271,20 @@ xfs_attr_leaf_removename(
* Returns 0 on successful retrieval, otherwise an error.
*/
STATIC int
-xfs_attr_leaf_get(xfs_da_args_t *args)
+xfs_attr_leaf_get(
+ struct xfs_da_args *args)
{
- struct xfs_buf *bp;
- int error;
+ struct xfs_buf *bp;
+ int error;
trace_xfs_attr_leaf_get(args);
- error = xfs_attr_leaf_hasname(args, &bp);
-
- if (error == -ENOATTR) {
- xfs_trans_brelse(args->trans, bp);
- return error;
- } else if (error != -EEXIST)
+ error = xfs_attr3_leaf_read(args->trans, args->dp, args->owner, 0, &bp);
+ if (error)
return error;
-
-
- error = xfs_attr3_leaf_getvalue(bp, args);
+ error = xfs_attr3_leaf_lookup_int(bp, args);
+ if (error == -EEXIST)
+ error = xfs_attr3_leaf_getvalue(bp, args);
xfs_trans_brelse(args->trans, bp);
return error;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 654/844] media: verisilicon: AV1: Fix tile info buffer size
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (652 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 653/844] xfs: remove xfs_attr_leaf_hasname Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 655/844] dm: fix excessive blk-crypto operations for invalid keys Sasha Levin
` (198 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Benjamin Gaignard, Nicolas Dufresne, Hans Verkuil, Sasha Levin
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
[ Upstream commit a505ca2db89ad92a8d8d27fa68ebafb12e04a679 ]
Each tile info is composed of: row_sb, col_sb, start_pos
and end_pos (4 bytes each). So the total required memory
is AV1_MAX_TILES * 16 bytes.
Use the correct #define to allocate the buffer and avoid
writing tile info in non-allocated memory.
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Fixes: 727a400686a2c ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: stable@vger.kernel.org
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
index 500e94bcb0293..e4e21ad373233 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -381,12 +381,12 @@ int rockchip_vpu981_av1_dec_init(struct hantro_ctx *ctx)
return -ENOMEM;
av1_dec->global_model.size = GLOBAL_MODEL_SIZE;
- av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_MAX_TILES,
+ av1_dec->tile_info.cpu = dma_alloc_coherent(vpu->dev, AV1_TILE_INFO_SIZE,
&av1_dec->tile_info.dma,
GFP_KERNEL);
if (!av1_dec->tile_info.cpu)
return -ENOMEM;
- av1_dec->tile_info.size = AV1_MAX_TILES;
+ av1_dec->tile_info.size = AV1_TILE_INFO_SIZE;
av1_dec->film_grain.cpu = dma_alloc_coherent(vpu->dev,
ALIGN(sizeof(struct rockchip_av1_film_grain), 2048),
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 655/844] dm: fix excessive blk-crypto operations for invalid keys
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (653 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 654/844] media: verisilicon: AV1: Fix tile info buffer size Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 656/844] media: uvcvideo: Return queued buffers on start_streaming() failure Sasha Levin
` (197 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Eric Biggers, Mikulas Patocka, Sasha Levin
From: Eric Biggers <ebiggers@kernel.org>
[ Upstream commit d6d0e6b9d54532264761405a1ba8ea5bd293acb1 ]
dm_exec_wrappedkey_op() passes through the derive_sw_secret, import_key,
generate_key, and prepare_key blk-crypto operations to an underlying
device.
Currently, it calls the operation on every underlying device until one
returns success.
This logic is flawed when the operation is expected to fail, such as an
invalid key being passed to derive_sw_secret. That can happen if
userspace passes an invalid key to the FS_IOC_ADD_ENCRYPTION_KEY ioctl.
When that happens on a device-mapper device that consists of many
dm-linear targets, a lot of unnecessary key unwrapping requests get sent
to the underlying key wrapping hardware.
Fix this by considering the first device only. As already documented in
the comment, it was already checked that all underlying devices support
wrapped keys, so this should be fine.
Fixes: e93912786e50 ("dm: pass through operations on wrapped inline crypto keys")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-table.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 0522cd700e0e2..4b70872725d04 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1237,9 +1237,6 @@ static int dm_wrappedkey_op_callback(struct dm_target *ti, struct dm_dev *dev,
bdev_get_queue(bdev)->crypto_profile;
int err = -EOPNOTSUPP;
- if (!args->err)
- return 0;
-
switch (args->op) {
case DERIVE_SW_SECRET:
err = blk_crypto_derive_sw_secret(
@@ -1266,9 +1263,7 @@ static int dm_wrappedkey_op_callback(struct dm_target *ti, struct dm_dev *dev,
break;
}
args->err = err;
-
- /* Try another device in case this fails. */
- return 0;
+ return 1; /* No need to continue the iteration. */
}
static int dm_exec_wrappedkey_op(struct blk_crypto_profile *profile,
@@ -1294,14 +1289,13 @@ static int dm_exec_wrappedkey_op(struct blk_crypto_profile *profile,
* declared on all underlying devices. Thus, all the underlying devices
* should support all wrapped key operations and they should behave
* identically, i.e. work with the same keys. So, just executing the
- * operation on the first device on which it works suffices for now.
+ * operation on the first device suffices for now.
*/
for (i = 0; i < t->num_targets; i++) {
ti = dm_table_get_target(t, i);
if (!ti->type->iterate_devices)
continue;
- ti->type->iterate_devices(ti, dm_wrappedkey_op_callback, args);
- if (!args->err)
+ if (ti->type->iterate_devices(ti, dm_wrappedkey_op_callback, args) != 0)
break;
}
out:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 656/844] media: uvcvideo: Return queued buffers on start_streaming() failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (654 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 655/844] dm: fix excessive blk-crypto operations for invalid keys Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 657/844] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode Sasha Levin
` (196 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michal Pecio, Ricardo Ribalda, Laurent Pinchart, Hans Verkuil,
Sasha Levin
From: Michal Pecio <michal.pecio@gmail.com>
[ Upstream commit 4cf3b6fd54ebb1ebc977bdc47fb6cfcf9a471a22 ]
Return buffers if streaming fails to start due to uvc_pm_get() error.
This bug may be responsible for a warning I got running
while :; do yavta -c3 /dev/video0; done
on an xHCI controller which failed under this workload.
I had no luck reproducing this warning again to confirm.
xhci_hcd 0000:09:00.0: HC died; cleaning up
usb 13-2: USB disconnect, device number 2
WARNING: CPU: 2 PID: 29386 at drivers/media/common/videobuf2/videobuf2-core.c:1803 vb2_start_streaming+0xac/0x120
Fixes: 7dd56c47784a ("media: uvcvideo: Remove stream->is_streaming field")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patch.msgid.link/20251015133642.3dede646.michal.pecio@gmail.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_queue.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c
index 790184c9843d2..e838c6c1893a6 100644
--- a/drivers/media/usb/uvc/uvc_queue.c
+++ b/drivers/media/usb/uvc/uvc_queue.c
@@ -177,18 +177,20 @@ static int uvc_start_streaming_video(struct vb2_queue *vq, unsigned int count)
ret = uvc_pm_get(stream->dev);
if (ret)
- return ret;
+ goto err_buffers;
queue->buf_used = 0;
ret = uvc_video_start_streaming(stream);
- if (ret == 0)
- return 0;
+ if (ret)
+ goto err_pm;
- uvc_pm_put(stream->dev);
+ return 0;
+err_pm:
+ uvc_pm_put(stream->dev);
+err_buffers:
uvc_queue_return_buffers(queue, UVC_BUF_STATE_QUEUED);
-
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 657/844] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (655 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 656/844] media: uvcvideo: Return queued buffers on start_streaming() failure Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 658/844] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in " Sasha Levin
` (195 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jinhui Guo, Lu Baolu, Joerg Roedel, Sasha Levin
From: Jinhui Guo <guojinhui.liam@bytedance.com>
[ Upstream commit 42662d19839f34735b718129ea200e3734b07e50 ]
PCIe endpoints with ATS enabled and passed through to userspace
(e.g., QEMU, DPDK) can hard-lock the host when their link drops,
either by surprise removal or by a link fault.
Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
request when device is disconnected") adds pci_dev_is_disconnected()
to devtlb_invalidation_with_pasid() so ATS invalidation is skipped
only when the device is being safely removed, but it applies only
when Intel IOMMU scalable mode is enabled.
With scalable mode disabled or unsupported, a system hard-lock
occurs when a PCIe endpoint's link drops because the Intel IOMMU
waits indefinitely for an ATS invalidation that cannot complete.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
domain_context_clear_one_cb
pci_for_each_dma_alias
device_block_translation
blocking_domain_attach_dev
iommu_deinit_device
__iommu_group_remove_device
iommu_release_device
iommu_bus_notifier
blocking_notifier_call_chain
bus_notify
device_del
pci_remove_bus_device
pci_stop_and_remove_bus_device
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist
Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
which calls qi_flush_dev_iotlb() and can also hard-lock the system
when a PCIe endpoint's link drops.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
intel_context_flush_no_pasid
device_pasid_table_teardown
pci_pasid_table_teardown
pci_for_each_dma_alias
intel_pasid_teardown_sm_context
intel_iommu_release_device
iommu_deinit_device
__iommu_group_remove_device
iommu_release_device
iommu_bus_notifier
blocking_notifier_call_chain
bus_notify
device_del
pci_remove_bus_device
pci_stop_and_remove_bus_device
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist
Sometimes the endpoint loses connection without a link-down event
(e.g., due to a link fault); killing the process (virsh destroy)
then hard-locks the host.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
domain_context_clear_one_cb
pci_for_each_dma_alias
device_block_translation
blocking_domain_attach_dev
__iommu_attach_device
__iommu_device_set_domain
__iommu_group_set_domain_internal
iommu_detach_group
vfio_iommu_type1_detach_group
vfio_group_detach_container
vfio_group_fops_release
__fput
pci_dev_is_disconnected() only covers safe-removal paths;
pci_device_is_present() tests accessibility by reading
vendor/device IDs and internally calls pci_dev_is_disconnected().
On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs.
Since __context_flush_dev_iotlb() is only called on
{attach,release}_dev paths (not hot), add pci_device_is_present()
there to skip inaccessible devices and avoid the hard-lock.
Fixes: 37764b952e1b ("iommu/vt-d: Global devTLB flush when present context entry changed")
Fixes: 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
Cc: stable@vger.kernel.org
Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
Link: https://lore.kernel.org/r/20251211035946.2071-2-guojinhui.liam@bytedance.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/pasid.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
index 34b209b88be2a..d3841a88e5948 100644
--- a/drivers/iommu/intel/pasid.c
+++ b/drivers/iommu/intel/pasid.c
@@ -926,6 +926,14 @@ static void __context_flush_dev_iotlb(struct device_domain_info *info)
if (!info->ats_enabled)
return;
+ /*
+ * Skip dev-IOTLB flush for inaccessible PCIe devices to prevent the
+ * Intel IOMMU from waiting indefinitely for an ATS invalidation that
+ * cannot complete.
+ */
+ if (!pci_device_is_present(to_pci_dev(info->dev)))
+ return;
+
qi_flush_dev_iotlb(info->iommu, PCI_DEVID(info->bus, info->devfn),
info->pfsid, info->ats_qdep, 0, MAX_AGAW_PFN_WIDTH);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 658/844] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (656 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 657/844] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 659/844] iommu/vt-d: Flush piotlb for SVM and Nested domain Sasha Levin
` (194 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jinhui Guo, Lu Baolu, Joerg Roedel, Sasha Levin
From: Jinhui Guo <guojinhui.liam@bytedance.com>
[ Upstream commit 10e60d87813989e20eac1f3eda30b3bae461e7f9 ]
Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
request when device is disconnected") relies on
pci_dev_is_disconnected() to skip ATS invalidation for
safely-removed devices, but it does not cover link-down caused
by faults, which can still hard-lock the system.
For example, if a VM fails to connect to the PCIe device,
"virsh destroy" is executed to release resources and isolate
the fault, but a hard-lockup occurs while releasing the group fd.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
intel_pasid_tear_down_entry
device_block_translation
blocking_domain_attach_dev
__iommu_attach_device
__iommu_device_set_domain
__iommu_group_set_domain_internal
iommu_detach_group
vfio_iommu_type1_detach_group
vfio_group_detach_container
vfio_group_fops_release
__fput
Although pci_device_is_present() is slower than
pci_dev_is_disconnected(), it still takes only ~70 µs on a
ConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed
and width increase.
Besides, devtlb_invalidation_with_pasid() is called only in the
paths below, which are far less frequent than memory map/unmap.
1. mm-struct release
2. {attach,release}_dev
3. set/remove PASID
4. dirty-tracking setup
The gain in system stability far outweighs the negligible cost
of using pci_device_is_present() instead of pci_dev_is_disconnected()
to decide when to skip ATS invalidation, especially under GDR
high-load conditions.
Fixes: 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected")
Cc: stable@vger.kernel.org
Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
Link: https://lore.kernel.org/r/20251211035946.2071-3-guojinhui.liam@bytedance.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/pasid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
index d3841a88e5948..b63a71904cfb8 100644
--- a/drivers/iommu/intel/pasid.c
+++ b/drivers/iommu/intel/pasid.c
@@ -219,7 +219,7 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu,
if (!info || !info->ats_enabled)
return;
- if (pci_dev_is_disconnected(to_pci_dev(dev)))
+ if (!pci_device_is_present(to_pci_dev(dev)))
return;
sid = PCI_DEVID(info->bus, info->devfn);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 659/844] iommu/vt-d: Flush piotlb for SVM and Nested domain
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (657 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 658/844] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in " Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 660/844] KVM: arm64: nv: Return correct RES0 bits for FGT registers Sasha Levin
` (193 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Yi Liu, Kevin Tian, Lu Baolu, Joerg Roedel, Sasha Levin
From: Yi Liu <yi.l.liu@intel.com>
[ Upstream commit 04b1b069f151e793767755f58b51670bff00cbc1 ]
Besides the paging domains that use FS, SVM and Nested domains need to
use piotlb invalidation descriptor as well.
Fixes: b33125296b50 ("iommu/vt-d: Create unique domain ops for each stage")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20251223065824.6164-1-yi.l.liu@intel.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/cache.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c
index 265e7290256b5..385ae5cfb30d4 100644
--- a/drivers/iommu/intel/cache.c
+++ b/drivers/iommu/intel/cache.c
@@ -363,6 +363,13 @@ static void qi_batch_add_pasid_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16
qi_batch_increment_index(iommu, batch);
}
+static bool intel_domain_use_piotlb(struct dmar_domain *domain)
+{
+ return domain->domain.type == IOMMU_DOMAIN_SVA ||
+ domain->domain.type == IOMMU_DOMAIN_NESTED ||
+ intel_domain_is_fs_paging(domain);
+}
+
static void cache_tag_flush_iotlb(struct dmar_domain *domain, struct cache_tag *tag,
unsigned long addr, unsigned long pages,
unsigned long mask, int ih)
@@ -370,7 +377,7 @@ static void cache_tag_flush_iotlb(struct dmar_domain *domain, struct cache_tag *
struct intel_iommu *iommu = tag->iommu;
u64 type = DMA_TLB_PSI_FLUSH;
- if (intel_domain_is_fs_paging(domain)) {
+ if (intel_domain_use_piotlb(domain)) {
qi_batch_add_piotlb(iommu, tag->domain_id, tag->pasid, addr,
pages, ih, domain->qi_batch);
return;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 660/844] KVM: arm64: nv: Return correct RES0 bits for FGT registers
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (658 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 659/844] iommu/vt-d: Flush piotlb for SVM and Nested domain Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 661/844] mfd: core: Add locking around 'mfd_of_node_list' Sasha Levin
` (192 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Zenghui Yu (Huawei), Marc Zyngier, Sasha Levin
From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
[ Upstream commit 2eb80a2eee18762a33aa770d742d64fe47852c7e ]
We had extended the sysreg masking infrastructure to more general
registers, instead of restricting it to VNCR-backed registers, since
commit a0162020095e ("KVM: arm64: Extend masking facility to arbitrary
registers"). Fix kvm_get_sysreg_res0() to reflect this fact.
Note that we're sure that we only deal with FGT registers in
kvm_get_sysreg_res0(), the
if (sr < __VNCR_START__)
is actually a never false, which should probably be removed later.
Fixes: 69c19e047dfe ("KVM: arm64: Add TCR2_EL2 to the sysreg arrays")
Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
Link: https://patch.msgid.link/20260121101631.41037-1-zenghui.yu@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/emulate-nested.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
index 834f13fb1fb7d..2d04fb56746ea 100644
--- a/arch/arm64/kvm/emulate-nested.c
+++ b/arch/arm64/kvm/emulate-nested.c
@@ -2428,7 +2428,7 @@ static u64 kvm_get_sysreg_res0(struct kvm *kvm, enum vcpu_sysreg sr)
masks = kvm->arch.sysreg_masks;
- return masks->mask[sr - __VNCR_START__].res0;
+ return masks->mask[sr - __SANITISED_REG_START__].res0;
}
static bool check_fgt_bit(struct kvm_vcpu *vcpu, enum vcpu_sysreg sr,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 661/844] mfd: core: Add locking around 'mfd_of_node_list'
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (659 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 660/844] KVM: arm64: nv: Return correct RES0 bits for FGT registers Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 662/844] mfd: tps65219: Implement LOCK register handling for TPS65214 Sasha Levin
` (191 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Douglas Anderson, Lee Jones, Sasha Levin
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 20117c92bcf9c11afd64d7481d8f94fdf410726e ]
Manipulating a list in the kernel isn't safe without some sort of
mutual exclusion. Add a mutex any time we access / modify
'mfd_of_node_list' to prevent possible crashes.
Cc: stable@vger.kernel.org
Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match devices with the correct of_nodes")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251210113002.1.I6ceaca2cfb7eb25737012b166671f516696be4fd@changeid
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/mfd-core.c | 36 ++++++++++++++++++++++--------------
1 file changed, 22 insertions(+), 14 deletions(-)
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 7d14a1e7631ee..c55223ce4327a 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -22,6 +22,7 @@
#include <linux/regulator/consumer.h>
static LIST_HEAD(mfd_of_node_list);
+static DEFINE_MUTEX(mfd_of_node_mutex);
struct mfd_of_node_entry {
struct list_head list;
@@ -105,9 +106,11 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev,
u64 of_node_addr;
/* Skip if OF node has previously been allocated to a device */
- list_for_each_entry(of_entry, &mfd_of_node_list, list)
- if (of_entry->np == np)
- return -EAGAIN;
+ scoped_guard(mutex, &mfd_of_node_mutex) {
+ list_for_each_entry(of_entry, &mfd_of_node_list, list)
+ if (of_entry->np == np)
+ return -EAGAIN;
+ }
if (!cell->use_of_reg)
/* No of_reg defined - allocate first free compatible match */
@@ -129,7 +132,8 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev,
of_entry->dev = &pdev->dev;
of_entry->np = np;
- list_add_tail(&of_entry->list, &mfd_of_node_list);
+ scoped_guard(mutex, &mfd_of_node_mutex)
+ list_add_tail(&of_entry->list, &mfd_of_node_list);
of_node_get(np);
device_set_node(&pdev->dev, of_fwnode_handle(np));
@@ -286,11 +290,13 @@ static int mfd_add_device(struct device *parent, int id,
if (cell->swnode)
device_remove_software_node(&pdev->dev);
fail_of_entry:
- list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list)
- if (of_entry->dev == &pdev->dev) {
- list_del(&of_entry->list);
- kfree(of_entry);
- }
+ scoped_guard(mutex, &mfd_of_node_mutex) {
+ list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list)
+ if (of_entry->dev == &pdev->dev) {
+ list_del(&of_entry->list);
+ kfree(of_entry);
+ }
+ }
fail_alias:
regulator_bulk_unregister_supply_alias(&pdev->dev,
cell->parent_supplies,
@@ -360,11 +366,13 @@ static int mfd_remove_devices_fn(struct device *dev, void *data)
if (cell->swnode)
device_remove_software_node(&pdev->dev);
- list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list)
- if (of_entry->dev == &pdev->dev) {
- list_del(&of_entry->list);
- kfree(of_entry);
- }
+ scoped_guard(mutex, &mfd_of_node_mutex) {
+ list_for_each_entry_safe(of_entry, tmp, &mfd_of_node_list, list)
+ if (of_entry->dev == &pdev->dev) {
+ list_del(&of_entry->list);
+ kfree(of_entry);
+ }
+ }
regulator_bulk_unregister_supply_alias(dev, cell->parent_supplies,
cell->num_parent_supplies);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 662/844] mfd: tps65219: Implement LOCK register handling for TPS65214
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (660 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 661/844] mfd: core: Add locking around 'mfd_of_node_list' Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 663/844] mfd: macsmc: Initialize mutex Sasha Levin
` (190 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kory Maincent (TI.com), Andrew Davis, Lee Jones, Sasha Levin
From: "Kory Maincent (TI.com)" <kory.maincent@bootlin.com>
[ Upstream commit d3fcf276b501a82d4504fd5b1ed40249546530d1 ]
The TPS65214 PMIC variant has a LOCK_REG register that prevents writes to
nearly all registers when locked. Unlock the registers at probe time and
leave them unlocked permanently.
This approach is justified because:
- Register locking is very uncommon in typical system operation
- No code path is expected to lock the registers during runtime
- Adding a custom regmap write function would add overhead to every
register write, including voltage changes triggered by CPU OPP
transitions from the cpufreq governor which could happen quite
frequently
Cc: stable@vger.kernel.org
Fixes: 7947219ab1a2d ("mfd: tps65219: Add support for TI TPS65214 PMIC")
Reviewed-by: Andrew Davis <afd@ti.com>
Signed-off-by: Kory Maincent (TI.com) <kory.maincent@bootlin.com>
Link: https://patch.msgid.link/20251218-fix_tps65219-v5-1-8bb511417f3a@bootlin.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/tps65219.c | 9 +++++++++
include/linux/mfd/tps65219.h | 2 ++
2 files changed, 11 insertions(+)
diff --git a/drivers/mfd/tps65219.c b/drivers/mfd/tps65219.c
index 65a952555218d..7275dcdb7c44f 100644
--- a/drivers/mfd/tps65219.c
+++ b/drivers/mfd/tps65219.c
@@ -498,6 +498,15 @@ static int tps65219_probe(struct i2c_client *client)
return ret;
}
+ if (chip_id == TPS65214) {
+ ret = i2c_smbus_write_byte_data(client, TPS65214_REG_LOCK,
+ TPS65214_LOCK_ACCESS_CMD);
+ if (ret) {
+ dev_err(tps->dev, "Failed to unlock registers %d\n", ret);
+ return ret;
+ }
+ }
+
ret = devm_regmap_add_irq_chip(tps->dev, tps->regmap, client->irq,
IRQF_ONESHOT, 0, pmic->irq_chip,
&tps->irq_data);
diff --git a/include/linux/mfd/tps65219.h b/include/linux/mfd/tps65219.h
index 55234e771ba73..3abf937191d0c 100644
--- a/include/linux/mfd/tps65219.h
+++ b/include/linux/mfd/tps65219.h
@@ -149,6 +149,8 @@ enum pmic_id {
#define TPS65215_ENABLE_LDO2_EN_MASK BIT(5)
#define TPS65214_ENABLE_LDO1_EN_MASK BIT(5)
#define TPS65219_ENABLE_LDO4_EN_MASK BIT(6)
+/* Register Unlock */
+#define TPS65214_LOCK_ACCESS_CMD 0x5a
/* power ON-OFF sequence slot */
#define TPS65219_BUCKS_LDOS_SEQUENCE_OFF_SLOT_MASK GENMASK(3, 0)
#define TPS65219_BUCKS_LDOS_SEQUENCE_ON_SLOT_MASK GENMASK(7, 4)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 663/844] mfd: macsmc: Initialize mutex
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (661 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 662/844] mfd: tps65219: Implement LOCK register handling for TPS65214 Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 664/844] mfd: qcom-pm8xxx: Fix OF populate on driver rebind Sasha Levin
` (189 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Janne Grunau, Sven Peter, Neal Gompa, Lee Jones, Sasha Levin
From: Janne Grunau <j@jannau.net>
[ Upstream commit 414f65d6736342c77d4ec5e7373039f4a09250dd ]
Initialize struct apple_smc's mutex in apple_smc_probe(). Using the
mutex uninitialized surprisingly resulted only in occasional NULL
pointer dereferences in apple_smc_read() calls from the probe()
functions of sub devices.
Cc: stable@vger.kernel.org
Fixes: e038d985c9823 ("mfd: Add Apple Silicon System Management Controller")
Signed-off-by: Janne Grunau <j@jannau.net>
Reviewed-by: Sven Peter <sven@kernel.org>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Link: https://patch.msgid.link/20251231-macsmc-mutex_init-v2-1-5818c9dc9b29@jannau.net
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/macsmc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/macsmc.c b/drivers/mfd/macsmc.c
index e3893e255ce5e..3015e8d36d6e5 100644
--- a/drivers/mfd/macsmc.c
+++ b/drivers/mfd/macsmc.c
@@ -413,6 +413,7 @@ static int apple_smc_probe(struct platform_device *pdev)
if (!smc)
return -ENOMEM;
+ mutex_init(&smc->mutex);
smc->dev = &pdev->dev;
smc->sram_base = devm_platform_get_and_ioremap_resource(pdev, 1, &smc->sram);
if (IS_ERR(smc->sram_base))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 664/844] mfd: qcom-pm8xxx: Fix OF populate on driver rebind
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (662 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 663/844] mfd: macsmc: Initialize mutex Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 665/844] mfd: omap-usb-host: " Sasha Levin
` (188 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Dmitry Baryshkov, Konrad Dybcio, Lee Jones,
Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 27a8acea47a93fea6ad0e2df4c20a9b51490e4d9 ]
Since commit c6e126de43e7 ("of: Keep track of populated platform
devices") child devices will not be created by of_platform_populate()
if the devices had previously been deregistered individually so that the
OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that
the child devices are created if the driver is rebound.
Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20251219110947.24101-1-johan@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/qcom-pm8xxx.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/mfd/qcom-pm8xxx.c b/drivers/mfd/qcom-pm8xxx.c
index 1149f7102a365..0cf374c015ce7 100644
--- a/drivers/mfd/qcom-pm8xxx.c
+++ b/drivers/mfd/qcom-pm8xxx.c
@@ -577,17 +577,11 @@ static int pm8xxx_probe(struct platform_device *pdev)
return rc;
}
-static int pm8xxx_remove_child(struct device *dev, void *unused)
-{
- platform_device_unregister(to_platform_device(dev));
- return 0;
-}
-
static void pm8xxx_remove(struct platform_device *pdev)
{
struct pm_irq_chip *chip = platform_get_drvdata(pdev);
- device_for_each_child(&pdev->dev, NULL, pm8xxx_remove_child);
+ of_platform_depopulate(&pdev->dev);
irq_domain_remove(chip->irqdomain);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 665/844] mfd: omap-usb-host: Fix OF populate on driver rebind
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (663 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 664/844] mfd: qcom-pm8xxx: Fix OF populate on driver rebind Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 666/844] erofs: fix incorrect early exits for invalid metabox-enabled images Sasha Levin
` (187 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Andreas Kemnade, Lee Jones, Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 24804ba508a3e240501c521685a1c4eb9f574f8e ]
Since commit c6e126de43e7 ("of: Keep track of populated platform
devices") child devices will not be created by of_platform_populate()
if the devices had previously been deregistered individually so that the
OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that
the child devices are created if the driver is rebound.
Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20251219110714.23919-1-johan@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/omap-usb-host.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index a77b6fc790f2e..4d29a6e2ed87a 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -819,8 +819,10 @@ static void usbhs_omap_remove(struct platform_device *pdev)
{
pm_runtime_disable(&pdev->dev);
- /* remove children */
- device_for_each_child(&pdev->dev, NULL, usbhs_omap_remove_child);
+ if (pdev->dev.of_node)
+ of_platform_depopulate(&pdev->dev);
+ else
+ device_for_each_child(&pdev->dev, NULL, usbhs_omap_remove_child);
}
static const struct dev_pm_ops usbhsomap_dev_pm_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 666/844] erofs: fix incorrect early exits for invalid metabox-enabled images
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (664 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 665/844] mfd: omap-usb-host: " Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 667/844] erofs: fix incorrect early exits in volume label handling Sasha Levin
` (186 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Gao Xiang, stable, Hongbo Li, Chao Yu, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 643575d5a4f24b23b0c54aa20aa74a4abed8ff5e ]
Crafted EROFS images with metadata compression enabled can trigger
incorrect early returns, leading to folio reference leaks.
However, this does not cause system crashes or other severe issues.
Fixes: 414091322c63 ("erofs: implement metadata compression")
Cc: stable@kernel.org
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/super.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 5136cda5972a9..b54083128e0f4 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -330,12 +330,13 @@ static int erofs_read_superblock(struct super_block *sb)
}
sbi->packed_nid = le64_to_cpu(dsb->packed_nid);
if (erofs_sb_has_metabox(sbi)) {
+ ret = -EFSCORRUPTED;
if (sbi->sb_size <= offsetof(struct erofs_super_block,
metabox_nid))
- return -EFSCORRUPTED;
+ goto out;
sbi->metabox_nid = le64_to_cpu(dsb->metabox_nid);
if (sbi->metabox_nid & BIT_ULL(EROFS_DIRENT_NID_METABOX_BIT))
- return -EFSCORRUPTED; /* self-loop detection */
+ goto out; /* self-loop detection */
}
sbi->inos = le64_to_cpu(dsb->inos);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 667/844] erofs: fix incorrect early exits in volume label handling
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (665 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 666/844] erofs: fix incorrect early exits for invalid metabox-enabled images Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 668/844] arm64: dts: rockchip: Explicitly request UFS reset pin on RK3576 Sasha Levin
` (185 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Gao Xiang, stable, Hongbo Li, Chao Yu, Sasha Levin
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 3afa4da38802a4cba1c23848a32284e7e57b831b ]
Crafted EROFS images containing valid volume labels can trigger
incorrect early returns, leading to folio reference leaks.
However, this does not cause system crashes or other severe issues.
Fixes: 1cf12c717741 ("erofs: Add support for FS_IOC_GETFSLABEL")
Cc: stable@kernel.org
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/super.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index b54083128e0f4..ee37628ec99fb 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -347,8 +347,10 @@ static int erofs_read_superblock(struct super_block *sb)
if (dsb->volume_name[0]) {
sbi->volume_name = kstrndup(dsb->volume_name,
sizeof(dsb->volume_name), GFP_KERNEL);
- if (!sbi->volume_name)
- return -ENOMEM;
+ if (!sbi->volume_name) {
+ ret = -ENOMEM;
+ goto out;
+ }
}
/* parse on-disk compression configurations */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 668/844] arm64: dts: rockchip: Explicitly request UFS reset pin on RK3576
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (666 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 667/844] erofs: fix incorrect early exits in volume label handling Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 669/844] arm64: dts: rockchip: Fix rk356x PCIe range mappings Sasha Levin
` (184 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexey Charkov, Quentin Schulz, Heiko Stuebner, Sasha Levin
From: Alexey Charkov <alchark@gmail.com>
[ Upstream commit 79a3286e61829fc43abdd6e3beb31b24930c7af6 ]
Rockchip RK3576 UFS controller uses a dedicated pin to reset the connected
UFS device, which can operate either in a hardware controlled mode or as a
GPIO pin.
Power-on default is GPIO mode, but the boot ROM reconfigures it to a
hardware controlled mode if it uses UFS to load the next boot stage.
Given that existing bindings (and rk3576.dtsi) expect a GPIO-controlled
device reset, request the required pin config explicitly.
The pin is requested with pull-down enabled, which is in line with the
SoC power-on default and helps ensure that the attached UFS chip stays
in reset until the driver takes over the control of the respective
GPIO line.
This doesn't appear to affect Linux, but it does affect U-boot:
Before:
=> md.l 0x2604b398
2604b398: 00000011 00000000 00000000 00000000 ................
< ... snip ... >
=> ufs init
ufshcd-rockchip ufshc@2a2d0000: [RX, TX]: gear=[3, 3], lane[2, 2], pwr[FASTAUTO_MODE, FASTAUTO_MODE], rate = 2
=> md.l 0x2604b398
2604b398: 00000011 00000000 00000000 00000000 ................
After:
=> md.l 0x2604b398
2604b398: 00000011 00000000 00000000 00000000 ................
< ... snip ...>
=> ufs init
ufshcd-rockchip ufshc@2a2d0000: [RX, TX]: gear=[3, 3], lane[2, 2], pwr[FASTAUTO_MODE, FASTAUTO_MODE], rate = 2
=> md.l 0x2604b398
2604b398: 00000010 00000000 00000000 00000000 ................
(0x2604b398 is the respective pin mux register, with its BIT0 driving the
mode of UFS_RST: unset = GPIO, set = hardware controlled UFS_RST)
This helps ensure that GPIO-driven device reset actually fires when the
system requests it, not when whatever black box magic inside the UFSHC
decides to reset the flash chip.
Cc: stable@vger.kernel.org
Fixes: c75e5e010fef ("scsi: arm64: dts: rockchip: Add UFS support for RK3576 SoC")
Reported-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Alexey Charkov <alchark@gmail.com>
Link: https://patch.msgid.link/20260121-ufs-rst-v3-1-35839bcb4ca7@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3576-pinctrl.dtsi | 7 +++++++
arch/arm64/boot/dts/rockchip/rk3576.dtsi | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3576-pinctrl.dtsi b/arch/arm64/boot/dts/rockchip/rk3576-pinctrl.dtsi
index 0b0851a7e4ea9..98c9f8013158c 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3576-pinctrl.dtsi
@@ -5228,6 +5228,13 @@ ufs_rst: ufs-rst {
/* ufs_rstn */
<4 RK_PD0 1 &pcfg_pull_none>;
};
+
+ /omit-if-no-ref/
+ ufs_rstgpio: ufs-rstgpio {
+ rockchip,pins =
+ /* ufs_rstn */
+ <4 RK_PD0 RK_FUNC_GPIO &pcfg_pull_down>;
+ };
};
ufs_testdata0 {
diff --git a/arch/arm64/boot/dts/rockchip/rk3576.dtsi b/arch/arm64/boot/dts/rockchip/rk3576.dtsi
index c72343e7a0456..70e67d4dccb8a 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3576.dtsi
@@ -1826,7 +1826,7 @@ ufshc: ufshc@2a2d0000 {
assigned-clock-parents = <&cru CLK_REF_MPHY_26M>;
interrupts = <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>;
power-domains = <&power RK3576_PD_USB>;
- pinctrl-0 = <&ufs_refclk>;
+ pinctrl-0 = <&ufs_refclk &ufs_rstgpio>;
pinctrl-names = "default";
resets = <&cru SRST_A_UFS_BIU>, <&cru SRST_A_UFS_SYS>,
<&cru SRST_A_UFS>, <&cru SRST_P_UFS_GRF>;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 669/844] arm64: dts: rockchip: Fix rk356x PCIe range mappings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (667 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 668/844] arm64: dts: rockchip: Explicitly request UFS reset pin on RK3576 Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 670/844] arm64: dts: rockchip: Fix rk3588 " Sasha Levin
` (183 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shawn Lin, Andrew Powers-Holmes, Heiko Stuebner, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit f63ea193a404481f080ca2958f73e9f364682db9 ]
The pcie bus address should be mapped 1:1 to the cpu side MMIO address, so
that there is no same address allocated from normal system memory. Otherwise
it's broken if the same address assigned to the EP for DMA purpose.Fix it to
sync with the vendor BSP.
Fixes: 568a67e742df ("arm64: dts: rockchip: Fix rk356x PCIe register and range mappings")
Fixes: 66b51ea7d70f ("arm64: dts: rockchip: Add rk3568 PCIe2x1 controller")
Cc: stable@vger.kernel.org
Cc: Andrew Powers-Holmes <aholmes@omnom.net>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/1767600929-195341-1-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3568.dtsi | 4 ++--
arch/arm64/boot/dts/rockchip/rk356x-base.dtsi | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3568.dtsi b/arch/arm64/boot/dts/rockchip/rk3568.dtsi
index e719a3df126c5..658097ed69714 100644
--- a/arch/arm64/boot/dts/rockchip/rk3568.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3568.dtsi
@@ -185,7 +185,7 @@ pcie3x1: pcie@fe270000 {
<0x0 0xf2000000 0x0 0x00100000>;
ranges = <0x01000000 0x0 0xf2100000 0x0 0xf2100000 0x0 0x00100000>,
<0x02000000 0x0 0xf2200000 0x0 0xf2200000 0x0 0x01e00000>,
- <0x03000000 0x0 0x40000000 0x3 0x40000000 0x0 0x40000000>;
+ <0x03000000 0x3 0x40000000 0x3 0x40000000 0x0 0x40000000>;
reg-names = "dbi", "apb", "config";
resets = <&cru SRST_PCIE30X1_POWERUP>;
reset-names = "pipe";
@@ -238,7 +238,7 @@ pcie3x2: pcie@fe280000 {
<0x0 0xf0000000 0x0 0x00100000>;
ranges = <0x01000000 0x0 0xf0100000 0x0 0xf0100000 0x0 0x00100000>,
<0x02000000 0x0 0xf0200000 0x0 0xf0200000 0x0 0x01e00000>,
- <0x03000000 0x0 0x40000000 0x3 0x80000000 0x0 0x40000000>;
+ <0x03000000 0x3 0x80000000 0x3 0x80000000 0x0 0x40000000>;
reg-names = "dbi", "apb", "config";
resets = <&cru SRST_PCIE30X2_POWERUP>;
reset-names = "pipe";
diff --git a/arch/arm64/boot/dts/rockchip/rk356x-base.dtsi b/arch/arm64/boot/dts/rockchip/rk356x-base.dtsi
index 8893b7b6cc9ff..a2c4957a58992 100644
--- a/arch/arm64/boot/dts/rockchip/rk356x-base.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk356x-base.dtsi
@@ -1022,7 +1022,7 @@ pcie2x1: pcie@fe260000 {
power-domains = <&power RK3568_PD_PIPE>;
ranges = <0x01000000 0x0 0xf4100000 0x0 0xf4100000 0x0 0x00100000>,
<0x02000000 0x0 0xf4200000 0x0 0xf4200000 0x0 0x01e00000>,
- <0x03000000 0x0 0x40000000 0x3 0x00000000 0x0 0x40000000>;
+ <0x03000000 0x3 0x00000000 0x3 0x00000000 0x0 0x40000000>;
resets = <&cru SRST_PCIE20_POWERUP>;
reset-names = "pipe";
#address-cells = <3>;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 670/844] arm64: dts: rockchip: Fix rk3588 PCIe range mappings
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (668 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 669/844] arm64: dts: rockchip: Fix rk356x PCIe range mappings Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 671/844] PCI/PM: Prevent runtime suspend until devices are fully initialized Sasha Levin
` (182 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shawn Lin, Sebastian Reichel, Heiko Stuebner, Sasha Levin
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 46c56b737161060dfa468f25ae699749047902a2 ]
The pcie bus address should be mapped 1:1 to the cpu side MMIO address, so
that there is no same address allocated from normal system memory. Otherwise
it's broken if the same address assigned to the EP for DMA purpose.Fix it to
sync with the vendor BSP.
Fixes: 0acf4fa7f187 ("arm64: dts: rockchip: add PCIe3 support for rk3588")
Fixes: 8d81b77f4c49 ("arm64: dts: rockchip: add rk3588 PCIe2 support")
Cc: stable@vger.kernel.org
Cc: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/1767600929-195341-2-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 4 ++--
| 6 +++---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
index 7ab12d1054a73..fdb017258b7bc 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
@@ -1955,7 +1955,7 @@ pcie2x1l1: pcie@fe180000 {
power-domains = <&power RK3588_PD_PCIE>;
ranges = <0x01000000 0x0 0xf3100000 0x0 0xf3100000 0x0 0x00100000>,
<0x02000000 0x0 0xf3200000 0x0 0xf3200000 0x0 0x00e00000>,
- <0x03000000 0x0 0x40000000 0x9 0xc0000000 0x0 0x40000000>;
+ <0x03000000 0x9 0xc0000000 0x9 0xc0000000 0x0 0x40000000>;
reg = <0xa 0x40c00000 0x0 0x00400000>,
<0x0 0xfe180000 0x0 0x00010000>,
<0x0 0xf3000000 0x0 0x00100000>;
@@ -2007,7 +2007,7 @@ pcie2x1l2: pcie@fe190000 {
power-domains = <&power RK3588_PD_PCIE>;
ranges = <0x01000000 0x0 0xf4100000 0x0 0xf4100000 0x0 0x00100000>,
<0x02000000 0x0 0xf4200000 0x0 0xf4200000 0x0 0x00e00000>,
- <0x03000000 0x0 0x40000000 0xa 0x00000000 0x0 0x40000000>;
+ <0x03000000 0xa 0x00000000 0xa 0x00000000 0x0 0x40000000>;
reg = <0xa 0x41000000 0x0 0x00400000>,
<0x0 0xfe190000 0x0 0x00010000>,
<0x0 0xf4000000 0x0 0x00100000>;
--git a/arch/arm64/boot/dts/rockchip/rk3588-extra.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-extra.dtsi
index 6e5a58428bbab..a2640014ee042 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-extra.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3588-extra.dtsi
@@ -375,7 +375,7 @@ pcie3x4: pcie@fe150000 {
power-domains = <&power RK3588_PD_PCIE>;
ranges = <0x01000000 0x0 0xf0100000 0x0 0xf0100000 0x0 0x00100000>,
<0x02000000 0x0 0xf0200000 0x0 0xf0200000 0x0 0x00e00000>,
- <0x03000000 0x0 0x40000000 0x9 0x00000000 0x0 0x40000000>;
+ <0x03000000 0x9 0x00000000 0x9 0x00000000 0x0 0x40000000>;
reg = <0xa 0x40000000 0x0 0x00400000>,
<0x0 0xfe150000 0x0 0x00010000>,
<0x0 0xf0000000 0x0 0x00100000>;
@@ -462,7 +462,7 @@ pcie3x2: pcie@fe160000 {
power-domains = <&power RK3588_PD_PCIE>;
ranges = <0x01000000 0x0 0xf1100000 0x0 0xf1100000 0x0 0x00100000>,
<0x02000000 0x0 0xf1200000 0x0 0xf1200000 0x0 0x00e00000>,
- <0x03000000 0x0 0x40000000 0x9 0x40000000 0x0 0x40000000>;
+ <0x03000000 0x9 0x40000000 0x9 0x40000000 0x0 0x40000000>;
reg = <0xa 0x40400000 0x0 0x00400000>,
<0x0 0xfe160000 0x0 0x00010000>,
<0x0 0xf1000000 0x0 0x00100000>;
@@ -512,7 +512,7 @@ pcie2x1l0: pcie@fe170000 {
power-domains = <&power RK3588_PD_PCIE>;
ranges = <0x01000000 0x0 0xf2100000 0x0 0xf2100000 0x0 0x00100000>,
<0x02000000 0x0 0xf2200000 0x0 0xf2200000 0x0 0x00e00000>,
- <0x03000000 0x0 0x40000000 0x9 0x80000000 0x0 0x40000000>;
+ <0x03000000 0x9 0x80000000 0x9 0x80000000 0x0 0x40000000>;
reg = <0xa 0x40800000 0x0 0x00400000>,
<0x0 0xfe170000 0x0 0x00010000>,
<0x0 0xf2000000 0x0 0x00100000>;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 671/844] PCI/PM: Prevent runtime suspend until devices are fully initialized
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (669 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 670/844] arm64: dts: rockchip: Fix rk3588 " Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 672/844] iio: accel: adxl380: Avoid reading more entries than present in FIFO Sasha Levin
` (181 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Brian Norris, Bjorn Helgaas, Marek Szyprowski, Sasha Levin
From: Brian Norris <briannorris@chromium.org>
[ Upstream commit 51c0996dadaea20d73eb0495aeda9cb0422243e8 ]
Previously, it was possible for a PCI device to be runtime-suspended before
it was fully initialized. When that happened, the suspend process could
save invalid device state, for example, before BAR assignment. Restoring
the invalid state during resume may leave the device non-functional.
Prevent runtime suspend for PCI devices until they are fully initialized by
deferring pm_runtime_enable().
More details on how exactly this may occur:
1. PCI device is created by pci_scan_slot() or similar
2. As part of pci_scan_slot(), pci_pm_init() puts the device in D0 and
prevents runtime suspend prevented via pm_runtime_forbid()
3. pci_device_add() adds the underlying 'struct device' via device_add(),
which means user space can allow runtime suspend, e.g.,
echo auto > /sys/bus/pci/devices/.../power/control
4. PCI device receives BAR configuration
(pci_assign_unassigned_bus_resources(), etc.)
5. pci_bus_add_device() applies final fixups, saves device state, and
tries to attach a driver
The device may potentially be suspended between #3 and #5, so this is racy
with user space (udev or similar).
Many PCI devices are enumerated at subsys_initcall time and so will not
race with user space, but devices created later by hotplug or modular
pwrctrl or host controller drivers are susceptible to this race.
More runtime PM details at the first Link: below.
Link: https://lore.kernel.org/all/0e35a4e1-894a-47c1-9528-fc5ffbafd9e2@samsung.com/
Signed-off-by: Brian Norris <briannorris@chromium.org>
[bhelgaas: update comments per https://lore.kernel.org/r/CAJZ5v0iBNOmMtqfqEbrYyuK2u+2J2+zZ-iQd1FvyCPjdvU2TJg@mail.gmail.com]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260122094815.v5.1.I60a53c170a8596661883bd2b4ef475155c7aa72b@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/bus.c | 8 ++++++++
drivers/pci/pci.c | 8 +++++++-
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 4383a36fd6ca0..41e5c45e38b5e 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -15,6 +15,7 @@
#include <linux/of.h>
#include <linux/of_platform.h>
#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
#include <linux/proc_fs.h>
#include <linux/slab.h>
@@ -379,6 +380,13 @@ void pci_bus_add_device(struct pci_dev *dev)
put_device(&pdev->dev);
}
+ /*
+ * Enable runtime PM, which potentially allows the device to
+ * suspend immediately, only after the PCI state has been
+ * configured completely.
+ */
+ pm_runtime_enable(&dev->dev);
+
if (!dn || of_device_is_available(dn))
pci_dev_allow_binding(dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index f21f6933c9b63..a4eb3bc2127ae 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3199,8 +3199,14 @@ void pci_pm_init(struct pci_dev *dev)
poweron:
pci_pm_power_up_and_verify_state(dev);
pm_runtime_forbid(&dev->dev);
+
+ /*
+ * Runtime PM will be enabled for the device when it has been fully
+ * configured, but since its parent and suppliers may suspend in
+ * the meantime, prevent them from doing so by changing the
+ * device's runtime PM status to "active".
+ */
pm_runtime_set_active(&dev->dev);
- pm_runtime_enable(&dev->dev);
}
static unsigned long pci_ea_flags(struct pci_dev *dev, u8 prop)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 672/844] iio: accel: adxl380: Avoid reading more entries than present in FIFO
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (670 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 671/844] PCI/PM: Prevent runtime suspend until devices are fully initialized Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 673/844] clk: tegra: tegra124-emc: fix device leak on set_rate() Sasha Levin
` (180 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Francesco Lavra, Stable, Jonathan Cameron, Sasha Levin
From: Francesco Lavra <flavra@baylibre.com>
[ Upstream commit c1b14015224cfcccd5356333763f2f4f401bd810 ]
The interrupt handler reads FIFO entries in batches of N samples, where N
is the number of scan elements that have been enabled. However, the sensor
fills the FIFO one sample at a time, even when more than one channel is
enabled. Therefore,the number of entries reported by the FIFO status
registers may not be a multiple of N; if this number is not a multiple, the
number of entries read from the FIFO may exceed the number of entries
actually present.
To fix the above issue, round down the number of FIFO entries read from the
status registers so that it is always a multiple of N.
Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/adxl380.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/adxl380.c b/drivers/iio/accel/adxl380.c
index aef5109c1ddd9..9f6c0e02575a6 100644
--- a/drivers/iio/accel/adxl380.c
+++ b/drivers/iio/accel/adxl380.c
@@ -949,6 +949,7 @@ static irqreturn_t adxl380_irq_handler(int irq, void *p)
if (ret)
return IRQ_HANDLED;
+ fifo_entries = rounddown(fifo_entries, st->fifo_set_size);
for (i = 0; i < fifo_entries; i += st->fifo_set_size) {
ret = regmap_noinc_read(st->regmap, ADXL380_FIFO_DATA,
&st->fifo_buf[i],
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 673/844] clk: tegra: tegra124-emc: fix device leak on set_rate()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (671 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 672/844] iio: accel: adxl380: Avoid reading more entries than present in FIFO Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 674/844] iommu/arm-smmu-v3: Add update_safe bits to fix STE update sequence Sasha Levin
` (179 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Mikko Perttunen, Miaoqian Lin, Stephen Boyd,
Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit da61439c63d34ae6503d080a847f144d587e3a48 ]
Make sure to drop the reference taken when looking up the EMC device and
its driver data on first set_rate().
Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver")
Fixes: 6d6ef58c2470 ("clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver")
Cc: stable@vger.kernel.org # 4.2: 6d6ef58c2470
Cc: Mikko Perttunen <mperttunen@nvidia.com>
Cc: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/tegra/clk-tegra124-emc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c
index 0f6fb776b2298..5f1af6dfe7154 100644
--- a/drivers/clk/tegra/clk-tegra124-emc.c
+++ b/drivers/clk/tegra/clk-tegra124-emc.c
@@ -197,8 +197,8 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra)
tegra->emc_node = NULL;
tegra->emc = platform_get_drvdata(pdev);
+ put_device(&pdev->dev);
if (!tegra->emc) {
- put_device(&pdev->dev);
pr_err("%s: cannot find EMC driver\n", __func__);
return NULL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 674/844] iommu/arm-smmu-v3: Add update_safe bits to fix STE update sequence
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (672 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 673/844] clk: tegra: tegra124-emc: fix device leak on set_rate() Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 675/844] iommu/arm-smmu-v3: Mark STE MEV safe when computing the " Sasha Levin
` (178 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jason Gunthorpe, Shuai Xue, Mostafa Saleh, Pranjal Shrivastava,
Nicolin Chen, Will Deacon, Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 2781f2a930abb5d27f80b8afbabfa19684833b65 ]
C_BAD_STE was observed when updating nested STE from an S1-bypass mode to
an S1DSS-bypass mode. As both modes enabled S2, the used bit is slightly
different than the normal S1-bypass and S1DSS-bypass modes. As a result,
fields like MEV and EATS in S2's used list marked the word1 as a critical
word that requested a STE.V=0. This breaks a hitless update.
However, both MEV and EATS aren't critical in terms of STE update. One
controls the merge of the events and the other controls the ATS that is
managed by the driver at the same time via pci_enable_ats().
Add an arm_smmu_get_ste_update_safe() to allow STE update algorithm to
relax those fields, avoiding the STE update breakages.
After this change, entry_set has no caller checking its return value, so
change it to void.
Note that this change is required by both MEV and EATS fields, which were
introduced in different kernel versions. So add get_update_safe() first.
MEV and EATS will be added to arm_smmu_get_ste_update_safe() separately.
Fixes: 1e8be08d1c91 ("iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c | 31 +++++++++++++++++--
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 28 ++++++++++++-----
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 4 +++
3 files changed, 53 insertions(+), 10 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c
index d2671bfd37981..b254a94b2003d 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c
@@ -38,13 +38,16 @@ enum arm_smmu_test_master_feat {
static bool arm_smmu_entry_differs_in_used_bits(const __le64 *entry,
const __le64 *used_bits,
const __le64 *target,
+ const __le64 *safe,
unsigned int length)
{
bool differs = false;
unsigned int i;
for (i = 0; i < length; i++) {
- if ((entry[i] & used_bits[i]) != target[i])
+ __le64 used = used_bits[i] & ~safe[i];
+
+ if ((entry[i] & used) != (target[i] & used))
differs = true;
}
return differs;
@@ -56,12 +59,24 @@ arm_smmu_test_writer_record_syncs(struct arm_smmu_entry_writer *writer)
struct arm_smmu_test_writer *test_writer =
container_of(writer, struct arm_smmu_test_writer, writer);
__le64 *entry_used_bits;
+ __le64 *safe_target;
+ __le64 *safe_init;
entry_used_bits = kunit_kzalloc(
test_writer->test, sizeof(*entry_used_bits) * NUM_ENTRY_QWORDS,
GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test_writer->test, entry_used_bits);
+ safe_target = kunit_kzalloc(test_writer->test,
+ sizeof(*safe_target) * NUM_ENTRY_QWORDS,
+ GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test_writer->test, safe_target);
+
+ safe_init = kunit_kzalloc(test_writer->test,
+ sizeof(*safe_init) * NUM_ENTRY_QWORDS,
+ GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test_writer->test, safe_init);
+
pr_debug("STE value is now set to: ");
print_hex_dump_debug(" ", DUMP_PREFIX_NONE, 16, 8,
test_writer->entry,
@@ -79,14 +94,23 @@ arm_smmu_test_writer_record_syncs(struct arm_smmu_entry_writer *writer)
* configuration.
*/
writer->ops->get_used(test_writer->entry, entry_used_bits);
+ if (writer->ops->get_update_safe)
+ writer->ops->get_update_safe(test_writer->entry,
+ test_writer->init_entry,
+ safe_init);
+ if (writer->ops->get_update_safe)
+ writer->ops->get_update_safe(test_writer->entry,
+ test_writer->target_entry,
+ safe_target);
KUNIT_EXPECT_FALSE(
test_writer->test,
arm_smmu_entry_differs_in_used_bits(
test_writer->entry, entry_used_bits,
- test_writer->init_entry, NUM_ENTRY_QWORDS) &&
+ test_writer->init_entry, safe_init,
+ NUM_ENTRY_QWORDS) &&
arm_smmu_entry_differs_in_used_bits(
test_writer->entry, entry_used_bits,
- test_writer->target_entry,
+ test_writer->target_entry, safe_target,
NUM_ENTRY_QWORDS));
}
}
@@ -106,6 +130,7 @@ arm_smmu_v3_test_debug_print_used_bits(struct arm_smmu_entry_writer *writer,
static const struct arm_smmu_entry_writer_ops test_ste_ops = {
.sync = arm_smmu_test_writer_record_syncs,
.get_used = arm_smmu_get_ste_used,
+ .get_update_safe = arm_smmu_get_ste_update_safe,
};
static const struct arm_smmu_entry_writer_ops test_cd_ops = {
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 7a6aea3b61c11..56420104e154e 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -1093,6 +1093,13 @@ void arm_smmu_get_ste_used(const __le64 *ent, __le64 *used_bits)
}
EXPORT_SYMBOL_IF_KUNIT(arm_smmu_get_ste_used);
+VISIBLE_IF_KUNIT
+void arm_smmu_get_ste_update_safe(const __le64 *cur, const __le64 *target,
+ __le64 *safe_bits)
+{
+}
+EXPORT_SYMBOL_IF_KUNIT(arm_smmu_get_ste_update_safe);
+
/*
* Figure out if we can do a hitless update of entry to become target. Returns a
* bit mask where 1 indicates that qword needs to be set disruptively.
@@ -1105,13 +1112,22 @@ static u8 arm_smmu_entry_qword_diff(struct arm_smmu_entry_writer *writer,
{
__le64 target_used[NUM_ENTRY_QWORDS] = {};
__le64 cur_used[NUM_ENTRY_QWORDS] = {};
+ __le64 safe[NUM_ENTRY_QWORDS] = {};
u8 used_qword_diff = 0;
unsigned int i;
writer->ops->get_used(entry, cur_used);
writer->ops->get_used(target, target_used);
+ if (writer->ops->get_update_safe)
+ writer->ops->get_update_safe(entry, target, safe);
for (i = 0; i != NUM_ENTRY_QWORDS; i++) {
+ /*
+ * Safe is only used for bits that are used by both entries,
+ * otherwise it is sequenced according to the unused entry.
+ */
+ safe[i] &= target_used[i] & cur_used[i];
+
/*
* Check that masks are up to date, the make functions are not
* allowed to set a bit to 1 if the used function doesn't say it
@@ -1120,6 +1136,7 @@ static u8 arm_smmu_entry_qword_diff(struct arm_smmu_entry_writer *writer,
WARN_ON_ONCE(target[i] & ~target_used[i]);
/* Bits can change because they are not currently being used */
+ cur_used[i] &= ~safe[i];
unused_update[i] = (entry[i] & cur_used[i]) |
(target[i] & ~cur_used[i]);
/*
@@ -1132,7 +1149,7 @@ static u8 arm_smmu_entry_qword_diff(struct arm_smmu_entry_writer *writer,
return used_qword_diff;
}
-static bool entry_set(struct arm_smmu_entry_writer *writer, __le64 *entry,
+static void entry_set(struct arm_smmu_entry_writer *writer, __le64 *entry,
const __le64 *target, unsigned int start,
unsigned int len)
{
@@ -1148,7 +1165,6 @@ static bool entry_set(struct arm_smmu_entry_writer *writer, __le64 *entry,
if (changed)
writer->ops->sync(writer);
- return changed;
}
/*
@@ -1218,12 +1234,9 @@ void arm_smmu_write_entry(struct arm_smmu_entry_writer *writer, __le64 *entry,
entry_set(writer, entry, target, 0, 1);
} else {
/*
- * No inuse bit changed. Sanity check that all unused bits are 0
- * in the entry. The target was already sanity checked by
- * compute_qword_diff().
+ * No inuse bit changed, though safe bits may have changed.
*/
- WARN_ON_ONCE(
- entry_set(writer, entry, target, 0, NUM_ENTRY_QWORDS));
+ entry_set(writer, entry, target, 0, NUM_ENTRY_QWORDS);
}
}
EXPORT_SYMBOL_IF_KUNIT(arm_smmu_write_entry);
@@ -1554,6 +1567,7 @@ static void arm_smmu_ste_writer_sync_entry(struct arm_smmu_entry_writer *writer)
static const struct arm_smmu_entry_writer_ops arm_smmu_ste_writer_ops = {
.sync = arm_smmu_ste_writer_sync_entry,
.get_used = arm_smmu_get_ste_used,
+ .get_update_safe = arm_smmu_get_ste_update_safe,
};
static void arm_smmu_write_ste(struct arm_smmu_master *master, u32 sid,
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
index ae23aacc38402..287e223c054d1 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
@@ -900,6 +900,8 @@ struct arm_smmu_entry_writer {
struct arm_smmu_entry_writer_ops {
void (*get_used)(const __le64 *entry, __le64 *used);
+ void (*get_update_safe)(const __le64 *cur, const __le64 *target,
+ __le64 *safe_bits);
void (*sync)(struct arm_smmu_entry_writer *writer);
};
@@ -911,6 +913,8 @@ void arm_smmu_make_s2_domain_ste(struct arm_smmu_ste *target,
#if IS_ENABLED(CONFIG_KUNIT)
void arm_smmu_get_ste_used(const __le64 *ent, __le64 *used_bits);
+void arm_smmu_get_ste_update_safe(const __le64 *cur, const __le64 *target,
+ __le64 *safe_bits);
void arm_smmu_write_entry(struct arm_smmu_entry_writer *writer, __le64 *cur,
const __le64 *target);
void arm_smmu_get_cd_used(const __le64 *ent, __le64 *used_bits);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 675/844] iommu/arm-smmu-v3: Mark STE MEV safe when computing the update sequence
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (673 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 674/844] iommu/arm-smmu-v3: Add update_safe bits to fix STE update sequence Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 676/844] iommu/arm-smmu-v3: Mark EATS_TRANS " Sasha Levin
` (177 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jason Gunthorpe, Shuai Xue, Mostafa Saleh, Pranjal Shrivastava,
Nicolin Chen, Will Deacon, Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit f3c1d372dbb8e5a86923f20db66deabef42bfc9d ]
Nested CD tables set the MEV bit to try to reduce multi-fault spamming on
the hypervisor. Since MEV is in STE word 1 this causes a breaking update
sequence that is not required and impacts real workloads.
For the purposes of STE updates the value of MEV doesn't matter, if it is
set/cleared early or late it just results in a change to the fault reports
that must be supported by the kernel anyhow. The spec says:
Note: Software must expect, and be able to deal with, coalesced fault
records even when MEV == 0.
So mark STE MEV safe when computing the update sequence, to avoid creating
a breaking update.
Fixes: da0c56520e88 ("iommu/arm-smmu-v3: Set MEV bit in nested STE for DoS mitigations")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 56420104e154e..65c0119f45eae 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -1097,6 +1097,16 @@ VISIBLE_IF_KUNIT
void arm_smmu_get_ste_update_safe(const __le64 *cur, const __le64 *target,
__le64 *safe_bits)
{
+ /*
+ * MEV does not meaningfully impact the operation of the HW, it only
+ * changes how many fault events are generated, thus we can relax it
+ * when computing the ordering. The spec notes the device can act like
+ * MEV=1 anyhow:
+ *
+ * Note: Software must expect, and be able to deal with, coalesced
+ * fault records even when MEV == 0.
+ */
+ safe_bits[1] |= cpu_to_le64(STRTAB_STE_1_MEV);
}
EXPORT_SYMBOL_IF_KUNIT(arm_smmu_get_ste_update_safe);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 676/844] iommu/arm-smmu-v3: Mark EATS_TRANS safe when computing the update sequence
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (674 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 675/844] iommu/arm-smmu-v3: Mark STE MEV safe when computing the " Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 677/844] iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate Sasha Levin
` (176 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jason Gunthorpe, Shuai Xue, Nicolin Chen, Will Deacon,
Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 7cad800485956a263318930613f8f4a084af8c70 ]
If VM wants to toggle EATS_TRANS off at the same time as changing the CFG,
hypervisor will see EATS change to 0 and insert a V=0 breaking update into
the STE even though the VM did not ask for that.
In bare metal, EATS_TRANS is ignored by CFG=ABORT/BYPASS, which is why this
does not cause a problem until we have the nested case where CFG is always
a variation of S2 trans that does use EATS_TRANS.
Relax the rules for EATS_TRANS sequencing, we don't need it to be exact as
the enclosing code will always disable ATS at the PCI device when changing
EATS_TRANS. This ensures there are no ATS transactions that can race with
an EATS_TRANS change so we don't need to carefully sequence these bits.
Fixes: 1e8be08d1c91 ("iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED")
Cc: stable@vger.kernel.org
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 26 +++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 65c0119f45eae..d55b8e39b8e3c 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -1097,6 +1097,32 @@ VISIBLE_IF_KUNIT
void arm_smmu_get_ste_update_safe(const __le64 *cur, const __le64 *target,
__le64 *safe_bits)
{
+ const __le64 eats_s1chk =
+ FIELD_PREP(STRTAB_STE_1_EATS, STRTAB_STE_1_EATS_S1CHK);
+ const __le64 eats_trans =
+ FIELD_PREP(STRTAB_STE_1_EATS, STRTAB_STE_1_EATS_TRANS);
+
+ /*
+ * When an STE changes EATS_TRANS, the sequencing code in the attach
+ * logic already will have the PCI cap for ATS disabled. Thus at this
+ * moment we can expect that the device will not generate ATS queries
+ * and so we don't care about the sequencing of EATS. The purpose of
+ * EATS_TRANS is to protect the system from hostile untrusted devices
+ * that issue ATS when the PCI config space is disabled. However, if
+ * EATS_TRANS is being changed, then we must have already trusted the
+ * device as the EATS_TRANS security block is being disabled.
+ *
+ * Note: now the EATS_TRANS update is moved to the first entry_set().
+ * Changing S2S and EATS might transiently result in S2S=1 and EATS=1
+ * which is a bad STE (see "5.2 Stream Table Entry"). In such a case,
+ * we can't do a hitless update. Also, it should not be added to the
+ * safe bits with STRTAB_STE_1_EATS_S1CHK, because EATS=0b11 would be
+ * effectively an errant 0b00 configuration.
+ */
+ if (!((cur[1] | target[1]) & cpu_to_le64(eats_s1chk)) &&
+ !((cur[2] | target[2]) & cpu_to_le64(STRTAB_STE_2_S2S)))
+ safe_bits[1] |= cpu_to_le64(eats_trans);
+
/*
* MEV does not meaningfully impact the operation of the HW, it only
* changes how many fault events are generated, thus we can relax it
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 677/844] iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (675 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 676/844] iommu/arm-smmu-v3: Mark EATS_TRANS " Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 678/844] usb: host: tegra: Remove manual wake IRQ disposal Sasha Levin
` (175 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nicolin Chen, Jason Gunthorpe, Pranjal Shrivastava, Will Deacon,
Sasha Levin
From: Nicolin Chen <nicolinc@nvidia.com>
[ Upstream commit a45dd34663025c75652b27e384e91c9c05ba1d80 ]
A vSTE may have three configuration types: Abort, Bypass, and Translate.
An Abort vSTE wouldn't enable ATS, but the other two might.
It makes sense for a Transalte vSTE to rely on the guest vSTE.EATS field.
For a Bypass vSTE, it would end up with an S2-only physical STE, similar
to an attachment to a regular S2 domain. However, the nested case always
disables ATS following the Bypass vSTE, while the regular S2 case always
enables ATS so long as arm_smmu_ats_supported(master) == true.
Note that ATS is needed for certain VM centric workloads and historically
non-vSMMU cases have relied on this automatic enablement. So, having the
nested case behave differently causes problems.
To fix that, add a condition to disable_ats, so that it might enable ATS
for a Bypass vSTE, aligning with the regular S2 case.
Fixes: f27298a82ba0 ("iommu/arm-smmu-v3: Allow ATS for IOMMU_DOMAIN_NESTED")
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
index 93fdadd07431a..823461a26659f 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
@@ -177,7 +177,9 @@ static int arm_smmu_attach_dev_nested(struct iommu_domain *domain,
* config bit here base this off the EATS value in the STE. If the EATS
* is set then the VM must generate ATC flushes.
*/
- state.disable_ats = !nested_domain->enable_ats;
+ if (FIELD_GET(STRTAB_STE_0_CFG, le64_to_cpu(nested_domain->ste[0])) ==
+ STRTAB_STE_0_CFG_S1_TRANS)
+ state.disable_ats = !nested_domain->enable_ats;
ret = arm_smmu_attach_prepare(&state, domain);
if (ret) {
mutex_unlock(&arm_smmu_asid_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 678/844] usb: host: tegra: Remove manual wake IRQ disposal
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (676 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 677/844] iommu/arm-smmu-v3: Do not set disable_ats unless vSTE is Translate Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 679/844] xfs: delete attr leaf freemap entries when empty Sasha Levin
` (174 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wayne Chang, Wei-Cheng Chen, Greg Kroah-Hartman, Sasha Levin
From: Wayne Chang <waynec@nvidia.com>
[ Upstream commit ef548189fd3f44786fb813af0018cc8b3bbed2b9 ]
We found that calling irq_dispose_mapping() caused a kernel warning
when removing the driver. The IRQs are obtained using
platform_get_irq(), which returns a Linux virtual IRQ number directly
managed by the device core, not by the OF subsystem. Therefore, the
driver should not call irq_dispose_mapping() for these IRQs.
Fixes: 5df186e2ef11 ("usb: xhci: tegra: Support USB wakeup function for Tegra234")
Cc: stable@vger.kernel.org
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Signed-off-by: Wei-Cheng Chen <weichengc@nvidia.com>
Link: https://patch.msgid.link/20260115103621.587366-1-weichengc@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-tegra.c | 21 ++-------------------
1 file changed, 2 insertions(+), 19 deletions(-)
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 8b492871d21d6..3f6aa2440b05b 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1570,7 +1570,6 @@ static int tegra_xusb_setup_wakeup(struct platform_device *pdev, struct tegra_xu
data = irq_get_irq_data(tegra->wake_irqs[i]);
if (!data) {
dev_warn(tegra->dev, "get wake event %d irq data fail\n", i);
- irq_dispose_mapping(tegra->wake_irqs[i]);
break;
}
@@ -1583,16 +1582,6 @@ static int tegra_xusb_setup_wakeup(struct platform_device *pdev, struct tegra_xu
return 0;
}
-static void tegra_xusb_dispose_wake(struct tegra_xusb *tegra)
-{
- unsigned int i;
-
- for (i = 0; i < tegra->num_wakes; i++)
- irq_dispose_mapping(tegra->wake_irqs[i]);
-
- tegra->num_wakes = 0;
-}
-
static int tegra_xusb_probe(struct platform_device *pdev)
{
struct tegra_xusb *tegra;
@@ -1648,10 +1637,8 @@ static int tegra_xusb_probe(struct platform_device *pdev)
return err;
tegra->padctl = tegra_xusb_padctl_get(&pdev->dev);
- if (IS_ERR(tegra->padctl)) {
- err = PTR_ERR(tegra->padctl);
- goto dispose_wake;
- }
+ if (IS_ERR(tegra->padctl))
+ return PTR_ERR(tegra->padctl);
np = of_parse_phandle(pdev->dev.of_node, "nvidia,xusb-padctl", 0);
if (!np) {
@@ -1975,8 +1962,6 @@ static int tegra_xusb_probe(struct platform_device *pdev)
put_padctl:
of_node_put(np);
tegra_xusb_padctl_put(tegra->padctl);
-dispose_wake:
- tegra_xusb_dispose_wake(tegra);
return err;
}
@@ -2009,8 +1994,6 @@ static void tegra_xusb_remove(struct platform_device *pdev)
if (tegra->padctl_irq)
pm_runtime_disable(&pdev->dev);
- tegra_xusb_dispose_wake(tegra);
-
pm_runtime_put(&pdev->dev);
tegra_xusb_disable(tegra);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 679/844] xfs: delete attr leaf freemap entries when empty
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (677 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 678/844] usb: host: tegra: Remove manual wake IRQ disposal Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 680/844] xfs: fix freemap adjustments when adding xattrs to leaf blocks Sasha Levin
` (173 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Darrick J. Wong, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit 6f13c1d2a6271c2e73226864a0e83de2770b6f34 ]
Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size
underflow"), Brian Foster observed that it's possible for a small
freemap at the end of the end of the xattr entries array to experience
a size underflow when subtracting the space consumed by an expansion of
the entries array. There are only three freemap entries, which means
that it is not a complete index of all free space in the leaf block.
This code can leave behind a zero-length freemap entry with a nonzero
base. Subsequent setxattr operations can increase the base up to the
point that it overlaps with another freemap entry. This isn't in and of
itself a problem because the code in _leaf_add that finds free space
ignores any freemap entry with zero size.
However, there's another bug in the freemap update code in _leaf_add,
which is that it fails to update a freemap entry that begins midway
through the xattr entry that was just appended to the array. That can
result in the freemap containing two entries with the same base but
different sizes (0 for the "pushed-up" entry, nonzero for the entry
that's actually tracking free space). A subsequent _leaf_add can then
allocate xattr namevalue entries on top of the entries array, leading to
data loss. But fixing that is for later.
For now, eliminate the possibility of confusion by zeroing out the base
of any freemap entry that has zero size. Because the freemap is not
intended to be a complete index of free space, a subsequent failure to
find any free space for a new xattr will trigger block compaction, which
regenerates the freemap.
It looks like this bug has been in the codebase for quite a long time.
Cc: <stable@vger.kernel.org> # v2.6.12
Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_attr_leaf.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 91c1b30ebaab3..33c6c468ad8d5 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -1580,6 +1580,19 @@ xfs_attr3_leaf_add_work(
min_t(uint16_t, ichdr->freemap[i].size,
sizeof(xfs_attr_leaf_entry_t));
}
+
+ /*
+ * Don't leave zero-length freemaps with nonzero base lying
+ * around, because we don't want the code in _remove that
+ * matches on base address to get confused and create
+ * overlapping freemaps. If we end up with no freemap entries
+ * then the next _add will compact the leaf block and
+ * regenerate the freemaps.
+ */
+ if (ichdr->freemap[i].size == 0 && ichdr->freemap[i].base > 0) {
+ ichdr->freemap[i].base = 0;
+ ichdr->holes = 1;
+ }
}
ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 680/844] xfs: fix freemap adjustments when adding xattrs to leaf blocks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (678 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 679/844] xfs: delete attr leaf freemap entries when empty Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 681/844] xfs: fix the xattr scrub to detect freemap/entries array collisions Sasha Levin
` (172 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Darrick J. Wong, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce ]
xfs/592 and xfs/794 both trip this assertion in the leaf block freemap
adjustment code after ~20 minutes of running on my test VMs:
ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)
+ xfs_attr3_leaf_hdr_size(leaf));
Upon enabling quite a lot more debugging code, I narrowed this down to
fsstress trying to set a local extended attribute with namelen=3 and
valuelen=71. This results in an entry size of 80 bytes.
At the start of xfs_attr3_leaf_add_work, the freemap looks like this:
i 0 base 448 size 0 rhs 448 count 46
i 1 base 388 size 132 rhs 448 count 46
i 2 base 2120 size 4 rhs 448 count 46
firstused = 520
where "rhs" is the first byte past the end of the leaf entry array.
This is inconsistent -- the entries array ends at byte 448, but
freemap[1] says there's free space starting at byte 388!
By the end of the function, the freemap is in worse shape:
i 0 base 456 size 0 rhs 456 count 47
i 1 base 388 size 52 rhs 456 count 47
i 2 base 2120 size 4 rhs 456 count 47
firstused = 440
Important note: 388 is not aligned with the entries array element size
of 8 bytes.
Based on the incorrect freemap, the name area starts at byte 440, which
is below the end of the entries array! That's why the assertion
triggers and the filesystem shuts down.
How did we end up here? First, recall from the previous patch that the
freemap array in an xattr leaf block is not intended to be a
comprehensive map of all free space in the leaf block. In other words,
it's perfectly legal to have a leaf block with:
* 376 bytes in use by the entries array
* freemap[0] has [base = 376, size = 8]
* freemap[1] has [base = 388, size = 1500]
* the space between 376 and 388 is free, but the freemap stopped
tracking that some time ago
If we add one xattr, the entries array grows to 384 bytes, and
freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we
add a second xattr, the entries array grows to 392 bytes, and freemap[0]
gets pushed up to [base = 392, size = 0]. This is bad, because
freemap[1] hasn't been updated, and now the entries array and the free
space claim the same space.
The fix here is to adjust all freemap entries so that none of them
collide with the entries array. Note that this fix relies on commit
2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and
the previous patch that resets zero length freemap entries to have
base = 0.
Cc: <stable@vger.kernel.org> # v2.6.12
Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_attr_leaf.c | 36 +++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
index 33c6c468ad8d5..b858e3c2ad50a 100644
--- a/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -1476,6 +1476,7 @@ xfs_attr3_leaf_add_work(
struct xfs_attr_leaf_name_local *name_loc;
struct xfs_attr_leaf_name_remote *name_rmt;
struct xfs_mount *mp;
+ int old_end, new_end;
int tmp;
int i;
@@ -1568,17 +1569,36 @@ xfs_attr3_leaf_add_work(
if (be16_to_cpu(entry->nameidx) < ichdr->firstused)
ichdr->firstused = be16_to_cpu(entry->nameidx);
- ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)
- + xfs_attr3_leaf_hdr_size(leaf));
- tmp = (ichdr->count - 1) * sizeof(xfs_attr_leaf_entry_t)
- + xfs_attr3_leaf_hdr_size(leaf);
+ new_end = ichdr->count * sizeof(struct xfs_attr_leaf_entry) +
+ xfs_attr3_leaf_hdr_size(leaf);
+ old_end = new_end - sizeof(struct xfs_attr_leaf_entry);
+
+ ASSERT(ichdr->firstused >= new_end);
for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
- if (ichdr->freemap[i].base == tmp) {
- ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t);
+ int diff = 0;
+
+ if (ichdr->freemap[i].base == old_end) {
+ /*
+ * This freemap entry starts at the old end of the
+ * leaf entry array, so we need to adjust its base
+ * upward to accomodate the larger array.
+ */
+ diff = sizeof(struct xfs_attr_leaf_entry);
+ } else if (ichdr->freemap[i].size > 0 &&
+ ichdr->freemap[i].base < new_end) {
+ /*
+ * This freemap entry starts in the space claimed by
+ * the new leaf entry. Adjust its base upward to
+ * reflect that.
+ */
+ diff = new_end - ichdr->freemap[i].base;
+ }
+
+ if (diff) {
+ ichdr->freemap[i].base += diff;
ichdr->freemap[i].size -=
- min_t(uint16_t, ichdr->freemap[i].size,
- sizeof(xfs_attr_leaf_entry_t));
+ min_t(uint16_t, ichdr->freemap[i].size, diff);
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 681/844] xfs: fix the xattr scrub to detect freemap/entries array collisions
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (679 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 680/844] xfs: fix freemap adjustments when adding xattrs to leaf blocks Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 682/844] xfs: fix remote xattr valuelblk check Sasha Levin
` (171 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Darrick J. Wong, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit 6fed8270448c246e706921c177e9633013dd3fcf ]
In the previous patches, we observed that it's possible for there to be
freemap entries with zero size but a nonzero base. This isn't an
inconsistency per se, but older kernels can get confused by this and
corrupt the block, leading to corruption.
If we see this, flag the xattr structure for optimization so that it
gets rebuilt.
Cc: <stable@vger.kernel.org> # v4.15
Fixes: 13791d3b833428 ("xfs: scrub extended attribute leaf space")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/attr.c | 54 ++++++++++++++++++++++-----------------------
1 file changed, 27 insertions(+), 27 deletions(-)
diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c
index 708334f9b2bd1..ef299be01de5e 100644
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -287,32 +287,6 @@ xchk_xattr_set_map(
return ret;
}
-/*
- * Check the leaf freemap from the usage bitmap. Returns false if the
- * attr freemap has problems or points to used space.
- */
-STATIC bool
-xchk_xattr_check_freemap(
- struct xfs_scrub *sc,
- struct xfs_attr3_icleaf_hdr *leafhdr)
-{
- struct xchk_xattr_buf *ab = sc->buf;
- unsigned int mapsize = sc->mp->m_attr_geo->blksize;
- int i;
-
- /* Construct bitmap of freemap contents. */
- bitmap_zero(ab->freemap, mapsize);
- for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
- if (!xchk_xattr_set_map(sc, ab->freemap,
- leafhdr->freemap[i].base,
- leafhdr->freemap[i].size))
- return false;
- }
-
- /* Look for bits that are set in freemap and are marked in use. */
- return !bitmap_intersects(ab->freemap, ab->usedmap, mapsize);
-}
-
/*
* Check this leaf entry's relations to everything else.
* Returns the number of bytes used for the name/value data.
@@ -403,6 +377,7 @@ xchk_xattr_block(
*last_checked = blk->blkno;
bitmap_zero(ab->usedmap, mp->m_attr_geo->blksize);
+ bitmap_zero(ab->freemap, mp->m_attr_geo->blksize);
/* Check all the padding. */
if (xfs_has_crc(ds->sc->mp)) {
@@ -449,6 +424,9 @@ xchk_xattr_block(
if ((char *)&entries[leafhdr.count] > (char *)leaf + leafhdr.firstused)
xchk_da_set_corrupt(ds, level);
+ if (ds->sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+ goto out;
+
buf_end = (char *)bp->b_addr + mp->m_attr_geo->blksize;
for (i = 0, ent = entries; i < leafhdr.count; ent++, i++) {
/* Mark the leaf entry itself. */
@@ -467,7 +445,29 @@ xchk_xattr_block(
goto out;
}
- if (!xchk_xattr_check_freemap(ds->sc, &leafhdr))
+ /* Construct bitmap of freemap contents. */
+ for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
+ if (!xchk_xattr_set_map(ds->sc, ab->freemap,
+ leafhdr.freemap[i].base,
+ leafhdr.freemap[i].size))
+ xchk_da_set_corrupt(ds, level);
+
+ /*
+ * freemap entries with zero length and nonzero base can cause
+ * problems with older kernels, so we mark these for preening
+ * even though there's no inconsistency.
+ */
+ if (leafhdr.freemap[i].size == 0 &&
+ leafhdr.freemap[i].base > 0)
+ xchk_da_set_preen(ds, level);
+
+ if (ds->sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+ goto out;
+ }
+
+ /* Look for bits that are set in freemap and are marked in use. */
+ if (bitmap_intersects(ab->freemap, ab->usedmap,
+ mp->m_attr_geo->blksize))
xchk_da_set_corrupt(ds, level);
if (leafhdr.usedbytes != usedbytes)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 682/844] xfs: fix remote xattr valuelblk check
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (680 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 681/844] xfs: fix the xattr scrub to detect freemap/entries array collisions Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 683/844] xfs: get rid of the xchk_xfile_*_descr calls Sasha Levin
` (170 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Darrick J. Wong, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit bd3138e8912c9db182eac5fed1337645a98b7a4f ]
In debugging other problems with generic/753, it turns out that it's
possible for the system go to down in the middle of a remote xattr set
operation such that the leaf block entry is marked incomplete and
valueblk is set to zero. Make this no longer a failure.
Cc: <stable@vger.kernel.org> # v4.15
Fixes: 13791d3b833428 ("xfs: scrub extended attribute leaf space")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/attr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c
index ef299be01de5e..a0878fdbcf386 100644
--- a/fs/xfs/scrub/attr.c
+++ b/fs/xfs/scrub/attr.c
@@ -338,7 +338,10 @@ xchk_xattr_entry(
rentry = xfs_attr3_leaf_name_remote(leaf, idx);
namesize = xfs_attr_leaf_entsize_remote(rentry->namelen);
name_end = (char *)rentry + namesize;
- if (rentry->namelen == 0 || rentry->valueblk == 0)
+ if (rentry->namelen == 0)
+ xchk_da_set_corrupt(ds, level);
+ if (rentry->valueblk == 0 &&
+ !(ent->flags & XFS_ATTR_INCOMPLETE))
xchk_da_set_corrupt(ds, level);
}
if (name_end > buf_end)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 683/844] xfs: get rid of the xchk_xfile_*_descr calls
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (681 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 682/844] xfs: fix remote xattr valuelblk check Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 684/844] spmi: apple: Add "apple,t8103-spmi" compatible Sasha Levin
` (169 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Darrick J. Wong, r772577952, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit 60382993a2e18041f88c7969f567f168cd3b4de3 ]
The xchk_xfile_*_descr macros call kasprintf, which can fail to allocate
memory if the formatted string is larger than 16 bytes (or whatever the
nofail guarantees are nowadays). Some of them could easily exceed that,
and Jiaming Zhang found a few places where that can happen with syzbot.
The descriptions are debugging aids and aren't required to be unique, so
let's just pass in static strings and eliminate this path to failure.
Note this patch touches a number of commits, most of which were merged
between 6.6 and 6.14.
Cc: r772577952@gmail.com
Cc: <stable@vger.kernel.org> # v6.12
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 13 ++++---------
fs/xfs/scrub/alloc_repair.c | 5 +----
fs/xfs/scrub/attr_repair.c | 20 +++++---------------
fs/xfs/scrub/bmap_repair.c | 6 +-----
fs/xfs/scrub/common.h | 25 -------------------------
fs/xfs/scrub/dir.c | 13 ++++---------
fs/xfs/scrub/dir_repair.c | 11 +++--------
fs/xfs/scrub/dirtree.c | 11 +++--------
fs/xfs/scrub/ialloc_repair.c | 5 +----
fs/xfs/scrub/nlinks.c | 6 ++----
fs/xfs/scrub/parent.c | 11 +++--------
fs/xfs/scrub/parent_repair.c | 23 ++++++-----------------
fs/xfs/scrub/quotacheck.c | 13 +++----------
fs/xfs/scrub/refcount_repair.c | 13 ++-----------
fs/xfs/scrub/rmap_repair.c | 5 +----
fs/xfs/scrub/rtbitmap_repair.c | 6 ++----
fs/xfs/scrub/rtrefcount_repair.c | 15 +++------------
fs/xfs/scrub/rtrmap_repair.c | 5 +----
fs/xfs/scrub/rtsummary.c | 7 ++-----
19 files changed, 47 insertions(+), 166 deletions(-)
--git a/fs/xfs/scrub/agheader_repair.c b/fs/xfs/scrub/agheader_repair.c
index cd6f0223879f4..a2f6a7f71d839 100644
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -1708,7 +1708,6 @@ xrep_agi(
{
struct xrep_agi *ragi;
struct xfs_mount *mp = sc->mp;
- char *descr;
unsigned int i;
int error;
@@ -1742,17 +1741,13 @@ xrep_agi(
xagino_bitmap_init(&ragi->iunlink_bmp);
sc->buf_cleanup = xrep_agi_buf_cleanup;
- descr = xchk_xfile_ag_descr(sc, "iunlinked next pointers");
- error = xfarray_create(descr, 0, sizeof(xfs_agino_t),
- &ragi->iunlink_next);
- kfree(descr);
+ error = xfarray_create("iunlinked next pointers", 0,
+ sizeof(xfs_agino_t), &ragi->iunlink_next);
if (error)
return error;
- descr = xchk_xfile_ag_descr(sc, "iunlinked prev pointers");
- error = xfarray_create(descr, 0, sizeof(xfs_agino_t),
- &ragi->iunlink_prev);
- kfree(descr);
+ error = xfarray_create("iunlinked prev pointers", 0,
+ sizeof(xfs_agino_t), &ragi->iunlink_prev);
if (error)
return error;
diff --git a/fs/xfs/scrub/alloc_repair.c b/fs/xfs/scrub/alloc_repair.c
index bed6a09aa7911..b6fe1f23819eb 100644
--- a/fs/xfs/scrub/alloc_repair.c
+++ b/fs/xfs/scrub/alloc_repair.c
@@ -850,7 +850,6 @@ xrep_allocbt(
struct xrep_abt *ra;
struct xfs_mount *mp = sc->mp;
unsigned int busy_gen;
- char *descr;
int error;
/* We require the rmapbt to rebuild anything. */
@@ -876,11 +875,9 @@ xrep_allocbt(
}
/* Set up enough storage to handle maximally fragmented free space. */
- descr = xchk_xfile_ag_descr(sc, "free space records");
- error = xfarray_create(descr, mp->m_sb.sb_agblocks / 2,
+ error = xfarray_create("free space records", mp->m_sb.sb_agblocks / 2,
sizeof(struct xfs_alloc_rec_incore),
&ra->free_records);
- kfree(descr);
if (error)
goto out_ra;
diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index 09d63aa10314b..eded354dec11e 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1529,7 +1529,6 @@ xrep_xattr_setup_scan(
struct xrep_xattr **rxp)
{
struct xrep_xattr *rx;
- char *descr;
int max_len;
int error;
@@ -1555,35 +1554,26 @@ xrep_xattr_setup_scan(
goto out_rx;
/* Set up some staging for salvaged attribute keys and values */
- descr = xchk_xfile_ino_descr(sc, "xattr keys");
- error = xfarray_create(descr, 0, sizeof(struct xrep_xattr_key),
+ error = xfarray_create("xattr keys", 0, sizeof(struct xrep_xattr_key),
&rx->xattr_records);
- kfree(descr);
if (error)
goto out_rx;
- descr = xchk_xfile_ino_descr(sc, "xattr names");
- error = xfblob_create(descr, &rx->xattr_blobs);
- kfree(descr);
+ error = xfblob_create("xattr names", &rx->xattr_blobs);
if (error)
goto out_keys;
if (xfs_has_parent(sc->mp)) {
ASSERT(sc->flags & XCHK_FSGATES_DIRENTS);
- descr = xchk_xfile_ino_descr(sc,
- "xattr retained parent pointer entries");
- error = xfarray_create(descr, 0,
+ error = xfarray_create("xattr parent pointer entries", 0,
sizeof(struct xrep_xattr_pptr),
&rx->pptr_recs);
- kfree(descr);
if (error)
goto out_values;
- descr = xchk_xfile_ino_descr(sc,
- "xattr retained parent pointer names");
- error = xfblob_create(descr, &rx->pptr_names);
- kfree(descr);
+ error = xfblob_create("xattr parent pointer names",
+ &rx->pptr_names);
if (error)
goto out_pprecs;
diff --git a/fs/xfs/scrub/bmap_repair.c b/fs/xfs/scrub/bmap_repair.c
index 1084213b8e9b8..747cd9389b491 100644
--- a/fs/xfs/scrub/bmap_repair.c
+++ b/fs/xfs/scrub/bmap_repair.c
@@ -923,7 +923,6 @@ xrep_bmap(
bool allow_unwritten)
{
struct xrep_bmap *rb;
- char *descr;
xfs_extnum_t max_bmbt_recs;
bool large_extcount;
int error = 0;
@@ -945,11 +944,8 @@ xrep_bmap(
/* Set up enough storage to handle the max records for this fork. */
large_extcount = xfs_has_large_extent_counts(sc->mp);
max_bmbt_recs = xfs_iext_max_nextents(large_extcount, whichfork);
- descr = xchk_xfile_ino_descr(sc, "%s fork mapping records",
- whichfork == XFS_DATA_FORK ? "data" : "attr");
- error = xfarray_create(descr, max_bmbt_recs,
+ error = xfarray_create("fork mapping records", max_bmbt_recs,
sizeof(struct xfs_bmbt_rec), &rb->bmap_records);
- kfree(descr);
if (error)
goto out_rb;
diff --git a/fs/xfs/scrub/common.h b/fs/xfs/scrub/common.h
index ddbc065c798cd..f2ecc68538f0c 100644
--- a/fs/xfs/scrub/common.h
+++ b/fs/xfs/scrub/common.h
@@ -246,31 +246,6 @@ static inline bool xchk_could_repair(const struct xfs_scrub *sc)
int xchk_metadata_inode_forks(struct xfs_scrub *sc);
-/*
- * Helper macros to allocate and format xfile description strings.
- * Callers must kfree the pointer returned.
- */
-#define xchk_xfile_descr(sc, fmt, ...) \
- kasprintf(XCHK_GFP_FLAGS, "XFS (%s): " fmt, \
- (sc)->mp->m_super->s_id, ##__VA_ARGS__)
-#define xchk_xfile_ag_descr(sc, fmt, ...) \
- kasprintf(XCHK_GFP_FLAGS, "XFS (%s): AG 0x%x " fmt, \
- (sc)->mp->m_super->s_id, \
- (sc)->sa.pag ? \
- pag_agno((sc)->sa.pag) : (sc)->sm->sm_agno, \
- ##__VA_ARGS__)
-#define xchk_xfile_ino_descr(sc, fmt, ...) \
- kasprintf(XCHK_GFP_FLAGS, "XFS (%s): inode 0x%llx " fmt, \
- (sc)->mp->m_super->s_id, \
- (sc)->ip ? (sc)->ip->i_ino : (sc)->sm->sm_ino, \
- ##__VA_ARGS__)
-#define xchk_xfile_rtgroup_descr(sc, fmt, ...) \
- kasprintf(XCHK_GFP_FLAGS, "XFS (%s): rtgroup 0x%x " fmt, \
- (sc)->mp->m_super->s_id, \
- (sc)->sa.pag ? \
- rtg_rgno((sc)->sr.rtg) : (sc)->sm->sm_agno, \
- ##__VA_ARGS__)
-
/*
* Setting up a hook to wait for intents to drain is costly -- we have to take
* the CPU hotplug lock and force an i-cache flush on all CPUs once to set it
diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
index c877bde71e628..4f849d98cbdd2 100644
--- a/fs/xfs/scrub/dir.c
+++ b/fs/xfs/scrub/dir.c
@@ -1102,22 +1102,17 @@ xchk_directory(
sd->xname.name = sd->namebuf;
if (xfs_has_parent(sc->mp)) {
- char *descr;
-
/*
* Set up some staging memory for dirents that we can't check
* due to locking contention.
*/
- descr = xchk_xfile_ino_descr(sc, "slow directory entries");
- error = xfarray_create(descr, 0, sizeof(struct xchk_dirent),
- &sd->dir_entries);
- kfree(descr);
+ error = xfarray_create("slow directory entries", 0,
+ sizeof(struct xchk_dirent), &sd->dir_entries);
if (error)
goto out_sd;
- descr = xchk_xfile_ino_descr(sc, "slow directory entry names");
- error = xfblob_create(descr, &sd->dir_names);
- kfree(descr);
+ error = xfblob_create("slow directory entry names",
+ &sd->dir_names);
if (error)
goto out_entries;
}
diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 8d3b550990b58..7a21b688a4715 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -1784,20 +1784,15 @@ xrep_dir_setup_scan(
struct xrep_dir *rd)
{
struct xfs_scrub *sc = rd->sc;
- char *descr;
int error;
/* Set up some staging memory for salvaging dirents. */
- descr = xchk_xfile_ino_descr(sc, "directory entries");
- error = xfarray_create(descr, 0, sizeof(struct xrep_dirent),
- &rd->dir_entries);
- kfree(descr);
+ error = xfarray_create("directory entries", 0,
+ sizeof(struct xrep_dirent), &rd->dir_entries);
if (error)
return error;
- descr = xchk_xfile_ino_descr(sc, "directory entry names");
- error = xfblob_create(descr, &rd->dir_names);
- kfree(descr);
+ error = xfblob_create("directory entry names", &rd->dir_names);
if (error)
goto out_xfarray;
diff --git a/fs/xfs/scrub/dirtree.c b/fs/xfs/scrub/dirtree.c
index 3a9cdf8738b6d..f9c85b8b194fa 100644
--- a/fs/xfs/scrub/dirtree.c
+++ b/fs/xfs/scrub/dirtree.c
@@ -92,7 +92,6 @@ xchk_setup_dirtree(
struct xfs_scrub *sc)
{
struct xchk_dirtree *dl;
- char *descr;
int error;
xchk_fsgates_enable(sc, XCHK_FSGATES_DIRENTS);
@@ -116,16 +115,12 @@ xchk_setup_dirtree(
mutex_init(&dl->lock);
- descr = xchk_xfile_ino_descr(sc, "dirtree path steps");
- error = xfarray_create(descr, 0, sizeof(struct xchk_dirpath_step),
- &dl->path_steps);
- kfree(descr);
+ error = xfarray_create("dirtree path steps", 0,
+ sizeof(struct xchk_dirpath_step), &dl->path_steps);
if (error)
goto out_dl;
- descr = xchk_xfile_ino_descr(sc, "dirtree path names");
- error = xfblob_create(descr, &dl->path_names);
- kfree(descr);
+ error = xfblob_create("dirtree path names", &dl->path_names);
if (error)
goto out_steps;
diff --git a/fs/xfs/scrub/ialloc_repair.c b/fs/xfs/scrub/ialloc_repair.c
index 14e48d3f1912b..b1d00167d263f 100644
--- a/fs/xfs/scrub/ialloc_repair.c
+++ b/fs/xfs/scrub/ialloc_repair.c
@@ -797,7 +797,6 @@ xrep_iallocbt(
{
struct xrep_ibt *ri;
struct xfs_mount *mp = sc->mp;
- char *descr;
xfs_agino_t first_agino, last_agino;
int error = 0;
@@ -816,11 +815,9 @@ xrep_iallocbt(
/* Set up enough storage to handle an AG with nothing but inodes. */
xfs_agino_range(mp, pag_agno(sc->sa.pag), &first_agino, &last_agino);
last_agino /= XFS_INODES_PER_CHUNK;
- descr = xchk_xfile_ag_descr(sc, "inode index records");
- error = xfarray_create(descr, last_agino,
+ error = xfarray_create("inode index records", last_agino,
sizeof(struct xfs_inobt_rec_incore),
&ri->inode_records);
- kfree(descr);
if (error)
goto out_ri;
diff --git a/fs/xfs/scrub/nlinks.c b/fs/xfs/scrub/nlinks.c
index 091c79e432e59..2ba686e4de8bc 100644
--- a/fs/xfs/scrub/nlinks.c
+++ b/fs/xfs/scrub/nlinks.c
@@ -990,7 +990,6 @@ xchk_nlinks_setup_scan(
struct xchk_nlink_ctrs *xnc)
{
struct xfs_mount *mp = sc->mp;
- char *descr;
unsigned long long max_inos;
xfs_agnumber_t last_agno = mp->m_sb.sb_agcount - 1;
xfs_agino_t first_agino, last_agino;
@@ -1007,10 +1006,9 @@ xchk_nlinks_setup_scan(
*/
xfs_agino_range(mp, last_agno, &first_agino, &last_agino);
max_inos = XFS_AGINO_TO_INO(mp, last_agno, last_agino) + 1;
- descr = xchk_xfile_descr(sc, "file link counts");
- error = xfarray_create(descr, min(XFS_MAXINUMBER + 1, max_inos),
+ error = xfarray_create("file link counts",
+ min(XFS_MAXINUMBER + 1, max_inos),
sizeof(struct xchk_nlink), &xnc->nlinks);
- kfree(descr);
if (error)
goto out_teardown;
diff --git a/fs/xfs/scrub/parent.c b/fs/xfs/scrub/parent.c
index 11d5de10fd567..23c195d14494e 100644
--- a/fs/xfs/scrub/parent.c
+++ b/fs/xfs/scrub/parent.c
@@ -755,7 +755,6 @@ xchk_parent_pptr(
struct xfs_scrub *sc)
{
struct xchk_pptrs *pp;
- char *descr;
int error;
pp = kvzalloc(sizeof(struct xchk_pptrs), XCHK_GFP_FLAGS);
@@ -768,16 +767,12 @@ xchk_parent_pptr(
* Set up some staging memory for parent pointers that we can't check
* due to locking contention.
*/
- descr = xchk_xfile_ino_descr(sc, "slow parent pointer entries");
- error = xfarray_create(descr, 0, sizeof(struct xchk_pptr),
- &pp->pptr_entries);
- kfree(descr);
+ error = xfarray_create("slow parent pointer entries", 0,
+ sizeof(struct xchk_pptr), &pp->pptr_entries);
if (error)
goto out_pp;
- descr = xchk_xfile_ino_descr(sc, "slow parent pointer names");
- error = xfblob_create(descr, &pp->pptr_names);
- kfree(descr);
+ error = xfblob_create("slow parent pointer names", &pp->pptr_names);
if (error)
goto out_entries;
diff --git a/fs/xfs/scrub/parent_repair.c b/fs/xfs/scrub/parent_repair.c
index 2949feda62717..897902c54178d 100644
--- a/fs/xfs/scrub/parent_repair.c
+++ b/fs/xfs/scrub/parent_repair.c
@@ -1497,7 +1497,6 @@ xrep_parent_setup_scan(
struct xrep_parent *rp)
{
struct xfs_scrub *sc = rp->sc;
- char *descr;
struct xfs_da_geometry *geo = sc->mp->m_attr_geo;
int max_len;
int error;
@@ -1525,32 +1524,22 @@ xrep_parent_setup_scan(
goto out_xattr_name;
/* Set up some staging memory for logging parent pointer updates. */
- descr = xchk_xfile_ino_descr(sc, "parent pointer entries");
- error = xfarray_create(descr, 0, sizeof(struct xrep_pptr),
- &rp->pptr_recs);
- kfree(descr);
+ error = xfarray_create("parent pointer entries", 0,
+ sizeof(struct xrep_pptr), &rp->pptr_recs);
if (error)
goto out_xattr_value;
- descr = xchk_xfile_ino_descr(sc, "parent pointer names");
- error = xfblob_create(descr, &rp->pptr_names);
- kfree(descr);
+ error = xfblob_create("parent pointer names", &rp->pptr_names);
if (error)
goto out_recs;
/* Set up some storage for copying attrs before the mapping exchange */
- descr = xchk_xfile_ino_descr(sc,
- "parent pointer retained xattr entries");
- error = xfarray_create(descr, 0, sizeof(struct xrep_parent_xattr),
- &rp->xattr_records);
- kfree(descr);
+ error = xfarray_create("parent pointer xattr entries", 0,
+ sizeof(struct xrep_parent_xattr), &rp->xattr_records);
if (error)
goto out_names;
- descr = xchk_xfile_ino_descr(sc,
- "parent pointer retained xattr values");
- error = xfblob_create(descr, &rp->xattr_blobs);
- kfree(descr);
+ error = xfblob_create("parent pointer xattr values", &rp->xattr_blobs);
if (error)
goto out_attr_keys;
diff --git a/fs/xfs/scrub/quotacheck.c b/fs/xfs/scrub/quotacheck.c
index d412a8359784e..3b2f4ccde2ec0 100644
--- a/fs/xfs/scrub/quotacheck.c
+++ b/fs/xfs/scrub/quotacheck.c
@@ -741,7 +741,6 @@ xqcheck_setup_scan(
struct xfs_scrub *sc,
struct xqcheck *xqc)
{
- char *descr;
struct xfs_quotainfo *qi = sc->mp->m_quotainfo;
unsigned long long max_dquots = XFS_DQ_ID_MAX + 1ULL;
int error;
@@ -756,28 +755,22 @@ xqcheck_setup_scan(
error = -ENOMEM;
if (xfs_this_quota_on(sc->mp, XFS_DQTYPE_USER)) {
- descr = xchk_xfile_descr(sc, "user dquot records");
- error = xfarray_create(descr, max_dquots,
+ error = xfarray_create("user dquot records", max_dquots,
sizeof(struct xqcheck_dquot), &xqc->ucounts);
- kfree(descr);
if (error)
goto out_teardown;
}
if (xfs_this_quota_on(sc->mp, XFS_DQTYPE_GROUP)) {
- descr = xchk_xfile_descr(sc, "group dquot records");
- error = xfarray_create(descr, max_dquots,
+ error = xfarray_create("group dquot records", max_dquots,
sizeof(struct xqcheck_dquot), &xqc->gcounts);
- kfree(descr);
if (error)
goto out_teardown;
}
if (xfs_this_quota_on(sc->mp, XFS_DQTYPE_PROJ)) {
- descr = xchk_xfile_descr(sc, "project dquot records");
- error = xfarray_create(descr, max_dquots,
+ error = xfarray_create("project dquot records", max_dquots,
sizeof(struct xqcheck_dquot), &xqc->pcounts);
- kfree(descr);
if (error)
goto out_teardown;
}
diff --git a/fs/xfs/scrub/refcount_repair.c b/fs/xfs/scrub/refcount_repair.c
index 9c8cb5332da04..360fd7354880a 100644
--- a/fs/xfs/scrub/refcount_repair.c
+++ b/fs/xfs/scrub/refcount_repair.c
@@ -123,13 +123,7 @@ int
xrep_setup_ag_refcountbt(
struct xfs_scrub *sc)
{
- char *descr;
- int error;
-
- descr = xchk_xfile_ag_descr(sc, "rmap record bag");
- error = xrep_setup_xfbtree(sc, descr);
- kfree(descr);
- return error;
+ return xrep_setup_xfbtree(sc, "rmap record bag");
}
/* Check for any obvious conflicts with this shared/CoW staging extent. */
@@ -704,7 +698,6 @@ xrep_refcountbt(
{
struct xrep_refc *rr;
struct xfs_mount *mp = sc->mp;
- char *descr;
int error;
/* We require the rmapbt to rebuild anything. */
@@ -717,11 +710,9 @@ xrep_refcountbt(
rr->sc = sc;
/* Set up enough storage to handle one refcount record per block. */
- descr = xchk_xfile_ag_descr(sc, "reference count records");
- error = xfarray_create(descr, mp->m_sb.sb_agblocks,
+ error = xfarray_create("reference count records", mp->m_sb.sb_agblocks,
sizeof(struct xfs_refcount_irec),
&rr->refcount_records);
- kfree(descr);
if (error)
goto out_rr;
diff --git a/fs/xfs/scrub/rmap_repair.c b/fs/xfs/scrub/rmap_repair.c
index 17d4a38d735cb..cfd1cf403b37e 100644
--- a/fs/xfs/scrub/rmap_repair.c
+++ b/fs/xfs/scrub/rmap_repair.c
@@ -164,14 +164,11 @@ xrep_setup_ag_rmapbt(
struct xfs_scrub *sc)
{
struct xrep_rmap *rr;
- char *descr;
int error;
xchk_fsgates_enable(sc, XCHK_FSGATES_RMAP);
- descr = xchk_xfile_ag_descr(sc, "reverse mapping records");
- error = xrep_setup_xfbtree(sc, descr);
- kfree(descr);
+ error = xrep_setup_xfbtree(sc, "reverse mapping records");
if (error)
return error;
diff --git a/fs/xfs/scrub/rtbitmap_repair.c b/fs/xfs/scrub/rtbitmap_repair.c
index 203a1a97c5026..41d6736a529d0 100644
--- a/fs/xfs/scrub/rtbitmap_repair.c
+++ b/fs/xfs/scrub/rtbitmap_repair.c
@@ -43,7 +43,6 @@ xrep_setup_rtbitmap(
struct xchk_rtbitmap *rtb)
{
struct xfs_mount *mp = sc->mp;
- char *descr;
unsigned long long blocks = mp->m_sb.sb_rbmblocks;
int error;
@@ -52,9 +51,8 @@ xrep_setup_rtbitmap(
return error;
/* Create an xfile to hold our reconstructed bitmap. */
- descr = xchk_xfile_rtgroup_descr(sc, "bitmap file");
- error = xfile_create(descr, blocks * mp->m_sb.sb_blocksize, &sc->xfile);
- kfree(descr);
+ error = xfile_create("realtime bitmap file",
+ blocks * mp->m_sb.sb_blocksize, &sc->xfile);
if (error)
return error;
diff --git a/fs/xfs/scrub/rtrefcount_repair.c b/fs/xfs/scrub/rtrefcount_repair.c
index 983362447826d..b35e39cce7ad5 100644
--- a/fs/xfs/scrub/rtrefcount_repair.c
+++ b/fs/xfs/scrub/rtrefcount_repair.c
@@ -128,13 +128,7 @@ int
xrep_setup_rtrefcountbt(
struct xfs_scrub *sc)
{
- char *descr;
- int error;
-
- descr = xchk_xfile_ag_descr(sc, "rmap record bag");
- error = xrep_setup_xfbtree(sc, descr);
- kfree(descr);
- return error;
+ return xrep_setup_xfbtree(sc, "realtime rmap record bag");
}
/* Check for any obvious conflicts with this shared/CoW staging extent. */
@@ -704,7 +698,6 @@ xrep_rtrefcountbt(
{
struct xrep_rtrefc *rr;
struct xfs_mount *mp = sc->mp;
- char *descr;
int error;
/* We require the rmapbt to rebuild anything. */
@@ -722,11 +715,9 @@ xrep_rtrefcountbt(
rr->sc = sc;
/* Set up enough storage to handle one refcount record per rt extent. */
- descr = xchk_xfile_ag_descr(sc, "reference count records");
- error = xfarray_create(descr, mp->m_sb.sb_rextents,
- sizeof(struct xfs_refcount_irec),
+ error = xfarray_create("realtime reference count records",
+ mp->m_sb.sb_rextents, sizeof(struct xfs_refcount_irec),
&rr->refcount_records);
- kfree(descr);
if (error)
goto out_rr;
diff --git a/fs/xfs/scrub/rtrmap_repair.c b/fs/xfs/scrub/rtrmap_repair.c
index 7561941a337a1..749977a66e40f 100644
--- a/fs/xfs/scrub/rtrmap_repair.c
+++ b/fs/xfs/scrub/rtrmap_repair.c
@@ -103,14 +103,11 @@ xrep_setup_rtrmapbt(
struct xfs_scrub *sc)
{
struct xrep_rtrmap *rr;
- char *descr;
int error;
xchk_fsgates_enable(sc, XCHK_FSGATES_RMAP);
- descr = xchk_xfile_rtgroup_descr(sc, "reverse mapping records");
- error = xrep_setup_xfbtree(sc, descr);
- kfree(descr);
+ error = xrep_setup_xfbtree(sc, "realtime reverse mapping records");
if (error)
return error;
diff --git a/fs/xfs/scrub/rtsummary.c b/fs/xfs/scrub/rtsummary.c
index 4ac679c1bd29c..fb78cff2ac3a1 100644
--- a/fs/xfs/scrub/rtsummary.c
+++ b/fs/xfs/scrub/rtsummary.c
@@ -43,7 +43,6 @@ xchk_setup_rtsummary(
struct xfs_scrub *sc)
{
struct xfs_mount *mp = sc->mp;
- char *descr;
struct xchk_rtsummary *rts;
int error;
@@ -70,10 +69,8 @@ xchk_setup_rtsummary(
* Create an xfile to construct a new rtsummary file. The xfile allows
* us to avoid pinning kernel memory for this purpose.
*/
- descr = xchk_xfile_descr(sc, "realtime summary file");
- error = xfile_create(descr, XFS_FSB_TO_B(mp, mp->m_rsumblocks),
- &sc->xfile);
- kfree(descr);
+ error = xfile_create("realtime summary file",
+ XFS_FSB_TO_B(mp, mp->m_rsumblocks), &sc->xfile);
if (error)
return error;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 684/844] spmi: apple: Add "apple,t8103-spmi" compatible
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (682 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 683/844] xfs: get rid of the xchk_xfile_*_descr calls Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 685/844] rust/drm: Fix Registration::{new,new_foreign_owned}() docs Sasha Levin
` (168 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Janne Grunau, Neal Gompa, Stephen Boyd, Greg Kroah-Hartman,
Sasha Levin
From: Janne Grunau <j@jannau.net>
[ Upstream commit 6c54b0a801dd8227237ba0bf0728bb42681cf027 ]
After discussion with the devicetree maintainers we agreed to not extend
lists with the generic compatible "apple,spmi" anymore [1]. Use
"apple,t8103-spmi" as base compatible as it is the SoC the driver and
bindings were written for.
[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
Fixes: 77ca75e80c71 ("spmi: add a spmi driver for Apple SoC")
Cc: stable@vger.kernel.org
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Janne Grunau <j@jannau.net>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Link: https://patch.msgid.link/20260123182039.224314-7-sboyd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spmi/spmi-apple-controller.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spmi/spmi-apple-controller.c b/drivers/spmi/spmi-apple-controller.c
index 697b3e8bb0235..87e3ee9d4f2aa 100644
--- a/drivers/spmi/spmi-apple-controller.c
+++ b/drivers/spmi/spmi-apple-controller.c
@@ -149,6 +149,7 @@ static int apple_spmi_probe(struct platform_device *pdev)
}
static const struct of_device_id apple_spmi_match_table[] = {
+ { .compatible = "apple,t8103-spmi", },
{ .compatible = "apple,spmi", },
{}
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 685/844] rust/drm: Fix Registration::{new,new_foreign_owned}() docs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (683 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 684/844] spmi: apple: Add "apple,t8103-spmi" compatible Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:29 ` [PATCH 6.19 686/844] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Sasha Levin
` (167 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Lyude Paul, Danilo Krummrich, Sasha Levin
From: Lyude Paul <lyude@redhat.com>
[ Upstream commit 638eeda8abaa3e6afe6bd5758ef8045a7f33b9a0 ]
Looks like we've actually had a malformed rustdoc reference in the rustdocs
for Registration::new_foreign_owned() for a while that, when fixed, still
couldn't resolve properly because it refers to a private item.
This is probably leftover from when Registration::new() was public, so drop
the documentation from that function and fixup the documentation for
Registration::new_foreign_owned().
Signed-off-by: Lyude Paul <lyude@redhat.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Fixes: 0600032c54b7 ("rust: drm: add DRM driver registration")
Cc: <stable@vger.kernel.org> # v6.16+
Link: https://patch.msgid.link/20260122221037.3462081-1-lyude@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/drm/driver.rs | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/rust/kernel/drm/driver.rs b/rust/kernel/drm/driver.rs
index f30ee4c6245cd..e09f977b5b519 100644
--- a/rust/kernel/drm/driver.rs
+++ b/rust/kernel/drm/driver.rs
@@ -121,7 +121,6 @@ pub trait Driver {
pub struct Registration<T: Driver>(ARef<drm::Device<T>>);
impl<T: Driver> Registration<T> {
- /// Creates a new [`Registration`] and registers it.
fn new(drm: &drm::Device<T>, flags: usize) -> Result<Self> {
// SAFETY: `drm.as_raw()` is valid by the invariants of `drm::Device`.
to_result(unsafe { bindings::drm_dev_register(drm.as_raw(), flags) })?;
@@ -129,8 +128,9 @@ fn new(drm: &drm::Device<T>, flags: usize) -> Result<Self> {
Ok(Self(drm.into()))
}
- /// Same as [`Registration::new`}, but transfers ownership of the [`Registration`] to
- /// [`devres::register`].
+ /// Registers a new [`Device`](drm::Device) with userspace.
+ ///
+ /// Ownership of the [`Registration`] object is passed to [`devres::register`].
pub fn new_foreign_owned(
drm: &drm::Device<T>,
dev: &device::Device<device::Bound>,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 686/844] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (684 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 685/844] rust/drm: Fix Registration::{new,new_foreign_owned}() docs Sasha Levin
@ 2026-02-28 17:29 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 687/844] PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions Sasha Levin
` (166 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Vasiliy Kovalev, Sean Christopherson, Sasha Levin
From: Vasiliy Kovalev <kovalev@altlinux.org>
[ Upstream commit 95d848dc7e639988dbb385a8cba9b484607cf98c ]
Add SRCU read-side protection when reading PDPTR registers in
__get_sregs2().
Reading PDPTRs may trigger access to guest memory:
kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() ->
kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot()
kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(),
which uses srcu_dereference_check() and requires either kvm->srcu or
kvm->slots_lock to be held. Currently only vcpu->mutex is held,
triggering lockdep warning:
=============================
WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot
6.12.59+ #3 Not tainted
include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.5.1717/15100:
#0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824
__kvm_memslots include/linux/kvm_host.h:1062 [inline]
__kvm_memslots include/linux/kvm_host.h:1059 [inline]
kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline]
kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617
kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302
load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065
svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688
kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline]
__get_sregs2 arch/x86/kvm/x86.c:11784 [inline]
kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279
kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Suggested-by: Sean Christopherson <seanjc@google.com>
Cc: stable@vger.kernel.org
Fixes: 6dba94035203 ("KVM: x86: Introduce KVM_GET_SREGS2 / KVM_SET_SREGS2")
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://patch.msgid.link/20260123222801.646123-1-kovalev@altlinux.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kvm/x86.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d65ebaed18986..8b12bf0774c77 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -12157,9 +12157,11 @@ static void __get_sregs2(struct kvm_vcpu *vcpu, struct kvm_sregs2 *sregs2)
return;
if (is_pae_paging(vcpu)) {
+ kvm_vcpu_srcu_read_lock(vcpu);
for (i = 0 ; i < 4 ; i++)
sregs2->pdptrs[i] = kvm_pdptr_read(vcpu, i);
sregs2->flags |= KVM_SREGS2_FLAGS_PDPTRS_VALID;
+ kvm_vcpu_srcu_read_unlock(vcpu);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 687/844] PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (685 preceding siblings ...)
2026-02-28 17:29 ` [PATCH 6.19 686/844] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 688/844] pinctrl: intel: Add code name documentation Sasha Levin
` (165 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Manikanta Maddireddy, Manivannan Sadhasivam, Bjorn Helgaas,
Niklas Cassel, Frank Li, Sasha Levin
From: Manikanta Maddireddy <mmaddireddy@nvidia.com>
[ Upstream commit 8754dd7639ab0fd68c3ab9d91c7bdecc3e5740a8 ]
struct configfs_item_operations callbacks are defined like the following:
int (*allow_link)(struct config_item *src, struct config_item *target);
void (*drop_link)(struct config_item *src, struct config_item *target);
While pci_primary_epc_epf_link() and pci_secondary_epc_epf_link() specify
the parameters in the correct order, pci_primary_epc_epf_unlink() and
pci_secondary_epc_epf_unlink() specify the parameters in the wrong order,
leading to the below kernel crash when using the unlink command in
configfs:
Unable to handle kernel paging request at virtual address 0000000300000857
Mem abort info:
...
pc : string+0x54/0x14c
lr : vsnprintf+0x280/0x6e8
...
string+0x54/0x14c
vsnprintf+0x280/0x6e8
vprintk_default+0x38/0x4c
vprintk+0xc4/0xe0
pci_epf_unbind+0xdc/0x108
configfs_unlink+0xe0/0x208+0x44/0x74
vfs_unlink+0x120/0x29c
__arm64_sys_unlinkat+0x3c/0x90
invoke_syscall+0x48/0x134
do_el0_svc+0x1c/0x30prop.0+0xd0/0xf0
Fixes: e85a2d783762 ("PCI: endpoint: Add support in configfs to associate two EPCs with EPF")
Signed-off-by: Manikanta Maddireddy <mmaddireddy@nvidia.com>
[mani: cced stable, changed commit message as per https://lore.kernel.org/linux-pci/aV9joi3jF1R6ca02@ryzen]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260108062747.1870669-1-mmaddireddy@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/pci-ep-cfs.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/endpoint/pci-ep-cfs.c b/drivers/pci/endpoint/pci-ep-cfs.c
index 43feb6139fa36..8b392a8363bb1 100644
--- a/drivers/pci/endpoint/pci-ep-cfs.c
+++ b/drivers/pci/endpoint/pci-ep-cfs.c
@@ -68,8 +68,8 @@ static int pci_secondary_epc_epf_link(struct config_item *epf_item,
return 0;
}
-static void pci_secondary_epc_epf_unlink(struct config_item *epc_item,
- struct config_item *epf_item)
+static void pci_secondary_epc_epf_unlink(struct config_item *epf_item,
+ struct config_item *epc_item)
{
struct pci_epf_group *epf_group = to_pci_epf_group(epf_item->ci_parent);
struct pci_epc_group *epc_group = to_pci_epc_group(epc_item);
@@ -132,8 +132,8 @@ static int pci_primary_epc_epf_link(struct config_item *epf_item,
return 0;
}
-static void pci_primary_epc_epf_unlink(struct config_item *epc_item,
- struct config_item *epf_item)
+static void pci_primary_epc_epf_unlink(struct config_item *epf_item,
+ struct config_item *epc_item)
{
struct pci_epf_group *epf_group = to_pci_epf_group(epf_item->ci_parent);
struct pci_epc_group *epc_group = to_pci_epc_group(epc_item);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 688/844] pinctrl: intel: Add code name documentation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (686 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 687/844] PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 689/844] xfs: only call xf{array,blob}_destroy if we have a valid pointer Sasha Levin
` (164 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Raag Jadav, Guido Trentalancia, Mika Westerberg, Andy Shevchenko,
Sasha Levin
From: Raag Jadav <raag.jadav@intel.com>
[ Upstream commit fc32c5725fbe1164d353400389d3e29d19960a3a ]
Intel pinctrl drivers support large set of platforms and the IPs are
often reused by their different variants, but it's currently not possible
to figure out the exact driver that supports specific variant. Add user
friendly documentation for them.
Cc: stable@vger.kernel.org
Reported-by: Guido Trentalancia <guido@trentalancia.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220056
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Guido Trentalancia <guido@trentalancia.com>
[andy: added Oxford comma]
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/intel/Kconfig | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/pinctrl/intel/Kconfig b/drivers/pinctrl/intel/Kconfig
index 248c2e558ff32..3ebf072371457 100644
--- a/drivers/pinctrl/intel/Kconfig
+++ b/drivers/pinctrl/intel/Kconfig
@@ -52,7 +52,10 @@ config PINCTRL_ALDERLAKE
select PINCTRL_INTEL
help
This pinctrl driver provides an interface that allows configuring
- of Intel Alder Lake PCH pins and using them as GPIOs.
+ PCH pins of the following platforms and using them as GPIOs:
+ - Alder Lake HX, N, and S
+ - Raptor Lake HX, E, and S
+ - Twin Lake
config PINCTRL_BROXTON
tristate "Intel Broxton pinctrl and GPIO driver"
@@ -136,15 +139,17 @@ config PINCTRL_METEORLAKE
select PINCTRL_INTEL
help
This pinctrl driver provides an interface that allows configuring
- of Intel Meteor Lake pins and using them as GPIOs.
+ SoC pins of the following platforms and using them as GPIOs:
+ - Arrow Lake (all variants)
+ - Meteor Lake (all variants)
config PINCTRL_METEORPOINT
tristate "Intel Meteor Point pinctrl and GPIO driver"
select PINCTRL_INTEL
help
- Meteor Point is the PCH of Intel Meteor Lake. This pinctrl driver
- provides an interface that allows configuring of PCH pins and
- using them as GPIOs.
+ This pinctrl driver provides an interface that allows configuring
+ PCH pins of the following platforms and using them as GPIOs:
+ - Arrow Lake HX and S
config PINCTRL_SUNRISEPOINT
tristate "Intel Sunrisepoint pinctrl and GPIO driver"
@@ -159,7 +164,11 @@ config PINCTRL_TIGERLAKE
select PINCTRL_INTEL
help
This pinctrl driver provides an interface that allows configuring
- of Intel Tiger Lake PCH pins and using them as GPIOs.
+ PCH pins of the following platforms and using them as GPIOs:
+ - Alder Lake H, P, PS, and U
+ - Raptor Lake H, P, PS, PX, and U
+ - Rocket Lake S
+ - Tiger Lake (all variants)
source "drivers/pinctrl/intel/Kconfig.tng"
endmenu
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 689/844] xfs: only call xf{array,blob}_destroy if we have a valid pointer
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (687 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 688/844] pinctrl: intel: Add code name documentation Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-03-02 7:06 ` Jiri Slaby
2026-02-28 17:30 ` [PATCH 6.19 690/844] xfs: check return value of xchk_scrub_create_subord Sasha Levin
` (163 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Darrick J. Wong, r772577952, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit ba408d299a3bb3c5309f40c5326e4fb83ead4247 ]
Only call the xfarray and xfblob destructor if we have a valid pointer,
and be sure to null out that pointer afterwards. Note that this patch
fixes a large number of commits, most of which were merged between 6.9
and 6.10.
Cc: r772577952@gmail.com
Cc: <stable@vger.kernel.org> # v6.12
Fixes: ab97f4b1c03075 ("xfs: repair AGI unlinked inode bucket lists")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 8 ++++++--
fs/xfs/scrub/attr_repair.c | 6 ++++--
fs/xfs/scrub/dir_repair.c | 8 ++++++--
fs/xfs/scrub/dirtree.c | 8 ++++++--
fs/xfs/scrub/nlinks.c | 3 ++-
5 files changed, 24 insertions(+), 9 deletions(-)
--git a/fs/xfs/scrub/agheader_repair.c b/fs/xfs/scrub/agheader_repair.c
index a2f6a7f71d839..6e3fef36d6614 100644
--- a/fs/xfs/scrub/agheader_repair.c
+++ b/fs/xfs/scrub/agheader_repair.c
@@ -837,8 +837,12 @@ xrep_agi_buf_cleanup(
{
struct xrep_agi *ragi = buf;
- xfarray_destroy(ragi->iunlink_prev);
- xfarray_destroy(ragi->iunlink_next);
+ if (ragi->iunlink_prev)
+ xfarray_destroy(ragi->iunlink_prev);
+ ragi->iunlink_prev = NULL;
+ if (ragi->iunlink_next)
+ xfarray_destroy(ragi->iunlink_next);
+ ragi->iunlink_next = NULL;
xagino_bitmap_destroy(&ragi->iunlink_bmp);
}
diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c
index eded354dec11e..dd24044c44efd 100644
--- a/fs/xfs/scrub/attr_repair.c
+++ b/fs/xfs/scrub/attr_repair.c
@@ -1516,8 +1516,10 @@ xrep_xattr_teardown(
xfblob_destroy(rx->pptr_names);
if (rx->pptr_recs)
xfarray_destroy(rx->pptr_recs);
- xfblob_destroy(rx->xattr_blobs);
- xfarray_destroy(rx->xattr_records);
+ if (rx->xattr_blobs)
+ xfblob_destroy(rx->xattr_blobs);
+ if (rx->xattr_records)
+ xfarray_destroy(rx->xattr_records);
mutex_destroy(&rx->lock);
kfree(rx);
}
diff --git a/fs/xfs/scrub/dir_repair.c b/fs/xfs/scrub/dir_repair.c
index 7a21b688a4715..d5a55eabf6801 100644
--- a/fs/xfs/scrub/dir_repair.c
+++ b/fs/xfs/scrub/dir_repair.c
@@ -172,8 +172,12 @@ xrep_dir_teardown(
struct xrep_dir *rd = sc->buf;
xrep_findparent_scan_teardown(&rd->pscan);
- xfblob_destroy(rd->dir_names);
- xfarray_destroy(rd->dir_entries);
+ if (rd->dir_names)
+ xfblob_destroy(rd->dir_names);
+ rd->dir_names = NULL;
+ if (rd->dir_entries)
+ xfarray_destroy(rd->dir_entries);
+ rd->dir_names = NULL;
}
/* Set up for a directory repair. */
diff --git a/fs/xfs/scrub/dirtree.c b/fs/xfs/scrub/dirtree.c
index f9c85b8b194fa..3e0bbe75c44cf 100644
--- a/fs/xfs/scrub/dirtree.c
+++ b/fs/xfs/scrub/dirtree.c
@@ -81,8 +81,12 @@ xchk_dirtree_buf_cleanup(
kfree(path);
}
- xfblob_destroy(dl->path_names);
- xfarray_destroy(dl->path_steps);
+ if (dl->path_names)
+ xfblob_destroy(dl->path_names);
+ dl->path_names = NULL;
+ if (dl->path_steps)
+ xfarray_destroy(dl->path_steps);
+ dl->path_steps = NULL;
mutex_destroy(&dl->lock);
}
diff --git a/fs/xfs/scrub/nlinks.c b/fs/xfs/scrub/nlinks.c
index 2ba686e4de8bc..dec3b9b47453e 100644
--- a/fs/xfs/scrub/nlinks.c
+++ b/fs/xfs/scrub/nlinks.c
@@ -971,7 +971,8 @@ xchk_nlinks_teardown_scan(
xfs_dir_hook_del(xnc->sc->mp, &xnc->dhook);
- xfarray_destroy(xnc->nlinks);
+ if (xnc->nlinks)
+ xfarray_destroy(xnc->nlinks);
xnc->nlinks = NULL;
xchk_iscan_teardown(&xnc->collect_iscan);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 689/844] xfs: only call xf{array,blob}_destroy if we have a valid pointer
2026-02-28 17:30 ` [PATCH 6.19 689/844] xfs: only call xf{array,blob}_destroy if we have a valid pointer Sasha Levin
@ 2026-03-02 7:06 ` Jiri Slaby
2026-03-02 14:03 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Jiri Slaby @ 2026-03-02 7:06 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Darrick J. Wong, r772577952, Christoph Hellwig
On 28. 02. 26, 18:30, Sasha Levin wrote:
> From: "Darrick J. Wong" <djwong@kernel.org>
>
> [ Upstream commit ba408d299a3bb3c5309f40c5326e4fb83ead4247 ]
...
> --- a/fs/xfs/scrub/dir_repair.c
> +++ b/fs/xfs/scrub/dir_repair.c
> @@ -172,8 +172,12 @@ xrep_dir_teardown(
> struct xrep_dir *rd = sc->buf;
>
> xrep_findparent_scan_teardown(&rd->pscan);
> - xfblob_destroy(rd->dir_names);
> - xfarray_destroy(rd->dir_entries);
> + if (rd->dir_names)
> + xfblob_destroy(rd->dir_names);
> + rd->dir_names = NULL;
> + if (rd->dir_entries)
> + xfarray_destroy(rd->dir_entries);
> + rd->dir_names = NULL;
This cut&paste error is fixed by:
e764dd439d68 xfs: fix copy-paste error in previous fix
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 689/844] xfs: only call xf{array,blob}_destroy if we have a valid pointer
2026-03-02 7:06 ` Jiri Slaby
@ 2026-03-02 14:03 ` Sasha Levin
0 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-03-02 14:03 UTC (permalink / raw)
To: Jiri Slaby
Cc: linux-kernel, stable, Darrick J. Wong, r772577952,
Christoph Hellwig
On Mon, Mar 02, 2026 at 08:06:04AM +0100, Jiri Slaby wrote:
>On 28. 02. 26, 18:30, Sasha Levin wrote:
>>From: "Darrick J. Wong" <djwong@kernel.org>
>>
>>[ Upstream commit ba408d299a3bb3c5309f40c5326e4fb83ead4247 ]
>...
>>--- a/fs/xfs/scrub/dir_repair.c
>>+++ b/fs/xfs/scrub/dir_repair.c
>>@@ -172,8 +172,12 @@ xrep_dir_teardown(
>> struct xrep_dir *rd = sc->buf;
>> xrep_findparent_scan_teardown(&rd->pscan);
>>- xfblob_destroy(rd->dir_names);
>>- xfarray_destroy(rd->dir_entries);
>>+ if (rd->dir_names)
>>+ xfblob_destroy(rd->dir_names);
>>+ rd->dir_names = NULL;
>>+ if (rd->dir_entries)
>>+ xfarray_destroy(rd->dir_entries);
>>+ rd->dir_names = NULL;
>
>This cut&paste error is fixed by:
>e764dd439d68 xfs: fix copy-paste error in previous fix
Queued up, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* [PATCH 6.19 690/844] xfs: check return value of xchk_scrub_create_subord
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (688 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 689/844] xfs: only call xf{array,blob}_destroy if we have a valid pointer Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 691/844] xfs: check for deleted cursors when revalidating two btrees Sasha Levin
` (162 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Darrick J. Wong, r772577952, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit ca27313fb3f23e4ac18532ede4ec1c7cc5814c4a ]
Fix this function to return NULL instead of a mangled ENOMEM, then fix
the callers to actually check for a null pointer and return ENOMEM.
Most of the corrections here are for code merged between 6.2 and 6.10.
Cc: r772577952@gmail.com
Cc: <stable@vger.kernel.org> # v6.12
Fixes: 1a5f6e08d4e379 ("xfs: create subordinate scrub contexts for xchk_metadata_inode_subtype")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/common.c | 3 +++
fs/xfs/scrub/repair.c | 3 +++
fs/xfs/scrub/scrub.c | 2 +-
3 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c
index 5f9be4151d722..ebabf3b620a2c 100644
--- a/fs/xfs/scrub/common.c
+++ b/fs/xfs/scrub/common.c
@@ -1399,6 +1399,9 @@ xchk_metadata_inode_subtype(
int error;
sub = xchk_scrub_create_subord(sc, scrub_type);
+ if (!sub)
+ return -ENOMEM;
+
error = sub->sc.ops->scrub(&sub->sc);
xchk_scrub_free_subord(sub);
return error;
diff --git a/fs/xfs/scrub/repair.c b/fs/xfs/scrub/repair.c
index efd5a7ccdf624..4d45d39e67f11 100644
--- a/fs/xfs/scrub/repair.c
+++ b/fs/xfs/scrub/repair.c
@@ -1136,6 +1136,9 @@ xrep_metadata_inode_subtype(
* setup/teardown routines.
*/
sub = xchk_scrub_create_subord(sc, scrub_type);
+ if (!sub)
+ return -ENOMEM;
+
error = sub->sc.ops->scrub(&sub->sc);
if (error)
goto out;
diff --git a/fs/xfs/scrub/scrub.c b/fs/xfs/scrub/scrub.c
index 3c3b0d25006ff..c312f0a672e65 100644
--- a/fs/xfs/scrub/scrub.c
+++ b/fs/xfs/scrub/scrub.c
@@ -634,7 +634,7 @@ xchk_scrub_create_subord(
sub = kzalloc(sizeof(*sub), XCHK_GFP_FLAGS);
if (!sub)
- return ERR_PTR(-ENOMEM);
+ return NULL;
sub->old_smtype = sc->sm->sm_type;
sub->old_smflags = sc->sm->sm_flags;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 691/844] xfs: check for deleted cursors when revalidating two btrees
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (689 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 690/844] xfs: check return value of xchk_scrub_create_subord Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 692/844] md/bitmap: fix GPF in write_page caused by resize race Sasha Levin
` (161 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Darrick J. Wong, r772577952, Christoph Hellwig, Sasha Levin
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit 55e03b8cbe2783ec9acfb88e8adb946ed504e117 ]
The free space and inode btree repair functions will rebuild both btrees
at the same time, after which it needs to evaluate both btrees to
confirm that the corruptions are gone.
However, Jiaming Zhang ran syzbot and produced a crash in the second
xchk_allocbt call. His root-cause analysis is as follows (with minor
corrections):
In xrep_revalidate_allocbt(), xchk_allocbt() is called twice (first
for BNOBT, second for CNTBT). The cause of this issue is that the
first call nullified the cursor required by the second call.
Let's first enter xrep_revalidate_allocbt() via following call chain:
xfs_file_ioctl() ->
xfs_ioc_scrubv_metadata() ->
xfs_scrub_metadata() ->
`sc->ops->repair_eval(sc)` ->
xrep_revalidate_allocbt()
xchk_allocbt() is called twice in this function. In the first call:
/* Note that sc->sm->sm_type is XFS_SCRUB_TYPE_BNOPT now */
xchk_allocbt() ->
xchk_btree() ->
`bs->scrub_rec(bs, recp)` ->
xchk_allocbt_rec() ->
xchk_allocbt_xref() ->
xchk_allocbt_xref_other()
since sm_type is XFS_SCRUB_TYPE_BNOBT, pur is set to &sc->sa.cnt_cur.
Kernel called xfs_alloc_get_rec() and returned -EFSCORRUPTED. Call
chain:
xfs_alloc_get_rec() ->
xfs_btree_get_rec() ->
xfs_btree_check_block() ->
(XFS_IS_CORRUPT || XFS_TEST_ERROR), the former is false and the latter
is true, return -EFSCORRUPTED. This should be caused by
ioctl$XFS_IOC_ERROR_INJECTION I guess.
Back to xchk_allocbt_xref_other(), after receiving -EFSCORRUPTED from
xfs_alloc_get_rec(), kernel called xchk_should_check_xref(). In this
function, *curpp (points to sc->sa.cnt_cur) is nullified.
Back to xrep_revalidate_allocbt(), since sc->sa.cnt_cur has been
nullified, it then triggered null-ptr-deref via xchk_allocbt() (second
call) -> xchk_btree().
So. The bnobt revalidation failed on a cross-reference attempt, so we
deleted the cntbt cursor, and then crashed when we tried to revalidate
the cntbt. Therefore, check for a null cntbt cursor before that
revalidation, and mark the repair incomplete. Also we can ignore the
second tree entirely if the first tree was rebuilt but is already
corrupt.
Apply the same fix to xrep_revalidate_iallocbt because it has the same
problem.
Cc: r772577952@gmail.com
Link: https://lore.kernel.org/linux-xfs/CANypQFYU5rRPkTy=iG5m1Lp4RWasSgrHXAh3p8YJojxV0X15dQ@mail.gmail.com/T/#m520c7835fad637eccf843c7936c200589427cc7e
Cc: <stable@vger.kernel.org> # v6.8
Fixes: dbfbf3bdf639a2 ("xfs: repair inode btrees")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/scrub/alloc_repair.c | 15 +++++++++++++++
fs/xfs/scrub/ialloc_repair.c | 20 +++++++++++++++++---
2 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/fs/xfs/scrub/alloc_repair.c b/fs/xfs/scrub/alloc_repair.c
index b6fe1f23819eb..35035d02a2316 100644
--- a/fs/xfs/scrub/alloc_repair.c
+++ b/fs/xfs/scrub/alloc_repair.c
@@ -923,7 +923,22 @@ xrep_revalidate_allocbt(
if (error)
goto out;
+ /*
+ * If the bnobt is still corrupt, we've failed to repair the filesystem
+ * and should just bail out.
+ *
+ * If the bnobt fails cross-examination with the cntbt, the scan will
+ * free the cntbt cursor, so we need to mark the repair incomplete
+ * and avoid walking off the end of the NULL cntbt cursor.
+ */
+ if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+ goto out;
+
sc->sm->sm_type = XFS_SCRUB_TYPE_CNTBT;
+ if (!sc->sa.cnt_cur) {
+ xchk_set_incomplete(sc);
+ goto out;
+ }
error = xchk_allocbt(sc);
out:
sc->sm->sm_type = old_type;
diff --git a/fs/xfs/scrub/ialloc_repair.c b/fs/xfs/scrub/ialloc_repair.c
index b1d00167d263f..f28459f58832f 100644
--- a/fs/xfs/scrub/ialloc_repair.c
+++ b/fs/xfs/scrub/ialloc_repair.c
@@ -863,10 +863,24 @@ xrep_revalidate_iallocbt(
if (error)
goto out;
- if (xfs_has_finobt(sc->mp)) {
- sc->sm->sm_type = XFS_SCRUB_TYPE_FINOBT;
- error = xchk_iallocbt(sc);
+ /*
+ * If the inobt is still corrupt, we've failed to repair the filesystem
+ * and should just bail out.
+ *
+ * If the inobt fails cross-examination with the finobt, the scan will
+ * free the finobt cursor, so we need to mark the repair incomplete
+ * and avoid walking off the end of the NULL finobt cursor.
+ */
+ if (!xfs_has_finobt(sc->mp) ||
+ (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT))
+ goto out;
+
+ sc->sm->sm_type = XFS_SCRUB_TYPE_FINOBT;
+ if (!sc->sa.fino_cur) {
+ xchk_set_incomplete(sc);
+ goto out;
}
+ error = xchk_iallocbt(sc);
out:
sc->sm->sm_type = old_type;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 692/844] md/bitmap: fix GPF in write_page caused by resize race
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (690 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 691/844] xfs: check for deleted cursors when revalidating two btrees Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 693/844] nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg() Sasha Levin
` (160 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jack Wang, Yu Kuai, Sasha Levin
From: Jack Wang <jinpu.wang@ionos.com>
[ Upstream commit 46ef85f854dfa9d5226b3c1c46493d79556c9589 ]
A General Protection Fault occurs in write_page() during array resize:
RIP: 0010:write_page+0x22b/0x3c0 [md_mod]
This is a use-after-free race between bitmap_daemon_work() and
__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap`
without locking, while the resize path frees that storage via
md_bitmap_file_unmap(). `quiesce()` does not stop the md thread,
allowing concurrent access to freed pages.
Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.
Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com
Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u
Cc: stable@vger.kernel.org
Fixes: d60b479d177a ("md/bitmap: add bitmap_resize function to allow bitmap resizing.")
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 84b7e2af6dbaa..7bb56d0491a2f 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2453,6 +2453,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks,
memcpy(page_address(store.sb_page),
page_address(bitmap->storage.sb_page),
sizeof(bitmap_super_t));
+ mutex_lock(&bitmap->mddev->bitmap_info.mutex);
spin_lock_irq(&bitmap->counts.lock);
md_bitmap_file_unmap(&bitmap->storage);
bitmap->storage = store;
@@ -2560,7 +2561,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks,
set_page_attr(bitmap, i, BITMAP_PAGE_DIRTY);
}
spin_unlock_irq(&bitmap->counts.lock);
-
+ mutex_unlock(&bitmap->mddev->bitmap_info.mutex);
if (!init) {
__bitmap_unplug(bitmap);
bitmap->mddev->pers->quiesce(bitmap->mddev, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 693/844] nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (691 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 692/844] md/bitmap: fix GPF in write_page caused by resize race Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 694/844] NFSD: fix setting FMODE_NOCMTIME in nfs4_open_delegation Sasha Levin
` (159 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jeff Layton, Chris Mason, Chuck Lever, Sasha Levin
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 789477b849394afdb60507924d65f7ef18f078ce ]
Claude pointed out that there is a nfs4_file refcount leak in
nfsd_get_dir_deleg(). Ensure that the reference to "fp" is released
before returning.
Fixes: 8b99f6a8c116 ("nfsd: wire up GET_DIR_DELEGATION handling")
Cc: stable@vger.kernel.org
Cc: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4state.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index d5e0f3a52d4f0..45d486466cdc3 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -9520,8 +9520,10 @@ nfsd_get_dir_deleg(struct nfsd4_compound_state *cstate,
spin_unlock(&clp->cl_lock);
spin_unlock(&state_lock);
- if (!status)
+ if (!status) {
+ put_nfs4_file(fp);
return dp;
+ }
/* Something failed. Drop the lease and clean up the stid */
kernel_setlease(fp->fi_deleg_file->nf_file, F_UNLCK, NULL, (void **)&dp);
@@ -9529,5 +9531,6 @@ nfsd_get_dir_deleg(struct nfsd4_compound_state *cstate,
nfs4_put_stid(&dp->dl_stid);
out_delegees:
put_deleg_file(fp);
+ put_nfs4_file(fp);
return ERR_PTR(status);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 694/844] NFSD: fix setting FMODE_NOCMTIME in nfs4_open_delegation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (692 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 693/844] nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 695/844] nfsd: fix return error code for nfsd_map_name_to_[ug]id Sasha Levin
` (158 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Olga Kornievskaia, Jeff Layton, Chuck Lever, Sasha Levin
From: Olga Kornievskaia <okorniev@redhat.com>
[ Upstream commit 41b0a87bc60d5ccfa8575481ddb4d4d8758507fa ]
fstests generic/215 and generic/407 were failing because the server
wasn't updating mtime properly. When deleg attribute support is not
compiled in and thus no attribute delegation was given, the server
was skipping updating mtime and ctime because FMODE_NOCMTIME was
uncoditionally set for the write delegation.
Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation")
Cc: stable@vger.kernel.org
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4state.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 45d486466cdc3..c298ec2621ec9 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6353,7 +6353,8 @@ nfs4_open_delegation(struct svc_rqst *rqstp, struct nfsd4_open *open,
dp->dl_ctime = stat.ctime;
dp->dl_mtime = stat.mtime;
spin_lock(&f->f_lock);
- f->f_mode |= FMODE_NOCMTIME;
+ if (deleg_ts)
+ f->f_mode |= FMODE_NOCMTIME;
spin_unlock(&f->f_lock);
trace_nfsd_deleg_write(&dp->dl_stid.sc_stateid);
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 695/844] nfsd: fix return error code for nfsd_map_name_to_[ug]id
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (693 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 694/844] NFSD: fix setting FMODE_NOCMTIME in nfs4_open_delegation Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 696/844] nvmem: Drop OF node reference on nvmem_add_one_cell() failure Sasha Levin
` (157 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Anthony Iliopoulos, NeilBrown, Chuck Lever, Sasha Levin
From: Anthony Iliopoulos <ailiop@suse.com>
[ Upstream commit 404d779466646bf1461f2090ff137e99acaecf42 ]
idmap lookups can time out while the cache is waiting for a userspace
upcall reply. In that case cache_check() returns -ETIMEDOUT to callers.
The nfsd_map_name_to_[ug]id functions currently proceed with attempting
to map the id to a kuid despite a potentially temporary failure to
perform the idmap lookup. This results in the code returning the error
NFSERR_BADOWNER which can cause client operations to return to userspace
with failure.
Fix this by returning the failure status before attempting kuid mapping.
This will return NFSERR_JUKEBOX on idmap lookup timeout so that clients
can retry the operation instead of aborting it.
Fixes: 65e10f6d0ab0 ("nfsd: Convert idmap to use kuids and kgids")
Cc: stable@vger.kernel.org
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4idmap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
index b5b3d45979c9b..c319c31b0f647 100644
--- a/fs/nfsd/nfs4idmap.c
+++ b/fs/nfsd/nfs4idmap.c
@@ -672,6 +672,8 @@ __be32 nfsd_map_name_to_uid(struct svc_rqst *rqstp, const char *name,
return nfserr_inval;
status = do_name_to_id(rqstp, IDMAP_TYPE_USER, name, namelen, &id);
+ if (status)
+ return status;
*uid = make_kuid(nfsd_user_namespace(rqstp), id);
if (!uid_valid(*uid))
status = nfserr_badowner;
@@ -707,6 +709,8 @@ __be32 nfsd_map_name_to_gid(struct svc_rqst *rqstp, const char *name,
return nfserr_inval;
status = do_name_to_id(rqstp, IDMAP_TYPE_GROUP, name, namelen, &id);
+ if (status)
+ return status;
*gid = make_kgid(nfsd_user_namespace(rqstp), id);
if (!gid_valid(*gid))
status = nfserr_badowner;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 696/844] nvmem: Drop OF node reference on nvmem_add_one_cell() failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (694 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 695/844] nfsd: fix return error code for nfsd_map_name_to_[ug]id Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 697/844] PCI: Fix bridge window alignment with optional resources Sasha Levin
` (156 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Krzysztof Kozlowski, Srinivas Kandagatla, Greg Kroah-Hartman,
Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit f397bc0781553d01b4cdba506c09334a31cb0ec5 ]
If nvmem_add_one_cell() failed, the ownership of "child" (or "info.np"),
thus its OF reference, is not passed further and function should clean
up by putting the reference it got via earlier of_node_get(). Note that
this is independent of references obtained via for_each_child_of_node()
loop.
Fixes: 50014d659617 ("nvmem: core: use nvmem_add_one_cell() in nvmem_add_cells_from_of()")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://patch.msgid.link/20260116170846.733558-2-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvmem/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 387c88c552595..ff68fd5ad3d6f 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -831,6 +831,7 @@ static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_nod
kfree(info.name);
if (ret) {
of_node_put(child);
+ of_node_put(info.np);
return ret;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 697/844] PCI: Fix bridge window alignment with optional resources
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (695 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 696/844] nvmem: Drop OF node reference on nvmem_add_one_cell() failure Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 698/844] ima: verify the previous kernel's IMA buffer lies in addressable RAM Sasha Levin
` (155 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilpo Järvinen, Malte Schröder, Bjorn Helgaas,
Sasha Levin
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 7e90360e6d4599795b6f4e094e20d0bdf3b2615f ]
pbus_size_mem() has two alignments, one for required resources in min_align
and another in add_align that takes account optional resources.
The add_align is applied to the bridge window through the realloc_head
list. It can happen, however, that add_align is larger than min_align but
calculated size1 and size0 are equal due to extra tailroom (e.g., hotplug
reservation, tail alignment), and therefore no entry is created to the
realloc_head list. Without the bridge appearing in the realloc head,
add_align is lost when pbus_size_mem() returns.
The problem is visible in this log for 0000:05:00.0 which lacks
add_size ... add_align ... line that would indicate it was added into
the realloc_head list:
pci 0000:05:00.0: PCI bridge to [bus 06-16]
...
pci 0000:06:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus 07] requires relaxed alignment rules
pci 0000:06:06.0: bridge window [mem 0x00100000-0x001fffff] to [bus 0a] requires relaxed alignment rules
pci 0000:06:07.0: bridge window [mem 0x00100000-0x003fffff] to [bus 0b] requires relaxed alignment rules
pci 0000:06:08.0: bridge window [mem 0x00800000-0x00ffffff 64bit pref] to [bus 0c-14] requires relaxed alignment rules
pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] requires relaxed alignment rules
pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] requires relaxed alignment rules
pci 0000:06:08.0: bridge window [mem 0x01000000-0x057fffff] to [bus 0c-14] add_size 100000 add_align 1000000
pci 0000:06:0c.0: bridge window [mem 0x00100000-0x001fffff] to [bus 15] requires relaxed alignment rules
pci 0000:06:0d.0: bridge window [mem 0x00100000-0x001fffff] to [bus 16] requires relaxed alignment rules
pci 0000:06:0d.0: bridge window [mem 0x00100000-0x001fffff] to [bus 16] requires relaxed alignment rules
pci 0000:05:00.0: bridge window [mem 0xd4800000-0xd97fffff]: assigned
pci 0000:05:00.0: bridge window [mem 0x1060000000-0x10607fffff 64bit pref]: assigned
pci 0000:06:08.0: bridge window [mem size 0x04900000]: can't assign; no space
pci 0000:06:08.0: bridge window [mem size 0x04900000]: failed to assign
While this bug itself seems old, it has likely become more visible after
the relaxed tail alignment that does not grossly overestimate the size
needed for the bridge window.
Make sure add_align > min_align too results in adding an entry into the
realloc head list. In addition, add handling to the cases where add_size is
zero while only alignment differs.
Fixes: d74b9027a4da ("PCI: Consider additional PF's IOV BAR alignment in sizing and assigning")
Reported-by: Malte Schröder <malte+lkml@tnxip.de>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Malte Schröder <malte+lkml@tnxip.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251219174036.16738-2-ilpo.jarvinen@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/setup-bus.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 09a28cfcd5b88..ee8fe6e0de5fd 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -14,6 +14,7 @@
* tighter packing. Prefetchable range support.
*/
+#include <linux/align.h>
#include <linux/bitops.h>
#include <linux/bug.h>
#include <linux/init.h>
@@ -463,7 +464,7 @@ static void reassign_resources_sorted(struct list_head *realloc_head,
"%s %pR: ignoring failure in optional allocation\n",
res_name, res);
}
- } else if (add_size > 0) {
+ } else if (add_size > 0 || !IS_ALIGNED(res->start, align)) {
res->flags |= add_res->flags &
(IORESOURCE_STARTALIGN|IORESOURCE_SIZEALIGN);
if (pci_reassign_resource(dev, idx, add_size, align))
@@ -1392,12 +1393,13 @@ static void pbus_size_mem(struct pci_bus *bus, unsigned long type,
resource_set_range(b_res, min_align, size0);
b_res->flags |= IORESOURCE_STARTALIGN;
- if (bus->self && size1 > size0 && realloc_head) {
+ if (bus->self && realloc_head && (size1 > size0 || add_align > min_align)) {
b_res->flags &= ~IORESOURCE_DISABLED;
- add_to_list(realloc_head, bus->self, b_res, size1-size0, add_align);
+ add_size = size1 > size0 ? size1 - size0 : 0;
+ add_to_list(realloc_head, bus->self, b_res, add_size, add_align);
pci_info(bus->self, "bridge window %pR to %pR add_size %llx add_align %llx\n",
b_res, &bus->busn_res,
- (unsigned long long) (size1 - size0),
+ (unsigned long long) add_size,
(unsigned long long) add_align);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 698/844] ima: verify the previous kernel's IMA buffer lies in addressable RAM
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (696 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 697/844] PCI: Fix bridge window alignment with optional resources Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 699/844] of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() Sasha Levin
` (154 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Harshit Mogalapalli, Mimi Zohar, Alexander Graf, Ard Biesheuvel,
Borislav Betkov, guoweikang, Henry Willard, H. Peter Anvin,
Ingo Molnar, Jiri Bohac, Joel Granados, Jonathan McDowell,
Mike Rapoport, Paul Webb, Sohil Mehta, Sourabh Jain,
Thomas Gleinxer, Yifei Liu, Baoquan He, Andrew Morton,
Sasha Levin
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
[ Upstream commit 10d1c75ed4382a8e79874379caa2ead8952734f9 ]
Patch series "Address page fault in ima_restore_measurement_list()", v3.
When the second-stage kernel is booted via kexec with a limiting command
line such as "mem=<size>" we observe a pafe fault that happens.
BUG: unable to handle page fault for address: ffff97793ff47000
RIP: ima_restore_measurement_list+0xdc/0x45a
#PF: error_code(0x0000) not-present page
This happens on x86_64 only, as this is already fixed in aarch64 in
commit: cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer
against memory bounds")
This patch (of 3):
When the second-stage kernel is booted with a limiting command line (e.g.
"mem=<size>"), the IMA measurement buffer handed over from the previous
kernel may fall outside the addressable RAM of the new kernel. Accessing
such a buffer can fault during early restore.
Introduce a small generic helper, ima_validate_range(), which verifies
that a physical [start, end] range for the previous-kernel IMA buffer lies
within addressable memory:
- On x86, use pfn_range_is_mapped().
- On OF based architectures, use page_is_ram().
Link: https://lkml.kernel.org/r/20251231061609.907170-1-harshit.m.mogalapalli@oracle.com
Link: https://lkml.kernel.org/r/20251231061609.907170-2-harshit.m.mogalapalli@oracle.com
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Borislav Betkov <bp@alien8.de>
Cc: guoweikang <guoweikang.kernel@gmail.com>
Cc: Henry Willard <henry.willard@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Bohac <jbohac@suse.cz>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: Jonathan McDowell <noodles@fb.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Paul Webb <paul.x.webb@oracle.com>
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: Yifei Liu <yifei.l.liu@oracle.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ima.h | 1 +
security/integrity/ima/ima_kexec.c | 35 ++++++++++++++++++++++++++++++
2 files changed, 36 insertions(+)
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 8e29cb4e6a01d..abf8923f8fc51 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -69,6 +69,7 @@ static inline int ima_measure_critical_data(const char *event_label,
#ifdef CONFIG_HAVE_IMA_KEXEC
int __init ima_free_kexec_buffer(void);
int __init ima_get_kexec_buffer(void **addr, size_t *size);
+int ima_validate_range(phys_addr_t phys, size_t size);
#endif
#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
index 5beb69edd12fd..36a34c54de58b 100644
--- a/security/integrity/ima/ima_kexec.c
+++ b/security/integrity/ima/ima_kexec.c
@@ -12,6 +12,8 @@
#include <linux/kexec.h>
#include <linux/of.h>
#include <linux/ima.h>
+#include <linux/mm.h>
+#include <linux/overflow.h>
#include <linux/reboot.h>
#include <asm/page.h>
#include "ima.h"
@@ -294,3 +296,36 @@ void __init ima_load_kexec_buffer(void)
pr_debug("Error restoring the measurement list: %d\n", rc);
}
}
+
+/*
+ * ima_validate_range - verify a physical buffer lies in addressable RAM
+ * @phys: physical start address of the buffer from previous kernel
+ * @size: size of the buffer
+ *
+ * On success return 0. On failure returns -EINVAL so callers can skip
+ * restoring.
+ */
+int ima_validate_range(phys_addr_t phys, size_t size)
+{
+ unsigned long start_pfn, end_pfn;
+ phys_addr_t end_phys;
+
+ if (check_add_overflow(phys, (phys_addr_t)size - 1, &end_phys))
+ return -EINVAL;
+
+ start_pfn = PHYS_PFN(phys);
+ end_pfn = PHYS_PFN(end_phys);
+
+#ifdef CONFIG_X86
+ if (!pfn_range_is_mapped(start_pfn, end_pfn))
+#else
+ if (!page_is_ram(start_pfn) || !page_is_ram(end_pfn))
+#endif
+ {
+ pr_warn("IMA: previous kernel measurement buffer %pa (size 0x%zx) lies outside available memory\n",
+ &phys, size);
+ return -EINVAL;
+ }
+
+ return 0;
+}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 699/844] of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (697 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 698/844] ima: verify the previous kernel's IMA buffer lies in addressable RAM Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 700/844] x86/kexec: add a sanity check on previous kernel's ima kexec buffer Sasha Levin
` (153 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Harshit Mogalapalli, Mimi Zohar, Alexander Graf, Ard Biesheuvel,
Baoquan He, Borislav Betkov, guoweikang, Henry Willard,
H. Peter Anvin, Ingo Molnar, Jiri Bohac, Joel Granados,
Jonathan McDowell, Mike Rapoport, Paul Webb, Sohil Mehta,
Sourabh Jain, Thomas Gleinxer, Yifei Liu, Andrew Morton,
Sasha Levin
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
[ Upstream commit 4d02233235ed0450de9c10fcdcf3484e3c9401ce ]
Refactor the OF/DT ima_get_kexec_buffer() to use a generic helper to
validate the address range. No functional change intended.
Link: https://lkml.kernel.org/r/20251231061609.907170-3-harshit.m.mogalapalli@oracle.com
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Borislav Betkov <bp@alien8.de>
Cc: guoweikang <guoweikang.kernel@gmail.com>
Cc: Henry Willard <henry.willard@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Bohac <jbohac@suse.cz>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: Jonathan McDowell <noodles@fb.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Paul Webb <paul.x.webb@oracle.com>
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: Yifei Liu <yifei.l.liu@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/kexec.c | 15 +++------------
1 file changed, 3 insertions(+), 12 deletions(-)
diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
index 1ee2d31816aeb..c4cf3552c0183 100644
--- a/drivers/of/kexec.c
+++ b/drivers/of/kexec.c
@@ -128,7 +128,6 @@ int __init ima_get_kexec_buffer(void **addr, size_t *size)
{
int ret, len;
unsigned long tmp_addr;
- unsigned long start_pfn, end_pfn;
size_t tmp_size;
const void *prop;
@@ -144,17 +143,9 @@ int __init ima_get_kexec_buffer(void **addr, size_t *size)
if (!tmp_size)
return -ENOENT;
- /*
- * Calculate the PFNs for the buffer and ensure
- * they are with in addressable memory.
- */
- start_pfn = PHYS_PFN(tmp_addr);
- end_pfn = PHYS_PFN(tmp_addr + tmp_size - 1);
- if (!page_is_ram(start_pfn) || !page_is_ram(end_pfn)) {
- pr_warn("IMA buffer at 0x%lx, size = 0x%zx beyond memory\n",
- tmp_addr, tmp_size);
- return -EINVAL;
- }
+ ret = ima_validate_range(tmp_addr, tmp_size);
+ if (ret)
+ return ret;
*addr = __va(tmp_addr);
*size = tmp_size;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 700/844] x86/kexec: add a sanity check on previous kernel's ima kexec buffer
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (698 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 699/844] of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 701/844] mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node Sasha Levin
` (152 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Harshit Mogalapalli, Paul Webb, Mimi Zohar, Alexander Graf,
Ard Biesheuvel, Baoquan He, Borislav Betkov, guoweikang,
Henry Willard, H. Peter Anvin, Ingo Molnar, Jiri Bohac,
Joel Granados, Jonathan McDowell, Mike Rapoport, Sohil Mehta,
Sourabh Jain, Thomas Gleinxer, Yifei Liu, Andrew Morton,
Sasha Levin
From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
[ Upstream commit c5489d04337b47e93c0623e8145fcba3f5739efd ]
When the second-stage kernel is booted via kexec with a limiting command
line such as "mem=<size>", the physical range that contains the carried
over IMA measurement list may fall outside the truncated RAM leading to a
kernel panic.
BUG: unable to handle page fault for address: ffff97793ff47000
RIP: ima_restore_measurement_list+0xdc/0x45a
#PF: error_code(0x0000) – not-present page
Other architectures already validate the range with page_is_ram(), as done
in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer
against memory bounds") do a similar check on x86.
Without carrying the measurement list across kexec, the attestation
would fail.
Link: https://lkml.kernel.org/r/20251231061609.907170-4-harshit.m.mogalapalli@oracle.com
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
Reported-by: Paul Webb <paul.x.webb@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Borislav Betkov <bp@alien8.de>
Cc: guoweikang <guoweikang.kernel@gmail.com>
Cc: Henry Willard <henry.willard@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Bohac <jbohac@suse.cz>
Cc: Joel Granados <joel.granados@kernel.org>
Cc: Jonathan McDowell <noodles@fb.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: Yifei Liu <yifei.l.liu@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/setup.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 1b2edd07a3e17..383d4a4784f5b 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -439,9 +439,15 @@ int __init ima_free_kexec_buffer(void)
int __init ima_get_kexec_buffer(void **addr, size_t *size)
{
+ int ret;
+
if (!ima_kexec_buffer_size)
return -ENOENT;
+ ret = ima_validate_range(ima_kexec_buffer_phys, ima_kexec_buffer_size);
+ if (ret)
+ return ret;
+
*addr = __va(ima_kexec_buffer_phys);
*size = ima_kexec_buffer_size;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 701/844] mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (699 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 700/844] x86/kexec: add a sanity check on previous kernel's ima kexec buffer Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 702/844] usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN Sasha Levin
` (151 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Deepanshu Kartikey, syzbot+d8d4c31d40f868eaea30, Uladzislau Rezki,
Hillf Danton, Andrew Morton, Sasha Levin
From: Deepanshu Kartikey <kartikey406@gmail.com>
[ Upstream commit 5747435e0fd474c24530ef1a6822f47e7d264b27 ]
When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during
vmalloc cleanup triggers expensive stack unwinding that acquires RCU read
locks. Processing a large purge_list without rescheduling can cause the
task to hold CPU for extended periods (10+ seconds), leading to RCU stalls
and potential OOM conditions.
The issue manifests in purge_vmap_node() -> kasan_release_vmalloc_node()
where iterating through hundreds or thousands of vmap_area entries and
freeing their associated shadow pages causes:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l
...
task:kworker/0:17 state:R running task stack:28840 pid:6229
...
kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299
purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299
Each call to kasan_release_vmalloc() can free many pages, and with
page_owner tracking, each free triggers save_stack() which performs stack
unwinding under RCU read lock. Without yielding, this creates an
unbounded RCU critical section.
Add periodic cond_resched() calls within the loop to allow:
- RCU grace periods to complete
- Other tasks to run
- Scheduler to preempt when needed
The fix uses need_resched() for immediate response under load, with a
batch count of 32 as a guaranteed upper bound to prevent worst-case stalls
even under light load.
Link: https://lkml.kernel.org/r/20260112103612.627247-1-kartikey406@gmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reported-by: syzbot+d8d4c31d40f868eaea30@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d8d4c31d40f868eaea30
Link: https://lore.kernel.org/all/20260112084723.622910-1-kartikey406@gmail.com/T/ [v1]
Suggested-by: Uladzislau Rezki <urezki@gmail.com>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Hillf Danton <hdanton@sina.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/vmalloc.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index e286c2d2068cb..ea24ee957605e 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2268,11 +2268,14 @@ decay_va_pool_node(struct vmap_node *vn, bool full_decay)
reclaim_list_global(&decay_list);
}
+#define KASAN_RELEASE_BATCH_SIZE 32
+
static void
kasan_release_vmalloc_node(struct vmap_node *vn)
{
struct vmap_area *va;
unsigned long start, end;
+ unsigned int batch_count = 0;
start = list_first_entry(&vn->purge_list, struct vmap_area, list)->va_start;
end = list_last_entry(&vn->purge_list, struct vmap_area, list)->va_end;
@@ -2282,6 +2285,11 @@ kasan_release_vmalloc_node(struct vmap_node *vn)
kasan_release_vmalloc(va->va_start, va->va_end,
va->va_start, va->va_end,
KASAN_VMALLOC_PAGE_RANGE);
+
+ if (need_resched() || (++batch_count >= KASAN_RELEASE_BATCH_SIZE)) {
+ cond_resched();
+ batch_count = 0;
+ }
}
kasan_release_vmalloc(start, end, start, end, KASAN_VMALLOC_TLB_FLUSH);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 702/844] usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (700 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 701/844] mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 703/844] mm/slab: add rcu_barrier() to kvfree_rcu_barrier_on_cache() Sasha Levin
` (150 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Haotien Hsu, stable, Wayne Chang, Greg Kroah-Hartman, Sasha Levin
From: Haotien Hsu <haotienh@nvidia.com>
[ Upstream commit 1132e90840abf3e7db11f1d28199e9fbc0b0e69e ]
The COREPLL_PWRDN bit in the BLCG register must be set when the XUSB
device controller is powergated and cleared when it is unpowergated.
If this bit is not explicitly controlled, the core PLL may remain in an
incorrect power state across suspend/resume or ELPG transitions.
Therefore, update the driver to explicitly control this bit during
powergate transitions.
Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller")
Cc: stable <stable@kernel.org>
Signed-off-by: Haotien Hsu <haotienh@nvidia.com>
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Link: https://patch.msgid.link/20260123173121.4093902-1-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/tegra-xudc.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
index 9d2007f448c04..7f7251c10e952 100644
--- a/drivers/usb/gadget/udc/tegra-xudc.c
+++ b/drivers/usb/gadget/udc/tegra-xudc.c
@@ -3392,17 +3392,18 @@ static void tegra_xudc_device_params_init(struct tegra_xudc *xudc)
{
u32 val, imod;
+ val = xudc_readl(xudc, BLCG);
if (xudc->soc->has_ipfs) {
- val = xudc_readl(xudc, BLCG);
val |= BLCG_ALL;
val &= ~(BLCG_DFPCI | BLCG_UFPCI | BLCG_FE |
BLCG_COREPLL_PWRDN);
val |= BLCG_IOPLL_0_PWRDN;
val |= BLCG_IOPLL_1_PWRDN;
val |= BLCG_IOPLL_2_PWRDN;
-
- xudc_writel(xudc, val, BLCG);
+ } else {
+ val &= ~BLCG_COREPLL_PWRDN;
}
+ xudc_writel(xudc, val, BLCG);
if (xudc->soc->port_speed_quirk)
tegra_xudc_limit_port_speed(xudc);
@@ -3953,6 +3954,7 @@ static void tegra_xudc_remove(struct platform_device *pdev)
static int __maybe_unused tegra_xudc_powergate(struct tegra_xudc *xudc)
{
unsigned long flags;
+ u32 val;
dev_dbg(xudc->dev, "entering ELPG\n");
@@ -3965,6 +3967,10 @@ static int __maybe_unused tegra_xudc_powergate(struct tegra_xudc *xudc)
spin_unlock_irqrestore(&xudc->lock, flags);
+ val = xudc_readl(xudc, BLCG);
+ val |= BLCG_COREPLL_PWRDN;
+ xudc_writel(xudc, val, BLCG);
+
clk_bulk_disable_unprepare(xudc->soc->num_clks, xudc->clks);
regulator_bulk_disable(xudc->soc->num_supplies, xudc->supplies);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 703/844] mm/slab: add rcu_barrier() to kvfree_rcu_barrier_on_cache()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (701 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 702/844] usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 704/844] io_uring/net: don't continue send bundle if poll was required for retry Sasha Levin
` (149 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vlastimil Babka, kernel test robot, Harry Yoo, Suren Baghdasaryan,
Liam R. Howlett, Sasha Levin
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit b55b423e8518361124ff0a9e15df431b3682ee4f ]
After we submit the rcu_free sheaves to call_rcu() we need to make sure
the rcu callbacks complete. kvfree_rcu_barrier() does that via
flush_all_rcu_sheaves() but kvfree_rcu_barrier_on_cache() doesn't. Fix
that.
This currently causes no issues because the caches with sheaves we have
are never destroyed. The problem flagged by kernel test robot was
reported for a patch that enables sheaves for (almost) all caches, and
occurred only with CONFIG_KASAN. Harry Yoo found the root cause [1]:
It turns out the object freed by sheaf_flush_unused() was in KASAN
percpu quarantine list (confirmed by dumping the list) by the time
__kmem_cache_shutdown() returns an error.
Quarantined objects are supposed to be flushed by kasan_cache_shutdown(),
but things go wrong if the rcu callback (rcu_free_sheaf_nobarn()) is
processed after kasan_cache_shutdown() finishes.
That's why rcu_barrier() in __kmem_cache_shutdown() didn't help,
because it's called after kasan_cache_shutdown().
Calling rcu_barrier() in kvfree_rcu_barrier_on_cache() guarantees
that it'll be added to the quarantine list before kasan_cache_shutdown()
is called. So it's a valid fix!
[1] https://lore.kernel.org/all/aWd6f3jERlrB5yeF@hyeyoo/
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202601121442.c530bed3-lkp@intel.com
Fixes: 0f35040de593 ("mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction")
Cc: stable@vger.kernel.org
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Tested-by: Harry Yoo <harry.yoo@oracle.com>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slab_common.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/slab_common.c b/mm/slab_common.c
index eed7ea556cb1a..ee994ec7f251e 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -2133,8 +2133,11 @@ EXPORT_SYMBOL_GPL(kvfree_rcu_barrier);
*/
void kvfree_rcu_barrier_on_cache(struct kmem_cache *s)
{
- if (s->cpu_sheaves)
+ if (s->cpu_sheaves) {
flush_rcu_sheaves_on_cache(s);
+ rcu_barrier();
+ }
+
/*
* TODO: Introduce a version of __kvfree_rcu_barrier() that works
* on a specific slab cache.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 704/844] io_uring/net: don't continue send bundle if poll was required for retry
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (702 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 703/844] mm/slab: add rcu_barrier() to kvfree_rcu_barrier_on_cache() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 705/844] bus: fsl-mc: fix an error handling in fsl_mc_device_add() Sasha Levin
` (148 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jens Axboe, Sasha Levin
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit 806ae939c41e5da1d94a1e2b31f5702e96b6c3e3 ]
If a send bundle has picked a bunch of buffers, then it needs to send
all of those to be complete. This may require poll arming, if the send
buffer ends up being full. Once a send bundle has been poll armed, no
further bundles should be attempted.
This allows a current bundle to complete even though it needs to go
through polling to do so, but it will not allow another bundle to be
started once that has happened. Ideally we would abort a bundle if it
was only partially sent, but as some parts of it already went out on the
wire, this obviously isn't feasible. Not continuing more bundle attempts
post encountering a full socket buffer is the second best thing.
Cc: stable@vger.kernel.org
Fixes: a05d1f625c7a ("io_uring/net: support bundles for send")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/net.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/io_uring/net.c b/io_uring/net.c
index 519ea055b7619..d9a4b83804a25 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -515,7 +515,11 @@ static inline bool io_send_finish(struct io_kiocb *req,
cflags = io_put_kbufs(req, sel->val, sel->buf_list, io_bundle_nbufs(kmsg, sel->val));
- if (bundle_finished || req->flags & REQ_F_BL_EMPTY)
+ /*
+ * Don't start new bundles if the buffer list is empty, or if the
+ * current operation needed to go through polling to complete.
+ */
+ if (bundle_finished || req->flags & (REQ_F_BL_EMPTY | REQ_F_POLLED))
goto finish;
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 705/844] bus: fsl-mc: fix an error handling in fsl_mc_device_add()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (703 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 704/844] io_uring/net: don't continue send bundle if poll was required for retry Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 706/844] dm mpath: Add missing dm_put_device when failing to get scsi dh name Sasha Levin
` (147 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Haoxiang Li, Dan Carpenter, Su Hui, Christophe Leroy (CS GROUP),
Ioana Ciornei, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 52f527d0916bcdd7621a0c9e7e599b133294d495 ]
In fsl_mc_device_add(), device_initialize() is called first.
put_device() should be called to drop the reference if error
occurs. And other resources would be released via put_device
-> fsl_mc_device_release. So remove redundant kfree() in
error handling path.
Fixes: bbf9d17d9875 ("staging: fsl-mc: Freescale Management Complex (fsl-mc) bus driver")
Cc: stable@vger.kernel.org
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/b767348e-d89c-416e-acea-1ebbff3bea20@stanley.mountain/
Signed-off-by: Su Hui <suhui@nfschina.com>
Suggested-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://lore.kernel.org/r/20260124102054.1613093-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index a97baf2cbcdd5..eb7b6c0ba9e7c 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -909,11 +909,7 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc,
return 0;
error_cleanup_dev:
- kfree(mc_dev->regions);
- if (mc_bus)
- kfree(mc_bus);
- else
- kfree(mc_dev);
+ put_device(&mc_dev->dev);
return error;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 706/844] dm mpath: Add missing dm_put_device when failing to get scsi dh name
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (704 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 705/844] bus: fsl-mc: fix an error handling in fsl_mc_device_add() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 707/844] dm mpath: make pg_init_delay_msecs settable Sasha Levin
` (146 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Benjamin Marzinski, Mikulas Patocka, Sasha Levin
From: Benjamin Marzinski <bmarzins@redhat.com>
[ Upstream commit 787bd63ee661b0148ce8e1fde92b7afddd85c446 ]
When commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in
scsi_dh_attached_handler_name()") added code to fail parsing the path if
scsi_dh_attached_handler_name() failed with -ENOMEM, it didn't clean up
the reference to the path device that had just been taken. Fix this, and
steamline the error paths of parse_path() a little.
Fixes: fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-mpath.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index d5d6ef7ba8381..b739894f01807 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -960,27 +960,27 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
attached_handler_name = NULL;
} else {
r = PTR_ERR(attached_handler_name);
- goto bad;
+ ti->error = "error allocating handler name";
+ goto bad_put_device;
}
}
if (attached_handler_name || m->hw_handler_name) {
INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
r = setup_scsi_dh(p->path.dev->bdev, m, &attached_handler_name, &ti->error);
kfree(attached_handler_name);
- if (r) {
- dm_put_device(ti, p->path.dev);
- goto bad;
- }
+ if (r)
+ goto bad_put_device;
}
r = ps->type->add_path(ps, &p->path, as->argc, as->argv, &ti->error);
- if (r) {
- dm_put_device(ti, p->path.dev);
- goto bad;
- }
+ if (r)
+ goto bad_put_device;
return p;
- bad:
+
+bad_put_device:
+ dm_put_device(ti, p->path.dev);
+bad:
free_pgpath(p);
return ERR_PTR(r);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 707/844] dm mpath: make pg_init_delay_msecs settable
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (705 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 706/844] dm mpath: Add missing dm_put_device when failing to get scsi dh name Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 708/844] arm64: poe: fix stale POR_EL0 values for ptrace Sasha Levin
` (145 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Benjamin Marzinski, Sasha Levin
From: Benjamin Marzinski <bmarzins@redhat.com>
[ Upstream commit 218b16992a37ea97b9e09b7659a25a864fb9976f ]
"pg_init_delay_msecs X" can be passed as a feature in the multipath
table and is used to set m->pg_init_delay_msecs in parse_features().
However, alloc_multipath_stage2(), which is called after
parse_features(), resets m->pg_init_delay_msecs to its default value.
Instead, set m->pg_init_delay_msecs in alloc_multipath(), which is
called before parse_features(), to avoid overwriting a value passed in
by the table.
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-mpath.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index b739894f01807..aa9a88a9aa768 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -225,6 +225,7 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
mutex_init(&m->work_mutex);
m->queue_mode = DM_TYPE_NONE;
+ m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
m->ti = ti;
ti->private = m;
@@ -251,7 +252,6 @@ static int alloc_multipath_stage2(struct dm_target *ti, struct multipath *m)
set_bit(MPATHF_QUEUE_IO, &m->flags);
atomic_set(&m->pg_init_in_progress, 0);
atomic_set(&m->pg_init_count, 0);
- m->pg_init_delay_msecs = DM_PG_INIT_DELAY_DEFAULT;
init_waitqueue_head(&m->pg_init_wait);
init_waitqueue_head(&m->probe_wait);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 708/844] arm64: poe: fix stale POR_EL0 values for ptrace
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (706 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 707/844] dm mpath: make pg_init_delay_msecs settable Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 709/844] tools: Fix bitfield dependency failure Sasha Levin
` (144 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Joey Gouly, David Spickett, Kevin Brodsky, Mark Rutland,
Will Deacon, Sasha Levin
From: Joey Gouly <joey.gouly@arm.com>
[ Upstream commit 1f3b950492db411e6c30ee0076b61ef2694c100a ]
If a process wrote to POR_EL0 and then crashed before a context switch
happened, the coredump would contain an incorrect value for POR_EL0.
The value read in poe_get() would be a stale value left in thread.por_el0. Fix
this by reading the value from the system register, if the target thread is the
current thread.
This matches what gcs/fpsimd do.
Fixes: 175198199262 ("arm64/ptrace: add support for FEAT_POE")
Reported-by: David Spickett <david.spickett@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Joey Gouly <joey.gouly@arm.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/ptrace.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 6c5ff6807d4cc..64ff87f023113 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1484,6 +1484,9 @@ static int poe_get(struct task_struct *target,
if (!system_supports_poe())
return -EINVAL;
+ if (target == current)
+ current->thread.por_el0 = read_sysreg_s(SYS_POR_EL0);
+
return membuf_write(&to, &target->thread.por_el0,
sizeof(target->thread.por_el0));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 709/844] tools: Fix bitfield dependency failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (707 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 708/844] arm64: poe: fix stale POR_EL0 values for ptrace Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 710/844] vhost: move vdpa group bound check to vhost_vdpa Sasha Levin
` (143 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Leo Yan, Hamza Mahfooz, Thomas Voegtle, Greg Kroah-Hartman,
Ian Rogers, James Clark, Namhyung Kim, Arnaldo Carvalho de Melo,
Sasha Levin
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit a537c0da168a08b0b6a7f7bd9e75f4cc8d45ff57 ]
A perf build failure was reported by Thomas Voegtle on stable kernel
v6.6.120:
CC tests/sample-parsing.o
CC util/intel-pt-decoder/intel-pt-pkt-decoder.o
CC util/perf-regs-arch/perf_regs_csky.o
CC util/arm-spe-decoder/arm-spe-pkt-decoder.o
CC util/perf-regs-arch/perf_regs_loongarch.o
In file included from util/arm-spe-decoder/arm-spe-pkt-decoder.h:10,
from util/arm-spe-decoder/arm-spe-pkt-decoder.c:14:
/local/git/linux-stable-rc/tools/include/linux/bitfield.h: In function ‘le16_encode_bits’:
/local/git/linux-stable-rc/tools/include/linux/bitfield.h:166:31: error: implicit declaration of
function ‘cpu_to_le16’; did you mean ‘htole16’? [-Werror=implicit-function-declaration]
____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \
^~~~~~~~~
/local/git/linux-stable-rc/tools/include/linux/bitfield.h:149:9: note: in definition of macro
‘____MAKE_OP’
return to((v & field_mask(field)) * field_multiplier(field)); \
^~
/local/git/linux-stable-rc/tools/include/linux/bitfield.h:170:1: note: in expansion of macro
‘__MAKE_OP’
__MAKE_OP(16)
Fix this by including linux/kernel.h, which provides the required
definitions.
The issue was not found on the mainline due to the relevant C files have
included kernel.h. It'd be good to merge this change on mainline
as well for robustness.
Closes: https://lore.kernel.org/stable/3a44500b-d7c8-179f-61f6-e51cb50d3512@lio96.de/
Fixes: 64d86c03e1441742 ("perf arm-spe: Extend branch operations")
Reported-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Reported-by: Thomas Voegtle <tv@lio96.de>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Ian Rogers <irogers@google.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
To: Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/linux/bitfield.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/include/linux/bitfield.h b/tools/include/linux/bitfield.h
index 6093fa6db2600..ddf81f24956ba 100644
--- a/tools/include/linux/bitfield.h
+++ b/tools/include/linux/bitfield.h
@@ -8,6 +8,7 @@
#define _LINUX_BITFIELD_H
#include <linux/build_bug.h>
+#include <linux/kernel.h>
#include <asm/byteorder.h>
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 710/844] vhost: move vdpa group bound check to vhost_vdpa
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (708 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 709/844] tools: Fix bitfield dependency failure Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 711/844] ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks Sasha Levin
` (142 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eugenio Pérez, Jason Wang, Michael S. Tsirkin, Sasha Levin
From: Eugenio Pérez <eperezma@redhat.com>
[ Upstream commit cd025c1e876b4e262e71398236a1550486a73ede ]
Remove duplication by consolidating these here. This reduces the
posibility of a parent driver missing them.
While we're at it, fix a bug in vdpa_sim where a valid ASID can be
assigned to a group equal to ngroups, causing an out of bound write.
Cc: stable@vger.kernel.org
Fixes: bda324fd037a ("vdpasim: control virtqueue support")
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260119143306.1818855-2-eperezma@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 3 ---
drivers/vdpa/vdpa_sim/vdpa_sim.c | 6 ------
drivers/vhost/vdpa.c | 2 +-
3 files changed, 1 insertion(+), 10 deletions(-)
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index ddaa1366704bb..44062e9d68f00 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -3640,9 +3640,6 @@ static int mlx5_set_group_asid(struct vdpa_device *vdev, u32 group,
struct mlx5_vdpa_dev *mvdev = to_mvdev(vdev);
int err = 0;
- if (group >= MLX5_VDPA_NUMVQ_GROUPS)
- return -EINVAL;
-
mvdev->mres.group2asid[group] = asid;
mutex_lock(&mvdev->mres.lock);
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
index c1c6431950e1b..df9c7ddc5d782 100644
--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
+++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
@@ -606,12 +606,6 @@ static int vdpasim_set_group_asid(struct vdpa_device *vdpa, unsigned int group,
struct vhost_iotlb *iommu;
int i;
- if (group > vdpasim->dev_attr.ngroups)
- return -EINVAL;
-
- if (asid >= vdpasim->dev_attr.nas)
- return -EINVAL;
-
iommu = &vdpasim->iommu[asid];
mutex_lock(&vdpasim->mutex);
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index b0179e8567aba..7e51eec842b8c 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -680,7 +680,7 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
case VHOST_VDPA_SET_GROUP_ASID:
if (copy_from_user(&s, argp, sizeof(s)))
return -EFAULT;
- if (s.num >= vdpa->nas)
+ if (idx >= vdpa->ngroups || s.num >= vdpa->nas)
return -EINVAL;
if (!ops->set_group_asid)
return -EOPNOTSUPP;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 711/844] ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (709 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 710/844] vhost: move vdpa group bound check to vhost_vdpa Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 712/844] ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 Sasha Levin
` (141 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Fabio M. De Francesco, Dave Jiang, Hanjun Guo, Jonathan Cameron,
Rafael J. Wysocki, Sasha Levin
From: "Fabio M. De Francesco" <fabio.m.de.francesco@linux.intel.com>
[ Upstream commit 70205869686212eb8e4cddf02bf87fd5fd597bc2 ]
Move the CPER CXL protocol errors validity check out of
cxl_cper_post_prot_err() to new cxl_cper_sec_prot_err_valid() and limit
the serial number check only to CXL agents that are CXL devices (UEFI
v2.10, Appendix N.2.13).
Export the new symbol for reuse by ELOG.
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Fabio M. De Francesco <fabio.m.de.francesco@linux.intel.com>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260114101543.85926-4-fabio.m.de.francesco@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: b584bfbd7ec4 ("ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/Makefile | 1 +
drivers/acpi/apei/ghes.c | 18 +----------------
drivers/acpi/apei/ghes_helpers.c | 33 ++++++++++++++++++++++++++++++++
include/cxl/event.h | 10 ++++++++++
4 files changed, 45 insertions(+), 17 deletions(-)
create mode 100644 drivers/acpi/apei/ghes_helpers.c
diff --git a/drivers/acpi/apei/Makefile b/drivers/acpi/apei/Makefile
index 2c474e6477e12..5db61dfb46915 100644
--- a/drivers/acpi/apei/Makefile
+++ b/drivers/acpi/apei/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_ACPI_APEI) += apei.o
obj-$(CONFIG_ACPI_APEI_GHES) += ghes.o
+obj-$(CONFIG_ACPI_APEI_PCIEAER) += ghes_helpers.o
obj-$(CONFIG_ACPI_APEI_EINJ) += einj.o
einj-y := einj-core.o
einj-$(CONFIG_ACPI_APEI_EINJ_CXL) += einj-cxl.o
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 77ea7a5b761f1..9919c31e42c07 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -741,24 +741,8 @@ static void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err,
struct cxl_cper_prot_err_work_data wd;
u8 *dvsec_start, *cap_start;
- if (!(prot_err->valid_bits & PROT_ERR_VALID_AGENT_ADDRESS)) {
- pr_err_ratelimited("CXL CPER invalid agent type\n");
+ if (cxl_cper_sec_prot_err_valid(prot_err))
return;
- }
-
- if (!(prot_err->valid_bits & PROT_ERR_VALID_ERROR_LOG)) {
- pr_err_ratelimited("CXL CPER invalid protocol error log\n");
- return;
- }
-
- if (prot_err->err_len != sizeof(struct cxl_ras_capability_regs)) {
- pr_err_ratelimited("CXL CPER invalid RAS Cap size (%u)\n",
- prot_err->err_len);
- return;
- }
-
- if (!(prot_err->valid_bits & PROT_ERR_VALID_SERIAL_NUMBER))
- pr_warn(FW_WARN "CXL CPER no device serial number\n");
guard(spinlock_irqsave)(&cxl_cper_prot_err_work_lock);
diff --git a/drivers/acpi/apei/ghes_helpers.c b/drivers/acpi/apei/ghes_helpers.c
new file mode 100644
index 0000000000000..f3d162139a974
--- /dev/null
+++ b/drivers/acpi/apei/ghes_helpers.c
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Copyright(c) 2025 Intel Corporation. All rights reserved
+
+#include <linux/printk.h>
+#include <cxl/event.h>
+
+int cxl_cper_sec_prot_err_valid(struct cxl_cper_sec_prot_err *prot_err)
+{
+ if (!(prot_err->valid_bits & PROT_ERR_VALID_AGENT_ADDRESS)) {
+ pr_err_ratelimited("CXL CPER invalid agent type\n");
+ return -EINVAL;
+ }
+
+ if (!(prot_err->valid_bits & PROT_ERR_VALID_ERROR_LOG)) {
+ pr_err_ratelimited("CXL CPER invalid protocol error log\n");
+ return -EINVAL;
+ }
+
+ if (prot_err->err_len != sizeof(struct cxl_ras_capability_regs)) {
+ pr_err_ratelimited("CXL CPER invalid RAS Cap size (%u)\n",
+ prot_err->err_len);
+ return -EINVAL;
+ }
+
+ if ((prot_err->agent_type == RCD || prot_err->agent_type == DEVICE ||
+ prot_err->agent_type == LD || prot_err->agent_type == FMLD) &&
+ !(prot_err->valid_bits & PROT_ERR_VALID_SERIAL_NUMBER))
+ pr_warn_ratelimited(FW_WARN
+ "CXL CPER no device serial number\n");
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(cxl_cper_sec_prot_err_valid);
diff --git a/include/cxl/event.h b/include/cxl/event.h
index 6fd90f9cc2034..4d7d1036ea9cb 100644
--- a/include/cxl/event.h
+++ b/include/cxl/event.h
@@ -320,4 +320,14 @@ static inline int cxl_cper_prot_err_kfifo_get(struct cxl_cper_prot_err_work_data
}
#endif
+#ifdef CONFIG_ACPI_APEI_PCIEAER
+int cxl_cper_sec_prot_err_valid(struct cxl_cper_sec_prot_err *prot_err);
+#else
+static inline int
+cxl_cper_sec_prot_err_valid(struct cxl_cper_sec_prot_err *prot_err)
+{
+ return -EOPNOTSUPP;
+}
+#endif
+
#endif /* _LINUX_CXL_EVENT_H */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 712/844] ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (710 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 711/844] ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 713/844] powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() Sasha Levin
` (140 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Nathan Chancellor, Rafael J. Wysocki, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit b584bfbd7ec417f257f651cc00a90c66e31dfbf1 ]
After a recent innocuous change to drivers/acpi/apei/ghes.c, building
ARCH=arm64 allmodconfig with clang-17 or older (which has both
CONFIG_KASAN=y and CONFIG_WERROR=y) fails with:
drivers/acpi/apei/ghes.c:902:13: error: stack frame size (2768) exceeds limit (2048) in 'ghes_do_proc' [-Werror,-Wframe-larger-than]
902 | static void ghes_do_proc(struct ghes *ghes,
| ^
A KASAN pass that removes unneeded stack instrumentation, enabled by
default in clang-18 [1], drastically improves stack usage in this case.
To avoid the warning in the common allmodconfig case when it can break
the build, disable KASAN for ghes.o when compile testing with clang-17
and older. Disabling KASAN outright may hide legitimate runtime issues,
so live with the warning in that case; the user can either increase the
frame warning limit or disable -Werror, which they should probably do
when debugging with KASAN anyways.
Closes: https://github.com/ClangBuiltLinux/linux/issues/2148
Link: https://github.com/llvm/llvm-project/commit/51fbab134560ece663517bf1e8c2a30300d08f1a [1]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260114-ghes-avoid-wflt-clang-older-than-18-v1-1-9c8248bfe4f4@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/Makefile | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/acpi/apei/Makefile b/drivers/acpi/apei/Makefile
index 5db61dfb46915..1a0b85923cd42 100644
--- a/drivers/acpi/apei/Makefile
+++ b/drivers/acpi/apei/Makefile
@@ -1,6 +1,10 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_ACPI_APEI) += apei.o
obj-$(CONFIG_ACPI_APEI_GHES) += ghes.o
+# clang versions prior to 18 may blow out the stack with KASAN
+ifeq ($(CONFIG_COMPILE_TEST)_$(CONFIG_CC_IS_CLANG)_$(call clang-min-version, 180000),y_y_)
+KASAN_SANITIZE_ghes.o := n
+endif
obj-$(CONFIG_ACPI_APEI_PCIEAER) += ghes_helpers.o
obj-$(CONFIG_ACPI_APEI_EINJ) += einj.o
einj-y := einj-core.o
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 713/844] powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (711 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 712/844] ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 714/844] iio: gyro: itg3200: Fix unchecked return value in read_raw Sasha Levin
` (139 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Guangshuo Li, Christophe Leroy, Madhavan Srinivasan, Sasha Levin
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 33c1c6d8a28a2761ac74b0380b2563cf546c2a3a ]
As kcalloc() may fail, check its return value to avoid a NULL pointer
dereference when passing it to of_property_read_u32_array().
Fixes: 790a1662d3a26 ("powerpc/smp: Parse ibm,thread-groups with multiple properties")
Cc: stable@vger.kernel.org
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250923133235.1862108-1-lgs201920130244@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/smp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 292fee8809bc8..cad3358fa4c35 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -822,6 +822,8 @@ static int parse_thread_groups(struct device_node *dn,
count = of_property_count_u32_elems(dn, "ibm,thread-groups");
thread_group_array = kcalloc(count, sizeof(u32), GFP_KERNEL);
+ if (!thread_group_array)
+ return -ENOMEM;
ret = of_property_read_u32_array(dn, "ibm,thread-groups",
thread_group_array, count);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 714/844] iio: gyro: itg3200: Fix unchecked return value in read_raw
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (712 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 713/844] powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 715/844] mtd: spinand: Disable continuous read during probe Sasha Levin
` (138 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Antoniu Miclaus, Andy Shevchenko, Stable, Jonathan Cameron,
Sasha Levin
From: Antoniu Miclaus <antoniu.miclaus@analog.com>
[ Upstream commit b79b24f578cdb2d657db23e5fafe82c7e6a36b72 ]
The return value from itg3200_read_reg_s16() is stored in ret but
never checked. The function unconditionally returns IIO_VAL_INT,
ignoring potential I2C read failures. This causes garbage data to
be returned to userspace when the read fails, with no error reported.
Add proper error checking to propagate the failure to callers.
Fixes: 9dbf091da080 ("iio: gyro: Add itg3200")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/gyro/itg3200_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/gyro/itg3200_core.c b/drivers/iio/gyro/itg3200_core.c
index cd8a2dae56cd9..bfe95ec1abda9 100644
--- a/drivers/iio/gyro/itg3200_core.c
+++ b/drivers/iio/gyro/itg3200_core.c
@@ -93,6 +93,8 @@ static int itg3200_read_raw(struct iio_dev *indio_dev,
case IIO_CHAN_INFO_RAW:
reg = (u8)chan->address;
ret = itg3200_read_reg_s16(indio_dev, reg, val);
+ if (ret)
+ return ret;
return IIO_VAL_INT;
case IIO_CHAN_INFO_SCALE:
*val = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 715/844] mtd: spinand: Disable continuous read during probe
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (713 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 714/844] iio: gyro: itg3200: Fix unchecked return value in read_raw Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 716/844] power: reset: tdx-ec-poweroff: fix restart Sasha Levin
` (137 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David LaPorte, Gunnar Kudrjavets, Mikhail Kshevetskiy,
Miquel Raynal, Sasha Levin
From: David LaPorte <dalaport@amazon.com>
[ Upstream commit b4af7d194dc879353829f3c56988a68fbba1fbdd ]
Macronix serial NAND devices with continuous read support do not
clear the configuration register on soft reset and lack a hardware
reset pin. When continuous read is interrupted (e.g., during reboot),
the feature remains enabled at the device level.
With continuous read enabled, the OOB area becomes inaccessible and
all reads are instead directed to the main area. As a result, during
partition allocation as part of MTD device registration, the first two
bytes of the main area for the master block are read and indicate that
the block is bad. This process repeats for every subsequent block for
the partition.
All reads and writes that reference the BBT find no good blocks and
fail.
The only paths for recovery from this state are triggering the
continuous read feature by way of raw MTD reads or through a NAND
device power drain.
Disable continuous read explicitly during spinand probe to ensure
quiescent feature state.
Fixes: 631cfdd0520d ("mtd: spi-nand: Add continuous read support")
Cc: stable@vger.kernel.org
Signed-off-by: David LaPorte <dalaport@amazon.com>
Reviewed-by: Gunnar Kudrjavets <gunnarku@amazon.com>
Reviewed-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/spi/core.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index d207286572d87..9540fd04156c7 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -859,6 +859,14 @@ static void spinand_cont_read_init(struct spinand_device *spinand)
(engine_type == NAND_ECC_ENGINE_TYPE_ON_DIE ||
engine_type == NAND_ECC_ENGINE_TYPE_NONE)) {
spinand->cont_read_possible = true;
+
+ /*
+ * Ensure continuous read is disabled on probe.
+ * Some devices retain this state across soft reset,
+ * which leaves the OOB area inaccessible and results
+ * in false positive returns from spinand_isbad().
+ */
+ spinand_cont_read_enable(spinand, false);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 716/844] power: reset: tdx-ec-poweroff: fix restart
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (714 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 715/844] mtd: spinand: Disable continuous read during probe Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 717/844] mm/highmem: fix __kmap_to_page() build error Sasha Levin
` (136 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Emanuele Ghidoli, Francesco Dolcini, Sebastian Reichel,
Sasha Levin
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
[ Upstream commit 562357a6310f79e45844c3e980d410a1e8e02ce6 ]
During testing, restart occasionally failed on Toradex modules.
The issue was traced to an interaction between the EC-based reset/poweroff
handler and the PSCI restart handler. While the embedded controller is
resetting or powering off the module, the PSCI code may still be invoked,
triggering an I2C transaction to the PMIC. This can leave the PMIC I2C
in a frozen state.
Add a delay after issuing the EC reset or power-off command to give the
controller time to complete the operation and avoid falling back to another
restart/poweroff provider.
Also print an error message if sending the command to the embedded controller
fails.
Fixes: 18672fe12367 ("power: reset: add Toradex Embedded Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://patch.msgid.link/20260130071208.1184239-1-ghidoliemanuele@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/reset/tdx-ec-poweroff.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/power/reset/tdx-ec-poweroff.c b/drivers/power/reset/tdx-ec-poweroff.c
index 3302a127fce52..8040aa03d74d4 100644
--- a/drivers/power/reset/tdx-ec-poweroff.c
+++ b/drivers/power/reset/tdx-ec-poweroff.c
@@ -8,7 +8,10 @@
*/
#include <linux/array_size.h>
+#include <linux/bug.h>
+#include <linux/delay.h>
#include <linux/device.h>
+#include <linux/dev_printk.h>
#include <linux/err.h>
#include <linux/i2c.h>
#include <linux/mod_devicetable.h>
@@ -31,6 +34,8 @@
#define EC_REG_MAX 0xD0
+#define EC_CMD_TIMEOUT_MS 1000
+
static const struct regmap_range volatile_ranges[] = {
regmap_reg_range(EC_CMD_REG, EC_CMD_REG),
};
@@ -75,6 +80,13 @@ static int tdx_ec_power_off(struct sys_off_data *data)
err = tdx_ec_cmd(regmap, EC_CMD_POWEROFF);
+ if (err) {
+ dev_err(data->dev, "Failed to send power off command\n");
+ } else {
+ mdelay(EC_CMD_TIMEOUT_MS);
+ WARN_ONCE(1, "Unable to power off system\n");
+ }
+
return err ? NOTIFY_BAD : NOTIFY_DONE;
}
@@ -85,6 +97,13 @@ static int tdx_ec_restart(struct sys_off_data *data)
err = tdx_ec_cmd(regmap, EC_CMD_RESET);
+ if (err) {
+ dev_err(data->dev, "Failed to send restart command\n");
+ } else {
+ mdelay(EC_CMD_TIMEOUT_MS);
+ WARN_ONCE(1, "Unable to restart system\n");
+ }
+
return err ? NOTIFY_BAD : NOTIFY_DONE;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 717/844] mm/highmem: fix __kmap_to_page() build error
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (715 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 716/844] power: reset: tdx-ec-poweroff: fix restart Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 718/844] compiler-clang.h: require LLVM 19.1.0 or higher for __typeof_unqual__ Sasha Levin
` (135 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: William Tambe, Max Filippov, Chris Zankel, Andrew Morton,
Sasha Levin
From: William Tambe <williamt@cadence.com>
[ Upstream commit 94350fe6cad77b46c3dcb8c96543bef7647efbc0 ]
This changes fixes following build error which is a miss from ef6e06b2ef87
("highmem: fix kmap_to_page() for kmap_local_page() addresses").
mm/highmem.c:184:66: error: 'pteval' undeclared (first use in this
function); did you mean 'pte_val'?
184 | idx = arch_kmap_local_map_idx(i, pte_pfn(pteval));
In __kmap_to_page(), pteval is used but does not exist in the function.
(akpm: affects xtensa only)
Link: https://lkml.kernel.org/r/SJ0PR07MB86317E00EC0C59DA60935FDCD18DA@SJ0PR07MB8631.namprd07.prod.outlook.com
Fixes: ef6e06b2ef87 ("highmem: fix kmap_to_page() for kmap_local_page() addresses")
Signed-off-by: William Tambe <williamt@cadence.com>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Cc: Chris Zankel <chris@zankel.net>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/highmem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/highmem.c b/mm/highmem.c
index b5c8e4c2d5d49..a33e411839517 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -180,12 +180,13 @@ struct page *__kmap_to_page(void *vaddr)
for (i = 0; i < kctrl->idx; i++) {
unsigned long base_addr;
int idx;
+ pte_t pteval = kctrl->pteval[i];
idx = arch_kmap_local_map_idx(i, pte_pfn(pteval));
base_addr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
if (base_addr == base)
- return pte_page(kctrl->pteval[i]);
+ return pte_page(pteval);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 718/844] compiler-clang.h: require LLVM 19.1.0 or higher for __typeof_unqual__
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (716 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 717/844] mm/highmem: fix __kmap_to_page() build error Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 719/844] rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() Sasha Levin
` (134 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, Bill Wendling, Justin Stitt, Uros Bizjak,
Andrew Morton, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit e8d899d301346a5591c9d1af06c3c9b3501cf84b ]
When building the kernel using a version of LLVM between llvmorg-19-init
(the first commit of the LLVM 19 development cycle) and the change in
LLVM that actually added __typeof_unqual__ for all C modes [1], which
might happen during a bisect of LLVM, there is a build failure:
In file included from arch/x86/kernel/asm-offsets.c:9:
In file included from include/linux/crypto.h:15:
In file included from include/linux/completion.h:12:
In file included from include/linux/swait.h:7:
In file included from include/linux/spinlock.h:56:
In file included from include/linux/preempt.h:79:
arch/x86/include/asm/preempt.h:61:2: error: call to undeclared function '__typeof_unqual__'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
61 | raw_cpu_and_4(__preempt_count, ~PREEMPT_NEED_RESCHED);
| ^
arch/x86/include/asm/percpu.h:478:36: note: expanded from macro 'raw_cpu_and_4'
478 | #define raw_cpu_and_4(pcp, val) percpu_binary_op(4, , "and", (pcp), val)
| ^
arch/x86/include/asm/percpu.h:210:3: note: expanded from macro 'percpu_binary_op'
210 | TYPEOF_UNQUAL(_var) pto_tmp__; \
| ^
include/linux/compiler.h:248:29: note: expanded from macro 'TYPEOF_UNQUAL'
248 | # define TYPEOF_UNQUAL(exp) __typeof_unqual__(exp)
| ^
The current logic of CC_HAS_TYPEOF_UNQUAL just checks for a major
version of 19 but half of the 19 development cycle did not have support
for __typeof_unqual__.
Harden the logic of CC_HAS_TYPEOF_UNQUAL to avoid this error by only
using __typeof_unqual__ with a released version of LLVM 19, which is
greater than or equal to 19.1.0 with LLVM's versioning scheme that
matches GCC's [2].
Link: https://github.com/llvm/llvm-project/commit/cc308f60d41744b5920ec2e2e5b25e1273c8704b [1]
Link: https://github.com/llvm/llvm-project/commit/4532617ae420056bf32f6403dde07fb99d276a49 [2]
Link: https://lkml.kernel.org/r/20260116-require-llvm-19-1-for-typeof_unqual-v1-1-3b9a4a4b212b@kernel.org
Fixes: ac053946f5c4 ("compiler.h: introduce TYPEOF_UNQUAL() macro")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Uros Bizjak <ubizjak@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/compiler-clang.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 7edf1a07b5350..e1123dd284862 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -153,4 +153,4 @@
* Bindgen uses LLVM even if our C compiler is GCC, so we cannot
* rely on the auto-detected CONFIG_CC_HAS_TYPEOF_UNQUAL.
*/
-#define CC_HAS_TYPEOF_UNQUAL (__clang_major__ >= 19)
+#define CC_HAS_TYPEOF_UNQUAL (__clang_major__ > 19 || (__clang_major__ == 19 && __clang_minor__ > 0))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 719/844] rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (717 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 718/844] compiler-clang.h: require LLVM 19.1.0 or higher for __typeof_unqual__ Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 720/844] ocfs2: fix reflink preserve cleanup issue Sasha Levin
` (133 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Haoxiang Li, Andrew Morton, Alexandre Bounine, Matt Porter,
Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit 666183dcdd9ad3b8156a1df7f204f728f720380f ]
When idtab allocation fails, net is not registered with rio_add_net() yet,
so kfree(net) is sufficient to release the memory. Set mport->net to NULL
to avoid dangling pointer.
Link: https://lkml.kernel.org/r/20260121013508.195836-1-lihaoxiang@isrc.iscas.ac.cn
Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code")
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rapidio/rio-scan.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index c12941f71e2cb..dcd6619a4b027 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -854,7 +854,8 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport,
if (idtab == NULL) {
pr_err("RIO: failed to allocate destID table\n");
- rio_free_net(net);
+ kfree(net);
+ mport->net = NULL;
net = NULL;
} else {
net->enum_data = idtab;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 720/844] ocfs2: fix reflink preserve cleanup issue
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (718 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 719/844] rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 721/844] kexec: derive purgatory entry from symbol Sasha Levin
` (132 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Heming Zhao, Mark Fasheh, Joel Becker, Junxiao Bi, Joseph Qi,
Changwei Ge, Jun Piao, Andrew Morton, Sasha Levin
From: Heming Zhao <heming.zhao@suse.com>
[ Upstream commit 5138c936c2c82c9be8883921854bc6f7e1177d8c ]
commit c06c303832ec ("ocfs2: fix xattr array entry __counted_by error")
doesn't handle all cases and the cleanup job for preserved xattr entries
still has bug:
- the 'last' pointer should be shifted by one unit after cleanup
an array entry.
- current code logic doesn't cleanup the first entry when xh_count is 1.
Note, commit c06c303832ec is also a bug fix for 0fe9b66c65f3.
Link: https://lkml.kernel.org/r/20251210015725.8409-2-heming.zhao@suse.com
Fixes: 0fe9b66c65f3 ("ocfs2: Add preserve to reflink.")
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/xattr.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 1b21fbc16d73a..1bff4f2d1345e 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -6394,6 +6394,10 @@ static int ocfs2_reflink_xattr_header(handle_t *handle,
(void *)last - (void *)xe);
memset(last, 0,
sizeof(struct ocfs2_xattr_entry));
+ last = &new_xh->xh_entries[le16_to_cpu(new_xh->xh_count)] - 1;
+ } else {
+ memset(xe, 0, sizeof(struct ocfs2_xattr_entry));
+ last = NULL;
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 721/844] kexec: derive purgatory entry from symbol
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (719 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 720/844] ocfs2: fix reflink preserve cleanup issue Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 722/844] crash_dump: fix dm_crypt keys locking and ref leak Sasha Levin
` (131 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Li Chen, Baoquan He, Alexander Graf, Eric Biggers, Philipp Rudo,
Ricardo Ribalda Delgado, Ross Zwisler, Sourabh Jain,
Steven Rostedt, Andrew Morton, Sasha Levin
From: Li Chen <me@linux.beauty>
[ Upstream commit 480e1d5c64bb14441f79f2eb9421d5e26f91ea3d ]
kexec_load_purgatory() derives image->start by locating e_entry inside an
SHF_EXECINSTR section. If the purgatory object contains multiple
executable sections with overlapping sh_addr, the entrypoint check can
match more than once and trigger a WARN.
Derive the entry section from the purgatory_start symbol when present and
compute image->start from its final placement. Keep the existing e_entry
fallback for purgatories that do not expose the symbol.
WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784
Call Trace:
<TASK>
bzImage64_load+0x133/0xa00
__do_sys_kexec_file_load+0x2b3/0x5c0
do_syscall_64+0x81/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
[me@linux.beauty: move helper to avoid forward declaration, per Baoquan]
Link: https://lkml.kernel.org/r/20260128043511.316860-1-me@linux.beauty
Link: https://lkml.kernel.org/r/20260120124005.148381-1-me@linux.beauty
Fixes: 8652d44f466a ("kexec: support purgatories with .text.hot sections")
Signed-off-by: Li Chen <me@linux.beauty>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Li Chen <me@linux.beauty>
Cc: Philipp Rudo <prudo@redhat.com>
Cc: Ricardo Ribalda Delgado <ribalda@chromium.org>
Cc: Ross Zwisler <zwisler@google.com>
Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/kexec_file.c | 131 +++++++++++++++++++++++++-------------------
1 file changed, 74 insertions(+), 57 deletions(-)
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index eb62a97942428..2bfbb2d144e69 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -882,6 +882,60 @@ static int kexec_calculate_store_digests(struct kimage *image)
}
#ifdef CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY
+/*
+ * kexec_purgatory_find_symbol - find a symbol in the purgatory
+ * @pi: Purgatory to search in.
+ * @name: Name of the symbol.
+ *
+ * Return: pointer to symbol in read-only symtab on success, NULL on error.
+ */
+static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi,
+ const char *name)
+{
+ const Elf_Shdr *sechdrs;
+ const Elf_Ehdr *ehdr;
+ const Elf_Sym *syms;
+ const char *strtab;
+ int i, k;
+
+ if (!pi->ehdr)
+ return NULL;
+
+ ehdr = pi->ehdr;
+ sechdrs = (void *)ehdr + ehdr->e_shoff;
+
+ for (i = 0; i < ehdr->e_shnum; i++) {
+ if (sechdrs[i].sh_type != SHT_SYMTAB)
+ continue;
+
+ if (sechdrs[i].sh_link >= ehdr->e_shnum)
+ /* Invalid strtab section number */
+ continue;
+ strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset;
+ syms = (void *)ehdr + sechdrs[i].sh_offset;
+
+ /* Go through symbols for a match */
+ for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) {
+ if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL)
+ continue;
+
+ if (strcmp(strtab + syms[k].st_name, name) != 0)
+ continue;
+
+ if (syms[k].st_shndx == SHN_UNDEF ||
+ syms[k].st_shndx >= ehdr->e_shnum) {
+ pr_debug("Symbol: %s has bad section index %d.\n",
+ name, syms[k].st_shndx);
+ return NULL;
+ }
+
+ /* Found the symbol we are looking for */
+ return &syms[k];
+ }
+ }
+
+ return NULL;
+}
/*
* kexec_purgatory_setup_kbuf - prepare buffer to load purgatory.
* @pi: Purgatory to be loaded.
@@ -960,6 +1014,10 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
unsigned long offset;
size_t sechdrs_size;
Elf_Shdr *sechdrs;
+ const Elf_Sym *entry_sym;
+ u16 entry_shndx = 0;
+ unsigned long entry_off = 0;
+ bool start_fixed = false;
int i;
/*
@@ -977,6 +1035,12 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
bss_addr = kbuf->mem + kbuf->bufsz;
kbuf->image->start = pi->ehdr->e_entry;
+ entry_sym = kexec_purgatory_find_symbol(pi, "purgatory_start");
+ if (entry_sym) {
+ entry_shndx = entry_sym->st_shndx;
+ entry_off = entry_sym->st_value;
+ }
+
for (i = 0; i < pi->ehdr->e_shnum; i++) {
unsigned long align;
void *src, *dst;
@@ -994,6 +1058,13 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
offset = ALIGN(offset, align);
+ if (!start_fixed && entry_sym && i == entry_shndx &&
+ (sechdrs[i].sh_flags & SHF_EXECINSTR) &&
+ entry_off < sechdrs[i].sh_size) {
+ kbuf->image->start = kbuf->mem + offset + entry_off;
+ start_fixed = true;
+ }
+
/*
* Check if the segment contains the entry point, if so,
* calculate the value of image->start based on it.
@@ -1004,13 +1075,14 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
* is not set to the initial value, and warn the user so they
* have a chance to fix their purgatory's linker script.
*/
- if (sechdrs[i].sh_flags & SHF_EXECINSTR &&
+ if (!start_fixed && sechdrs[i].sh_flags & SHF_EXECINSTR &&
pi->ehdr->e_entry >= sechdrs[i].sh_addr &&
pi->ehdr->e_entry < (sechdrs[i].sh_addr
+ sechdrs[i].sh_size) &&
- !WARN_ON(kbuf->image->start != pi->ehdr->e_entry)) {
+ kbuf->image->start == pi->ehdr->e_entry) {
kbuf->image->start -= sechdrs[i].sh_addr;
kbuf->image->start += kbuf->mem + offset;
+ start_fixed = true;
}
src = (void *)pi->ehdr + sechdrs[i].sh_offset;
@@ -1128,61 +1200,6 @@ int kexec_load_purgatory(struct kimage *image, struct kexec_buf *kbuf)
return ret;
}
-/*
- * kexec_purgatory_find_symbol - find a symbol in the purgatory
- * @pi: Purgatory to search in.
- * @name: Name of the symbol.
- *
- * Return: pointer to symbol in read-only symtab on success, NULL on error.
- */
-static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi,
- const char *name)
-{
- const Elf_Shdr *sechdrs;
- const Elf_Ehdr *ehdr;
- const Elf_Sym *syms;
- const char *strtab;
- int i, k;
-
- if (!pi->ehdr)
- return NULL;
-
- ehdr = pi->ehdr;
- sechdrs = (void *)ehdr + ehdr->e_shoff;
-
- for (i = 0; i < ehdr->e_shnum; i++) {
- if (sechdrs[i].sh_type != SHT_SYMTAB)
- continue;
-
- if (sechdrs[i].sh_link >= ehdr->e_shnum)
- /* Invalid strtab section number */
- continue;
- strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset;
- syms = (void *)ehdr + sechdrs[i].sh_offset;
-
- /* Go through symbols for a match */
- for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) {
- if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL)
- continue;
-
- if (strcmp(strtab + syms[k].st_name, name) != 0)
- continue;
-
- if (syms[k].st_shndx == SHN_UNDEF ||
- syms[k].st_shndx >= ehdr->e_shnum) {
- pr_debug("Symbol: %s has bad section index %d.\n",
- name, syms[k].st_shndx);
- return NULL;
- }
-
- /* Found the symbol we are looking for */
- return &syms[k];
- }
- }
-
- return NULL;
-}
-
void *kexec_purgatory_get_symbol_addr(struct kimage *image, const char *name)
{
struct purgatory_info *pi = &image->purgatory_info;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 722/844] crash_dump: fix dm_crypt keys locking and ref leak
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (720 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 721/844] kexec: derive purgatory entry from symbol Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 723/844] kho: skip memoryless NUMA nodes when reserving scratch areas Sasha Levin
` (130 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Vasily Gorbik, Baoquan He, Coiby Xu, Dave Young, Vivek Goyal,
Andrew Morton, Sasha Levin
From: Vasily Gorbik <gor@linux.ibm.com>
[ Upstream commit 96a54b8ffc8c4567c32fe0b6996669f1132b026d ]
crash_load_dm_crypt_keys() reads dm-crypt volume keys from the user
keyring. It uses user_key_payload_locked() without holding key->sem,
which makes lockdep complain when kexec_file_load() assembles the crash
image:
=============================
WARNING: suspicious RCU usage
-----------------------------
./include/keys/user-type.h:53 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
no locks held by kexec/4875.
stack backtrace:
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
lockdep_rcu_suspicious.cold+0x4e/0x96
crash_load_dm_crypt_keys+0x314/0x390
bzImage64_load+0x116/0x9a0
? __lock_acquire+0x464/0x1ba0
__do_sys_kexec_file_load+0x26a/0x4f0
do_syscall_64+0xbd/0x430
entry_SYSCALL_64_after_hwframe+0x77/0x7f
In addition, the key returned by request_key() is never key_put()'d,
leaking a key reference on each load attempt.
Take key->sem while copying the payload and drop the key reference
afterwards.
Link: https://lkml.kernel.org/r/patch.git-2d4d76083a5c.your-ad-here.call-01769426386-ext-2560@work.hours
Fixes: 479e58549b0f ("crash_dump: store dm crypt keys in kdump reserved memory")
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Coiby Xu <coxu@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/crash_dump_dm_crypt.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c
index 401423ba477da..abb307a23de33 100644
--- a/kernel/crash_dump_dm_crypt.c
+++ b/kernel/crash_dump_dm_crypt.c
@@ -143,6 +143,7 @@ static int read_key_from_user_keying(struct dm_crypt_key *dm_key)
{
const struct user_key_payload *ukp;
struct key *key;
+ int ret = 0;
kexec_dprintk("Requesting logon key %s", dm_key->key_desc);
key = request_key(&key_type_logon, dm_key->key_desc, NULL);
@@ -152,20 +153,28 @@ static int read_key_from_user_keying(struct dm_crypt_key *dm_key)
return PTR_ERR(key);
}
+ down_read(&key->sem);
ukp = user_key_payload_locked(key);
- if (!ukp)
- return -EKEYREVOKED;
+ if (!ukp) {
+ ret = -EKEYREVOKED;
+ goto out;
+ }
if (ukp->datalen > KEY_SIZE_MAX) {
pr_err("Key size %u exceeds maximum (%u)\n", ukp->datalen, KEY_SIZE_MAX);
- return -EINVAL;
+ ret = -EINVAL;
+ goto out;
}
memcpy(dm_key->data, ukp->data, ukp->datalen);
dm_key->key_size = ukp->datalen;
kexec_dprintk("Get dm crypt key (size=%u) %s: %8ph\n", dm_key->key_size,
dm_key->key_desc, dm_key->data);
- return 0;
+
+out:
+ up_read(&key->sem);
+ key_put(key);
+ return ret;
}
struct config_key {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 723/844] kho: skip memoryless NUMA nodes when reserving scratch areas
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (721 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 722/844] crash_dump: fix dm_crypt keys locking and ref leak Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 724/844] Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" Sasha Levin
` (129 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Evangelos Petrongonas, Pratyush Yadav, Mike Rapoport (Microsoft),
Pasha Tatashin, Alexander Graf, Andrew Morton, Sasha Levin
From: Evangelos Petrongonas <epetron@amazon.de>
[ Upstream commit 427b2535f51342de3156babc6bdc3f3b7dd2c707 ]
kho_reserve_scratch() iterates over all online NUMA nodes to allocate
per-node scratch memory. On systems with memoryless NUMA nodes (nodes
that have CPUs but no memory), memblock_alloc_range_nid() fails because
there is no memory available on that node. This causes KHO initialization
to fail and kho_enable to be set to false.
Some ARM64 systems have NUMA topologies where certain nodes contain only
CPUs without any associated memory. These configurations are valid and
should not prevent KHO from functioning.
Fix this by only counting nodes that have memory (N_MEMORY state) and skip
memoryless nodes in the per-node scratch allocation loop.
Link: https://lkml.kernel.org/r/20260120175913.34368-1-epetron@amazon.de
Fixes: 3dc92c311498 ("kexec: add Kexec HandOver (KHO) generation helpers").
Signed-off-by: Evangelos Petrongonas <epetron@amazon.de>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/liveupdate/kexec_handover.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kexec_handover.c
index 90d411a59f76d..fcbbfcd3365f6 100644
--- a/kernel/liveupdate/kexec_handover.c
+++ b/kernel/liveupdate/kexec_handover.c
@@ -645,7 +645,7 @@ static void __init kho_reserve_scratch(void)
scratch_size_update();
/* FIXME: deal with node hot-plug/remove */
- kho_scratch_cnt = num_online_nodes() + 2;
+ kho_scratch_cnt = nodes_weight(node_states[N_MEMORY]) + 2;
size = kho_scratch_cnt * sizeof(*kho_scratch);
kho_scratch = memblock_alloc(size, PAGE_SIZE);
if (!kho_scratch)
@@ -675,7 +675,11 @@ static void __init kho_reserve_scratch(void)
kho_scratch[i].size = size;
i++;
- for_each_online_node(nid) {
+ /*
+ * Loop over nodes that have both memory and are online. Skip
+ * memoryless nodes, as we can not allocate scratch areas there.
+ */
+ for_each_node_state(nid, N_MEMORY) {
size = scratch_size_node(nid);
addr = memblock_alloc_range_nid(size, CMA_MIN_ALIGNMENT_BYTES,
0, MEMBLOCK_ALLOC_ACCESSIBLE,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 724/844] Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (722 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 723/844] kho: skip memoryless NUMA nodes when reserving scratch areas Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 725/844] PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Sasha Levin
` (128 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Schnelle, Benjamin Block, Bjorn Helgaas, Gerd Bayer,
Sasha Levin
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit 2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a ]
This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking
when enabling/disabling SR-IOV"), which causes a deadlock by recursively
taking pci_rescan_remove_lock when sriov_del_vfs() is called as part of
pci_stop_and_remove_bus_device(). For example with the following sequence
of commands:
$ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs
$ echo 1 > /sys/bus/pci/devices/<pf>/remove
A trimmed trace of the deadlock on a mlx5 device is as below:
zsh/5715 is trying to acquire lock:
000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140
but task is already holding lock:
000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80
...
Call Trace:
[<00000259778c4f90>] dump_stack_lvl+0xc0/0x110
[<00000259779c844e>] print_deadlock_bug+0x31e/0x330
[<00000259779c1908>] __lock_acquire+0x16c8/0x32f0
[<00000259779bffac>] lock_acquire+0x14c/0x350
[<00000259789643a6>] __mutex_lock_common+0xe6/0x1520
[<000002597896413c>] mutex_lock_nested+0x3c/0x50
[<00000259784a07e4>] sriov_disable+0x34/0x140
[<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]
[<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]
[<00000259784857fc>] pci_device_remove+0x3c/0xa0
[<000002597851012e>] device_release_driver_internal+0x18e/0x280
[<000002597847ae22>] pci_stop_bus_device+0x82/0xa0
[<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80
[<00000259784972c2>] remove_store+0x72/0x90
[<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200
[<0000025977d7241c>] vfs_write+0x24c/0x300
[<0000025977d72696>] ksys_write+0x86/0x110
[<000002597895b61c>] __do_syscall+0x14c/0x400
[<000002597896e0ee>] system_call+0x6e/0x90
This alone is not a complete fix as it restores the issue the cited commit
tried to solve. A new fix will be provided as a follow on.
Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV")
Reported-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Acked-by: Gerd Bayer <gbayer@linux.ibm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251216-revert_sriov_lock-v3-1-dac4925a7621@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/iov.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index 00784a60ba80b..7de5b18647beb 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -629,18 +629,15 @@ static int sriov_add_vfs(struct pci_dev *dev, u16 num_vfs)
if (dev->no_vf_scan)
return 0;
- pci_lock_rescan_remove();
for (i = 0; i < num_vfs; i++) {
rc = pci_iov_add_virtfn(dev, i);
if (rc)
goto failed;
}
- pci_unlock_rescan_remove();
return 0;
failed:
while (i--)
pci_iov_remove_virtfn(dev, i);
- pci_unlock_rescan_remove();
return rc;
}
@@ -765,10 +762,8 @@ static void sriov_del_vfs(struct pci_dev *dev)
struct pci_sriov *iov = dev->sriov;
int i;
- pci_lock_rescan_remove();
for (i = 0; i < iov->num_VFs; i++)
pci_iov_remove_virtfn(dev, i);
- pci_unlock_rescan_remove();
}
static void sriov_disable(struct pci_dev *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 725/844] PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (723 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 724/844] Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 726/844] arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y Sasha Levin
` (127 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Schnelle, Benjamin Block, Bjorn Helgaas, Gerd Bayer,
Sasha Levin
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit a5338e365c4559d7b4d7356116b0eb95b12e08d5 ]
Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when
enabling/disabling SR-IOV") tried to fix a race between the VF removal
inside sriov_del_vfs() and concurrent hot unplug by taking the PCI
rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock
was also taken in sriov_add_vfs() to protect addition of VFs.
This approach however causes deadlock on trying to remove PFs with SR-IOV
enabled because PFs disable SR-IOV during removal and this removal happens
under the PCI rescan/remove lock. So the original fix had to be reverted.
Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and
sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs
hotplug higher up in the callchain by taking the lock in
sriov_numvfs_store() before calling into the driver's sriov_configure()
callback.
Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV")
Reported-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251216-revert_sriov_lock-v3-2-dac4925a7621@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/iov.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index 7de5b18647beb..4a659c34935e1 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -495,7 +495,9 @@ static ssize_t sriov_numvfs_store(struct device *dev,
if (num_vfs == 0) {
/* disable VFs */
+ pci_lock_rescan_remove();
ret = pdev->driver->sriov_configure(pdev, 0);
+ pci_unlock_rescan_remove();
goto exit;
}
@@ -507,7 +509,9 @@ static ssize_t sriov_numvfs_store(struct device *dev,
goto exit;
}
+ pci_lock_rescan_remove();
ret = pdev->driver->sriov_configure(pdev, num_vfs);
+ pci_unlock_rescan_remove();
if (ret < 0)
goto exit;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 726/844] arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (724 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 725/844] PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 727/844] uprobes: Fix incorrect lockdep condition in filter_chain() Sasha Levin
` (126 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Marco Elver, Boqun Feng, David Laight, Will Deacon, Sasha Levin
From: Marco Elver <elver@google.com>
[ Upstream commit bb0c99e08ab9aa6d04b40cb63c72db9950d51749 ]
The implementation of __READ_ONCE() under CONFIG_LTO=y incorrectly
qualified the fallback "once" access for types larger than 8 bytes,
which are not atomic but should still happen "once" and suppress common
compiler optimizations.
The cast `volatile typeof(__x)` applied the volatile qualifier to the
pointer type itself rather than the pointee. This created a volatile
pointer to a non-volatile type, which violated __READ_ONCE() semantics.
Fix this by casting to `volatile typeof(*__x) *`.
With a defconfig + LTO + debug options build, we see the following
functions to be affected:
xen_manage_runstate_time (884 -> 944 bytes)
xen_steal_clock (248 -> 340 bytes)
^-- use __READ_ONCE() to load vcpu_runstate_info structs
Fixes: e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y")
Cc: stable@vger.kernel.org
Reviewed-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Marco Elver <elver@google.com>
Tested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/rwonce.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/rwonce.h b/arch/arm64/include/asm/rwonce.h
index 78beceec10cda..fc0fb42b0b641 100644
--- a/arch/arm64/include/asm/rwonce.h
+++ b/arch/arm64/include/asm/rwonce.h
@@ -58,7 +58,7 @@
default: \
atomic = 0; \
} \
- atomic ? (typeof(*__x))__u.__val : (*(volatile typeof(__x))__x);\
+ atomic ? (typeof(*__x))__u.__val : (*(volatile typeof(*__x) *)__x);\
})
#endif /* !BUILD_VDSO */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 727/844] uprobes: Fix incorrect lockdep condition in filter_chain()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (725 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 726/844] arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 728/844] clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 Sasha Levin
` (125 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Breno Leitao, Peter Zijlstra (Intel), Oleg Nesterov,
Andrii Nakryiko, Masami Hiramatsu (Google), Sasha Levin
From: Breno Leitao <leitao@debian.org>
[ Upstream commit a56a38fd9196fc89401e498d70b7aa9c9679fa6e ]
The list_for_each_entry_rcu() in filter_chain() uses
rcu_read_lock_trace_held() as the lockdep condition, but the function
holds consumer_rwsem, not the RCU trace lock.
This gives me the following output when running with some locking debug
option enabled:
kernel/events/uprobes.c:1141 RCU-list traversed in non-reader section!!
filter_chain
register_for_each_vma
uprobe_unregister_nosync
__probe_event_disable
Remove the incorrect lockdep condition since the rwsem provides
sufficient protection for the list traversal.
Fixes: cc01bd044e6a ("uprobes: travers uprobe's consumer list locklessly under SRCU protection")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260128-uprobe_rcu-v2-1-994ea6d32730@debian.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/uprobes.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 1ab7a7e4efb63..3ec996ca6de0d 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1138,7 +1138,7 @@ static bool filter_chain(struct uprobe *uprobe, struct mm_struct *mm)
bool ret = false;
down_read(&uprobe->consumer_rwsem);
- list_for_each_entry_rcu(uc, &uprobe->consumers, cons_node, rcu_read_lock_trace_held()) {
+ list_for_each_entry(uc, &uprobe->consumers, cons_node) {
ret = consumer_filter(uc, mm);
if (ret)
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 728/844] clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (726 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 727/844] uprobes: Fix incorrect lockdep condition in filter_chain() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 729/844] btrfs: fix periodic reclaim condition Sasha Levin
` (124 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Marek Vasut, Geert Uytterhoeven, Stephen Boyd, Sasha Levin
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 5ec820fc28d0b8a0f3890d476b1976f20e8343cc ]
The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure
there are 8 slots for those newly registered clk_hw pointers, else
there is going to be out of bounds write when pointers 4..7 are set
into struct rs9_driver_data .clk_dif[4..7] field.
Since there are other structure members past this struct clk_hw
pointer array, writing to .clk_dif[4..7] fields corrupts both
the struct rs9_driver_data content and data around it, sometimes
without crashing the kernel. However, the kernel does surely
crash when the driver is unbound or during suspend.
Fix this, increase the struct clk_hw pointer array size to the
maximum output count of 9FGV0841, which is the biggest chip that
is supported by this driver.
Cc: stable@vger.kernel.org
Fixes: f0e5e1800204 ("clk: rs9: Add support for 9FGV0841")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Closes: https://lore.kernel.org/CAMuHMdVyQpOBT+Ho+mXY07fndFN9bKJdaaWGn91WOFnnYErLyg@mail.gmail.com
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-renesas-pcie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c
index 4c3a5e4eb77ac..f94a9c4d0b670 100644
--- a/drivers/clk/clk-renesas-pcie.c
+++ b/drivers/clk/clk-renesas-pcie.c
@@ -64,7 +64,7 @@ struct rs9_driver_data {
struct i2c_client *client;
struct regmap *regmap;
const struct rs9_chip_info *chip_info;
- struct clk_hw *clk_dif[4];
+ struct clk_hw *clk_dif[8];
u8 pll_amplitude;
u8 pll_ssc;
u8 clk_dif_sr;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 729/844] btrfs: fix periodic reclaim condition
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (727 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 728/844] clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 730/844] btrfs: zoned: fixup last alloc pointer after extent removal for RAID1 Sasha Levin
` (123 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sun YangKai, Boris Burkov, David Sterba, Sasha Levin
From: Sun YangKai <sunk67188@gmail.com>
[ Upstream commit 19eff93dc738e8afaa59cb374b44bb5a162e6c2d ]
Problems with current implementation:
1. reclaimable_bytes is signed while chunk_sz is unsigned, causing
negative reclaimable_bytes to trigger reclaim unexpectedly
2. The "space must be freed between scans" assumption breaks the
two-scan requirement: first scan marks block groups, second scan
reclaims them. Without the second scan, no reclamation occurs.
Instead, track actual reclaim progress: pause reclaim when block groups
will be reclaimed, and resume only when progress is made. This ensures
reclaim continues until no further progress can be made. And resume
periodic reclaim when there's enough free space.
And we take care if reclaim is making any progress now, so it's
unnecessary to set periodic_reclaim_ready to false when failed to reclaim
a block group.
Fixes: 813d4c6422516 ("btrfs: prevent pathological periodic reclaim loops")
CC: stable@vger.kernel.org # 6.12+
Suggested-by: Boris Burkov <boris@bur.io>
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Sun YangKai <sunk67188@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 6 ++++--
fs/btrfs/space-info.c | 21 ++++++++++++---------
2 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index c7be37bcbc48d..25a0d207f10c9 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -1872,6 +1872,7 @@ void btrfs_reclaim_bgs_work(struct work_struct *work)
while (!list_empty(&fs_info->reclaim_bgs)) {
u64 used;
u64 reserved;
+ u64 old_total;
int ret = 0;
bg = list_first_entry(&fs_info->reclaim_bgs,
@@ -1937,6 +1938,7 @@ void btrfs_reclaim_bgs_work(struct work_struct *work)
}
spin_unlock(&bg->lock);
+ old_total = space_info->total_bytes;
spin_unlock(&space_info->lock);
/*
@@ -1989,14 +1991,14 @@ void btrfs_reclaim_bgs_work(struct work_struct *work)
reserved = 0;
spin_lock(&space_info->lock);
space_info->reclaim_errors++;
- if (READ_ONCE(space_info->periodic_reclaim))
- space_info->periodic_reclaim_ready = false;
spin_unlock(&space_info->lock);
}
spin_lock(&space_info->lock);
space_info->reclaim_count++;
space_info->reclaim_bytes += used;
space_info->reclaim_bytes += reserved;
+ if (space_info->total_bytes < old_total)
+ btrfs_set_periodic_reclaim_ready(space_info, true);
spin_unlock(&space_info->lock);
next:
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 3f08e450f7961..30aedf596b548 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -2099,11 +2099,11 @@ static bool is_reclaim_urgent(struct btrfs_space_info *space_info)
return unalloc < data_chunk_size;
}
-static void do_reclaim_sweep(struct btrfs_space_info *space_info, int raid)
+static bool do_reclaim_sweep(struct btrfs_space_info *space_info, int raid)
{
struct btrfs_block_group *bg;
int thresh_pct;
- bool try_again = true;
+ bool will_reclaim = false;
bool urgent;
spin_lock(&space_info->lock);
@@ -2121,7 +2121,7 @@ static void do_reclaim_sweep(struct btrfs_space_info *space_info, int raid)
spin_lock(&bg->lock);
thresh = mult_perc(bg->length, thresh_pct);
if (bg->used < thresh && bg->reclaim_mark) {
- try_again = false;
+ will_reclaim = true;
reclaim = true;
}
bg->reclaim_mark++;
@@ -2138,12 +2138,13 @@ static void do_reclaim_sweep(struct btrfs_space_info *space_info, int raid)
* If we have any staler groups, we don't touch the fresher ones, but if we
* really need a block group, do take a fresh one.
*/
- if (try_again && urgent) {
- try_again = false;
+ if (!will_reclaim && urgent) {
+ urgent = false;
goto again;
}
up_read(&space_info->groups_sem);
+ return will_reclaim;
}
void btrfs_space_info_update_reclaimable(struct btrfs_space_info *space_info, s64 bytes)
@@ -2153,7 +2154,8 @@ void btrfs_space_info_update_reclaimable(struct btrfs_space_info *space_info, s6
lockdep_assert_held(&space_info->lock);
space_info->reclaimable_bytes += bytes;
- if (space_info->reclaimable_bytes >= chunk_sz)
+ if (space_info->reclaimable_bytes > 0 &&
+ space_info->reclaimable_bytes >= chunk_sz)
btrfs_set_periodic_reclaim_ready(space_info, true);
}
@@ -2180,7 +2182,6 @@ static bool btrfs_should_periodic_reclaim(struct btrfs_space_info *space_info)
spin_lock(&space_info->lock);
ret = space_info->periodic_reclaim_ready;
- btrfs_set_periodic_reclaim_ready(space_info, false);
spin_unlock(&space_info->lock);
return ret;
@@ -2194,8 +2195,10 @@ void btrfs_reclaim_sweep(const struct btrfs_fs_info *fs_info)
list_for_each_entry(space_info, &fs_info->space_info, list) {
if (!btrfs_should_periodic_reclaim(space_info))
continue;
- for (raid = 0; raid < BTRFS_NR_RAID_TYPES; raid++)
- do_reclaim_sweep(space_info, raid);
+ for (raid = 0; raid < BTRFS_NR_RAID_TYPES; raid++) {
+ if (do_reclaim_sweep(space_info, raid))
+ btrfs_set_periodic_reclaim_ready(space_info, false);
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 730/844] btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (728 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 729/844] btrfs: fix periodic reclaim condition Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 731/844] btrfs: zoned: fixup last alloc pointer after extent removal for DUP Sasha Levin
` (122 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Naohiro Aota, Johannes Thumshirn, David Sterba, Sasha Levin
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit dda3ec9ee6b3e120603bff1b798f25b51e54ac5d ]
When a block group is composed of a sequential write zone and a
conventional zone, we recover the (pseudo) write pointer of the
conventional zone using the end of the last allocated position.
However, if the last extent in a block group is removed, the last extent
position will be smaller than the other real write pointer position.
Then, that will cause an error due to mismatch of the write pointers.
We can fixup this case by moving the alloc_offset to the corresponding
write pointer position.
Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree")
CC: stable@vger.kernel.org # 6.12+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/zoned.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
index 359a98e6de851..f27ba6e9b47d5 100644
--- a/fs/btrfs/zoned.c
+++ b/fs/btrfs/zoned.c
@@ -1490,6 +1490,21 @@ static int btrfs_load_block_group_raid1(struct btrfs_block_group *bg,
/* In case a device is missing we have a cap of 0, so don't use it. */
bg->zone_capacity = min_not_zero(zone_info[0].capacity, zone_info[1].capacity);
+ /*
+ * When the last extent is removed, last_alloc can be smaller than the other write
+ * pointer. In that case, last_alloc should be moved to the corresponding write
+ * pointer position.
+ */
+ for (i = 0; i < map->num_stripes; i++) {
+ if (zone_info[i].alloc_offset == WP_MISSING_DEV ||
+ zone_info[i].alloc_offset == WP_CONVENTIONAL)
+ continue;
+ if (last_alloc <= zone_info[i].alloc_offset) {
+ last_alloc = zone_info[i].alloc_offset;
+ break;
+ }
+ }
+
for (i = 0; i < map->num_stripes; i++) {
if (zone_info[i].alloc_offset == WP_MISSING_DEV)
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 731/844] btrfs: zoned: fixup last alloc pointer after extent removal for DUP
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (729 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 730/844] btrfs: zoned: fixup last alloc pointer after extent removal for RAID1 Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 732/844] btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10 Sasha Levin
` (121 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Naohiro Aota, Johannes Thumshirn, David Sterba, Sasha Levin
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit e2d848649e64de39fc1b9c64002629b4daa1105d ]
When a block group is composed of a sequential write zone and a
conventional zone, we recover the (pseudo) write pointer of the
conventional zone using the end of the last allocated position.
However, if the last extent in a block group is removed, the last extent
position will be smaller than the other real write pointer position.
Then, that will cause an error due to mismatch of the write pointers.
We can fixup this case by moving the alloc_offset to the corresponding
write pointer position.
Fixes: c0d90a79e8e6 ("btrfs: zoned: fix alloc_offset calculation for partly conventional block groups")
CC: stable@vger.kernel.org # 6.16+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/zoned.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
index f27ba6e9b47d5..6c06581954181 100644
--- a/fs/btrfs/zoned.c
+++ b/fs/btrfs/zoned.c
@@ -1449,6 +1449,20 @@ static int btrfs_load_block_group_dup(struct btrfs_block_group *bg,
return -EIO;
}
+ /*
+ * When the last extent is removed, last_alloc can be smaller than the other write
+ * pointer. In that case, last_alloc should be moved to the corresponding write
+ * pointer position.
+ */
+ for (int i = 0; i < map->num_stripes; i++) {
+ if (zone_info[i].alloc_offset == WP_CONVENTIONAL)
+ continue;
+ if (last_alloc <= zone_info[i].alloc_offset) {
+ last_alloc = zone_info[i].alloc_offset;
+ break;
+ }
+ }
+
if (zone_info[0].alloc_offset == WP_CONVENTIONAL)
zone_info[0].alloc_offset = last_alloc;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 732/844] btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (730 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 731/844] btrfs: zoned: fixup last alloc pointer after extent removal for DUP Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 733/844] btrfs: continue trimming remaining devices on failure Sasha Levin
` (120 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Naohiro Aota, Johannes Thumshirn, David Sterba, Sasha Levin
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit 52ee9965d09b2c56a027613db30d1fb20d623861 ]
When a block group is composed of a sequential write zone and a
conventional zone, we recover the (pseudo) write pointer of the
conventional zone using the end of the last allocated position.
However, if the last extent in a block group is removed, the last extent
position will be smaller than the other real write pointer position.
Then, that will cause an error due to mismatch of the write pointers.
We can fixup this case by moving the alloc_offset to the corresponding
write pointer position.
Fixes: 568220fa9657 ("btrfs: zoned: support RAID0/1/10 on top of raid stripe tree")
CC: stable@vger.kernel.org # 6.12+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/zoned.c | 194 +++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 179 insertions(+), 15 deletions(-)
diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c
index 6c06581954181..392e6ad874cc7 100644
--- a/fs/btrfs/zoned.c
+++ b/fs/btrfs/zoned.c
@@ -1560,7 +1560,9 @@ static int btrfs_load_block_group_raid0(struct btrfs_block_group *bg,
{
struct btrfs_fs_info *fs_info = bg->fs_info;
u64 stripe_nr = 0, stripe_offset = 0;
+ u64 prev_offset = 0;
u32 stripe_index = 0;
+ bool has_partial = false, has_conventional = false;
if ((map->type & BTRFS_BLOCK_GROUP_DATA) && !fs_info->stripe_root) {
btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree",
@@ -1568,6 +1570,35 @@ static int btrfs_load_block_group_raid0(struct btrfs_block_group *bg,
return -EINVAL;
}
+ /*
+ * When the last extent is removed, last_alloc can be smaller than the other write
+ * pointer. In that case, last_alloc should be moved to the corresponding write
+ * pointer position.
+ */
+ for (int i = 0; i < map->num_stripes; i++) {
+ u64 alloc;
+
+ if (zone_info[i].alloc_offset == WP_MISSING_DEV ||
+ zone_info[i].alloc_offset == WP_CONVENTIONAL)
+ continue;
+
+ stripe_nr = zone_info[i].alloc_offset >> BTRFS_STRIPE_LEN_SHIFT;
+ stripe_offset = zone_info[i].alloc_offset & BTRFS_STRIPE_LEN_MASK;
+ if (stripe_offset == 0 && stripe_nr > 0) {
+ stripe_nr--;
+ stripe_offset = BTRFS_STRIPE_LEN;
+ }
+ alloc = ((stripe_nr * map->num_stripes + i) << BTRFS_STRIPE_LEN_SHIFT) +
+ stripe_offset;
+ last_alloc = max(last_alloc, alloc);
+
+ /* Partially written stripe found. It should be last. */
+ if (zone_info[i].alloc_offset & BTRFS_STRIPE_LEN_MASK)
+ break;
+ }
+ stripe_nr = 0;
+ stripe_offset = 0;
+
if (last_alloc) {
u32 factor = map->num_stripes;
@@ -1581,7 +1612,7 @@ static int btrfs_load_block_group_raid0(struct btrfs_block_group *bg,
continue;
if (zone_info[i].alloc_offset == WP_CONVENTIONAL) {
-
+ has_conventional = true;
zone_info[i].alloc_offset = btrfs_stripe_nr_to_offset(stripe_nr);
if (stripe_index > i)
@@ -1590,6 +1621,28 @@ static int btrfs_load_block_group_raid0(struct btrfs_block_group *bg,
zone_info[i].alloc_offset += stripe_offset;
}
+ /* Verification */
+ if (i != 0) {
+ if (unlikely(prev_offset < zone_info[i].alloc_offset)) {
+ btrfs_err(fs_info,
+ "zoned: stripe position disorder found in block group %llu",
+ bg->start);
+ return -EIO;
+ }
+
+ if (unlikely(has_partial &&
+ (zone_info[i].alloc_offset & BTRFS_STRIPE_LEN_MASK))) {
+ btrfs_err(fs_info,
+ "zoned: multiple partial written stripe found in block group %llu",
+ bg->start);
+ return -EIO;
+ }
+ }
+ prev_offset = zone_info[i].alloc_offset;
+
+ if ((zone_info[i].alloc_offset & BTRFS_STRIPE_LEN_MASK) != 0)
+ has_partial = true;
+
if (test_bit(0, active) != test_bit(i, active)) {
if (unlikely(!btrfs_zone_activate(bg)))
return -EIO;
@@ -1601,6 +1654,19 @@ static int btrfs_load_block_group_raid0(struct btrfs_block_group *bg,
bg->alloc_offset += zone_info[i].alloc_offset;
}
+ /* Check if all devices stay in the same stripe row. */
+ if (unlikely(zone_info[0].alloc_offset -
+ zone_info[map->num_stripes - 1].alloc_offset > BTRFS_STRIPE_LEN)) {
+ btrfs_err(fs_info, "zoned: stripe gap too large in block group %llu", bg->start);
+ return -EIO;
+ }
+
+ if (unlikely(has_conventional && bg->alloc_offset < last_alloc)) {
+ btrfs_err(fs_info, "zoned: allocated extent stays beyond write pointers %llu %llu",
+ bg->alloc_offset, last_alloc);
+ return -EIO;
+ }
+
return 0;
}
@@ -1611,8 +1677,11 @@ static int btrfs_load_block_group_raid10(struct btrfs_block_group *bg,
u64 last_alloc)
{
struct btrfs_fs_info *fs_info = bg->fs_info;
+ u64 AUTO_KFREE(raid0_allocs);
u64 stripe_nr = 0, stripe_offset = 0;
u32 stripe_index = 0;
+ bool has_partial = false, has_conventional = false;
+ u64 prev_offset = 0;
if ((map->type & BTRFS_BLOCK_GROUP_DATA) && !fs_info->stripe_root) {
btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree",
@@ -1620,6 +1689,60 @@ static int btrfs_load_block_group_raid10(struct btrfs_block_group *bg,
return -EINVAL;
}
+ raid0_allocs = kcalloc(map->num_stripes / map->sub_stripes, sizeof(*raid0_allocs),
+ GFP_NOFS);
+ if (!raid0_allocs)
+ return -ENOMEM;
+
+ /*
+ * When the last extent is removed, last_alloc can be smaller than the other write
+ * pointer. In that case, last_alloc should be moved to the corresponding write
+ * pointer position.
+ */
+ for (int i = 0; i < map->num_stripes; i += map->sub_stripes) {
+ u64 alloc = zone_info[i].alloc_offset;
+
+ for (int j = 1; j < map->sub_stripes; j++) {
+ int idx = i + j;
+
+ if (zone_info[idx].alloc_offset == WP_MISSING_DEV ||
+ zone_info[idx].alloc_offset == WP_CONVENTIONAL)
+ continue;
+ if (alloc == WP_MISSING_DEV || alloc == WP_CONVENTIONAL) {
+ alloc = zone_info[idx].alloc_offset;
+ } else if (unlikely(zone_info[idx].alloc_offset != alloc)) {
+ btrfs_err(fs_info,
+ "zoned: write pointer mismatch found in block group %llu",
+ bg->start);
+ return -EIO;
+ }
+ }
+
+ raid0_allocs[i / map->sub_stripes] = alloc;
+ if (alloc == WP_CONVENTIONAL)
+ continue;
+ if (unlikely(alloc == WP_MISSING_DEV)) {
+ btrfs_err(fs_info,
+ "zoned: cannot recover write pointer of block group %llu due to missing device",
+ bg->start);
+ return -EIO;
+ }
+
+ stripe_nr = alloc >> BTRFS_STRIPE_LEN_SHIFT;
+ stripe_offset = alloc & BTRFS_STRIPE_LEN_MASK;
+ if (stripe_offset == 0 && stripe_nr > 0) {
+ stripe_nr--;
+ stripe_offset = BTRFS_STRIPE_LEN;
+ }
+
+ alloc = ((stripe_nr * (map->num_stripes / map->sub_stripes) +
+ (i / map->sub_stripes)) <<
+ BTRFS_STRIPE_LEN_SHIFT) + stripe_offset;
+ last_alloc = max(last_alloc, alloc);
+ }
+ stripe_nr = 0;
+ stripe_offset = 0;
+
if (last_alloc) {
u32 factor = map->num_stripes / map->sub_stripes;
@@ -1629,24 +1752,51 @@ static int btrfs_load_block_group_raid10(struct btrfs_block_group *bg,
}
for (int i = 0; i < map->num_stripes; i++) {
- if (zone_info[i].alloc_offset == WP_MISSING_DEV)
- continue;
+ int idx = i / map->sub_stripes;
- if (test_bit(0, active) != test_bit(i, active)) {
- if (unlikely(!btrfs_zone_activate(bg)))
- return -EIO;
- } else {
- if (test_bit(0, active))
- set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &bg->runtime_flags);
+ if (raid0_allocs[idx] == WP_CONVENTIONAL) {
+ has_conventional = true;
+ raid0_allocs[idx] = btrfs_stripe_nr_to_offset(stripe_nr);
+
+ if (stripe_index > idx)
+ raid0_allocs[idx] += BTRFS_STRIPE_LEN;
+ else if (stripe_index == idx)
+ raid0_allocs[idx] += stripe_offset;
}
- if (zone_info[i].alloc_offset == WP_CONVENTIONAL) {
- zone_info[i].alloc_offset = btrfs_stripe_nr_to_offset(stripe_nr);
+ if ((i % map->sub_stripes) == 0) {
+ /* Verification */
+ if (i != 0) {
+ if (unlikely(prev_offset < raid0_allocs[idx])) {
+ btrfs_err(fs_info,
+ "zoned: stripe position disorder found in block group %llu",
+ bg->start);
+ return -EIO;
+ }
- if (stripe_index > (i / map->sub_stripes))
- zone_info[i].alloc_offset += BTRFS_STRIPE_LEN;
- else if (stripe_index == (i / map->sub_stripes))
- zone_info[i].alloc_offset += stripe_offset;
+ if (unlikely(has_partial &&
+ (raid0_allocs[idx] & BTRFS_STRIPE_LEN_MASK))) {
+ btrfs_err(fs_info,
+ "zoned: multiple partial written stripe found in block group %llu",
+ bg->start);
+ return -EIO;
+ }
+ }
+ prev_offset = raid0_allocs[idx];
+
+ if ((raid0_allocs[idx] & BTRFS_STRIPE_LEN_MASK) != 0)
+ has_partial = true;
+ }
+
+ if (zone_info[i].alloc_offset == WP_MISSING_DEV ||
+ zone_info[i].alloc_offset == WP_CONVENTIONAL)
+ zone_info[i].alloc_offset = raid0_allocs[idx];
+
+ if (test_bit(0, active) != test_bit(i, active)) {
+ if (unlikely(!btrfs_zone_activate(bg)))
+ return -EIO;
+ } else if (test_bit(0, active)) {
+ set_bit(BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE, &bg->runtime_flags);
}
if ((i % map->sub_stripes) == 0) {
@@ -1655,6 +1805,20 @@ static int btrfs_load_block_group_raid10(struct btrfs_block_group *bg,
}
}
+ /* Check if all devices stay in the same stripe row. */
+ if (unlikely(zone_info[0].alloc_offset -
+ zone_info[map->num_stripes - 1].alloc_offset > BTRFS_STRIPE_LEN)) {
+ btrfs_err(fs_info, "zoned: stripe gap too large in block group %llu",
+ bg->start);
+ return -EIO;
+ }
+
+ if (unlikely(has_conventional && bg->alloc_offset < last_alloc)) {
+ btrfs_err(fs_info, "zoned: allocated extent stays beyond write pointers %llu %llu",
+ bg->alloc_offset, last_alloc);
+ return -EIO;
+ }
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 733/844] btrfs: continue trimming remaining devices on failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (731 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 732/844] btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10 Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 734/844] iommupt: Always add IOVA range to iotlb_gather in gather_range_pages() Sasha Levin
` (119 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: jinbaohong, Qu Wenruo, Robbie Ko, Filipe Manana, David Sterba,
Sasha Levin
From: jinbaohong <jinbaohong@synology.com>
[ Upstream commit 912d1c6680bdb40b72b1b9204706f32b6eb842c3 ]
Commit 93bba24d4b5a ("btrfs: Enhance btrfs_trim_fs function to handle
error better") intended to make device trimming continue even if one
device fails, tracking failures and reporting them at the end. However,
it used 'break' instead of 'continue', causing the loop to exit on the
first device failure.
Fix this by replacing 'break' with 'continue'.
Fixes: 93bba24d4b5a ("btrfs: Enhance btrfs_trim_fs function to handle error better")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: jinbaohong <jinbaohong@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 8bdb609f58a7e..bc0db6593f329 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -6588,7 +6588,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
if (ret) {
dev_failed++;
dev_ret = ret;
- break;
+ continue;
}
}
mutex_unlock(&fs_devices->device_list_mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 734/844] iommupt: Always add IOVA range to iotlb_gather in gather_range_pages()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (732 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 733/844] btrfs: continue trimming remaining devices on failure Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 735/844] remoteproc: imx_rproc: Fix invalid loaded resource table detection Sasha Levin
` (118 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Yu Zhang, Jason Gunthorpe, Joerg Roedel, Sasha Levin
From: Yu Zhang <zhangyu1@linux.microsoft.com>
[ Upstream commit b48ca920613858b477f75946907e72c74570af05 ]
Add current (iova, len) to the iotlb gather, regardless of the setting
of PT_FEAT_FLUSH_RANGE or PT_FEAT_FLUSH_RANGE_NO_GAPS.
In gather_range_pages(), the current IOVA range is only added to
iotlb_gather when PT_FEAT_FLUSH_RANGE is set. Yet a virtual IOMMU with
NpCache uses only PT_FEAT_FLUSH_RANGE_NO_GAPS. In that case, iotlb_gather
will stay empty (start=ULONG_MAX, end=0) after initialization, and the
current (iova, len) will not be added to the iotlb_gather, causing
subsequent iommu_iotlb_sync() to perform IOTLB invalidation with wrong
parameters (e.g., amd_iommu_iotlb_sync() computes size from
gather->end - gather->start + 1, leading to an invalid range).
The disjoint check and sync for PT_FEAT_FLUSH_RANGE_NO_GAPS remain
unchanged: when the new range is disjoint from the existing gather,
we still sync first and then add the new range, so semantics for
NO_GAPS are preserved.
Fixes: 7c53f4238aa8 ("iommupt: Add unmap_pages op")
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Yu Zhang <zhangyu1@linux.microsoft.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/generic_pt/iommu_pt.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h
index d575f3ba9d341..3e33fe64feab2 100644
--- a/drivers/iommu/generic_pt/iommu_pt.h
+++ b/drivers/iommu/generic_pt/iommu_pt.h
@@ -58,10 +58,9 @@ static void gather_range_pages(struct iommu_iotlb_gather *iotlb_gather,
* Note that the sync frees the gather's free list, so we must
* not have any pages on that list that are covered by iova/len
*/
- } else if (pt_feature(common, PT_FEAT_FLUSH_RANGE)) {
- iommu_iotlb_gather_add_range(iotlb_gather, iova, len);
}
+ iommu_iotlb_gather_add_range(iotlb_gather, iova, len);
iommu_pages_list_splice(free_list, &iotlb_gather->freelist);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 735/844] remoteproc: imx_rproc: Fix invalid loaded resource table detection
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (733 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 734/844] iommupt: Always add IOVA range to iotlb_gather in gather_range_pages() Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 736/844] perf/arm-cmn: Reject unsupported hardware configurations Sasha Levin
` (117 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Peng Fan, Daniel Baluta, Mathieu Poirier, Sasha Levin
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d ]
imx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded
resource table even when the current firmware does not provide one.
When the device tree contains a "rsc-table" entry, priv->rsc_table is
non-NULL and denotes where a resource table would be located if one is
present in memory. However, when the current firmware has no resource
table, rproc->table_ptr is NULL. The function still returns
priv->rsc_table, and the remoteproc core interprets this as a valid loaded
resource table.
Fix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when
there is no resource table for the current firmware (i.e. when
rproc->table_ptr is NULL). This aligns the function's semantics with the
remoteproc core: a loaded resource table is only reported when a valid
table_ptr exists.
With this change, starting firmware without a resource table no longer
triggers a crash.
Fixes: e954a1bd1610 ("remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table")
Cc: stable@vger.kernel.org
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://lore.kernel.org/r/20260129-imx-rproc-fix-v3-1-fc4e41e6e750@nxp.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/imx_rproc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index 33f21ab24c921..d93bf5134d6f0 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -609,6 +609,10 @@ imx_rproc_elf_find_loaded_rsc_table(struct rproc *rproc, const struct firmware *
{
struct imx_rproc *priv = rproc->priv;
+ /* No resource table in the firmware */
+ if (!rproc->table_ptr)
+ return NULL;
+
if (priv->rsc_table)
return (struct resource_table *)priv->rsc_table;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 736/844] perf/arm-cmn: Reject unsupported hardware configurations
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (734 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 735/844] remoteproc: imx_rproc: Fix invalid loaded resource table detection Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 737/844] scsi: ufs: core: Flush exception handling work when RPM level is zero Sasha Levin
` (116 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Robin Murphy, Ilkka Koskinen, Will Deacon, Sasha Levin
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit 36c0de02575ce59dfd879eb4ef63d53a68bbf9ce ]
So far we've been fairly lax about accepting both unknown CMN models
(at least with a warning), and unknown revisions of those which we
do know, as although things do frequently change between releases,
typically enough remains the same to be somewhat useful for at least
some basic bringup checks. However, we also make assumptions of the
maximum supported sizes and numbers of things in various places, and
there's no guarantee that something new might not be bigger and lead
to nasty array overflows. Make sure we only try to run on things that
actually match our assumptions and so will not risk memory corruption.
We have at least always failed on completely unknown node types, so
update that error message for clarity and consistency too.
Cc: stable@vger.kernel.org
Fixes: 7819e05a0dce ("perf/arm-cmn: Revamp model detection")
Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/arm-cmn.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
index 651edd73bfcb1..4fbafc4b79843 100644
--- a/drivers/perf/arm-cmn.c
+++ b/drivers/perf/arm-cmn.c
@@ -2422,6 +2422,15 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn);
dn->portid_bits = xp->portid_bits;
dn->deviceid_bits = xp->deviceid_bits;
+ /*
+ * Logical IDs are assigned from 0 per node type, so as
+ * soon as we see one bigger than expected, we can assume
+ * there are more than we can cope with.
+ */
+ if (dn->logid > CMN_MAX_NODES_PER_EVENT) {
+ dev_err(cmn->dev, "Node ID invalid for supported CMN versions: %d\n", dn->logid);
+ return -ENODEV;
+ }
switch (dn->type) {
case CMN_TYPE_DTC:
@@ -2471,7 +2480,7 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
break;
/* Something has gone horribly wrong */
default:
- dev_err(cmn->dev, "invalid device node type: 0x%x\n", dn->type);
+ dev_err(cmn->dev, "Device node type invalid for supported CMN versions: 0x%x\n", dn->type);
return -ENODEV;
}
}
@@ -2499,6 +2508,10 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
cmn->mesh_x = cmn->num_xps;
cmn->mesh_y = cmn->num_xps / cmn->mesh_x;
+ if (max(cmn->mesh_x, cmn->mesh_y) > CMN_MAX_DIMENSION) {
+ dev_err(cmn->dev, "Mesh size invalid for supported CMN versions: %dx%d\n", cmn->mesh_x, cmn->mesh_y);
+ return -ENODEV;
+ }
/* 1x1 config plays havoc with XP event encodings */
if (cmn->num_xps == 1)
dev_warn(cmn->dev, "1x1 config not fully supported, translate XP events manually\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 737/844] scsi: ufs: core: Flush exception handling work when RPM level is zero
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (735 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 736/844] perf/arm-cmn: Reject unsupported hardware configurations Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 738/844] mm/slab: avoid allocating slabobj_ext array from its own slab Sasha Levin
` (115 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Yen, Peter Wang, Bart Van Assche, Martin K. Petersen,
Sasha Levin
From: Thomas Yen <thomasyen@google.com>
[ Upstream commit f8ef441811ec413717f188f63d99182f30f0f08e ]
Ensure that the exception event handling work is explicitly flushed during
suspend when the runtime power management level is set to UFS_PM_LVL_0.
When the RPM level is zero, the device power mode and link state both
remain active. Previously, the UFS core driver bypassed flushing exception
event handling jobs in this configuration. This created a race condition
where the driver could attempt to access the host controller to handle an
exception after the system had already entered a deep power-down state,
resulting in a system crash.
Explicitly flush this work and disable auto BKOPs before the suspend
callback proceeds. This guarantees that pending exception tasks complete
and prevents illegal hardware access during the power-down sequence.
Fixes: 57d104c153d3 ("ufs: add UFS power management support")
Signed-off-by: Thomas Yen <thomasyen@google.com>
Cc: Stable Tree <stable@vger.kernel.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260129165156.956601-1-thomasyen@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 604043a7533d3..09f0d77d57f02 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -9994,6 +9994,8 @@ static int __ufshcd_wl_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)
if (req_dev_pwr_mode == UFS_ACTIVE_PWR_MODE &&
req_link_state == UIC_LINK_ACTIVE_STATE) {
+ ufshcd_disable_auto_bkops(hba);
+ flush_work(&hba->eeh_work);
goto vops_suspend;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 738/844] mm/slab: avoid allocating slabobj_ext array from its own slab
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (736 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 737/844] scsi: ufs: core: Flush exception handling work when RPM level is zero Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 739/844] mm/slab: use unsigned long for orig_size to ensure proper metadata align Sasha Levin
` (114 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Harry Yoo, kernel test robot, Hao Li, Vlastimil Babka,
Sasha Levin
From: Harry Yoo <harry.yoo@oracle.com>
[ Upstream commit 280ea9c3154b2af7d841f992c9fc79e9d6534e03 ]
When allocating slabobj_ext array in alloc_slab_obj_exts(), the array
can be allocated from the same slab we're allocating the array for.
This led to obj_exts_in_slab() incorrectly returning true [1],
although the array is not allocated from wasted space of the slab.
Vlastimil Babka observed that this problem should be fixed even when
ignoring its incompatibility with obj_exts_in_slab(), because it creates
slabs that are never freed as there is always at least one allocated
object.
To avoid this, use the next kmalloc size or large kmalloc when
the array can be allocated from the same cache we're allocating
the array for.
In case of random kmalloc caches, there are multiple kmalloc caches
for the same size and the cache is selected based on the caller address.
Because it is fragile to ensure the same caller address is passed to
kmalloc_slab(), kmalloc_noprof(), and kmalloc_node_noprof(), bump the
size to (s->object_size + 1) when the sizes are equal, instead of
directly comparing the kmem_cache pointers.
Note that this doesn't happen when memory allocation profiling is
disabled, as when the allocation of the array is triggered by memory
cgroup (KMALLOC_CGROUP), the array is allocated from KMALLOC_NORMAL.
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202601231457.f7b31e09-lkp@intel.com [1]
Cc: stable@vger.kernel.org
Fixes: 4b8736964640 ("mm/slab: add allocation accounting into slab allocation and free paths")
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Link: https://patch.msgid.link/20260126125714.88008-1-harry.yoo@oracle.com
Reviewed-by: Hao Li <hao.li@linux.dev>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slub.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++-------
1 file changed, 53 insertions(+), 7 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index e1583757331e7..9a7c2fec6208a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2095,6 +2095,49 @@ static inline void init_slab_obj_exts(struct slab *slab)
slab->obj_exts = 0;
}
+/*
+ * Calculate the allocation size for slabobj_ext array.
+ *
+ * When memory allocation profiling is enabled, the obj_exts array
+ * could be allocated from the same slab cache it's being allocated for.
+ * This would prevent the slab from ever being freed because it would
+ * always contain at least one allocated object (its own obj_exts array).
+ *
+ * To avoid this, increase the allocation size when we detect the array
+ * may come from the same cache, forcing it to use a different cache.
+ */
+static inline size_t obj_exts_alloc_size(struct kmem_cache *s,
+ struct slab *slab, gfp_t gfp)
+{
+ size_t sz = sizeof(struct slabobj_ext) * slab->objects;
+ struct kmem_cache *obj_exts_cache;
+
+ /*
+ * slabobj_ext array for KMALLOC_CGROUP allocations
+ * are served from KMALLOC_NORMAL caches.
+ */
+ if (!mem_alloc_profiling_enabled())
+ return sz;
+
+ if (sz > KMALLOC_MAX_CACHE_SIZE)
+ return sz;
+
+ if (!is_kmalloc_normal(s))
+ return sz;
+
+ obj_exts_cache = kmalloc_slab(sz, NULL, gfp, 0);
+ /*
+ * We can't simply compare s with obj_exts_cache, because random kmalloc
+ * caches have multiple caches per size, selected by caller address.
+ * Since caller address may differ between kmalloc_slab() and actual
+ * allocation, bump size when sizes are equal.
+ */
+ if (s->object_size == obj_exts_cache->object_size)
+ return obj_exts_cache->object_size + 1;
+
+ return sz;
+}
+
int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
gfp_t gfp, bool new_slab)
{
@@ -2103,26 +2146,26 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
unsigned long new_exts;
unsigned long old_exts;
struct slabobj_ext *vec;
+ size_t sz;
gfp &= ~OBJCGS_CLEAR_MASK;
/* Prevent recursive extension vector allocation */
gfp |= __GFP_NO_OBJ_EXT;
+ sz = obj_exts_alloc_size(s, slab, gfp);
+
/*
* Note that allow_spin may be false during early boot and its
* restricted GFP_BOOT_MASK. Due to kmalloc_nolock() only supporting
* architectures with cmpxchg16b, early obj_exts will be missing for
* very early allocations on those.
*/
- if (unlikely(!allow_spin)) {
- size_t sz = objects * sizeof(struct slabobj_ext);
-
+ if (unlikely(!allow_spin))
vec = kmalloc_nolock(sz, __GFP_ZERO | __GFP_NO_OBJ_EXT,
slab_nid(slab));
- } else {
- vec = kcalloc_node(objects, sizeof(struct slabobj_ext), gfp,
- slab_nid(slab));
- }
+ else
+ vec = kmalloc_node(sz, gfp | __GFP_ZERO, slab_nid(slab));
+
if (!vec) {
/*
* Try to mark vectors which failed to allocate.
@@ -2136,6 +2179,9 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
return -ENOMEM;
}
+ VM_WARN_ON_ONCE(virt_to_slab(vec) != NULL &&
+ virt_to_slab(vec)->slab_cache == s);
+
new_exts = (unsigned long)vec;
if (unlikely(!allow_spin))
new_exts |= OBJEXTS_NOSPIN_ALLOC;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 739/844] mm/slab: use unsigned long for orig_size to ensure proper metadata align
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (737 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 738/844] mm/slab: avoid allocating slabobj_ext array from its own slab Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 740/844] PM: sleep: core: Avoid bit field races related to work_in_progress Sasha Levin
` (113 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Harry Yoo, Andrey Ryabinin, Vlastimil Babka, Sasha Levin
From: Harry Yoo <harry.yoo@oracle.com>
[ Upstream commit b85f369b81aed457acbea4ad3314218254a72fd2 ]
When both KASAN and SLAB_STORE_USER are enabled, accesses to
struct kasan_alloc_meta fields can be misaligned on 64-bit architectures.
This occurs because orig_size is currently defined as unsigned int,
which only guarantees 4-byte alignment. When struct kasan_alloc_meta is
placed after orig_size, it may end up at a 4-byte boundary rather than
the required 8-byte boundary on 64-bit systems.
Note that 64-bit architectures without HAVE_EFFICIENT_UNALIGNED_ACCESS
are assumed to require 64-bit accesses to be 64-bit aligned.
See HAVE_64BIT_ALIGNED_ACCESS and commit adab66b71abf ("Revert:
"ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"") for more details.
Change orig_size from unsigned int to unsigned long to ensure proper
alignment for any subsequent metadata. This should not waste additional
memory because kmalloc objects are already aligned to at least
ARCH_KMALLOC_MINALIGN.
Closes: https://lore.kernel.org/all/aPrLF0OUK651M4dk@hyeyoo
Suggested-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 6edf2576a6cc ("mm/slub: enable debugging memory wasting of kmalloc")
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Closes: https://lore.kernel.org/all/aPrLF0OUK651M4dk@hyeyoo/
Link: https://patch.msgid.link/20260113061845.159790-2-harry.yoo@oracle.com
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slub.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index 9a7c2fec6208a..78946116ecd2f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -857,7 +857,7 @@ static inline bool slab_update_freelist(struct kmem_cache *s, struct slab *slab,
* request size in the meta data area, for better debug and sanity check.
*/
static inline void set_orig_size(struct kmem_cache *s,
- void *object, unsigned int orig_size)
+ void *object, unsigned long orig_size)
{
void *p = kasan_reset_tag(object);
@@ -867,10 +867,10 @@ static inline void set_orig_size(struct kmem_cache *s,
p += get_info_end(s);
p += sizeof(struct track) * 2;
- *(unsigned int *)p = orig_size;
+ *(unsigned long *)p = orig_size;
}
-static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
+static inline unsigned long get_orig_size(struct kmem_cache *s, void *object)
{
void *p = kasan_reset_tag(object);
@@ -883,7 +883,7 @@ static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
p += get_info_end(s);
p += sizeof(struct track) * 2;
- return *(unsigned int *)p;
+ return *(unsigned long *)p;
}
#ifdef CONFIG_SLUB_DEBUG
@@ -1198,7 +1198,7 @@ static void print_trailer(struct kmem_cache *s, struct slab *slab, u8 *p)
off += 2 * sizeof(struct track);
if (slub_debug_orig_size(s))
- off += sizeof(unsigned int);
+ off += sizeof(unsigned long);
off += kasan_metadata_size(s, false);
@@ -1394,7 +1394,7 @@ static int check_pad_bytes(struct kmem_cache *s, struct slab *slab, u8 *p)
off += 2 * sizeof(struct track);
if (s->flags & SLAB_KMALLOC)
- off += sizeof(unsigned int);
+ off += sizeof(unsigned long);
}
off += kasan_metadata_size(s, false);
@@ -8021,7 +8021,7 @@ static int calculate_sizes(struct kmem_cache_args *args, struct kmem_cache *s)
/* Save the original kmalloc request size */
if (flags & SLAB_KMALLOC)
- size += sizeof(unsigned int);
+ size += sizeof(unsigned long);
}
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 740/844] PM: sleep: core: Avoid bit field races related to work_in_progress
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (738 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 739/844] mm/slab: use unsigned long for orig_size to ensure proper metadata align Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 741/844] MIPS: Loongson2ef: Register PCI controller in early stage Sasha Levin
` (112 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Xuewen Yan, Rafael J. Wysocki, Sasha Levin
From: Xuewen Yan <xuewen.yan@unisoc.com>
[ Upstream commit 0491f3f9f664e7e0131eb4d2a8b19c49562e5c64 ]
In all of the system suspend transition phases, the async processing of
a device may be carried out in parallel with power.work_in_progress
updates for the device's parent or suppliers and if it touches bit
fields from the same group (for example, power.must_resume or
power.wakeup_path), bit field corruption is possible.
To avoid that, turn work_in_progress in struct dev_pm_info into a proper
bool field and relocate it to save space.
Fixes: aa7a9275ab81 ("PM: sleep: Suspend async parents after suspending children")
Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous")
Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
Closes: https://lore.kernel.org/linux-pm/20260203063459.12808-1-xuewen.yan@unisoc.com/
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Added subject and changelog ]
Link: https://patch.msgid.link/CAB8ipk_VX2VPm706Jwa1=8NSA7_btWL2ieXmBgHr2JcULEP76g@mail.gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/pm.h b/include/linux/pm.h
index 98a899858ecee..afcaaa37a8126 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -681,10 +681,10 @@ struct dev_pm_info {
struct list_head entry;
struct completion completion;
struct wakeup_source *wakeup;
+ bool work_in_progress; /* Owned by the PM core */
bool wakeup_path:1;
bool syscore:1;
bool no_pm_callbacks:1; /* Owned by the PM core */
- bool work_in_progress:1; /* Owned by the PM core */
bool smart_suspend:1; /* Owned by the PM core */
bool must_resume:1; /* Owned by the PM core */
bool may_skip_resume:1; /* Set by subsystems */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 741/844] MIPS: Loongson2ef: Register PCI controller in early stage
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (739 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 740/844] PM: sleep: core: Avoid bit field races related to work_in_progress Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 742/844] MIPS: Loongson2ef: Use pcibios_align_resource() to block io range Sasha Levin
` (111 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Rong Zhang, Beiyan Yun, Yao Zi, Jiaxun Yang, Thomas Bogendoerfer,
Sasha Levin
From: Rong Zhang <rongrong@oss.cipunited.com>
[ Upstream commit 6a00c043af07492502ba7a2263ddc4cdb01b66a7 ]
We are about to set loongson_pci_io_resource.start to 0 and adopt
PCIBIOS_MIN_IO. As the first step, PCI controller needs to be registered
in early stage to make it the root of other resources (e.g., i8259) and
prevent resource conflicts.
Register it in plat_mem_setup() instead of arch_initcall().
Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()")
Cc: stable@vger.kernel.org
Tested-by: Beiyan Yun <root@infi.wang>
Tested-by: Yao Zi <me@ziyao.cc>
Signed-off-by: Rong Zhang <rongrong@oss.cipunited.com>
Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/mach-loongson2ef/loongson.h | 6 ++++++
arch/mips/loongson2ef/common/pci.c | 7 +------
arch/mips/loongson2ef/common/setup.c | 1 +
3 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/arch/mips/include/asm/mach-loongson2ef/loongson.h b/arch/mips/include/asm/mach-loongson2ef/loongson.h
index 4a098fb102325..0e586787eb87a 100644
--- a/arch/mips/include/asm/mach-loongson2ef/loongson.h
+++ b/arch/mips/include/asm/mach-loongson2ef/loongson.h
@@ -324,4 +324,10 @@ extern unsigned long _loongson_addrwincfg_base;
#endif /* ! CONFIG_CPU_SUPPORTS_ADDRWINCFG */
+#ifdef CONFIG_PCI
+void loongson2ef_pcibios_init(void);
+#else
+static inline void loongson2ef_pcibios_init(void) { }
+#endif
+
#endif /* __ASM_MACH_LOONGSON2EF_LOONGSON_H */
diff --git a/arch/mips/loongson2ef/common/pci.c b/arch/mips/loongson2ef/common/pci.c
index 7d9ea51e8c01e..55524f9a7b96b 100644
--- a/arch/mips/loongson2ef/common/pci.c
+++ b/arch/mips/loongson2ef/common/pci.c
@@ -73,15 +73,10 @@ static void __init setup_pcimap(void)
#endif
}
-static int __init pcibios_init(void)
+void __init loongson2ef_pcibios_init(void)
{
setup_pcimap();
loongson_pci_controller.io_map_base = mips_io_port_base;
register_pci_controller(&loongson_pci_controller);
-
-
- return 0;
}
-
-arch_initcall(pcibios_init);
diff --git a/arch/mips/loongson2ef/common/setup.c b/arch/mips/loongson2ef/common/setup.c
index 4fd27f4f90edb..a639e35acce59 100644
--- a/arch/mips/loongson2ef/common/setup.c
+++ b/arch/mips/loongson2ef/common/setup.c
@@ -27,4 +27,5 @@ EXPORT_SYMBOL(__wbflush);
void __init plat_mem_setup(void)
{
+ loongson2ef_pcibios_init();
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 742/844] MIPS: Loongson2ef: Use pcibios_align_resource() to block io range
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (740 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 741/844] MIPS: Loongson2ef: Register PCI controller in early stage Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 743/844] PCI: dwc: Fix msg_atu_index assignment Sasha Levin
` (110 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Rong Zhang, Beiyan Yun, Yao Zi, Jiaxun Yang, Thomas Bogendoerfer,
Sasha Levin
From: Rong Zhang <rongrong@oss.cipunited.com>
[ Upstream commit 32ec465103527ede09b640cd0ab0636dc58827fb ]
Loongson2ef reserves io range below 0x4000 (LOONGSON_PCI_IO_START) while
ISA-mode only IDE controller on the south bridge still has a hard
dependency on ISA IO ports.
The reservation was done by lifting loongson_pci_io_resource.start onto
0x4000. Prior to commit ae81aad5c2e1 ("MIPS: PCI: Use
pci_enable_resources()"), the arch specific pcibios_enable_resources()
did not check if the resources were claimed, which diverges from what
PCI core checks, effectively hiding the fact that IDE IO resources were
not properly within the resource tree. After starting to use
pcibios_enable_resources() from PCI core, enabling IDE controller fails:
pata_cs5536 0000:00:0e.2: BAR 0 [io 0x01f0-0x01f7]: not claimed; can't enable device
pata_cs5536 0000:00:0e.2: probe with driver pata_cs5536 failed with error -22
MIPS PCI code already has support for enforcing lower bounds using
PCIBIOS_MIN_IO in pcibios_align_resource() without altering the IO
window start address itself. Make Loongson2ef PCI code use
PCIBIOS_MIN_IO too.
Fixes: ae81aad5c2e1 ("MIPS: PCI: Use pci_enable_resources()")
Cc: stable@vger.kernel.org
Tested-by: Beiyan Yun <root@infi.wang>
Tested-by: Yao Zi <me@ziyao.cc>
Signed-off-by: Rong Zhang <rongrong@oss.cipunited.com>
Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/loongson2ef/common/pci.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/arch/mips/loongson2ef/common/pci.c b/arch/mips/loongson2ef/common/pci.c
index 55524f9a7b96b..0f11392104bfd 100644
--- a/arch/mips/loongson2ef/common/pci.c
+++ b/arch/mips/loongson2ef/common/pci.c
@@ -17,7 +17,7 @@ static struct resource loongson_pci_mem_resource = {
static struct resource loongson_pci_io_resource = {
.name = "pci io space",
- .start = LOONGSON_PCI_IO_START,
+ .start = 0x00000000UL, /* See loongson2ef_pcibios_init(). */
.end = IO_SPACE_LIMIT,
.flags = IORESOURCE_IO,
};
@@ -77,6 +77,15 @@ void __init loongson2ef_pcibios_init(void)
{
setup_pcimap();
+ /*
+ * ISA-mode only IDE controllers have a hard dependency on ISA IO ports.
+ *
+ * Claim them by setting PCI IO space to start at 0x00000000, and set
+ * PCIBIOS_MIN_IO to prevent non-legacy PCI devices from touching
+ * reserved regions.
+ */
+ PCIBIOS_MIN_IO = LOONGSON_PCI_IO_START;
+
loongson_pci_controller.io_map_base = mips_io_port_base;
register_pci_controller(&loongson_pci_controller);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 743/844] PCI: dwc: Fix msg_atu_index assignment
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (741 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 742/844] MIPS: Loongson2ef: Use pcibios_align_resource() to block io range Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 744/844] mux: mmio: fix regmap leak on probe failure Sasha Levin
` (109 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Niklas Cassel, Manivannan Sadhasivam, Maciej W. Rozycki,
Damien Le Moal, Hans Zhang, Frank Li, Shawn Lin, Sasha Levin
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 58fbf08935d9c4396417e5887df89a4e681fa7e3 ]
When dw_pcie_iatu_setup() configures outbound address translation for both
type PCIE_ATU_TYPE_MEM and PCIE_ATU_TYPE_IO, the iATU index to use is
incremented before calling dw_pcie_prog_outbound_atu().
However for msg_atu_index, the index is not incremented before use,
causing the iATU index to be the same as the last configured iATU index,
which means that it will incorrectly use the same iATU index that is
already in use, breaking outbound address translation.
In total there are three problems with this code:
-It assigns msg_atu_index the same index that was used for the last
outbound address translation window, rather than incrementing the index
before assignment.
-The index should only be incremented (and msg_atu_index assigned) if the
use_atu_msg feature is actually requested/in use (pp->use_atu_msg is set).
-If the use_atu_msg feature is requested/in use, and there are no outbound
iATUs available, the code should return an error, as otherwise when this
this feature is used, it will use an iATU index that is out of bounds.
Fixes: e1a4ec1a9520 ("PCI: dwc: Add generic MSG TLP support for sending PME_Turn_Off when system suspend")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Maciej W. Rozycki <macro@orcam.me.uk>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hans Zhang <zhanghuabing@ecosda.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260127151038.1484881-6-cassel@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-designware-host.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index af2eeed55f9e5..53125b97530b6 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -946,7 +946,14 @@ static int dw_pcie_iatu_setup(struct dw_pcie_rp *pp)
dev_warn(pci->dev, "Ranges exceed outbound iATU size (%d)\n",
pci->num_ob_windows);
- pp->msg_atu_index = i;
+ if (pp->use_atu_msg) {
+ if (pci->num_ob_windows > ++i) {
+ pp->msg_atu_index = i;
+ } else {
+ dev_err(pci->dev, "Cannot add outbound window for MSG TLP\n");
+ return -ENOMEM;
+ }
+ }
i = 0;
resource_list_for_each_entry(entry, &pp->bridge->dma_ranges) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 744/844] mux: mmio: fix regmap leak on probe failure
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (742 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 743/844] PCI: dwc: Fix msg_atu_index assignment Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 745/844] usb: dwc3: gadget: Move vbus draw to workqueue context Sasha Levin
` (108 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Johan Hovold, Andrew Davis, Greg Kroah-Hartman, Sasha Levin
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 3c4ae63073d84abee5d81ce46d86a94e9dae9c89 ]
The mmio regmap that may be allocated during probe is never freed.
Switch to using the device managed allocator so that the regmap is
released on probe failures (e.g. probe deferral) and on driver unbind.
Fixes: 61de83fd8256 ("mux: mmio: Do not use syscon helper to build regmap")
Cc: stable@vger.kernel.org # 6.16
Cc: Andrew Davis <afd@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Andrew Davis <afd@ti.com>
Link: https://patch.msgid.link/20251127134702.1915-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mux/mmio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mux/mmio.c b/drivers/mux/mmio.c
index 3409af1ffb80f..0611ef28bb69a 100644
--- a/drivers/mux/mmio.c
+++ b/drivers/mux/mmio.c
@@ -72,7 +72,7 @@ static int mux_mmio_probe(struct platform_device *pdev)
if (IS_ERR(base))
regmap = ERR_PTR(-ENODEV);
else
- regmap = regmap_init_mmio(dev, base, &mux_mmio_regmap_cfg);
+ regmap = devm_regmap_init_mmio(dev, base, &mux_mmio_regmap_cfg);
/* Fallback to checking the parent node on "real" errors. */
if (IS_ERR(regmap) && regmap != ERR_PTR(-EPROBE_DEFER)) {
regmap = dev_get_regmap(dev->parent, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 745/844] usb: dwc3: gadget: Move vbus draw to workqueue context
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (743 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 744/844] mux: mmio: fix regmap leak on probe failure Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:30 ` [PATCH 6.19 746/844] usb: dwc2: fix resume failure if dr_mode is host Sasha Levin
` (107 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Prashanth K, stable, Samuel Wu, Thinh Nguyen, Greg Kroah-Hartman,
Sasha Levin
From: Prashanth K <prashanth.k@oss.qualcomm.com>
[ Upstream commit 54aaa3b387c2f580a99dc86a9cc2eb6dfaf599a7 ]
Currently dwc3_gadget_vbus_draw() can be called from atomic
context, which in turn invokes power-supply-core APIs. And
some these PMIC APIs have operations that may sleep, leading
to kernel panic.
Fix this by moving the vbus_draw into a workqueue context.
Fixes: 99288de36020 ("usb: dwc3: add an alternate path in vbus_draw callback")
Cc: stable <stable@kernel.org>
Tested-by: Samuel Wu <wusamuel@google.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Link: https://patch.msgid.link/20260204054155.3063825-1-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc3/core.c | 19 ++++++++++++++++++-
drivers/usb/dwc3/core.h | 4 ++++
drivers/usb/dwc3/gadget.c | 8 +++-----
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 93fd5fdf95cb1..59801611dd756 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -2155,6 +2155,20 @@ static int dwc3_get_num_ports(struct dwc3 *dwc)
return 0;
}
+static void dwc3_vbus_draw_work(struct work_struct *work)
+{
+ struct dwc3 *dwc = container_of(work, struct dwc3, vbus_draw_work);
+ union power_supply_propval val = {0};
+ int ret;
+
+ val.intval = 1000 * (dwc->current_limit);
+ ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
+
+ if (ret < 0)
+ dev_dbg(dwc->dev, "Error (%d) setting vbus draw (%d mA)\n",
+ ret, dwc->current_limit);
+}
+
static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
{
struct power_supply *usb_psy;
@@ -2169,6 +2183,7 @@ static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
if (!usb_psy)
return ERR_PTR(-EPROBE_DEFER);
+ INIT_WORK(&dwc->vbus_draw_work, dwc3_vbus_draw_work);
return usb_psy;
}
@@ -2395,8 +2410,10 @@ void dwc3_core_remove(struct dwc3 *dwc)
dwc3_free_event_buffers(dwc);
- if (dwc->usb_psy)
+ if (dwc->usb_psy) {
+ cancel_work_sync(&dwc->vbus_draw_work);
power_supply_put(dwc->usb_psy);
+ }
}
EXPORT_SYMBOL_GPL(dwc3_core_remove);
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 45757169b672f..9cfc36d4bc259 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -1060,6 +1060,8 @@ struct dwc3_glue_ops {
* @role_switch_default_mode: default operation mode of controller while
* usb role is USB_ROLE_NONE.
* @usb_psy: pointer to power supply interface.
+ * @vbus_draw_work: Work to set the vbus drawing limit
+ * @current_limit: How much current to draw from vbus, in milliAmperes.
* @usb2_phy: pointer to USB2 PHY
* @usb3_phy: pointer to USB3 PHY
* @usb2_generic_phy: pointer to array of USB2 PHYs
@@ -1246,6 +1248,8 @@ struct dwc3 {
enum usb_dr_mode role_switch_default_mode;
struct power_supply *usb_psy;
+ struct work_struct vbus_draw_work;
+ unsigned int current_limit;
u32 fladj;
u32 ref_clk_per;
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8a35a6901db7d..5732d414e6a64 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3123,8 +3123,6 @@ static void dwc3_gadget_set_ssp_rate(struct usb_gadget *g,
static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
{
struct dwc3 *dwc = gadget_to_dwc(g);
- union power_supply_propval val = {0};
- int ret;
if (dwc->usb2_phy)
return usb_phy_set_power(dwc->usb2_phy, mA);
@@ -3132,10 +3130,10 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
if (!dwc->usb_psy)
return -EOPNOTSUPP;
- val.intval = 1000 * mA;
- ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
+ dwc->current_limit = mA;
+ schedule_work(&dwc->vbus_draw_work);
- return ret;
+ return 0;
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 746/844] usb: dwc2: fix resume failure if dr_mode is host
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (744 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 745/844] usb: dwc3: gadget: Move vbus draw to workqueue context Sasha Levin
@ 2026-02-28 17:30 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 747/844] mtd: rawnand: pl353: Fix software ECC support Sasha Levin
` (106 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:30 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jisheng Zhang, stable, Greg Kroah-Hartman, Sasha Levin
From: Jisheng Zhang <jszhang@kernel.org>
[ Upstream commit a52e4f2dff413b58c7200e89bb6540bd995e1269 ]
commit 13b1f8e25bfd1 ("usb: dwc2: Force mode optimizations") removed the
dwc2_force_mode(hsotg, true) in dwc2_force_dr_mode() if dr_mode is host.
But this brings a bug: the controller fails to resume back as host,
further debugging shows that the controller is resumed as peripheral.
The reason is dwc2_force_dr_mode() missed the host mode forcing, and
when resuming from s2ram, GINTSTS is 0 by default, dwc2_is_device_mode
in dwc2_resume() misreads this as the controller is in peripheral mode.
Fix the resume failure by adding back the dwc2_force_mode(hsotg, true).
Then an obvious question is: why this bug hasn't been observed and fixed
for about six years? There are two resons: most dwc2 platforms set the
dr_mode as otg; Some platforms don't have suspend & resume support yet.
Fixes: 13b1f8e25bfd1 ("usb: dwc2: Force mode optimizations")
Cc: stable <stable@kernel.org>
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260129021534.10411-1-jszhang@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index c3d24312db0fe..f375c5185bfe2 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -578,6 +578,7 @@ void dwc2_force_dr_mode(struct dwc2_hsotg *hsotg)
{
switch (hsotg->dr_mode) {
case USB_DR_MODE_HOST:
+ dwc2_force_mode(hsotg, true);
/*
* NOTE: This is required for some rockchip soc based
* platforms on their host-only dwc2.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 747/844] mtd: rawnand: pl353: Fix software ECC support
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (745 preceding siblings ...)
2026-02-28 17:30 ` [PATCH 6.19 746/844] usb: dwc2: fix resume failure if dr_mode is host Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 748/844] tipc: fix RCU dereference race in tipc_aead_users_dec() Sasha Levin
` (105 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Andrea Scian, stable, Miquel Raynal, Sasha Levin
From: Andrea Scian <andrea.scian@dave.eu>
[ Upstream commit 89b831ebdaca0df4ca3b226f7e7a1d1db1629060 ]
We need to set also write_page_raw in ecc structure to allow
choosing SW ECC instead of HW one, otherwise write operation fail.
Fixes: 08d8c62164a322 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
Signed-off-by: Andrea Scian <andrea.scian@dave.eu>
Cc: stable@kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/pl35x-nand-controller.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/nand/raw/pl35x-nand-controller.c b/drivers/mtd/nand/raw/pl35x-nand-controller.c
index 11bd90e3f18cb..7f012b7c3eaec 100644
--- a/drivers/mtd/nand/raw/pl35x-nand-controller.c
+++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c
@@ -976,6 +976,7 @@ static int pl35x_nand_attach_chip(struct nand_chip *chip)
fallthrough;
case NAND_ECC_ENGINE_TYPE_NONE:
case NAND_ECC_ENGINE_TYPE_SOFT:
+ chip->ecc.write_page_raw = nand_monolithic_write_page_raw;
break;
case NAND_ECC_ENGINE_TYPE_ON_HOST:
ret = pl35x_nand_init_hw_ecc_controller(nfc, chip);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 748/844] tipc: fix RCU dereference race in tipc_aead_users_dec()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (746 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 747/844] mtd: rawnand: pl353: Fix software ECC support Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 749/844] drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() Sasha Levin
` (104 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Daniel Hodges, Eric Dumazet, Jakub Kicinski, Sasha Levin
From: Daniel Hodges <hodgesd@meta.com>
[ Upstream commit 6a65c0cb0ff20b3cbc5f1c87b37dd22cdde14a1c ]
tipc_aead_users_dec() calls rcu_dereference(aead) twice: once to store
in 'tmp' for the NULL check, and again inside the atomic_add_unless()
call.
Use the already-dereferenced 'tmp' pointer consistently, matching the
correct pattern used in tipc_aead_users_inc() and tipc_aead_users_set().
Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
Cc: stable@vger.kernel.org
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Link: https://patch.msgid.link/20260203145621.17399-1-git@danielhodges.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
index 970db62bd029b..a3f9ca28c3d53 100644
--- a/net/tipc/crypto.c
+++ b/net/tipc/crypto.c
@@ -460,7 +460,7 @@ static void tipc_aead_users_dec(struct tipc_aead __rcu *aead, int lim)
rcu_read_lock();
tmp = rcu_dereference(aead);
if (tmp)
- atomic_add_unless(&rcu_dereference(aead)->users, -1, lim);
+ atomic_add_unless(&tmp->users, -1, lim);
rcu_read_unlock();
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 749/844] drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (747 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 748/844] tipc: fix RCU dereference race in tipc_aead_users_dec() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 750/844] drm/amdgpu: Protect GPU register accesses in powergated state in some paths Sasha Levin
` (103 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sunday Clement, Alexander Deucher, Alex Deucher, Sasha Levin
From: Sunday Clement <Sunday.Clement@amd.com>
[ Upstream commit 8a70a26c9f34baea6c3199a9862ddaff4554a96d ]
The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8
bytes via memset without checking the buffer size parameter. This allows
unprivileged userspace to trigger an out-of bounds kernel memory write
by passing a small buffer, leading to potential privilege
escalation.
Signed-off-by: Sunday Clement <Sunday.Clement@amd.com>
Reviewed-by: Alexander Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_events.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 5a190dd6be4e2..844a6a28a6408 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -331,6 +331,12 @@ static int kfd_event_page_set(struct kfd_process *p, void *kernel_address,
if (p->signal_page)
return -EBUSY;
+ if (size < KFD_SIGNAL_EVENT_LIMIT * 8) {
+ pr_err("Event page size %llu is too small, need at least %lu bytes\n",
+ size, (unsigned long)(KFD_SIGNAL_EVENT_LIMIT * 8));
+ return -EINVAL;
+ }
+
page = kzalloc(sizeof(*page), GFP_KERNEL);
if (!page)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 750/844] drm/amdgpu: Protect GPU register accesses in powergated state in some paths
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (748 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 749/844] drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 751/844] drm/amdgpu: GPU vm support 5-level page table Sasha Levin
` (102 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Yifan Zhang, Alex Deucher, Lijo Lazar, Sasha Levin
From: Yifan Zhang <yifan1.zhang@amd.com>
[ Upstream commit 39fc2bc4da0082c226cbee331f0a5d44db3997da ]
Ungate GPU CG/PG in device_fini_hw and device_halt to protect GPU
register accesses, e.g. GC registers are accessed in amdgpu_irq_disable_all()
and amdgpu_fence_driver_hw_fini().
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index ba6fb23b840a0..09f9d82e572da 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3659,9 +3659,6 @@ static int amdgpu_device_ip_fini_early(struct amdgpu_device *adev)
}
}
- amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
- amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
-
amdgpu_amdkfd_suspend(adev, true);
amdgpu_userq_suspend(adev);
@@ -5047,6 +5044,9 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
amdgpu_virt_fini_data_exchange(adev);
}
+ amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+ amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+
/* disable all interrupts */
amdgpu_irq_disable_all(adev);
if (adev->mode_info.mode_config_initialized) {
@@ -7502,6 +7502,9 @@ void amdgpu_device_halt(struct amdgpu_device *adev)
amdgpu_xcp_dev_unplug(adev);
drm_dev_unplug(ddev);
+ amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+ amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+
amdgpu_irq_disable_all(adev);
amdgpu_fence_driver_hw_fini(adev);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 751/844] drm/amdgpu: GPU vm support 5-level page table
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (749 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 750/844] drm/amdgpu: Protect GPU register accesses in powergated state in some paths Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 752/844] drm/amdgpu: Use 5-level paging if gmc support 57-bit VA Sasha Levin
` (101 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Philip Yang, Felix Kuehling, Alex Deucher, Sasha Levin
From: Philip Yang <Philip.Yang@amd.com>
[ Upstream commit f6b1c1f5fd7237f77fc3880603ea54dcf0371a20 ]
If GPU supports 5-level page table, but CPU disable 5-level page table
by using boot option no5lvl or CPU feature not available, the virtual
address will be 48bit, not needed to enable 5-level page table on GPU
vm.
If adev->vm_manager.num_level, number of pde levels, set to 4, then
gfxhub and mmhub register VM_CONTEXTx_CNTL/PAGE_TABLE_DEPTH will set
to 4 to enable 5-level page table in page table walker.
Set vm_manager.root_level to AMDGPU_VM_PDE3, then update GPU mapping
will allocate and update PDE3/PDE2/PDE1/PDE0/PTB 5-level page tables.
If max_level is not 4, no change for the logic to support features
needed by old ASICs.
v2: squash in CONFIG fix
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Acked-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 3b948dd0366a ("drm/amdgpu: Use 5-level paging if gmc support 57-bit VA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 20 ++++++++++++++++++++
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 3 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 1 +
3 files changed, 23 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index a67285118c37b..4d329454456bc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2360,9 +2360,26 @@ void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
unsigned max_bits)
{
unsigned int max_size = 1 << (max_bits - 30);
+ bool sys_5level_pgtable = false;
unsigned int vm_size;
uint64_t tmp;
+#ifdef CONFIG_X86_64
+ /*
+ * Refer to function configure_5level_paging() for details.
+ */
+ sys_5level_pgtable = (native_read_cr4() & X86_CR4_LA57);
+#endif
+
+ /*
+ * If GPU supports 5-level page table, but system uses 4-level page table,
+ * then use 4-level page table on GPU
+ */
+ if (max_level == 4 && !sys_5level_pgtable) {
+ min_vm_size = 256 * 1024;
+ max_level = 3;
+ }
+
/* adjust vm size first */
if (amdgpu_vm_size != -1) {
vm_size = amdgpu_vm_size;
@@ -2405,6 +2422,9 @@ void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
tmp = DIV_ROUND_UP(fls64(tmp) - 1, 9) - 1;
adev->vm_manager.num_level = min_t(unsigned int, max_level, tmp);
switch (adev->vm_manager.num_level) {
+ case 4:
+ adev->vm_manager.root_level = AMDGPU_VM_PDB3;
+ break;
case 3:
adev->vm_manager.root_level = AMDGPU_VM_PDB2;
break;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index 15d757c016cbb..de53176a398dc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -185,9 +185,10 @@ struct amdgpu_bo_vm;
#define AMDGPU_VM_USE_CPU_FOR_COMPUTE (1 << 1)
/* VMPT level enumerate, and the hiberachy is:
- * PDB2->PDB1->PDB0->PTB
+ * PDB3->PDB2->PDB1->PDB0->PTB
*/
enum amdgpu_vm_level {
+ AMDGPU_VM_PDB3,
AMDGPU_VM_PDB2,
AMDGPU_VM_PDB1,
AMDGPU_VM_PDB0,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
index f794fb1cc06e6..c7a7d51080a87 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c
@@ -51,6 +51,7 @@ static unsigned int amdgpu_vm_pt_level_shift(struct amdgpu_device *adev,
unsigned int level)
{
switch (level) {
+ case AMDGPU_VM_PDB3:
case AMDGPU_VM_PDB2:
case AMDGPU_VM_PDB1:
case AMDGPU_VM_PDB0:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 752/844] drm/amdgpu: Use 5-level paging if gmc support 57-bit VA
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (750 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 751/844] drm/amdgpu: GPU vm support 5-level page table Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 753/844] net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path Sasha Levin
` (100 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Philip Yang, Christian König, Alex Deucher, Sasha Levin
From: Philip Yang <Philip.Yang@amd.com>
[ Upstream commit 3b948dd0366a0b64c02e4ed1aefdf7825942e803 ]
Regardless if CPU enable 5-level paging, GPU vm use 5-level paging if
gmc init with 57-bit address space support, because
ARM64 4-level paging support 48-bit VA, x86 and GPU 4-level paging
support 47-bit VA, require 5-level paging on GPU to support ARM64.
NPA address space 52-bit mapping on NPA GPU VM require 5-level paging.
Debugger trap get device snapshot expect LDS and Scratch base, limit
above 57-bit, which is set only for 5-level paging.
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.19.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 -----------------
1 file changed, 17 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 4d329454456bc..bd7f83efed187 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2360,26 +2360,9 @@ void amdgpu_vm_adjust_size(struct amdgpu_device *adev, uint32_t min_vm_size,
unsigned max_bits)
{
unsigned int max_size = 1 << (max_bits - 30);
- bool sys_5level_pgtable = false;
unsigned int vm_size;
uint64_t tmp;
-#ifdef CONFIG_X86_64
- /*
- * Refer to function configure_5level_paging() for details.
- */
- sys_5level_pgtable = (native_read_cr4() & X86_CR4_LA57);
-#endif
-
- /*
- * If GPU supports 5-level page table, but system uses 4-level page table,
- * then use 4-level page table on GPU
- */
- if (max_level == 4 && !sys_5level_pgtable) {
- min_vm_size = 256 * 1024;
- max_level = 3;
- }
-
/* adjust vm size first */
if (amdgpu_vm_size != -1) {
vm_size = amdgpu_vm_size;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 753/844] net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (751 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 752/844] drm/amdgpu: Use 5-level paging if gmc support 57-bit VA Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 754/844] net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Sasha Levin
` (99 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kevin Hao, Alexander Sverdlin, Jakub Kicinski, Sasha Levin
From: Kevin Hao <haokexin@gmail.com>
[ Upstream commit 62db84b7efa63b78aed9fdbdae90f198771be94c ]
The current error handling in cpsw_probe() has two issues:
- cpsw_unregister_ports() may be called before cpsw_register_ports() has
been executed.
- cpsw_unregister_ports() is already invoked within cpsw_register_ports()
in case of a register_netdev() failure, but the error path would call
it again.
Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260205-cpsw-error-path-v1-1-6e58bae6b299@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/cpsw_new.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c
index 21af0a10626aa..b9fc31eb06134 100644
--- a/drivers/net/ethernet/ti/cpsw_new.c
+++ b/drivers/net/ethernet/ti/cpsw_new.c
@@ -2003,7 +2003,7 @@ static int cpsw_probe(struct platform_device *pdev)
/* setup netdevs */
ret = cpsw_create_ports(cpsw);
if (ret)
- goto clean_unregister_netdev;
+ goto clean_cpts;
/* Grab RX and TX IRQs. Note that we also have RX_THRESHOLD and
* MISC IRQs which are always kept disabled with this driver so
@@ -2017,14 +2017,14 @@ static int cpsw_probe(struct platform_device *pdev)
0, dev_name(dev), cpsw);
if (ret < 0) {
dev_err(dev, "error attaching irq (%d)\n", ret);
- goto clean_unregister_netdev;
+ goto clean_cpts;
}
ret = devm_request_irq(dev, cpsw->irqs_table[1], cpsw_tx_interrupt,
0, dev_name(dev), cpsw);
if (ret < 0) {
dev_err(dev, "error attaching irq (%d)\n", ret);
- goto clean_unregister_netdev;
+ goto clean_cpts;
}
if (!cpsw->cpts)
@@ -2034,7 +2034,7 @@ static int cpsw_probe(struct platform_device *pdev)
0, dev_name(&pdev->dev), cpsw);
if (ret < 0) {
dev_err(dev, "error attaching misc irq (%d)\n", ret);
- goto clean_unregister_netdev;
+ goto clean_cpts;
}
/* Enable misc CPTS evnt_pend IRQ */
@@ -2043,7 +2043,7 @@ static int cpsw_probe(struct platform_device *pdev)
skip_cpts:
ret = cpsw_register_notifiers(cpsw);
if (ret)
- goto clean_unregister_netdev;
+ goto clean_cpts;
ret = cpsw_register_devlink(cpsw);
if (ret)
@@ -2065,8 +2065,6 @@ static int cpsw_probe(struct platform_device *pdev)
clean_unregister_notifiers:
cpsw_unregister_notifiers(cpsw);
-clean_unregister_netdev:
- cpsw_unregister_ports(cpsw);
clean_cpts:
cpts_release(cpsw->cpts);
cpdma_ctlr_destroy(cpsw->dma);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 754/844] net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (752 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 753/844] net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 755/844] PCI: Don't claim disabled bridge windows Sasha Levin
` (98 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kevin Hao, Alexander Sverdlin, Jakub Kicinski, Sasha Levin
From: Kevin Hao <haokexin@gmail.com>
[ Upstream commit 9d724b34fbe13b71865ad0906a4be97571f19cf5 ]
If an error occurs during register_netdev() for the first MAC in
cpsw_register_ports(), even though cpsw->slaves[0].ndev is set to NULL,
cpsw->slaves[1].ndev would remain unchanged. This could later cause
cpsw_unregister_ports() to attempt unregistering the second MAC.
To address this, add a check for ndev->reg_state before calling
unregister_netdev(). With this change, setting cpsw->slaves[i].ndev
to NULL becomes unnecessary and can be removed accordingly.
Fixes: ed3525eda4c4 ("net: ethernet: ti: introduce cpsw switchdev based driver part 1 - dual-emac")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Link: https://patch.msgid.link/20260205-cpsw-error-path-v1-2-6e58bae6b299@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/cpsw_new.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/ti/cpsw_new.c b/drivers/net/ethernet/ti/cpsw_new.c
index b9fc31eb06134..7f42f58a4b031 100644
--- a/drivers/net/ethernet/ti/cpsw_new.c
+++ b/drivers/net/ethernet/ti/cpsw_new.c
@@ -1472,7 +1472,7 @@ static void cpsw_unregister_ports(struct cpsw_common *cpsw)
for (i = 0; i < cpsw->data.slaves; i++) {
ndev = cpsw->slaves[i].ndev;
- if (!ndev)
+ if (!ndev || ndev->reg_state != NETREG_REGISTERED)
continue;
priv = netdev_priv(ndev);
@@ -1494,7 +1494,6 @@ static int cpsw_register_ports(struct cpsw_common *cpsw)
if (ret) {
dev_err(cpsw->dev,
"cpsw: err registering net device%d\n", i);
- cpsw->slaves[i].ndev = NULL;
break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 755/844] PCI: Don't claim disabled bridge windows
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (753 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 754/844] net: cpsw_new: Fix potential unregister of netdev that has not been registered yet Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 756/844] PCI: Fix pci_slot_trylock() error handling Sasha Levin
` (97 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ilpo Järvinen, Sizhe Liu, Bjorn Helgaas, Sasha Levin
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 2ecc1bf14e2fdaff78bd1b8e7ed3dba336a3fad5 ]
The commit 8278c6914306 ("PCI: Preserve bridge window resource type flags")
changed bridge window resource behavior such that flags are no longer zero
if the bridge window is not valid or is disabled (mainly to preserve the
type flags for later use). If a bridge window has its limit smaller than
base address, pci_read_bridge_*() sets both IORESOURCE_UNSET and
IORESOURCE_DISABLED to indicate the bridge window exists but is not valid
with the current base and limit configuration.
The code in pci_claim_bridge_resources() still depends on the old behavior
of checking validity of the bridge window solely based on !r->flags,
whereas after 8278c6914306, also IORESOURCE_DISABLED may indicate bridge
window addresses are not valid.
While pci_claim_resource() does check IORESOURCE_UNSET,
pci_claim_bridge_resource() attempts to clip the resource if
pci_claim_resource() fails, which is not correct for bridge window
resources that are not valid. As pci_bus_clip_resource() performs clipping
regardless of flags and then clears IORESOURCE_UNSET, it should not be
called unless the resource is valid.
The problem is visible in this log:
pci 0000:20:00.0: PCI bridge to [bus 21]
pci 0000:20:00.0: bridge window [io size 0x0000 disabled]: can't claim; no address assigned
pci 0000:20:00.0: [io 0x0000-0xffffffffffffffff disabled] clipped to [io 0x0000-0xffff disabled]
Add IORESOURCE_DISABLED check in pci_claim_bridge_resources() to only
claim bridge windows that appear to have a valid configuration.
Fixes: 8278c6914306 ("PCI: Preserve bridge window resource type flags")
Reported-by: Sizhe Liu <liusizhe5@huawei.com>
Link: https://lore.kernel.org/all/20260203023545.2753811-1-liusizhe5@huawei.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/4d9228d6-a230-6ddf-e300-fbf42d523863@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/setup-bus.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index ee8fe6e0de5fd..8311b06fadcc6 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -1685,6 +1685,8 @@ static void pci_claim_bridge_resources(struct pci_dev *dev)
if (!r->flags || r->parent)
continue;
+ if (r->flags & IORESOURCE_DISABLED)
+ continue;
pci_claim_bridge_resource(dev, i);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 756/844] PCI: Fix pci_slot_trylock() error handling
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (754 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 755/844] PCI: Don't claim disabled bridge windows Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 757/844] parisc: kernel: replace kfree() with put_device() in create_tree_node() Sasha Levin
` (96 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jinhui Guo, Bjorn Helgaas, Dan Williams, Sasha Levin
From: Jinhui Guo <guojinhui.liam@bytedance.com>
[ Upstream commit 9368d1ee62829b08aa31836b3ca003803caf0b72 ]
Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()")
delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in
pci_slot_trylock(), but it forgets to remove the corresponding
pci_dev_unlock() when pci_bus_trylock() fails.
Before a4e772898f8b, the code did:
if (!pci_dev_trylock(dev)) /* <- lock bridge device */
goto unlock;
if (dev->subordinate) {
if (!pci_bus_trylock(dev->subordinate)) {
pci_dev_unlock(dev); /* <- unlock bridge device */
goto unlock;
}
}
After a4e772898f8b the bridge-device lock is no longer taken, but the
pci_dev_unlock(dev) on the failure path was left in place, leading to the
bug.
This yields one of two errors:
1. A warning that the lock is being unlocked when no one holds it.
2. An incorrect unlock of a lock that belongs to another thread.
Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure
path.
[Same patch later posted by Keith at
https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com]
Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()")
Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pci.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a4eb3bc2127ae..8500b862f4f2e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5355,10 +5355,8 @@ static int pci_slot_trylock(struct pci_slot *slot)
if (!dev->slot || dev->slot != slot)
continue;
if (dev->subordinate) {
- if (!pci_bus_trylock(dev->subordinate)) {
- pci_dev_unlock(dev);
+ if (!pci_bus_trylock(dev->subordinate))
goto unlock;
- }
} else if (!pci_dev_trylock(dev))
goto unlock;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 757/844] parisc: kernel: replace kfree() with put_device() in create_tree_node()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (755 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 756/844] PCI: Fix pci_slot_trylock() error handling Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 758/844] mptcp: pm: in-kernel: always set ID as avail when rm endp Sasha Levin
` (95 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Haoxiang Li, Helge Deller, Sasha Levin
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
[ Upstream commit dcf69599c47f29ce0a99117eb3f9ddcd2c4e78b6 ]
If device_register() fails, put_device() is the correct way to
drop the device reference.
Found by code review.
Fixes: 1070c9655b90 ("[PA-RISC] Fix must_check warnings in drivers.c")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/parisc/kernel/drivers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index 8d23fe42b0cee..809e3c171ad54 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -435,7 +435,7 @@ static struct parisc_device * __init create_tree_node(char id,
dev->dev.dma_mask = &dev->dma_mask;
dev->dev.coherent_dma_mask = dev->dma_mask;
if (device_register(&dev->dev)) {
- kfree(dev);
+ put_device(&dev->dev);
return NULL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 758/844] mptcp: pm: in-kernel: always set ID as avail when rm endp
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (756 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 757/844] parisc: kernel: replace kfree() with put_device() in create_tree_node() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 759/844] staging: rtl8723bs: fix null dereference in find_network Sasha Levin
` (94 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Matthieu Baerts (NGI0), syzbot+f56f7d56e2c6e11a01b6,
Mat Martineau, Jakub Kicinski, Sasha Levin
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit d191101dee25567c2af3b28565f45346c33d65f5 ]
Syzkaller managed to find a combination of actions that was generating
this warning:
WARNING: net/mptcp/pm_kernel.c:1074 at __mark_subflow_endp_available net/mptcp/pm_kernel.c:1074 [inline], CPU#1: syz.7.48/2535
WARNING: net/mptcp/pm_kernel.c:1074 at mptcp_pm_nl_fullmesh net/mptcp/pm_kernel.c:1446 [inline], CPU#1: syz.7.48/2535
WARNING: net/mptcp/pm_kernel.c:1074 at mptcp_pm_nl_set_flags_all net/mptcp/pm_kernel.c:1474 [inline], CPU#1: syz.7.48/2535
WARNING: net/mptcp/pm_kernel.c:1074 at mptcp_pm_nl_set_flags+0x5de/0x640 net/mptcp/pm_kernel.c:1538, CPU#1: syz.7.48/2535
Modules linked in:
CPU: 1 UID: 0 PID: 2535 Comm: syz.7.48 Not tainted 6.18.0-03987-gea5f5e676cf5 #17 PREEMPT(voluntary)
Hardware name: QEMU Ubuntu 25.10 PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_kernel.c:1074 [inline]
RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_kernel.c:1446 [inline]
RIP: 0010:mptcp_pm_nl_set_flags_all net/mptcp/pm_kernel.c:1474 [inline]
RIP: 0010:mptcp_pm_nl_set_flags+0x5de/0x640 net/mptcp/pm_kernel.c:1538
Code: 89 c7 e8 c5 8c 73 fe e9 f7 fd ff ff 49 83 ef 80 e8 b7 8c 73 fe 4c 89 ff be 03 00 00 00 e8 4a 29 e3 fe eb ac e8 a3 8c 73 fe 90 <0f> 0b 90 e9 3d ff ff ff e8 95 8c 73 fe b8 a1 ff ff ff eb 1a e8 89
RSP: 0018:ffffc9001535b820 EFLAGS: 00010287
netdevsim0: tun_chr_ioctl cmd 1074025677
RAX: ffffffff82da294d RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc900096d0000 RSI: 00000000000006d6 RDI: 00000000000006d7
netdevsim0: linktype set to 823
RBP: ffff88802cdb2240 R08: 00000000000104ae R09: ffffffffffffffff
R10: ffffffff82da27d4 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88801246d8c0 R14: ffffc9001535b8b8 R15: ffff88802cdb1800
FS: 00007fc6ac5a76c0(0000) GS:ffff8880f90c8000(0000) knlGS:0000000000000000
netlink: 'syz.3.50': attribute type 5 has an invalid length.
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
netlink: 1232 bytes leftover after parsing attributes in process `syz.3.50'.
CR2: 0000200000010000 CR3: 0000000025b1a000 CR4: 0000000000350ef0
Call Trace:
<TASK>
mptcp_pm_set_flags net/mptcp/pm_netlink.c:277 [inline]
mptcp_pm_nl_set_flags_doit+0x1d7/0x210 net/mptcp/pm_netlink.c:282
genl_family_rcv_msg_doit+0x117/0x180 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x3a8/0x3f0 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x16d/0x240 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x3e9/0x4c0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x4ab/0x5b0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg+0xc9/0xf0 net/socket.c:733
____sys_sendmsg+0x272/0x3b0 net/socket.c:2608
___sys_sendmsg+0x2de/0x320 net/socket.c:2662
__sys_sendmsg net/socket.c:2694 [inline]
__do_sys_sendmsg net/socket.c:2699 [inline]
__se_sys_sendmsg net/socket.c:2697 [inline]
__x64_sys_sendmsg+0x110/0x1a0 net/socket.c:2697
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xed/0x360 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc6adb66f6d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc6ac5a6ff8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc6addf5fa0 RCX: 00007fc6adb66f6d
RDX: 0000000000048084 RSI: 00002000000002c0 RDI: 000000000000000e
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
netlink: 'syz.5.51': attribute type 2 has an invalid length.
R13: 00007fff25e91fe0 R14: 00007fc6ac5a7ce4 R15: 00007fff25e920d7
</TASK>
The actions that caused that seem to be:
- Create an MPTCP endpoint for address A without any flags
- Create a new MPTCP connection from address A
- Remove the MPTCP endpoint: the corresponding subflows will be removed
- Recreate the endpoint with the same ID, but with the subflow flag
- Change the same endpoint to add the fullmesh flag
In this case, msk->pm.local_addr_used has been kept to 0 as expected,
but the corresponding bit in msk->pm.id_avail_bitmap was still unset
after having removed the endpoint, causing the splat later on.
When removing an endpoint, the corresponding endpoint ID was only marked
as available for "signal" types with an announced address, plus all
"subflow" types, but not the other types like an endpoint corresponding
to the initial subflow. In these cases, re-creating an endpoint with the
same ID didn't signal/create anything. Here, adding the fullmesh flag
was creating the splat when calling __mark_subflow_endp_available() from
mptcp_pm_nl_fullmesh(), because msk->pm.local_addr_used was set to 0
while the ID was marked as used.
To fix this issue, the corresponding bit in msk->pm.id_avail_bitmap can
always be set as available when removing an MPTCP in-kernel endpoint. In
other words, moving the call to __set_bit() to do it in all cases,
except for "subflow" types where this bit is handled in a dedicated
helper.
Note: instead of adding a new spin_(un)lock_bh that would be taken in
all cases, do all the actions requiring the spin lock under the same
block.
This modification potentially fixes another issue reported by syzbot,
see [1]. But without a reproducer or more details about what exactly
happened before, it is hard to confirm.
Fixes: e255683c06df ("mptcp: pm: re-using ID of unused removed ADD_ADDR")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/606
Reported-by: syzbot+f56f7d56e2c6e11a01b6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/68fcfc4a.050a0220.346f24.02fb.GAE@google.com [1]
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260205-net-mptcp-misc-fixes-6-19-rc8-v2-1-c2720ce75c34@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/pm_kernel.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/net/mptcp/pm_kernel.c b/net/mptcp/pm_kernel.c
index b26675054b0dc..4972c19fc73e2 100644
--- a/net/mptcp/pm_kernel.c
+++ b/net/mptcp/pm_kernel.c
@@ -1056,10 +1056,8 @@ static bool mptcp_pm_remove_anno_addr(struct mptcp_sock *msk,
ret = mptcp_remove_anno_list_by_saddr(msk, addr);
if (ret || force) {
spin_lock_bh(&msk->pm.lock);
- if (ret) {
- __set_bit(addr->id, msk->pm.id_avail_bitmap);
+ if (ret)
msk->pm.add_addr_signaled--;
- }
mptcp_pm_remove_addr(msk, &list);
spin_unlock_bh(&msk->pm.lock);
}
@@ -1097,17 +1095,15 @@ static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,
!(entry->flags & MPTCP_PM_ADDR_FLAG_IMPLICIT));
list.ids[0] = mptcp_endp_get_local_id(msk, addr);
- if (remove_subflow) {
- spin_lock_bh(&msk->pm.lock);
- mptcp_pm_rm_subflow(msk, &list);
- spin_unlock_bh(&msk->pm.lock);
- }
- if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
- spin_lock_bh(&msk->pm.lock);
+ spin_lock_bh(&msk->pm.lock);
+ if (remove_subflow)
+ mptcp_pm_rm_subflow(msk, &list);
+ if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW)
__mark_subflow_endp_available(msk, list.ids[0]);
- spin_unlock_bh(&msk->pm.lock);
- }
+ else /* mark endp ID as available, e.g. Signal or MPC endp */
+ __set_bit(addr->id, msk->pm.id_avail_bitmap);
+ spin_unlock_bh(&msk->pm.lock);
if (msk->mpc_endpoint_id == entry->addr.id)
msk->mpc_endpoint_id = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 759/844] staging: rtl8723bs: fix null dereference in find_network
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (757 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 758/844] mptcp: pm: in-kernel: always set ID as avail when rm endp Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 760/844] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Sasha Levin
` (93 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ethan Tidmore, Greg Kroah-Hartman, Sasha Levin
From: Ethan Tidmore <ethantidmore06@gmail.com>
[ Upstream commit 41460a19654c32d39fd0e3a3671cd8d4b7b8479f ]
The variable pwlan has the possibility of being NULL when passed into
rtw_free_network_nolock() which would later dereference the variable.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260202205429.20181-1-ethantidmore06@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 98704179ad35a..936c850e5aab8 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -835,8 +835,10 @@ static void find_network(struct adapter *adapter)
struct wlan_network *tgt_network = &pmlmepriv->cur_network;
pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.mac_address);
- if (pwlan)
- pwlan->fixed = false;
+ if (!pwlan)
+ return;
+
+ pwlan->fixed = false;
if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) &&
(adapter->stapriv.asoc_sta_count == 1))
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 760/844] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (758 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 759/844] staging: rtl8723bs: fix null dereference in find_network Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 761/844] kcsan, compiler_types: avoid duplicate type issues in BPF Type Format Sasha Levin
` (92 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Gui-Dong Han, Ben Hutchings, Guenter Roeck, Sasha Levin
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit 007be4327e443d79c9dd9e56dc16c36f6395d208 ]
Simply copying shared data to a local variable cannot prevent data
races. The compiler is allowed to optimize away the local copy and
re-read the shared memory, causing a Time-of-Check Time-of-Use (TOCTOU)
issue if the data changes between the check and the usage.
To enforce the use of the local variable, use READ_ONCE() when reading
the shared data and WRITE_ONCE() when updating it. Apply these macros to
the three identified locations (curr_sense, adc, and fault) where local
variables are used for error validation, ensuring the value remains
consistent.
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Closes: https://lore.kernel.org/all/6fe17868327207e8b850cf9f88b7dc58b2021f73.camel@decadent.org.uk/
Fixes: f5bae2642e3d ("hwmon: Driver for MAX16065 System Manager and compatibles")
Fixes: b8d5acdcf525 ("hwmon: (max16065) Use local variable to avoid TOCTOU")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Link: https://lore.kernel.org/r/20260203121443.5482-1-hanguidong02@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/max16065.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
index 4c9e7892a73c1..43fbb9b26b102 100644
--- a/drivers/hwmon/max16065.c
+++ b/drivers/hwmon/max16065.c
@@ -151,27 +151,27 @@ static struct max16065_data *max16065_update_device(struct device *dev)
int i;
for (i = 0; i < data->num_adc; i++)
- data->adc[i]
- = max16065_read_adc(client, MAX16065_ADC(i));
+ WRITE_ONCE(data->adc[i],
+ max16065_read_adc(client, MAX16065_ADC(i)));
if (data->have_current) {
- data->adc[MAX16065_NUM_ADC]
- = max16065_read_adc(client, MAX16065_CSP_ADC);
- data->curr_sense
- = i2c_smbus_read_byte_data(client,
- MAX16065_CURR_SENSE);
+ WRITE_ONCE(data->adc[MAX16065_NUM_ADC],
+ max16065_read_adc(client, MAX16065_CSP_ADC));
+ WRITE_ONCE(data->curr_sense,
+ i2c_smbus_read_byte_data(client, MAX16065_CURR_SENSE));
}
for (i = 0; i < 2; i++)
- data->fault[i]
- = i2c_smbus_read_byte_data(client, MAX16065_FAULT(i));
+ WRITE_ONCE(data->fault[i],
+ i2c_smbus_read_byte_data(client, MAX16065_FAULT(i)));
/*
* MAX16067 and MAX16068 have separate undervoltage and
* overvoltage alarm bits. Squash them together.
*/
if (data->chip == max16067 || data->chip == max16068)
- data->fault[0] |= data->fault[1];
+ WRITE_ONCE(data->fault[0],
+ data->fault[0] | data->fault[1]);
data->last_updated = jiffies;
data->valid = true;
@@ -185,7 +185,7 @@ static ssize_t max16065_alarm_show(struct device *dev,
{
struct sensor_device_attribute_2 *attr2 = to_sensor_dev_attr_2(da);
struct max16065_data *data = max16065_update_device(dev);
- int val = data->fault[attr2->nr];
+ int val = READ_ONCE(data->fault[attr2->nr]);
if (val < 0)
return val;
@@ -203,7 +203,7 @@ static ssize_t max16065_input_show(struct device *dev,
{
struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
struct max16065_data *data = max16065_update_device(dev);
- int adc = data->adc[attr->index];
+ int adc = READ_ONCE(data->adc[attr->index]);
if (unlikely(adc < 0))
return adc;
@@ -216,7 +216,7 @@ static ssize_t max16065_current_show(struct device *dev,
struct device_attribute *da, char *buf)
{
struct max16065_data *data = max16065_update_device(dev);
- int curr_sense = data->curr_sense;
+ int curr_sense = READ_ONCE(data->curr_sense);
if (unlikely(curr_sense < 0))
return curr_sense;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 761/844] kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (759 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 760/844] hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 762/844] watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() Sasha Levin
` (91 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alan Maguire, Nilay Shroff, Marco Elver, Yonghong Song,
Alexei Starovoitov, Andrii Nakryiko, Bart van Assche,
Daniel Borkman, Eduard Zingerman, Hao Luo, Heiko Carstens,
H. Peter Anvin, Jason A. Donenfeld, Jiri Olsa, John Fastabend,
Kees Cook, KP Singh, Martin KaFai Lau, Miguel Ojeda, Naman Jain,
Nathan Chancellor, Paul E . McKenney, Peter Zijlstra,
Stanislav Fomichev, Uros Bizjak, Andrew Morton, Sasha Levin
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit 9dc052234da736f7749f19ab6936342ec7dbe3ac ]
Enabling KCSAN is causing a large number of duplicate types in BTF for
core kernel structs like task_struct [1]. This is due to the definition
in include/linux/compiler_types.h
`#ifdef __SANITIZE_THREAD__
...
`#define __data_racy volatile
..
`#else
...
`#define __data_racy
...
`#endif
Because some objects in the kernel are compiled without KCSAN flags
(KCSAN_SANITIZE) we sometimes get the empty __data_racy annotation for
objects; as a result we get multiple conflicting representations of the
associated structs in DWARF, and these lead to multiple instances of core
kernel types in BTF since they cannot be deduplicated due to the
additional modifier in some instances.
Moving the __data_racy definition under CONFIG_KCSAN avoids this problem,
since the volatile modifier will be present for both KCSAN and
KCSAN_SANITIZE objects in a CONFIG_KCSAN=y kernel.
Link: https://lkml.kernel.org/r/20260116091730.324322-1-alan.maguire@oracle.com
Fixes: 31f605a308e6 ("kcsan, compiler_types: Introduce __data_racy type qualifier")
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Reported-by: Nilay Shroff <nilay@linux.ibm.com>
Tested-by: Nilay Shroff <nilay@linux.ibm.com>
Suggested-by: Marco Elver <elver@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Cc: Bart van Assche <bvanassche@acm.org>
Cc: Daniel Borkman <daniel@iogearbox.net>
Cc: Eduard Zingerman <eddyz87@gmail.com>
Cc: Hao Luo <haoluo@google.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Jason A. Donenfeld <jason@zx2c4.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Kees Cook <kees@kernel.org>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Martin KaFai Lau <martin.lau@linux.dev>
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Naman Jain <namjain@linux.microsoft.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: "Paul E . McKenney" <paulmck@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Uros Bizjak <ubizjak@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/compiler_types.h | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index d3318a3c25777..86111a189a874 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -303,6 +303,22 @@ struct ftrace_likely_data {
# define __no_kasan_or_inline __always_inline
#endif
+#ifdef CONFIG_KCSAN
+/*
+ * Type qualifier to mark variables where all data-racy accesses should be
+ * ignored by KCSAN. Note, the implementation simply marks these variables as
+ * volatile, since KCSAN will treat such accesses as "marked".
+ *
+ * Defined here because defining __data_racy as volatile for KCSAN objects only
+ * causes problems in BPF Type Format (BTF) generation since struct members
+ * of core kernel data structs will be volatile in some objects and not in
+ * others. Instead define it globally for KCSAN kernels.
+ */
+# define __data_racy volatile
+#else
+# define __data_racy
+#endif
+
#ifdef __SANITIZE_THREAD__
/*
* Clang still emits instrumentation for __tsan_func_{entry,exit}() and builtin
@@ -314,16 +330,9 @@ struct ftrace_likely_data {
* disable all instrumentation. See Kconfig.kcsan where this is mandatory.
*/
# define __no_kcsan __no_sanitize_thread __disable_sanitizer_instrumentation
-/*
- * Type qualifier to mark variables where all data-racy accesses should be
- * ignored by KCSAN. Note, the implementation simply marks these variables as
- * volatile, since KCSAN will treat such accesses as "marked".
- */
-# define __data_racy volatile
# define __no_sanitize_or_inline __no_kcsan notrace __maybe_unused
#else
# define __no_kcsan
-# define __data_racy
#endif
#ifdef __SANITIZE_MEMORY__
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 762/844] watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (760 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 761/844] kcsan, compiler_types: avoid duplicate type issues in BPF Type Format Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 763/844] i2c: imx-lpi2c: fix SMBus block read NACK after byte count Sasha Levin
` (90 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shengming Hu, Petr Mladek, Ingo Molnar, Mark Brown,
Thomas Gleixner, Zhang Run, Andrew Morton, Sasha Levin
From: Shengming Hu <hu.shengming@zte.com.cn>
[ Upstream commit cafe4074a7221dca2fa954dd1ab0cf99b6318e23 ]
cpustat_tail indexes cpustat_util[], which is a NUM_SAMPLE_PERIODS-sized
ring buffer. need_counting_irqs() currently wraps the index using
NUM_HARDIRQ_REPORT, which only happens to match NUM_SAMPLE_PERIODS.
Use NUM_SAMPLE_PERIODS for the wrap to keep the ring math correct even if
the NUM_HARDIRQ_REPORT or NUM_SAMPLE_PERIODS changes.
Link: https://lkml.kernel.org/r/tencent_7068189CB6D6689EB353F3D17BF5A5311A07@qq.com
Fixes: e9a9292e2368 ("watchdog/softlockup: Report the most frequent interrupts")
Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Zhang Run <zhang.run@zte.com.cn>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/watchdog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 366122f4a0f87..70eaa77242814 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -550,7 +550,7 @@ static bool need_counting_irqs(void)
u8 util;
int tail = __this_cpu_read(cpustat_tail);
- tail = (tail + NUM_HARDIRQ_REPORT - 1) % NUM_HARDIRQ_REPORT;
+ tail = (tail + NUM_SAMPLE_PERIODS - 1) % NUM_SAMPLE_PERIODS;
util = __this_cpu_read(cpustat_util[tail][STATS_HARDIRQ]);
return util > HARDIRQ_PERCENT_THRESH;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 763/844] i2c: imx-lpi2c: fix SMBus block read NACK after byte count
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (761 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 762/844] watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 764/844] cifs: Fix locking usage for tcon fields Sasha Levin
` (89 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Carlos Song, Frank Li, Andi Shyti, Wolfram Sang, Sasha Levin
From: Carlos Song <carlos.song@nxp.com>
[ Upstream commit efdc383d1cc28d45cbf5a23b5ffa997010aaacb4 ]
The LPI2C controller sends a NACK at the end of a receive command
unless another receive command is already queued in MTDR. During
SMBus block reads, this causes the controller to NACK immediately
after receiving the block length byte, aborting the transfer before
the data bytes are read.
Fix this by queueing a second receive command as soon as the block
length byte is received, keeping MTDR non-empty and ensuring
continuous ACKs. The initial receive command reads the block length,
and the subsequent command reads the remaining data bytes according
to the reported length.
Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Cc: <stable@vger.kernel.org> # v4.10+
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260123105459.3448822-1-carlos.song@nxp.com
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-imx-lpi2c.c | 107 ++++++++++++++++++++++-------
1 file changed, 83 insertions(+), 24 deletions(-)
diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index d882126c1778c..519a1ac832a41 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -5,6 +5,7 @@
* Copyright 2016 Freescale Semiconductor, Inc.
*/
+#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/completion.h>
#include <linux/delay.h>
@@ -90,6 +91,7 @@
#define MRDR_RXEMPTY BIT(14)
#define MDER_TDDE BIT(0)
#define MDER_RDDE BIT(1)
+#define MSR_RDF_ASSERTED(x) FIELD_GET(MSR_RDF, (x))
#define SCR_SEN BIT(0)
#define SCR_RST BIT(1)
@@ -461,7 +463,7 @@ static bool lpi2c_imx_write_txfifo(struct lpi2c_imx_struct *lpi2c_imx, bool atom
static bool lpi2c_imx_read_rxfifo(struct lpi2c_imx_struct *lpi2c_imx, bool atomic)
{
- unsigned int blocklen, remaining;
+ unsigned int remaining;
unsigned int temp, data;
do {
@@ -472,15 +474,6 @@ static bool lpi2c_imx_read_rxfifo(struct lpi2c_imx_struct *lpi2c_imx, bool atomi
lpi2c_imx->rx_buf[lpi2c_imx->delivered++] = data & 0xff;
} while (1);
- /*
- * First byte is the length of remaining packet in the SMBus block
- * data read. Add it to msgs->len.
- */
- if (lpi2c_imx->block_data) {
- blocklen = lpi2c_imx->rx_buf[0];
- lpi2c_imx->msglen += blocklen;
- }
-
remaining = lpi2c_imx->msglen - lpi2c_imx->delivered;
if (!remaining) {
@@ -493,12 +486,7 @@ static bool lpi2c_imx_read_rxfifo(struct lpi2c_imx_struct *lpi2c_imx, bool atomi
lpi2c_imx_set_rx_watermark(lpi2c_imx);
/* multiple receive commands */
- if (lpi2c_imx->block_data) {
- lpi2c_imx->block_data = 0;
- temp = remaining;
- temp |= (RECV_DATA << 8);
- writel(temp, lpi2c_imx->base + LPI2C_MTDR);
- } else if (!(lpi2c_imx->delivered & 0xff)) {
+ if (!(lpi2c_imx->delivered & 0xff)) {
temp = (remaining > CHUNK_DATA ? CHUNK_DATA : remaining) - 1;
temp |= (RECV_DATA << 8);
writel(temp, lpi2c_imx->base + LPI2C_MTDR);
@@ -536,18 +524,77 @@ static int lpi2c_imx_write_atomic(struct lpi2c_imx_struct *lpi2c_imx,
return err;
}
-static void lpi2c_imx_read_init(struct lpi2c_imx_struct *lpi2c_imx,
- struct i2c_msg *msgs)
+static unsigned int lpi2c_SMBus_block_read_length_byte(struct lpi2c_imx_struct *lpi2c_imx)
{
- unsigned int temp;
+ unsigned int data;
+
+ data = readl(lpi2c_imx->base + LPI2C_MRDR);
+ lpi2c_imx->rx_buf[lpi2c_imx->delivered++] = data & 0xff;
+
+ return data;
+}
+
+static int lpi2c_imx_read_init(struct lpi2c_imx_struct *lpi2c_imx,
+ struct i2c_msg *msgs)
+{
+ unsigned int temp, val, block_len;
+ int ret;
lpi2c_imx->rx_buf = msgs->buf;
lpi2c_imx->block_data = msgs->flags & I2C_M_RECV_LEN;
lpi2c_imx_set_rx_watermark(lpi2c_imx);
- temp = msgs->len > CHUNK_DATA ? CHUNK_DATA - 1 : msgs->len - 1;
- temp |= (RECV_DATA << 8);
- writel(temp, lpi2c_imx->base + LPI2C_MTDR);
+
+ if (!lpi2c_imx->block_data) {
+ temp = msgs->len > CHUNK_DATA ? CHUNK_DATA - 1 : msgs->len - 1;
+ temp |= (RECV_DATA << 8);
+ writel(temp, lpi2c_imx->base + LPI2C_MTDR);
+ } else {
+ /*
+ * The LPI2C controller automatically sends a NACK after the last byte of a
+ * receive command, unless the next command in MTDR is also a receive command.
+ * If MTDR is empty when a receive completes, a NACK is sent by default.
+ *
+ * To comply with the SMBus block read spec, we start with a 2-byte read:
+ * The first byte in RXFIFO is the block length. Once this byte arrives, the
+ * controller immediately updates MTDR with the next read command, ensuring
+ * continuous ACK instead of NACK.
+ *
+ * The second byte is the first block data byte. Therefore, the subsequent
+ * read command should request (block_len - 1) bytes, since one data byte
+ * has already been read.
+ */
+
+ writel((RECV_DATA << 8) | 0x01, lpi2c_imx->base + LPI2C_MTDR);
+
+ ret = readl_poll_timeout(lpi2c_imx->base + LPI2C_MSR, val,
+ MSR_RDF_ASSERTED(val), 1, 1000);
+ if (ret) {
+ dev_err(&lpi2c_imx->adapter.dev, "SMBus read count failed %d\n", ret);
+ return ret;
+ }
+
+ /* Read block length byte and confirm this SMBus transfer meets protocol */
+ block_len = lpi2c_SMBus_block_read_length_byte(lpi2c_imx);
+ if (block_len == 0 || block_len > I2C_SMBUS_BLOCK_MAX) {
+ dev_err(&lpi2c_imx->adapter.dev, "Invalid SMBus block read length\n");
+ return -EPROTO;
+ }
+
+ /*
+ * When block_len shows more bytes need to be read, update second read command to
+ * keep MTDR non-empty and ensuring continuous ACKs. Only update command register
+ * here. All block bytes will be read out at IRQ handler or lpi2c_imx_read_atomic()
+ * function.
+ */
+ if (block_len > 1)
+ writel((RECV_DATA << 8) | (block_len - 2), lpi2c_imx->base + LPI2C_MTDR);
+
+ lpi2c_imx->msglen += block_len;
+ msgs->len += block_len;
+ }
+
+ return 0;
}
static bool lpi2c_imx_read_chunk_atomic(struct lpi2c_imx_struct *lpi2c_imx)
@@ -592,6 +639,10 @@ static bool is_use_dma(struct lpi2c_imx_struct *lpi2c_imx, struct i2c_msg *msg)
if (!lpi2c_imx->can_use_dma)
return false;
+ /* DMA is not suitable for SMBus block read */
+ if (msg->flags & I2C_M_RECV_LEN)
+ return false;
+
/*
* A system-wide suspend or resume transition is in progress. LPI2C should use PIO to
* transfer data to avoid issue caused by no ready DMA HW resource.
@@ -609,10 +660,14 @@ static bool is_use_dma(struct lpi2c_imx_struct *lpi2c_imx, struct i2c_msg *msg)
static int lpi2c_imx_pio_xfer(struct lpi2c_imx_struct *lpi2c_imx,
struct i2c_msg *msg)
{
+ int ret;
+
reinit_completion(&lpi2c_imx->complete);
if (msg->flags & I2C_M_RD) {
- lpi2c_imx_read_init(lpi2c_imx, msg);
+ ret = lpi2c_imx_read_init(lpi2c_imx, msg);
+ if (ret)
+ return ret;
lpi2c_imx_intctrl(lpi2c_imx, MIER_RDIE | MIER_NDIE);
} else {
lpi2c_imx_write(lpi2c_imx, msg);
@@ -624,8 +679,12 @@ static int lpi2c_imx_pio_xfer(struct lpi2c_imx_struct *lpi2c_imx,
static int lpi2c_imx_pio_xfer_atomic(struct lpi2c_imx_struct *lpi2c_imx,
struct i2c_msg *msg)
{
+ int ret;
+
if (msg->flags & I2C_M_RD) {
- lpi2c_imx_read_init(lpi2c_imx, msg);
+ ret = lpi2c_imx_read_init(lpi2c_imx, msg);
+ if (ret)
+ return ret;
return lpi2c_imx_read_atomic(lpi2c_imx, msg);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 764/844] cifs: Fix locking usage for tcon fields
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (762 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 763/844] i2c: imx-lpi2c: fix SMBus block read NACK after byte count Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 765/844] MIPS: rb532: Fix MMIO UART resource registration Sasha Levin
` (88 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shyam Prasad N, Steve French, Sasha Levin
From: Shyam Prasad N <sprasad@microsoft.com>
[ Upstream commit 96c4af418586ee9a6aab61738644366426e05316 ]
We used to use the cifs_tcp_ses_lock to protect a lot of objects
that are not just the server, ses or tcon lists. We later introduced
srv_lock, ses_lock and tc_lock to protect fields within the
corresponding structs. This was done to provide a more granular
protection and avoid unnecessary serialization.
There were still a couple of uses of cifs_tcp_ses_lock to provide
tcon fields. In this patch, I've replaced them with tc_lock.
Cc: stable@vger.kernel.org
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cached_dir.c | 4 ++--
fs/smb/client/smb2misc.c | 6 +++---
fs/smb/client/smb2ops.c | 8 +++-----
fs/smb/client/smb2pdu.c | 2 ++
fs/smb/client/trace.h | 1 +
5 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c
index 1db7ab6c2529c..569030b3e68d4 100644
--- a/fs/smb/client/cached_dir.c
+++ b/fs/smb/client/cached_dir.c
@@ -788,11 +788,11 @@ static void cfids_laundromat_worker(struct work_struct *work)
cfid->dentry = NULL;
if (cfid->is_open) {
- spin_lock(&cifs_tcp_ses_lock);
+ spin_lock(&cfid->tcon->tc_lock);
++cfid->tcon->tc_count;
trace_smb3_tcon_ref(cfid->tcon->debug_id, cfid->tcon->tc_count,
netfs_trace_tcon_ref_get_cached_laundromat);
- spin_unlock(&cifs_tcp_ses_lock);
+ spin_unlock(&cfid->tcon->tc_lock);
queue_work(serverclose_wq, &cfid->close_work);
} else
/*
diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c
index f3cb62d914502..0871b9f1f86a6 100644
--- a/fs/smb/client/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -820,14 +820,14 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid,
int rc;
cifs_dbg(FYI, "%s: tc_count=%d\n", __func__, tcon->tc_count);
- spin_lock(&cifs_tcp_ses_lock);
+ spin_lock(&tcon->tc_lock);
if (tcon->tc_count <= 0) {
struct TCP_Server_Info *server = NULL;
trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
netfs_trace_tcon_ref_see_cancelled_close);
WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative");
- spin_unlock(&cifs_tcp_ses_lock);
+ spin_unlock(&tcon->tc_lock);
if (tcon->ses) {
server = tcon->ses->server;
@@ -841,7 +841,7 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid,
tcon->tc_count++;
trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
netfs_trace_tcon_ref_get_cancelled_close);
- spin_unlock(&cifs_tcp_ses_lock);
+ spin_unlock(&tcon->tc_lock);
rc = __smb2_handle_cancelled_cmd(tcon, SMB2_CLOSE_HE, 0,
persistent_fid, volatile_fid);
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index edfd6a4e87e8b..d76d79e50e8e7 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -3088,7 +3088,9 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
struct cifs_tcon,
tcon_list);
if (tcon) {
+ spin_lock(&tcon->tc_lock);
tcon->tc_count++;
+ spin_unlock(&tcon->tc_lock);
trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
netfs_trace_tcon_ref_get_dfs_refer);
}
@@ -3157,13 +3159,9 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
out:
if (tcon && !tcon->ipc) {
/* ipc tcons are not refcounted */
- spin_lock(&cifs_tcp_ses_lock);
- tcon->tc_count--;
+ cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_dfs_refer);
trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
netfs_trace_tcon_ref_dec_dfs_refer);
- /* tc_count can never go negative */
- WARN_ON(tcon->tc_count < 0);
- spin_unlock(&cifs_tcp_ses_lock);
}
kfree(utf16_path);
kfree(dfs_req);
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 5d57c895ca37a..c7e086dfb1765 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -4239,7 +4239,9 @@ void smb2_reconnect_server(struct work_struct *work)
list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
if (tcon->need_reconnect || tcon->need_reopen_files) {
+ spin_lock(&tcon->tc_lock);
tcon->tc_count++;
+ spin_unlock(&tcon->tc_lock);
trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
netfs_trace_tcon_ref_get_reconnect_server);
list_add_tail(&tcon->rlist, &tmp_list);
diff --git a/fs/smb/client/trace.h b/fs/smb/client/trace.h
index a584a77431132..191f02344dcdd 100644
--- a/fs/smb/client/trace.h
+++ b/fs/smb/client/trace.h
@@ -189,6 +189,7 @@
EM(netfs_trace_tcon_ref_put_cancelled_close_fid, "PUT Cn-Fid") \
EM(netfs_trace_tcon_ref_put_cancelled_mid, "PUT Cn-Mid") \
EM(netfs_trace_tcon_ref_put_mnt_ctx, "PUT MntCtx") \
+ EM(netfs_trace_tcon_ref_put_dfs_refer, "PUT DfsRfr") \
EM(netfs_trace_tcon_ref_put_reconnect_server, "PUT Reconn") \
EM(netfs_trace_tcon_ref_put_tlink, "PUT Tlink ") \
EM(netfs_trace_tcon_ref_see_cancelled_close, "SEE Cn-Cls") \
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 765/844] MIPS: rb532: Fix MMIO UART resource registration
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (763 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 764/844] cifs: Fix locking usage for tcon fields Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 766/844] ceph: supply snapshot context in ceph_zero_partial_object() Sasha Levin
` (87 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jiaxun Yang, Waldemar Brodkorb, Thomas Bogendoerfer, Sasha Levin
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
[ Upstream commit e93bb4b76cfefb302534246e892c7667491cb8cc ]
Since commit 6e690d54cfa8 ("serial: 8250: fix return error code in
serial8250_request_std_resource()"), registering an 8250 MMIO port
without mapbase no longer works, as the resource range is derived from
mapbase/mapsize.
Populate mapbase and mapsize accordingly. Also drop ugly membase KSEG1
pointer and set UPF_IOREMAP instead, letting the 8250 core perform the
ioremap.
Fixes: 6e690d54cfa8 ("serial: 8250: fix return error code in serial8250_request_std_resource()")
Cc: stable@vger.kernel.org
Reported-by: Waldemar Brodkorb <wbx@openadk.org>
Link: https://lore.kernel.org/linux-mips/aX-d0ShTplHKZT33@waldemar-brodkorb.de/
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/rb532/devices.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
index b7f6f782d9a13..ffa4d38ca95df 100644
--- a/arch/mips/rb532/devices.c
+++ b/arch/mips/rb532/devices.c
@@ -212,11 +212,12 @@ static struct platform_device rb532_wdt = {
static struct plat_serial8250_port rb532_uart_res[] = {
{
.type = PORT_16550A,
- .membase = (char *)KSEG1ADDR(REGBASE + UART0BASE),
+ .mapbase = REGBASE + UART0BASE,
+ .mapsize = 0x1000,
.irq = UART0_IRQ,
.regshift = 2,
.iotype = UPIO_MEM,
- .flags = UPF_BOOT_AUTOCONF,
+ .flags = UPF_BOOT_AUTOCONF | UPF_IOREMAP,
},
{
.flags = 0,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 766/844] ceph: supply snapshot context in ceph_zero_partial_object()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (764 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 765/844] MIPS: rb532: Fix MMIO UART resource registration Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 767/844] drm/i915/quirks: Fix device id for QUIRK_EDP_LIMIT_RATE_HBR2 entry Sasha Levin
` (86 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: ethanwu, Viacheslav Dubeyko, Ilya Dryomov, Sasha Levin
From: ethanwu <ethanwu@synology.com>
[ Upstream commit f16bd3fa74a2084ee7e16a8a2be7e7399b970907 ]
The ceph_zero_partial_object function was missing proper snapshot
context for its OSD write operations, which could lead to data
inconsistencies in snapshots.
Reproducer:
../src/vstart.sh --new -x --localhost --bluestore
./bin/ceph auth caps client.fs_a mds 'allow rwps fsname=a' mon 'allow r fsname=a' osd 'allow rw tag cephfs data=a'
mount -t ceph fs_a@.a=/ /mnt/mycephfs/ -o conf=./ceph.conf
dd if=/dev/urandom of=/mnt/mycephfs/foo bs=64K count=1
mkdir /mnt/mycephfs/.snap/snap1
md5sum /mnt/mycephfs/.snap/snap1/foo
fallocate -p -o 0 -l 4096 /mnt/mycephfs/foo
echo 3 > /proc/sys/vm/drop/caches
md5sum /mnt/mycephfs/.snap/snap1/foo # get different md5sum!!
Cc: stable@vger.kernel.org
Fixes: ad7a60de882ac ("ceph: punch hole support")
Signed-off-by: ethanwu <ethanwu@synology.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/file.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 983390069f737..9152b47227101 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -2568,6 +2568,7 @@ static int ceph_zero_partial_object(struct inode *inode,
struct ceph_inode_info *ci = ceph_inode(inode);
struct ceph_fs_client *fsc = ceph_inode_to_fs_client(inode);
struct ceph_osd_request *req;
+ struct ceph_snap_context *snapc;
int ret = 0;
loff_t zero = 0;
int op;
@@ -2582,12 +2583,25 @@ static int ceph_zero_partial_object(struct inode *inode,
op = CEPH_OSD_OP_ZERO;
}
+ spin_lock(&ci->i_ceph_lock);
+ if (__ceph_have_pending_cap_snap(ci)) {
+ struct ceph_cap_snap *capsnap =
+ list_last_entry(&ci->i_cap_snaps,
+ struct ceph_cap_snap,
+ ci_item);
+ snapc = ceph_get_snap_context(capsnap->context);
+ } else {
+ BUG_ON(!ci->i_head_snapc);
+ snapc = ceph_get_snap_context(ci->i_head_snapc);
+ }
+ spin_unlock(&ci->i_ceph_lock);
+
req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout,
ceph_vino(inode),
offset, length,
0, 1, op,
CEPH_OSD_FLAG_WRITE,
- NULL, 0, 0, false);
+ snapc, 0, 0, false);
if (IS_ERR(req)) {
ret = PTR_ERR(req);
goto out;
@@ -2601,6 +2615,7 @@ static int ceph_zero_partial_object(struct inode *inode,
ceph_osdc_put_request(req);
out:
+ ceph_put_snap_context(snapc);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 767/844] drm/i915/quirks: Fix device id for QUIRK_EDP_LIMIT_RATE_HBR2 entry
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (765 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 766/844] ceph: supply snapshot context in ceph_zero_partial_object() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 768/844] rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 Sasha Levin
` (85 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ankit Nautiyal, Jani Nikula, Ville Syrjälä,
Suraj Kandpal, Joonas Lahtinen, Sasha Levin
From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
[ Upstream commit 510e7261a7bcd6232e90f0b6b9f93303bdd29f8a ]
Update the device ID for Dell XPS 13 7390 2-in-1 in the quirk
`QUIRK_EDP_LIMIT_RATE_HBR2` entry. The previous ID (0x8a12) was
incorrect; the correct ID is 0x8a52.
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5969
Fixes: 21c586d9233a ("drm/i915/dp: Add device specific quirk to limit eDP rate to HBR2")
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Cc: <stable@vger.kernel.org> # v6.18+
Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/20251226043359.2553-1-ankit.k.nautiyal@intel.com
(cherry picked from commit c7c30c4093cc11ff66672471f12599a555708343)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_quirks.c b/drivers/gpu/drm/i915/display/intel_quirks.c
index d2e16b79d6be1..1abbdd426e587 100644
--- a/drivers/gpu/drm/i915/display/intel_quirks.c
+++ b/drivers/gpu/drm/i915/display/intel_quirks.c
@@ -239,7 +239,7 @@ static struct intel_quirk intel_quirks[] = {
{ 0x0f31, 0x103c, 0x220f, quirk_invert_brightness },
/* Dell XPS 13 7390 2-in-1 */
- { 0x8a12, 0x1028, 0x08b0, quirk_edp_limit_rate_hbr2 },
+ { 0x8a52, 0x1028, 0x08b0, quirk_edp_limit_rate_hbr2 },
};
static const struct intel_dpcd_quirk intel_dpcd_quirks[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 768/844] rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (766 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 767/844] drm/i915/quirks: Fix device id for QUIRK_EDP_LIMIT_RATE_HBR2 entry Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 769/844] mm/slab: do not access current->mems_allowed_seq if !allow_spin Sasha Levin
` (84 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Miguel Ojeda, David Wood, Wesley Wiser, Gary Guo, Sasha Levin
From: Miguel Ojeda <ojeda@kernel.org>
[ Upstream commit 0a9be83e57de0d0ca8ca4ec610bc344f17a8e5e7 ]
Custom target specifications are unstable, but starting with Rust 1.95.0,
`rustc` requires to explicitly pass `-Zunstable-options` to use them [1]:
error: error loading target specification: custom targets are unstable and require `-Zunstable-options`
|
= help: run `rustc --print target-list` for a list of built-in targets
David (Rust compiler team lead), writes:
"We're destabilising custom targets to allow us to move forward with
build-std without accidentally exposing functionality that we'd like
to revisit prior to committing to. I'll start a thread on Zulip to
discuss with the RfL team how we can come up with an alternative
for them."
Thus pass it.
Cc: David Wood <david@davidtw.co>
Cc: Wesley Wiser <wwiser@gmail.com>
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Link: https://github.com/rust-lang/rust/pull/151534 [1]
Reviewed-by: Gary Guo <gary@garyguo.net>
Tested-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260206204535.39431-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/Makefile | 3 +++
1 file changed, 3 insertions(+)
diff --git a/rust/Makefile b/rust/Makefile
index 4dcc2eff51cb2..725158740fc6f 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -552,6 +552,8 @@ $(obj)/$(libpin_init_internal_name): private rustc_target_flags = --cfg kernel
$(obj)/$(libpin_init_internal_name): $(src)/pin-init/internal/src/lib.rs FORCE
+$(call if_changed_dep,rustc_procmacro)
+# `rustc` requires `-Zunstable-options` to use custom target specifications
+# since Rust 1.95.0 (https://github.com/rust-lang/rust/pull/151534).
quiet_cmd_rustc_library = $(if $(skip_clippy),RUSTC,$(RUSTC_OR_CLIPPY_QUIET)) L $@
cmd_rustc_library = \
OBJTREE=$(abspath $(objtree)) \
@@ -562,6 +564,7 @@ quiet_cmd_rustc_library = $(if $(skip_clippy),RUSTC,$(RUSTC_OR_CLIPPY_QUIET)) L
--crate-type rlib -L$(objtree)/$(obj) \
--crate-name $(patsubst %.o,%,$(notdir $@)) $< \
--sysroot=/dev/null \
+ -Zunstable-options \
$(if $(rustc_objcopy),;$(OBJCOPY) $(rustc_objcopy) $@) \
$(cmd_objtool)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 769/844] mm/slab: do not access current->mems_allowed_seq if !allow_spin
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (767 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 768/844] rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 770/844] mm/slab: use prandom " Sasha Levin
` (83 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Harry Yoo, Vlastimil Babka, Sasha Levin
From: Harry Yoo <harry.yoo@oracle.com>
[ Upstream commit 144080a5823b2dbd635acb6decf7ab23182664f3 ]
Lockdep complains when get_from_any_partial() is called in an NMI
context, because current->mems_allowed_seq is seqcount_spinlock_t and
not NMI-safe:
================================
WARNING: inconsistent lock state
6.19.0-rc5-kfree-rcu+ #315 Tainted: G N
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
kunit_try_catch/9989 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff889085799820 (&____s->seqcount#3){.-.-}-{0:0}, at: ___slab_alloc+0x58f/0xc00
{INITIAL USE} state was registered at:
lock_acquire+0x185/0x320
kernel_init_freeable+0x391/0x1150
kernel_init+0x1f/0x220
ret_from_fork+0x736/0x8f0
ret_from_fork_asm+0x1a/0x30
irq event stamp: 56
hardirqs last enabled at (55): [<ffffffff850a68d7>] _raw_spin_unlock_irq+0x27/0x70
hardirqs last disabled at (56): [<ffffffff850858ca>] __schedule+0x2a8a/0x6630
softirqs last enabled at (0): [<ffffffff81536711>] copy_process+0x1dc1/0x6a10
softirqs last disabled at (0): [<0000000000000000>] 0x0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&____s->seqcount#3);
<Interrupt>
lock(&____s->seqcount#3);
*** DEADLOCK ***
According to Documentation/locking/seqlock.rst, seqcount_t is not
NMI-safe and seqcount_latch_t should be used when read path can interrupt
the write-side critical section. In this case, do not access
current->mems_allowed_seq and avoid retry.
Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Link: https://patch.msgid.link/20260210081900.329447-2-harry.yoo@oracle.com
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slub.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index 78946116ecd2f..6304a2b7b8318 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3610,6 +3610,7 @@ static struct slab *get_any_partial(struct kmem_cache *s,
enum zone_type highest_zoneidx = gfp_zone(pc->flags);
struct slab *slab;
unsigned int cpuset_mems_cookie;
+ bool allow_spin = gfpflags_allow_spinning(pc->flags);
/*
* The defrag ratio allows a configuration of the tradeoffs between
@@ -3634,7 +3635,15 @@ static struct slab *get_any_partial(struct kmem_cache *s,
return NULL;
do {
- cpuset_mems_cookie = read_mems_allowed_begin();
+ /*
+ * read_mems_allowed_begin() accesses current->mems_allowed_seq,
+ * a seqcount_spinlock_t that is not NMI-safe. Do not access
+ * current->mems_allowed_seq and avoid retry when GFP flags
+ * indicate spinning is not allowed.
+ */
+ if (allow_spin)
+ cpuset_mems_cookie = read_mems_allowed_begin();
+
zonelist = node_zonelist(mempolicy_slab_node(), pc->flags);
for_each_zone_zonelist(zone, z, zonelist, highest_zoneidx) {
struct kmem_cache_node *n;
@@ -3656,7 +3665,7 @@ static struct slab *get_any_partial(struct kmem_cache *s,
}
}
}
- } while (read_mems_allowed_retry(cpuset_mems_cookie));
+ } while (allow_spin && read_mems_allowed_retry(cpuset_mems_cookie));
#endif /* CONFIG_NUMA */
return NULL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 770/844] mm/slab: use prandom if !allow_spin
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (768 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 769/844] mm/slab: do not access current->mems_allowed_seq if !allow_spin Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 771/844] LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE Sasha Levin
` (82 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Harry Yoo, Vlastimil Babka, Sasha Levin
From: Harry Yoo <harry.yoo@oracle.com>
[ Upstream commit a1e244a9f177894969c6cd5ebbc6d72c19fc4a7a ]
When CONFIG_SLAB_FREELIST_RANDOM is enabled and get_random_u32()
is called in an NMI context, lockdep complains because it acquires
a local_lock:
================================
WARNING: inconsistent lock state
6.19.0-rc5-slab-for-next+ #325 Tainted: G N
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
kunit_try_catch/8312 [HC2[2]:SC0[0]:HE0:SE1] takes:
ffff88a02ec49cc0 (batched_entropy_u32.lock){-.-.}-{3:3}, at: get_random_u32+0x7f/0x2e0
{INITIAL USE} state was registered at:
lock_acquire+0xd9/0x2f0
get_random_u32+0x93/0x2e0
__get_random_u32_below+0x17/0x70
cache_random_seq_create+0x121/0x1c0
init_cache_random_seq+0x5d/0x110
do_kmem_cache_create+0x1e0/0xa30
__kmem_cache_create_args+0x4ec/0x830
create_kmalloc_caches+0xe6/0x130
kmem_cache_init+0x1b1/0x660
mm_core_init+0x1d8/0x4b0
start_kernel+0x620/0xcd0
x86_64_start_reservations+0x18/0x30
x86_64_start_kernel+0xf3/0x140
common_startup_64+0x13e/0x148
irq event stamp: 76
hardirqs last enabled at (75): [<ffffffff8298b77a>] exc_nmi+0x11a/0x240
hardirqs last disabled at (76): [<ffffffff8298b991>] sysvec_irq_work+0x11/0x110
softirqs last enabled at (0): [<ffffffff813b2dda>] copy_process+0xc7a/0x2350
softirqs last disabled at (0): [<0000000000000000>] 0x0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(batched_entropy_u32.lock);
<Interrupt>
lock(batched_entropy_u32.lock);
*** DEADLOCK ***
Fix this by using pseudo-random number generator if !allow_spin.
This means kmalloc_nolock() users won't get truly random numbers,
but there is not much we can do about it.
Note that an NMI handler might interrupt prandom_u32_state() and
change the random state, but that's safe.
Link: https://lore.kernel.org/all/0c33bdee-6de8-4d9f-92ca-4f72c1b6fb9f@suse.cz
Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
Cc: stable@vger.kernel.org
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Link: https://patch.msgid.link/20260210081900.329447-3-harry.yoo@oracle.com
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slub.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index 6304a2b7b8318..889c2804bbfeb 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -41,6 +41,7 @@
#include <linux/prefetch.h>
#include <linux/memcontrol.h>
#include <linux/random.h>
+#include <linux/prandom.h>
#include <kunit/test.h>
#include <kunit/test-bug.h>
#include <linux/sort.h>
@@ -3196,8 +3197,11 @@ static void *next_freelist_entry(struct kmem_cache *s,
return (char *)start + idx;
}
+static DEFINE_PER_CPU(struct rnd_state, slab_rnd_state);
+
/* Shuffle the single linked freelist based on a random pre-computed sequence */
-static bool shuffle_freelist(struct kmem_cache *s, struct slab *slab)
+static bool shuffle_freelist(struct kmem_cache *s, struct slab *slab,
+ bool allow_spin)
{
void *start;
void *cur;
@@ -3208,7 +3212,19 @@ static bool shuffle_freelist(struct kmem_cache *s, struct slab *slab)
return false;
freelist_count = oo_objects(s->oo);
- pos = get_random_u32_below(freelist_count);
+ if (allow_spin) {
+ pos = get_random_u32_below(freelist_count);
+ } else {
+ struct rnd_state *state;
+
+ /*
+ * An interrupt or NMI handler might interrupt and change
+ * the state in the middle, but that's safe.
+ */
+ state = &get_cpu_var(slab_rnd_state);
+ pos = prandom_u32_state(state) % freelist_count;
+ put_cpu_var(slab_rnd_state);
+ }
page_limit = slab->objects * s->size;
start = fixup_red_left(s, slab_address(slab));
@@ -3235,7 +3251,8 @@ static inline int init_cache_random_seq(struct kmem_cache *s)
return 0;
}
static inline void init_freelist_randomization(void) { }
-static inline bool shuffle_freelist(struct kmem_cache *s, struct slab *slab)
+static inline bool shuffle_freelist(struct kmem_cache *s, struct slab *slab,
+ bool allow_spin)
{
return false;
}
@@ -3320,7 +3337,7 @@ static struct slab *allocate_slab(struct kmem_cache *s, gfp_t flags, int node)
setup_slab_debug(s, slab, start);
- shuffle = shuffle_freelist(s, slab);
+ shuffle = shuffle_freelist(s, slab, allow_spin);
if (!shuffle) {
start = fixup_red_left(s, start);
@@ -8627,6 +8644,9 @@ void __init kmem_cache_init_late(void)
{
flushwq = alloc_workqueue("slub_flushwq", WQ_MEM_RECLAIM, 0);
WARN_ON(!flushwq);
+#ifdef CONFIG_SLAB_FREELIST_RANDOM
+ prandom_init_once(&slab_rnd_state);
+#endif
}
struct kmem_cache *
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 771/844] LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (769 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 770/844] mm/slab: use prandom " Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 772/844] LoongArch: Prefer top-down allocation after arch_mem_init() Sasha Levin
` (81 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: John Garry, Huacai Chen, Sasha Levin
From: John Garry <john.g.garry@oracle.com>
[ Upstream commit 94b0c831eda778ae9e4f2164a8b3de485d8977bb ]
The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE -
which is a valid index - so add a check for this.
Cc: stable@vger.kernel.org
Signed-off-by: John Garry <john.g.garry@oracle.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/topology.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/loongarch/include/asm/topology.h b/arch/loongarch/include/asm/topology.h
index f06e7ff25bb7c..6b79d6183085a 100644
--- a/arch/loongarch/include/asm/topology.h
+++ b/arch/loongarch/include/asm/topology.h
@@ -12,7 +12,7 @@
extern cpumask_t cpus_on_node[];
-#define cpumask_of_node(node) (&cpus_on_node[node])
+#define cpumask_of_node(node) ((node) == NUMA_NO_NODE ? cpu_all_mask : &cpus_on_node[node])
struct pci_bus;
extern int pcibus_to_node(struct pci_bus *);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 772/844] LoongArch: Prefer top-down allocation after arch_mem_init()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (770 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 771/844] LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 773/844] LoongArch: Use %px to print unmodified unwinding address Sasha Levin
` (80 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Huacai Chen, Sasha Levin
From: Huacai Chen <chenhuacai@loongson.cn>
[ Upstream commit 2172d6ebac9372eb01fe4505a53e18cb061e103b ]
Currently we use bottom-up allocation after sparse_init(), the reason is
sparse_init() need a lot of memory, and bottom-up allocation may exhaust
precious low memory (below 4GB). On the other hand, SWIOTLB and CMA need
low memories for DMA32, so swiotlb_init() and dma_contiguous_reserve()
need bottom-up allocation.
Since swiotlb_init() and dma_contiguous_reserve() are both called in
arch_mem_init(), we no longer need bottom-up allocation after that. So
we set the allocation policy to top-down at the end of arch_mem_init(),
in order to avoid later memory allocations (such as KASAN) exhaust low
memory.
This solve at least two problems:
1. Some buggy BIOSes use 0xfd000000~0xfe000000 for secondary CPUs, but
didn't reserve this range, which causes smpboot failures.
2. Some DMA32 devices, such as Loongson-DRM and OHCI, cannot work with
KASAN enabled.
Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/setup.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
index 20cb6f3064568..2b260d15b2e25 100644
--- a/arch/loongarch/kernel/setup.c
+++ b/arch/loongarch/kernel/setup.c
@@ -421,6 +421,7 @@ static void __init arch_mem_init(char **cmdline_p)
PFN_UP(__pa_symbol(&__nosave_end)));
memblock_dump_all();
+ memblock_set_bottom_up(false);
early_memtest(PFN_PHYS(ARCH_PFN_OFFSET), PFN_PHYS(max_low_pfn));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 773/844] LoongArch: Use %px to print unmodified unwinding address
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (771 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 772/844] LoongArch: Prefer top-down allocation after arch_mem_init() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 774/844] LoongArch: Handle percpu handler address for ORC unwinder Sasha Levin
` (79 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tiezhu Yang, Huacai Chen, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 77403a06d845db1caf9a6b0867b43e9dd8de8e4a ]
Currently, use %p to prevent leaking information about the kernel memory
layout when printing the PC address, but the kernel log messages are not
useful to debug problem if bt_address() returns 0. Given that the type of
"pc" variable is unsigned long, it should use %px to print the unmodified
unwinding address.
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/unwind_orc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/loongarch/kernel/unwind_orc.c b/arch/loongarch/kernel/unwind_orc.c
index 8a6e3429a860e..d6b3688a1ce97 100644
--- a/arch/loongarch/kernel/unwind_orc.c
+++ b/arch/loongarch/kernel/unwind_orc.c
@@ -494,7 +494,7 @@ bool unwind_next_frame(struct unwind_state *state)
state->pc = bt_address(pc);
if (!state->pc) {
- pr_err("cannot find unwind pc at %p\n", (void *)pc);
+ pr_err("cannot find unwind pc at %px\n", (void *)pc);
goto err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 774/844] LoongArch: Handle percpu handler address for ORC unwinder
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (772 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 773/844] LoongArch: Use %px to print unmodified unwinding address Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 775/844] LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT Sasha Levin
` (78 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tiezhu Yang, Huacai Chen, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 055c7e75190e0be43037bd663a3f6aced194416e ]
After commit 4cd641a79e69 ("LoongArch: Remove unnecessary checks for ORC
unwinder"), the system can not boot normally under some configs (such as
enable KASAN), there are many error messages "cannot find unwind pc".
The kernel boots normally with the defconfig, so no problem found out at
the first time. Here is one way to reproduce:
cd linux
make mrproper defconfig -j"$(nproc)"
scripts/config -e KASAN
make olddefconfig all -j"$(nproc)"
sudo make modules_install
sudo make install
sudo reboot
The address that can not unwind is not a valid kernel address which is
between "pcpu_handlers[cpu]" and "pcpu_handlers[cpu] + vec_sz" due to
the code of eentry was copied to the new area of pcpu_handlers[cpu] in
setup_tlb_handler(), handle this special case to get the valid address
to unwind normally.
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/setup.h | 3 +++
arch/loongarch/kernel/unwind_orc.c | 16 ++++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/arch/loongarch/include/asm/setup.h b/arch/loongarch/include/asm/setup.h
index 3c2fb16b11b64..f81375e5e89c0 100644
--- a/arch/loongarch/include/asm/setup.h
+++ b/arch/loongarch/include/asm/setup.h
@@ -7,6 +7,7 @@
#define _LOONGARCH_SETUP_H
#include <linux/types.h>
+#include <linux/threads.h>
#include <asm/sections.h>
#include <uapi/asm/setup.h>
@@ -14,6 +15,8 @@
extern unsigned long eentry;
extern unsigned long tlbrentry;
+extern unsigned long pcpu_handlers[NR_CPUS];
+extern long exception_handlers[VECSIZE * 128 / sizeof(long)];
extern char init_command_line[COMMAND_LINE_SIZE];
extern void tlb_init(int cpu);
extern void cpu_cache_init(void);
diff --git a/arch/loongarch/kernel/unwind_orc.c b/arch/loongarch/kernel/unwind_orc.c
index d6b3688a1ce97..11ba3e4ac9eee 100644
--- a/arch/loongarch/kernel/unwind_orc.c
+++ b/arch/loongarch/kernel/unwind_orc.c
@@ -352,6 +352,22 @@ static inline unsigned long bt_address(unsigned long ra)
{
extern unsigned long eentry;
+#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT)
+ int cpu;
+ int vec_sz = sizeof(exception_handlers);
+
+ for_each_possible_cpu(cpu) {
+ if (!pcpu_handlers[cpu])
+ continue;
+
+ if (ra >= pcpu_handlers[cpu] &&
+ ra < pcpu_handlers[cpu] + vec_sz) {
+ ra = ra + eentry - pcpu_handlers[cpu];
+ break;
+ }
+ }
+#endif
+
if (ra >= eentry && ra < eentry + EXCCODE_INT_END * VECSIZE) {
unsigned long func;
unsigned long type = (ra - eentry) / VECSIZE;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 775/844] LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (773 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 774/844] LoongArch: Handle percpu handler address for ORC unwinder Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 776/844] LoongArch: Remove some extern variables in source files Sasha Levin
` (77 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tiezhu Yang, Huacai Chen, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 70b0faae3590c628a98a627a10e5d211310169d4 ]
After commit 88fd2b70120d ("LoongArch: Fix sleeping in atomic context for
PREEMPT_RT"), it should guard percpu handler under !CONFIG_PREEMPT_RT to
avoid redundant operations.
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/unwind_prologue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/loongarch/kernel/unwind_prologue.c b/arch/loongarch/kernel/unwind_prologue.c
index 729e775bd40dd..ee1c29686ab05 100644
--- a/arch/loongarch/kernel/unwind_prologue.c
+++ b/arch/loongarch/kernel/unwind_prologue.c
@@ -65,7 +65,7 @@ static inline bool scan_handlers(unsigned long entry_offset)
static inline bool fix_exception(unsigned long pc)
{
-#ifdef CONFIG_NUMA
+#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT)
int cpu;
for_each_possible_cpu(cpu) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 776/844] LoongArch: Remove some extern variables in source files
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (774 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 775/844] LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 777/844] LoongArch: Disable instrumentation for setup_ptwalker() Sasha Levin
` (76 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tiezhu Yang, Huacai Chen, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 0e6f596d6ac635e80bb265d587b2287ef8fa1cd6 ]
There are declarations of the variable "eentry", "pcpu_handlers[]" and
"exception_handlers[]" in asm/setup.h, the source files already include
this header file directly or indirectly, so no need to declare them in
the source files, just remove the code.
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/kernel/unwind_orc.c | 2 --
arch/loongarch/kernel/unwind_prologue.c | 4 ----
arch/loongarch/mm/tlb.c | 1 -
3 files changed, 7 deletions(-)
diff --git a/arch/loongarch/kernel/unwind_orc.c b/arch/loongarch/kernel/unwind_orc.c
index 11ba3e4ac9eee..9cfb5bb1991f2 100644
--- a/arch/loongarch/kernel/unwind_orc.c
+++ b/arch/loongarch/kernel/unwind_orc.c
@@ -350,8 +350,6 @@ EXPORT_SYMBOL_GPL(unwind_start);
static inline unsigned long bt_address(unsigned long ra)
{
- extern unsigned long eentry;
-
#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT)
int cpu;
int vec_sz = sizeof(exception_handlers);
diff --git a/arch/loongarch/kernel/unwind_prologue.c b/arch/loongarch/kernel/unwind_prologue.c
index ee1c29686ab05..da07acad7973a 100644
--- a/arch/loongarch/kernel/unwind_prologue.c
+++ b/arch/loongarch/kernel/unwind_prologue.c
@@ -23,10 +23,6 @@ extern const int unwind_hint_lasx;
extern const int unwind_hint_lbt;
extern const int unwind_hint_ri;
extern const int unwind_hint_watch;
-extern unsigned long eentry;
-#ifdef CONFIG_NUMA
-extern unsigned long pcpu_handlers[NR_CPUS];
-#endif
static inline bool scan_handlers(unsigned long entry_offset)
{
diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c
index 6a3c91b9cacdc..4014c44695878 100644
--- a/arch/loongarch/mm/tlb.c
+++ b/arch/loongarch/mm/tlb.c
@@ -262,7 +262,6 @@ static void output_pgtable_bits_defines(void)
#ifdef CONFIG_NUMA
unsigned long pcpu_handlers[NR_CPUS];
#endif
-extern long exception_handlers[VECSIZE * 128 / sizeof(long)];
static void setup_tlb_handler(int cpu)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 777/844] LoongArch: Disable instrumentation for setup_ptwalker()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (775 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 776/844] LoongArch: Remove some extern variables in source files Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 778/844] net: ethernet: marvell: skge: remove incorrect conflicting PCI ID Sasha Levin
` (75 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Tiezhu Yang, Huacai Chen, Sasha Levin
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 7cb37af61f09c9cfd90c43c9275307c16320cbf2 ]
According to Documentation/dev-tools/kasan.rst, software KASAN modes use
compiler instrumentation to insert validity checks. Such instrumentation
might be incompatible with some parts of the kernel, and therefore needs
to be disabled, just use the attribute __no_sanitize_address to disable
instrumentation for the low level function setup_ptwalker().
Otherwise bringing up the secondary CPUs failed when CONFIG_KASAN is set
(especially when PTW is enabled), here are the call chains:
smpboot_entry()
start_secondary()
cpu_probe()
per_cpu_trap_init()
tlb_init()
setup_tlb_handler()
setup_ptwalker()
The reason is the PGD registers are configured in setup_ptwalker(), but
KASAN instrumentation may cause TLB exceptions before that.
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/mm/tlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c
index 4014c44695878..aaf7d685cc2aa 100644
--- a/arch/loongarch/mm/tlb.c
+++ b/arch/loongarch/mm/tlb.c
@@ -202,7 +202,7 @@ void __update_tlb(struct vm_area_struct *vma, unsigned long address, pte_t *ptep
local_irq_restore(flags);
}
-static void setup_ptwalker(void)
+static void __no_sanitize_address setup_ptwalker(void)
{
unsigned long pwctl0, pwctl1;
unsigned long pgd_i = 0, pgd_w = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 778/844] net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (776 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 777/844] LoongArch: Disable instrumentation for setup_ptwalker() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 779/844] net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() Sasha Levin
` (74 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ethan Nelson-Moore, Paolo Abeni, Sasha Levin
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit d01103fdcb871fd83fd06ef5803d576507c6a801 ]
The ID 1186:4302 is matched by both r8169 and skge. The same device ID
should not be in more than one driver, because in that case, which
driver is used is unpredictable. I downloaded the latest drivers for
all hardware revisions of the D-Link DGE-530T from D-Link's website,
and the only drivers which contain this ID are Realtek drivers.
Therefore, remove this device ID from skge.
In the kernel bug report which requested addition of this device ID,
someone created a patch to add the ID to skge. Then, it was pointed
out that this device is an "r8169 in disguise", and a patch was created
to add it to r8169. Somehow, both of these patches got merged. See the
link below.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=38862
Fixes: c074304c2bcf ("add pci-id for DGE-530T")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260206071724.15268-1-enelsonmoore@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/skge.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 05349a0b2db1c..cf4e26d337bb5 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -78,7 +78,6 @@ static const struct pci_device_id skge_id_table[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, 0x4320) }, /* SK-98xx V2.0 */
{ PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4b01) }, /* D-Link DGE-530T (rev.B) */
{ PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4c00) }, /* D-Link DGE-530T */
- { PCI_DEVICE(PCI_VENDOR_ID_DLINK, 0x4302) }, /* D-Link DGE-530T Rev C1 */
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4320) }, /* Marvell Yukon 88E8001/8003/8010 */
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x5005) }, /* Belkin */
{ PCI_DEVICE(PCI_VENDOR_ID_CNET, 0x434E) }, /* CNet PowerG-2000 */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 779/844] net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (777 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 778/844] net: ethernet: marvell: skge: remove incorrect conflicting PCI ID Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 780/844] octeontx2-af: CGX: fix bitmap leaks Sasha Levin
` (73 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Thomas Fourier, Christophe Leroy (CS GROUP), Paolo Abeni,
Sasha Levin
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit 36bd7d5deef936c4e1e3cd341598140e5c14c1d3 ]
The priv->rx_buffer and priv->tx_buffer are alloc'd together as
contiguous buffers in uhdlc_init() but freed as two buffers in
uhdlc_memclean().
Change the cleanup to only call dma_free_coherent() once on the whole
buffer.
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Link: https://patch.msgid.link/20260206085334.21195-2-fourier.thomas@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wan/fsl_ucc_hdlc.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index f999798a56127..dff84731343cc 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -790,18 +790,14 @@ static void uhdlc_memclean(struct ucc_hdlc_private *priv)
if (priv->rx_buffer) {
dma_free_coherent(priv->dev,
- RX_BD_RING_LEN * MAX_RX_BUF_LENGTH,
+ (RX_BD_RING_LEN + TX_BD_RING_LEN) * MAX_RX_BUF_LENGTH,
priv->rx_buffer, priv->dma_rx_addr);
priv->rx_buffer = NULL;
priv->dma_rx_addr = 0;
- }
- if (priv->tx_buffer) {
- dma_free_coherent(priv->dev,
- TX_BD_RING_LEN * MAX_RX_BUF_LENGTH,
- priv->tx_buffer, priv->dma_tx_addr);
priv->tx_buffer = NULL;
priv->dma_tx_addr = 0;
+
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 780/844] octeontx2-af: CGX: fix bitmap leaks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (778 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 779/844] net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 781/844] net: ti: icssg-prueth: Add optional dependency on HSR Sasha Levin
` (72 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bo Sun, Vadim Fedorenko, Jijie Shao, Jakub Kicinski, Sasha Levin
From: Bo Sun <bo@mboxify.com>
[ Upstream commit 3def995c4ede842adf509c410e92d09a0cedc965 ]
The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
Unbinding and rebinding the driver therefore triggers kmemleak:
unreferenced object (size 16):
backtrace:
rvu_alloc_bitmap
cgx_probe
Free both bitmaps during teardown.
Fixes: e740003874ed ("octeontx2-af: Flow control resource management")
Cc: stable@vger.kernel.org
Signed-off-by: Bo Sun <bo@mboxify.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Jijie Shao <shaojijie@huawei.com>
Link: https://patch.msgid.link/20260206130925.1087588-2-bo@mboxify.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
index 42044cd810b1f..fd4792e432bf0 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -1823,6 +1823,8 @@ static int cgx_lmac_exit(struct cgx *cgx)
cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, false);
cgx_configure_interrupt(cgx, lmac, lmac->lmac_id, true);
kfree(lmac->mac_to_index_bmap.bmap);
+ rvu_free_bitmap(&lmac->rx_fc_pfvf_bmap);
+ rvu_free_bitmap(&lmac->tx_fc_pfvf_bmap);
kfree(lmac->name);
kfree(lmac);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 781/844] net: ti: icssg-prueth: Add optional dependency on HSR
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (779 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 780/844] octeontx2-af: CGX: fix bitmap leaks Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 782/844] net: macb: Fix tx/rx malfunction after phy link down and up Sasha Levin
` (71 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kevin Hao, Paolo Abeni, Sasha Levin
From: Kevin Hao <haokexin@gmail.com>
[ Upstream commit e3998b6e90f875f19bf758053d79ccfd41880173 ]
Commit 95540ad6747c ("net: ti: icssg-prueth: Add support for HSR frame
forward offload") introduced support for offloading HSR frame forwarding,
which relies on functions such as is_hsr_master() provided by the HSR
module. Although HSR provides stubs for configurations with HSR
disabled, this driver still requires an optional dependency on HSR.
Otherwise, build failures will occur when icssg-prueth is built-in
while HSR is configured as a module.
ld.lld: error: undefined symbol: is_hsr_master
>>> referenced by icssg_prueth.c:710 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:710)
>>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_del_mcast) in archive vmlinux.a
>>> referenced by icssg_prueth.c:681 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:681)
>>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_add_mcast) in archive vmlinux.a
>>> referenced by icssg_prueth.c:1812 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:1812)
>>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(prueth_netdevice_event) in archive vmlinux.a
ld.lld: error: undefined symbol: hsr_get_port_ndev
>>> referenced by icssg_prueth.c:712 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:712)
>>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_del_mcast) in archive vmlinux.a
>>> referenced by icssg_prueth.c:712 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:712)
>>> drivers/net/etherneteth_hsr_del_mcast) in archive vmlinux.a
>>> referenced by icssg_prueth.c:683 (drivers/net/ethernet/ti/icssg/icssg_prueth.c:683)
>>> drivers/net/ethernet/ti/icssg/icssg_prueth.o:(icssg_prueth_hsr_add_mcast) in archive vmlinux.a
>>> referenced 1 more times
Fixes: 95540ad6747c ("net: ti: icssg-prueth: Add support for HSR frame forward offload")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260207-icssg-dep-v3-1-8c47c1937f81@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index fe5b2926d8ab0..c60b04921c62c 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -192,6 +192,7 @@ config TI_ICSSG_PRUETH
depends on NET_SWITCHDEV
depends on ARCH_K3 && OF && TI_K3_UDMA_GLUE_LAYER
depends on PTP_1588_CLOCK_OPTIONAL
+ depends on HSR || !HSR
help
Support dual Gigabit Ethernet ports over the ICSSG PRU Subsystem.
This subsystem is available starting with the AM65 platform.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 782/844] net: macb: Fix tx/rx malfunction after phy link down and up
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (780 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 781/844] net: ti: icssg-prueth: Add optional dependency on HSR Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 783/844] tracing: Fix to set write permission to per-cpu buffer_size_kb Sasha Levin
` (70 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kevin Hao, Paolo Abeni, Sasha Levin
From: Kevin Hao <haokexin@gmail.com>
[ Upstream commit bf9cf80cab81e39701861a42877a28295ade266f ]
In commit 99537d5c476c ("net: macb: Relocate mog_init_rings() callback
from macb_mac_link_up() to macb_open()"), the mog_init_rings() callback
was moved from macb_mac_link_up() to macb_open() to resolve a deadlock
issue. However, this change introduced a tx/rx malfunction following
phy link down and up events. The issue arises from a mismatch between
the software queue->tx_head, queue->tx_tail, queue->rx_prepared_head,
and queue->rx_tail values and the hardware's internal tx/rx queue
pointers.
According to the Zynq UltraScale TRM [1], when tx/rx is disabled, the
internal tx queue pointer resets to the value in the tx queue base
address register, while the internal rx queue pointer remains unchanged.
The following is quoted from the Zynq UltraScale TRM:
When transmit is disabled, with bit [3] of the network control register
set low, the transmit-buffer queue pointer resets to point to the address
indicated by the transmit-buffer queue base address register. Disabling
receive does not have the same effect on the receive-buffer queue
pointer.
Additionally, there is no need to reset the RBQP and TBQP registers in a
phy event callback. Therefore, move macb_init_buffers() to macb_open().
In a phy link up event, the only required action is to reset the tx
software head and tail pointers to align with the hardware's behavior.
[1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm
Fixes: 99537d5c476c ("net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260208-macb-init-ring-v1-1-939a32c14635@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 6511ecd5856bd..4ebb40adfab37 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -705,14 +705,12 @@ static void macb_mac_link_up(struct phylink_config *config,
if (rx_pause)
ctrl |= MACB_BIT(PAE);
- /* Initialize rings & buffers as clearing MACB_BIT(TE) in link down
- * cleared the pipeline and control registers.
- */
- macb_init_buffers(bp);
-
- for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue)
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+ queue->tx_head = 0;
+ queue->tx_tail = 0;
queue_writel(queue, IER,
bp->rx_intr_mask | MACB_TX_INT_FLAGS | MACB_BIT(HRESP));
+ }
}
macb_or_gem_writel(bp, NCFGR, ctrl);
@@ -2954,6 +2952,7 @@ static int macb_open(struct net_device *dev)
}
bp->macbgem_ops.mog_init_rings(bp);
+ macb_init_buffers(bp);
for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
napi_enable(&queue->napi_rx);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 783/844] tracing: Fix to set write permission to per-cpu buffer_size_kb
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (781 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 782/844] net: macb: Fix tx/rx malfunction after phy link down and up Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 784/844] tracing: Reset last_boot_info if ring buffer is reset Sasha Levin
` (69 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Masami Hiramatsu (Google), Mathieu Desnoyers,
Steven Rostedt (Google), Sasha Levin
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
[ Upstream commit f844282deed7481cf2f813933229261e27306551 ]
Since the per-cpu buffer_size_kb file is writable for changing
per-cpu ring buffer size, the file should have the write access
permission.
Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/177071301597.2293046.11683339475076917920.stgit@mhiramat.tok.corp.google.com
Fixes: 21ccc9cd7211 ("tracing: Disable "other" permission bits in the tracefs files")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8bd4ec08fb361..8e9c1bfe3ebb3 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -9398,7 +9398,7 @@ tracing_init_tracefs_percpu(struct trace_array *tr, long cpu)
trace_create_cpu_file("stats", TRACE_MODE_READ, d_cpu,
tr, cpu, &tracing_stats_fops);
- trace_create_cpu_file("buffer_size_kb", TRACE_MODE_READ, d_cpu,
+ trace_create_cpu_file("buffer_size_kb", TRACE_MODE_WRITE, d_cpu,
tr, cpu, &tracing_entries_fops);
if (tr->range_addr_start)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 784/844] tracing: Reset last_boot_info if ring buffer is reset
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (782 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 783/844] tracing: Fix to set write permission to per-cpu buffer_size_kb Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 785/844] ceph: do not propagate page array emplacement errors as batch errors Sasha Levin
` (68 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Masami Hiramatsu (Google), Mathieu Desnoyers,
Steven Rostedt (Google), Sasha Levin
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
[ Upstream commit 804c4a2209bcf6ed4c45386f033e4d0f7c5bfda5 ]
Commit 32dc0042528d ("tracing: Reset last-boot buffers when reading
out all cpu buffers") resets the last_boot_info when user read out
all data via trace_pipe* files. But it is not reset when user
resets the buffer from other files. (e.g. write `trace` file)
Reset it when the corresponding ring buffer is reset too.
Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/177071302364.2293046.17895165659153977720.stgit@mhiramat.tok.corp.google.com
Fixes: 32dc0042528d ("tracing: Reset last-boot buffers when reading out all cpu buffers")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8e9c1bfe3ebb3..cc93d0e1f1876 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4881,6 +4881,8 @@ static int tracing_single_release_tr(struct inode *inode, struct file *file)
return single_release(inode, file);
}
+static bool update_last_data_if_empty(struct trace_array *tr);
+
static int tracing_open(struct inode *inode, struct file *file)
{
struct trace_array *tr = inode->i_private;
@@ -4905,6 +4907,8 @@ static int tracing_open(struct inode *inode, struct file *file)
tracing_reset_online_cpus(trace_buf);
else
tracing_reset_cpu(trace_buf, cpu);
+
+ update_last_data_if_empty(tr);
}
if (file->f_mode & FMODE_READ) {
@@ -5971,6 +5975,7 @@ tracing_set_trace_read(struct file *filp, char __user *ubuf,
int tracer_init(struct tracer *t, struct trace_array *tr)
{
tracing_reset_online_cpus(&tr->array_buffer);
+ update_last_data_if_empty(tr);
return t->init(tr);
}
@@ -7789,6 +7794,7 @@ int tracing_set_clock(struct trace_array *tr, const char *clockstr)
ring_buffer_set_clock(tr->max_buffer.buffer, trace_clocks[i].func);
tracing_reset_online_cpus(&tr->max_buffer);
#endif
+ update_last_data_if_empty(tr);
if (tr->scratch && !(tr->flags & TRACE_ARRAY_FL_LAST_BOOT)) {
struct trace_scratch *tscratch = tr->scratch;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 785/844] ceph: do not propagate page array emplacement errors as batch errors
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (783 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 784/844] tracing: Reset last_boot_info if ring buffer is reset Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 786/844] ceph: fix write storm on fscrypted files Sasha Levin
` (67 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sam Edwards, Sam Edwards, Ilya Dryomov, Sasha Levin
From: Sam Edwards <cfsworks@gmail.com>
[ Upstream commit 707104682e3c163f7c14cdd6b07a3e95fb374759 ]
When fscrypt is enabled, move_dirty_folio_in_page_array() may fail
because it needs to allocate bounce buffers to store the encrypted
versions of each folio. Each folio beyond the first allocates its bounce
buffer with GFP_NOWAIT. Failures are common (and expected) under this
allocation mode; they should flush (not abort) the batch.
However, ceph_process_folio_batch() uses the same `rc` variable for its
own return code and for capturing the return codes of its routine calls;
failing to reset `rc` back to 0 results in the error being propagated
out to the main writeback loop, which cannot actually tolerate any
errors here: once `ceph_wbc.pages` is allocated, it must be passed to
ceph_submit_write() to be freed. If it survives until the next iteration
(e.g. due to the goto being followed), ceph_allocate_page_array()'s
BUG_ON() will oops the worker.
Note that this failure mode is currently masked due to another bug
(addressed next in this series) that prevents multiple encrypted folios
from being selected for the same write.
For now, just reset `rc` when redirtying the folio to prevent errors in
move_dirty_folio_in_page_array() from propagating. Note that
move_dirty_folio_in_page_array() is careful never to return errors on
the first folio, so there is no need to check for that. After this
change, ceph_process_folio_batch() no longer returns errors; its only
remaining failure indicator is `locked_pages == 0`, which the caller
already handles correctly.
Cc: stable@vger.kernel.org
Fixes: ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method")
Signed-off-by: Sam Edwards <CFSworks@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/addr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index faecd9025ee9c..3cfe3df6e6a22 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1369,6 +1369,7 @@ int ceph_process_folio_batch(struct address_space *mapping,
rc = move_dirty_folio_in_page_array(mapping, wbc, ceph_wbc,
folio);
if (rc) {
+ rc = 0;
folio_redirty_for_writepage(wbc, folio);
folio_unlock(folio);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 786/844] ceph: fix write storm on fscrypted files
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (784 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 785/844] ceph: do not propagate page array emplacement errors as batch errors Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 787/844] io_uring/filetable: clamp alloc_hint to the configured alloc range Sasha Levin
` (66 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sam Edwards, Sam Edwards, Ilya Dryomov, Sasha Levin
From: Sam Edwards <cfsworks@gmail.com>
[ Upstream commit cac190c7674fea71620d754ffcdaaeed7c551dbc ]
CephFS stores file data across multiple RADOS objects. An object is the
atomic unit of storage, so the writeback code must clean only folios
that belong to the same object with each OSD request.
CephFS also supports RAID0-style striping of file contents: if enabled,
each object stores multiple unbroken "stripe units" covering different
portions of the file; if disabled, a "stripe unit" is simply the whole
object. The stripe unit is (usually) reported as the inode's block size.
Though the writeback logic could, in principle, lock all dirty folios
belonging to the same object, its current design is to lock only a
single stripe unit at a time. Ever since this code was first written,
it has determined this size by checking the inode's block size.
However, the relatively-new fscrypt support needed to reduce the block
size for encrypted inodes to the crypto block size (see 'fixes' commit),
which causes an unnecessarily high number of write operations (~1024x as
many, with 4MiB objects) and correspondingly degraded performance.
Fix this (and clarify intent) by using i_layout.stripe_unit directly in
ceph_define_write_size() so that encrypted inodes are written back with
the same number of operations as if they were unencrypted.
This patch depends on the preceding commit ("ceph: do not propagate page
array emplacement errors as batch errors") for correctness. While it
applies cleanly on its own, applying it alone will introduce a
regression. This dependency is only relevant for kernels where
ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") has
been applied; stable kernels without that commit are unaffected.
Cc: stable@vger.kernel.org
Fixes: 94af0470924c ("ceph: add some fscrypt guardrails")
Signed-off-by: Sam Edwards <CFSworks@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/addr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 3cfe3df6e6a22..c6c853748942b 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -1000,7 +1000,8 @@ unsigned int ceph_define_write_size(struct address_space *mapping)
{
struct inode *inode = mapping->host;
struct ceph_fs_client *fsc = ceph_inode_to_fs_client(inode);
- unsigned int wsize = i_blocksize(inode);
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ unsigned int wsize = ci->i_layout.stripe_unit;
if (fsc->mount_options->wsize < wsize)
wsize = fsc->mount_options->wsize;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 787/844] io_uring/filetable: clamp alloc_hint to the configured alloc range
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (785 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 786/844] ceph: fix write storm on fscrypted files Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 788/844] io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots Sasha Levin
` (65 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jens Axboe, Sasha Levin
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit a6bded921ed35f21b3f6bd8e629bf488499ca442 ]
Explicit fixed file install/remove operations on slots outside the
configured alloc range can corrupt alloc_hint via io_file_bitmap_set()
and io_file_bitmap_clear(), which unconditionally update alloc_hint to
the bit position. This causes subsequent auto-allocations to fall
outside the configured range.
For example, if the alloc range is [10, 20) and a file is removed at
slot 2, alloc_hint gets set to 2. The next auto-alloc then starts
searching from slot 2, potentially returning a slot below the range.
Fix this by clamping alloc_hint to [file_alloc_start, file_alloc_end)
at the top of io_file_bitmap_get() before starting the search.
Cc: stable@vger.kernel.org
Fixes: 6e73dffbb93c ("io_uring: let to set a range for file slot allocation")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/filetable.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/io_uring/filetable.c b/io_uring/filetable.c
index 794ef95df293c..cb1838c9fc377 100644
--- a/io_uring/filetable.c
+++ b/io_uring/filetable.c
@@ -22,6 +22,10 @@ static int io_file_bitmap_get(struct io_ring_ctx *ctx)
if (!table->bitmap)
return -ENFILE;
+ if (table->alloc_hint < ctx->file_alloc_start ||
+ table->alloc_hint >= ctx->file_alloc_end)
+ table->alloc_hint = ctx->file_alloc_start;
+
do {
ret = find_next_zero_bit(table->bitmap, nr, table->alloc_hint);
if (ret != nr)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 788/844] io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (786 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 787/844] io_uring/filetable: clamp alloc_hint to the configured alloc range Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 789/844] drm/i915/dp: Fail state computation for invalid DSC source input BPP values Sasha Levin
` (64 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jens Axboe, Sasha Levin
From: Jens Axboe <axboe@kernel.dk>
[ Upstream commit f4d0668b38d8784f33a9a36c72ed5d0078247538 ]
__io_fixed_fd_install() returns 0 on success for non-alloc mode
(specific slot), not the slot index. io_pipe_fixed() used this return
value directly as the slot index in fds[], which can cause the reported
values returned via copy_to_user() to be incorrect, or the error path
operating on the incorrect direct descriptor.
Fix by computing the actual 0-based slot index (slot - 1) for specific
slot mode, while preserving the existing behavior for auto-alloc mode
where __io_fixed_fd_install() already returns the allocated index.
Cc: stable@vger.kernel.org
Fixes: 53db8a71ecb4 ("io_uring: add support for IORING_OP_PIPE")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/openclose.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/io_uring/openclose.c b/io_uring/openclose.c
index 15dde9bd6ff67..606ce0664e6a4 100644
--- a/io_uring/openclose.c
+++ b/io_uring/openclose.c
@@ -336,31 +336,34 @@ static int io_pipe_fixed(struct io_kiocb *req, struct file **files,
{
struct io_pipe *p = io_kiocb_to_cmd(req, struct io_pipe);
struct io_ring_ctx *ctx = req->ctx;
+ bool alloc_slot;
int ret, fds[2] = { -1, -1 };
int slot = p->file_slot;
if (p->flags & O_CLOEXEC)
return -EINVAL;
+ alloc_slot = slot == IORING_FILE_INDEX_ALLOC;
+
io_ring_submit_lock(ctx, issue_flags);
ret = __io_fixed_fd_install(ctx, files[0], slot);
if (ret < 0)
goto err;
- fds[0] = ret;
+ fds[0] = alloc_slot ? ret : slot - 1;
files[0] = NULL;
/*
* If a specific slot is given, next one will be used for
* the write side.
*/
- if (slot != IORING_FILE_INDEX_ALLOC)
+ if (!alloc_slot)
slot++;
ret = __io_fixed_fd_install(ctx, files[1], slot);
if (ret < 0)
goto err;
- fds[1] = ret;
+ fds[1] = alloc_slot ? ret : slot - 1;
files[1] = NULL;
io_ring_submit_unlock(ctx, issue_flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 789/844] drm/i915/dp: Fail state computation for invalid DSC source input BPP values
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (787 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 788/844] io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 790/844] drm/i915/dp: Fix pipe BPP clamping due to HDR Sasha Levin
` (63 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Imre Deak, Vinod Govindapillai, Sasha Levin
From: Imre Deak <imre.deak@intel.com>
[ Upstream commit 338465490cf7bd4a700ecd33e4855fee4622fa5f ]
There is no reason to accept an invalid minimum/maximum DSC source input
BPP value (i.e a minimum DSC input BPP value above the maximum pipe BPP
or a maximum DSC input BPP value below the minimum pipe BPP value), fail
the state computation in these cases.
Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patch.msgid.link/20251215192357.172201-17-imre.deak@intel.com
Stable-dep-of: fe26ae6ac8b8 ("drm/i915/dp: Fix pipe BPP clamping due to HDR")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_dp.c | 28 ++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index 0ec82fcbcf48e..d0dbc6715717d 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -2605,16 +2605,30 @@ intel_dp_compute_config_link_bpp_limits(struct intel_dp *intel_dp,
return true;
}
-static void
-intel_dp_dsc_compute_pipe_bpp_limits(struct intel_dp *intel_dp,
+static bool
+intel_dp_dsc_compute_pipe_bpp_limits(struct intel_connector *connector,
struct link_config_limits *limits)
{
- struct intel_display *display = to_intel_display(intel_dp);
+ struct intel_display *display = to_intel_display(connector);
+ const struct link_config_limits orig_limits = *limits;
int dsc_min_bpc = intel_dp_dsc_min_src_input_bpc();
int dsc_max_bpc = intel_dp_dsc_max_src_input_bpc(display);
- limits->pipe.max_bpp = clamp(limits->pipe.max_bpp, dsc_min_bpc * 3, dsc_max_bpc * 3);
- limits->pipe.min_bpp = clamp(limits->pipe.min_bpp, dsc_min_bpc * 3, dsc_max_bpc * 3);
+ limits->pipe.min_bpp = max(limits->pipe.min_bpp, dsc_min_bpc * 3);
+ limits->pipe.max_bpp = min(limits->pipe.max_bpp, dsc_max_bpc * 3);
+
+ if (limits->pipe.min_bpp <= 0 ||
+ limits->pipe.min_bpp > limits->pipe.max_bpp) {
+ drm_dbg_kms(display->drm,
+ "[CONNECTOR:%d:%s] Invalid DSC src/sink input BPP (src:%d-%d pipe:%d-%d)\n",
+ connector->base.base.id, connector->base.name,
+ dsc_min_bpc * 3, dsc_max_bpc * 3,
+ orig_limits.pipe.min_bpp, orig_limits.pipe.max_bpp);
+
+ return false;
+ }
+
+ return true;
}
bool
@@ -2654,8 +2668,8 @@ intel_dp_compute_config_limits(struct intel_dp *intel_dp,
respect_downstream_limits);
}
- if (dsc)
- intel_dp_dsc_compute_pipe_bpp_limits(intel_dp, limits);
+ if (dsc && !intel_dp_dsc_compute_pipe_bpp_limits(connector, limits))
+ return false;
if (is_mst || intel_dp->use_max_params) {
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 790/844] drm/i915/dp: Fix pipe BPP clamping due to HDR
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (788 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 789/844] drm/i915/dp: Fail state computation for invalid DSC source input BPP values Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 791/844] drm/amd/display: Increase DCN35 SR enter/exit latency Sasha Levin
` (62 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Imre Deak, Chaitanya Kumar Borah, Ankit Nautiyal, Joonas Lahtinen,
Sasha Levin
From: Imre Deak <imre.deak@intel.com>
[ Upstream commit fe26ae6ac8b88fcdac5036b557c129a17fe520d2 ]
The pipe BPP value shouldn't be set outside of the source's / sink's
valid pipe BPP range, ensure this when increasing the minimum pipe BPP
value to 30 due to HDR.
While at it debug print if the HDR mode was requested for a connector by
setting the corresponding HDR connector property. This indicates
if the requested HDR mode could not be enabled, since the selected
pipe BPP is below 30, due to a sink capability or link BW limit.
v2:
- Also handle the case where the sink could support the target 30 BPP
only in DSC mode due to a BW limit, but the sink doesn't support DSC
or 30 BPP as a DSC input BPP. (Chaitanya)
- Debug print the connector's HDR mode in the link config dump, to
indicate if a BPP >= 30 required by HDR couldn't be reached. (Ankit)
- Add Closes: trailer. (Ankit)
- Don't print the 30 BPP-outside of valid BPP range debug message if
the min BPP is already > 30 (and so a target BPP >= 30 required
for HDR is ensured).
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7052
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15503
Fixes: ba49a4643cf53 ("drm/i915/dp: Set min_bpp limit to 30 in HDR mode")
Cc: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Cc: <stable@vger.kernel.org> # v6.18+
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> # v1
Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patch.msgid.link/20260209133817.395823-1-imre.deak@intel.com
(cherry picked from commit 08b7ef16b6a03e8c966e286ee1ac608a6ffb3d4a)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_dp.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index d0dbc6715717d..ee258df439a7d 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -2639,6 +2639,7 @@ intel_dp_compute_config_limits(struct intel_dp *intel_dp,
bool dsc,
struct link_config_limits *limits)
{
+ struct intel_display *display = to_intel_display(intel_dp);
bool is_mst = intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DP_MST);
struct intel_connector *connector =
to_intel_connector(conn_state->connector);
@@ -2651,8 +2652,7 @@ intel_dp_compute_config_limits(struct intel_dp *intel_dp,
limits->min_lane_count = intel_dp_min_lane_count(intel_dp);
limits->max_lane_count = intel_dp_max_lane_count(intel_dp);
- limits->pipe.min_bpp = intel_dp_in_hdr_mode(conn_state) ? 30 :
- intel_dp_min_bpp(crtc_state->output_format);
+ limits->pipe.min_bpp = intel_dp_min_bpp(crtc_state->output_format);
if (is_mst) {
/*
* FIXME: If all the streams can't fit into the link with their
@@ -2668,6 +2668,19 @@ intel_dp_compute_config_limits(struct intel_dp *intel_dp,
respect_downstream_limits);
}
+ if (!dsc && intel_dp_in_hdr_mode(conn_state)) {
+ if (intel_dp_supports_dsc(intel_dp, connector, crtc_state) &&
+ limits->pipe.max_bpp >= 30)
+ limits->pipe.min_bpp = max(limits->pipe.min_bpp, 30);
+ else
+ drm_dbg_kms(display->drm,
+ "[CONNECTOR:%d:%s] Can't force 30 bpp for HDR (pipe bpp: %d-%d DSC-support: %s)\n",
+ connector->base.base.id, connector->base.name,
+ limits->pipe.min_bpp, limits->pipe.max_bpp,
+ str_yes_no(intel_dp_supports_dsc(intel_dp, connector,
+ crtc_state)));
+ }
+
if (dsc && !intel_dp_dsc_compute_pipe_bpp_limits(connector, limits))
return false;
@@ -2798,10 +2811,11 @@ intel_dp_compute_link_config(struct intel_encoder *encoder,
}
drm_dbg_kms(display->drm,
- "DP lane count %d clock %d bpp input %d compressed " FXP_Q4_FMT " link rate required %d available %d\n",
+ "DP lane count %d clock %d bpp input %d compressed " FXP_Q4_FMT " HDR %s link rate required %d available %d\n",
pipe_config->lane_count, pipe_config->port_clock,
pipe_config->pipe_bpp,
FXP_Q4_ARGS(pipe_config->dsc.compressed_bpp_x16),
+ str_yes_no(intel_dp_in_hdr_mode(conn_state)),
intel_dp_config_required_rate(pipe_config),
intel_dp_max_link_data_rate(intel_dp,
pipe_config->port_clock,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 791/844] drm/amd/display: Increase DCN35 SR enter/exit latency
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (789 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 790/844] drm/i915/dp: Fix pipe BPP clamping due to HDR Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 792/844] drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify Sasha Levin
` (61 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Leo Li, Nicholas Kazlauskas, Tom Chung, Daniel Wheeler,
Alex Deucher, Sasha Levin
From: Leo Li <sunpeng.li@amd.com>
[ Upstream commit 318917e1d8ecc89f820f4fabf79935f4fed718cd ]
[Why & How]
On Framework laptops with DDR5 modules, underflow can be observed.
It's unclear why it only occurs on specific desktop contents. However,
increasing enter/exit latencies by 3us seems to resolve it.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4463
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 16 ++++++++--------
.../gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 4 ++--
2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
index dfd0c9505af09..0a21910c87e10 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
@@ -768,32 +768,32 @@ static struct wm_table ddr5_wm_table = {
.wm_inst = WM_A,
.wm_type = WM_TYPE_PSTATE_CHG,
.pstate_latency_us = 11.72,
- .sr_exit_time_us = 28.0,
- .sr_enter_plus_exit_time_us = 30.0,
+ .sr_exit_time_us = 31.0,
+ .sr_enter_plus_exit_time_us = 33.0,
.valid = true,
},
{
.wm_inst = WM_B,
.wm_type = WM_TYPE_PSTATE_CHG,
.pstate_latency_us = 11.72,
- .sr_exit_time_us = 28.0,
- .sr_enter_plus_exit_time_us = 30.0,
+ .sr_exit_time_us = 31.0,
+ .sr_enter_plus_exit_time_us = 33.0,
.valid = true,
},
{
.wm_inst = WM_C,
.wm_type = WM_TYPE_PSTATE_CHG,
.pstate_latency_us = 11.72,
- .sr_exit_time_us = 28.0,
- .sr_enter_plus_exit_time_us = 30.0,
+ .sr_exit_time_us = 31.0,
+ .sr_enter_plus_exit_time_us = 33.0,
.valid = true,
},
{
.wm_inst = WM_D,
.wm_type = WM_TYPE_PSTATE_CHG,
.pstate_latency_us = 11.72,
- .sr_exit_time_us = 28.0,
- .sr_enter_plus_exit_time_us = 30.0,
+ .sr_exit_time_us = 31.0,
+ .sr_enter_plus_exit_time_us = 33.0,
.valid = true,
},
}
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
index 817a370e80a77..8a177d5ae213e 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
@@ -164,8 +164,8 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_5_soc = {
},
},
.num_states = 5,
- .sr_exit_time_us = 28.0,
- .sr_enter_plus_exit_time_us = 30.0,
+ .sr_exit_time_us = 31.0,
+ .sr_enter_plus_exit_time_us = 33.0,
.sr_exit_z8_time_us = 250.0,
.sr_enter_plus_exit_z8_time_us = 350.0,
.fclk_change_latency_us = 24.0,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 792/844] drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (790 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 791/844] drm/amd/display: Increase DCN35 SR enter/exit latency Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 793/844] mm/hugetlb: restore failed global reservations to subpool Sasha Levin
` (60 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Pierre-Eric Pelloux-Prayer, Christian König, Alex Deucher,
Sasha Levin
From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
[ Upstream commit b18fc0ab837381c1a6ef28386602cd888f2d9edf ]
Invalidating a dmabuf will impact other users of the shared BO.
In the scenario where process A moves the BO, it needs to inform
process B about the move and process B will need to update its
page table.
The commit fixes a synchronisation bug caused by the use of the
ticket: it made amdgpu_vm_handle_moved behave as if updating
the page table immediately was correct but in this case it's not.
An example is the following scenario, with 2 GPUs and glxgears
running on GPU0 and Xorg running on GPU1, on a system where P2P
PCI isn't supported:
glxgears:
export linear buffer from GPU0 and import using GPU1
submit frame rendering to GPU0
submit tiled->linear blit
Xorg:
copy of linear buffer
The sequence of jobs would be:
drm_sched_job_run # GPU0, frame rendering
drm_sched_job_queue # GPU0, blit
drm_sched_job_done # GPU0, frame rendering
drm_sched_job_run # GPU0, blit
move linear buffer for GPU1 access #
amdgpu_dma_buf_move_notify -> update pt # GPU0
It this point the blit job on GPU0 is still running and would
likely produce a page fault.
Cc: stable@vger.kernel.org
Fixes: a448cb003edc ("drm/amdgpu: implement amdgpu_gem_prime_move_notify v2")
Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
index c1461317eb298..83fed04436ad7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
@@ -496,8 +496,15 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach)
r = dma_resv_reserve_fences(resv, 2);
if (!r)
r = amdgpu_vm_clear_freed(adev, vm, NULL);
+
+ /* Don't pass 'ticket' to amdgpu_vm_handle_moved: we want the clear=true
+ * path to be used otherwise we might update the PT of another process
+ * while it's using the BO.
+ * With clear=true, amdgpu_vm_bo_update will sync to command submission
+ * from the same VM.
+ */
if (!r)
- r = amdgpu_vm_handle_moved(adev, vm, ticket);
+ r = amdgpu_vm_handle_moved(adev, vm, NULL);
if (r && r != -EBUSY)
DRM_ERROR("Failed to invalidate VM page tables (%d))\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 793/844] mm/hugetlb: restore failed global reservations to subpool
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (791 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 792/844] drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 794/844] mm/page_alloc: skip debug_check_no_{obj,locks}_freed with FPI_TRYLOCK Sasha Levin
` (59 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Joshua Hahn, Usama Arif, David Hildenbrand, Liam R. Howlett,
Lorenzo Stoakes, Ma Wupeng, Michal Hocko, Mike Rapoport,
Muchun Song, Oscar Salvador, Shakeel Butt, Suren Baghdasaryan,
Vlastimil Babka, Waiman Long, Andrew Morton, Sasha Levin
From: Joshua Hahn <joshua.hahnjy@gmail.com>
[ Upstream commit 1d3f9bb4c8af70304d19c22e30f5d16a2d589bb5 ]
Commit a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
fixed an underflow error for hstate->resv_huge_pages caused by incorrectly
attributing globally requested pages to the subpool's reservation.
Unfortunately, this fix also introduced the opposite problem, which would
leave spool->used_hpages elevated if the globally requested pages could
not be acquired. This is because while a subpool's reserve pages only
accounts for what is requested and allocated from the subpool, its "used"
counter keeps track of what is consumed in total, both from the subpool
and globally. Thus, we need to adjust spool->used_hpages in the other
direction, and make sure that globally requested pages are uncharged from
the subpool's used counter.
Each failed allocation attempt increments the used_hpages counter by how
many pages were requested from the global pool. Ultimately, this renders
the subpool unusable, as used_hpages approaches the max limit.
The issue can be reproduced as follows:
1. Allocate 4 hugetlb pages
2. Create a hugetlb mount with max=4, min=2
3. Consume 2 pages globally
4. Request 3 pages from the subpool (2 from subpool + 1 from global)
4.1 hugepage_subpool_get_pages(spool, 3) succeeds.
used_hpages += 3
4.2 hugetlb_acct_memory(h, 1) fails: no global pages left
used_hpages -= 2
5. Subpool now has used_hpages = 1, despite not being able to
successfully allocate any hugepages. It believes it can now only
allocate 3 more hugepages, not 4.
With each failed allocation attempt incrementing the used counter, the
subpool eventually reaches a point where its used counter equals its
max counter. At that point, any future allocations that try to
allocate hugeTLB pages from the subpool will fail, despite the subpool
not having any of its hugeTLB pages consumed by any user.
Once this happens, there is no way to make the subpool usable again,
since there is no way to decrement the used counter as no process is
really consuming the hugeTLB pages.
The underflow issue that the original commit fixes still remains fixed
as well.
Without this fix, used_hpages would keep on leaking if
hugetlb_acct_memory() fails.
Link: https://lkml.kernel.org/r/20260116204037.2270096-1-joshua.hahnjy@gmail.com
Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
Signed-off-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Acked-by: Usama Arif <usama.arif@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Waiman Long <longman@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/hugetlb.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a1832da0f6236..77e45dd50ba21 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6717,6 +6717,15 @@ long hugetlb_reserve_pages(struct inode *inode,
*/
hugetlb_acct_memory(h, -gbl_resv);
}
+ /* Restore used_hpages for pages that failed global reservation */
+ if (gbl_reserve && spool) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&spool->lock, flags);
+ if (spool->max_hpages != -1)
+ spool->used_hpages -= gbl_reserve;
+ unlock_or_release_subpool(spool, flags);
+ }
out_uncharge_cgroup:
hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h),
chg * pages_per_huge_page(h), h_cg);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 794/844] mm/page_alloc: skip debug_check_no_{obj,locks}_freed with FPI_TRYLOCK
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (792 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 793/844] mm/hugetlb: restore failed global reservations to subpool Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 795/844] procfs: fix possible double mmput() in do_procmap_query() Sasha Levin
` (58 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Harry Yoo, Vlastimil Babka, Zi Yan, Alexei Starovoitov,
Brendan Jackman, Johannes Weiner, Michal Hocko,
Sebastian Andrzej Siewior, Shakeel Butt, Suren Baghdasaryan,
Andrew Morton, Sasha Levin
From: Harry Yoo <harry.yoo@oracle.com>
[ Upstream commit 338ad1e84d15078a9ae46d7dd7466329ae0bfa61 ]
When CONFIG_DEBUG_OBJECTS_FREE is enabled,
debug_check_no_{obj,locks}_freed() functions are called.
Since both of them spin on a lock, they are not safe to be called if the
FPI_TRYLOCK flag is specified. This leads to a lockdep splat:
================================
WARNING: inconsistent lock state
6.19.0-rc5-slab-for-next+ #326 Tainted: G N
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
kunit_try_catch/9046 [HC2[2]:SC0[0]:HE0:SE1] takes:
ffffffff84ed6bf8 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_check_no_obj_freed+0xe0/0x300
{INITIAL USE} state was registered at:
lock_acquire+0xd9/0x2f0
_raw_spin_lock_irqsave+0x4c/0x80
__debug_object_init+0x9d/0x1f0
debug_object_init+0x34/0x50
__init_work+0x28/0x40
init_cgroup_housekeeping+0x151/0x210
init_cgroup_root+0x3d/0x140
cgroup_init_early+0x30/0x240
start_kernel+0x3e/0xcd0
x86_64_start_reservations+0x18/0x30
x86_64_start_kernel+0xf3/0x140
common_startup_64+0x13e/0x148
irq event stamp: 2998
hardirqs last enabled at (2997): [<ffffffff8298b77a>] exc_nmi+0x11a/0x240
hardirqs last disabled at (2998): [<ffffffff8298b991>] sysvec_irq_work+0x11/0x110
softirqs last enabled at (1416): [<ffffffff813c1f72>] __irq_exit_rcu+0x132/0x1c0
softirqs last disabled at (1303): [<ffffffff813c1f72>] __irq_exit_rcu+0x132/0x1c0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&obj_hash[i].lock);
<Interrupt>
lock(&obj_hash[i].lock);
*** DEADLOCK ***
Rename free_pages_prepare() to __free_pages_prepare(), add an fpi_t
parameter, and skip those checks if FPI_TRYLOCK is set. To keep the fpi_t
definition in mm/page_alloc.c, add a wrapper function free_pages_prepare()
that always passes FPI_NONE and use it in mm/compaction.c.
Link: https://lkml.kernel.org/r/20260209062639.16577-1-harry.yoo@oracle.com
Fixes: 8c57b687e833 ("mm, bpf: Introduce free_pages_nolock()")
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 1af52f568f22d..48af3d7b47849 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1340,8 +1340,8 @@ static inline void pgalloc_tag_sub_pages(struct alloc_tag *tag, unsigned int nr)
#endif /* CONFIG_MEM_ALLOC_PROFILING */
-__always_inline bool free_pages_prepare(struct page *page,
- unsigned int order)
+__always_inline bool __free_pages_prepare(struct page *page,
+ unsigned int order, fpi_t fpi_flags)
{
int bad = 0;
bool skip_kasan_poison = should_skip_kasan_poison(page);
@@ -1434,7 +1434,7 @@ __always_inline bool free_pages_prepare(struct page *page,
page_table_check_free(page, order);
pgalloc_tag_sub(page, 1 << order);
- if (!PageHighMem(page)) {
+ if (!PageHighMem(page) && !(fpi_flags & FPI_TRYLOCK)) {
debug_check_no_locks_freed(page_address(page),
PAGE_SIZE << order);
debug_check_no_obj_freed(page_address(page),
@@ -1473,6 +1473,11 @@ __always_inline bool free_pages_prepare(struct page *page,
return true;
}
+bool free_pages_prepare(struct page *page, unsigned int order)
+{
+ return __free_pages_prepare(page, order, FPI_NONE);
+}
+
/*
* Frees a number of pages from the PCP lists
* Assumes all pages on list are in same zone.
@@ -1606,7 +1611,7 @@ static void __free_pages_ok(struct page *page, unsigned int order,
unsigned long pfn = page_to_pfn(page);
struct zone *zone = page_zone(page);
- if (free_pages_prepare(page, order))
+ if (__free_pages_prepare(page, order, fpi_flags))
free_one_page(zone, page, pfn, order, fpi_flags);
}
@@ -2970,7 +2975,7 @@ static void __free_frozen_pages(struct page *page, unsigned int order,
return;
}
- if (!free_pages_prepare(page, order))
+ if (!__free_pages_prepare(page, order, fpi_flags))
return;
/*
@@ -3027,7 +3032,7 @@ void free_unref_folios(struct folio_batch *folios)
unsigned long pfn = folio_pfn(folio);
unsigned int order = folio_order(folio);
- if (!free_pages_prepare(&folio->page, order))
+ if (!__free_pages_prepare(&folio->page, order, FPI_NONE))
continue;
/*
* Free orders not handled on the PCP directly to the
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 795/844] procfs: fix possible double mmput() in do_procmap_query()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (793 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 794/844] mm/page_alloc: skip debug_check_no_{obj,locks}_freed with FPI_TRYLOCK Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 796/844] mm/vmscan: fix demotion targets checks in reclaim/demotion Sasha Levin
` (57 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Andrii Nakryiko, Ruikai Peng, Thomas Gleixner, Shakeel Butt,
syzbot+237b5b985b78c1da9600, Andrew Morton, Sasha Levin
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 61dc9f776705d6db6847c101b98fa4f0e9eb6fa3 ]
When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY
we return with -ENAMETOOLONG error. After recent changes this condition
happens later, after we unlocked mmap_lock/per-VMA lock and did mmput(),
so original goto out is now wrong and will double-mmput() mm_struct. Fix
by jumping further to clean up only vm_file and name_buf.
Link: https://lkml.kernel.org/r/20260210192738.3041609-1-andrii@kernel.org
Fixes: b5cbacd7f86f ("procfs: avoid fetching build ID while holding VMA lock")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reported-by: Ruikai Peng <ruikai@pwno.io>
Reported-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Reported-by: syzbot+237b5b985b78c1da9600@syzkaller.appspotmail.com
Cc: Ruikai Peng <ruikai@pwno.io>
Closes: https://lkml.kernel.org/r/CAFD3drOJANTZPuyiqMdqpiRwOKnHwv5QgMNZghCDr-WxdiHvMg@mail.gmail.com
Closes: https://lore.kernel.org/all/698aaf3c.050a0220.3b3015.0088.GAE@google.com/T/#u
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/proc/task_mmu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 26188a4ad1abd..2f55efc368162 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -780,7 +780,7 @@ static int do_procmap_query(struct mm_struct *mm, void __user *uarg)
} else {
if (karg.build_id_size < build_id_sz) {
err = -ENAMETOOLONG;
- goto out;
+ goto out_file;
}
karg.build_id_size = build_id_sz;
}
@@ -808,6 +808,7 @@ static int do_procmap_query(struct mm_struct *mm, void __user *uarg)
out:
query_vma_teardown(&lock_ctx);
mmput(mm);
+out_file:
if (vm_file)
fput(vm_file);
kfree(name_buf);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 796/844] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (794 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 795/844] procfs: fix possible double mmput() in do_procmap_query() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 797/844] mm/page_alloc: clear page->private in free_pages_prepare() Sasha Levin
` (56 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bing Jiao, Shakeel Butt, Axel Rasmussen, David Hildenbrand,
Gregory Price, Johannes Weiner, Joshua Hahn, Liam Howlett,
Lorenzo Stoakes, Michal Hocko, Mike Rapoport, Muchun Song,
Qi Zheng, Roman Gushchin, Suren Baghdasaryan, Tejun Heo,
Vlastimil Babka, Waiman Long, Wei Xu, Yuanchu Xie, Andrew Morton,
Sasha Levin
From: Bing Jiao <bingjiao@google.com>
[ Upstream commit 1aceed565ff172fc0331dd1d5e7e65139b711139 ]
Patch series "mm/vmscan: fix demotion targets checks in reclaim/demotion",
v9.
This patch series addresses two issues in demote_folio_list(),
can_demote(), and next_demotion_node() in reclaim/demotion.
1. demote_folio_list() and can_demote() do not correctly check
demotion target against cpuset.mems_effective, which will cause (a)
pages to be demoted to not-allowed nodes and (b) pages fail demotion
even if the system still has allowed demotion nodes.
Patch 1 fixes this bug by updating cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets.
2. next_demotion_node() returns a preferred demotion target, but it
does not check the node against allowed nodes.
Patch 2 ensures that next_demotion_node() filters against the allowed
node mask and selects the closest demotion target to the source node.
This patch (of 2):
Fix two bugs in demote_folio_list() and can_demote() due to incorrect
demotion target checks against cpuset.mems_effective in reclaim/demotion.
Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
introduces the cpuset.mems_effective check and applies it to can_demote().
However:
1. It does not apply this check in demote_folio_list(), which leads
to situations where pages are demoted to nodes that are
explicitly excluded from the task's cpuset.mems.
2. It checks only the nodes in the immediate next demotion hierarchy
and does not check all allowed demotion targets in can_demote().
This can cause pages to never be demoted if the nodes in the next
demotion hierarchy are not set in mems_effective.
These bugs break resource isolation provided by cpuset.mems. This is
visible from userspace because pages can either fail to be demoted
entirely or are demoted to nodes that are not allowed in multi-tier memory
systems.
To address these bugs, update cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets. Also update can_demote()
and demote_folio_list() accordingly.
Bug 1 reproduction:
Assume a system with 4 nodes, where nodes 0-1 are top-tier and
nodes 2-3 are far-tier memory. All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Should respect node 0-2 limit.
# Observation: Node 3 shows significant allocation (MemFree drops)
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
Bug 2 reproduction:
Assume a system with 6 nodes, where nodes 0-2 are top-tier,
node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Pages are demoted to Nodes 4-5
# Observation: No pages are demoted before oom.
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Link: https://lkml.kernel.org/r/20260114205305.2869796-1-bingjiao@google.com
Link: https://lkml.kernel.org/r/20260114205305.2869796-2-bingjiao@google.com
Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Gregory Price <gourry@gourry.net>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Qi Zheng <zhengqi.arch@bytedance.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Waiman Long <longman@redhat.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/cpuset.h | 6 ++---
include/linux/memcontrol.h | 6 ++---
kernel/cgroup/cpuset.c | 54 +++++++++++++++++++++++++-------------
mm/memcontrol.c | 16 +++++++++--
mm/vmscan.c | 34 +++++++++++++++---------
5 files changed, 78 insertions(+), 38 deletions(-)
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index a98d3330385c2..631577384677a 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
task_unlock(current);
}
-extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
+extern void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask);
#else /* !CONFIG_CPUSETS */
static inline bool cpusets_enabled(void) { return false; }
@@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
return false;
}
-static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+static inline void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
- return true;
+ nodes_copy(*mask, node_states[N_MEMORY]);
}
#endif /* !CONFIG_CPUSETS */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0651865a4564f..412db7663357e 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1744,7 +1744,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
rcu_read_unlock();
}
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
@@ -1815,9 +1815,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
return 0;
}
-static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
+ nodemask_t *mask)
{
- return true;
}
static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index dc3ac38c5d160..62e1807b23448 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -4424,40 +4424,58 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
return allowed;
}
-bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+/**
+ * cpuset_nodes_allowed - return effective_mems mask from a cgroup cpuset.
+ * @cgroup: pointer to struct cgroup.
+ * @mask: pointer to struct nodemask_t to be returned.
+ *
+ * Returns effective_mems mask from a cgroup cpuset if it is cgroup v2 and
+ * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
+ *
+ * This function intentionally avoids taking the cpuset_mutex or callback_lock
+ * when accessing effective_mems. This is because the obtained effective_mems
+ * is stale immediately after the query anyway (e.g., effective_mems is updated
+ * immediately after releasing the lock but before returning).
+ *
+ * As a result, returned @mask may be empty because cs->effective_mems can be
+ * rebound during this call. Besides, nodes in @mask are not guaranteed to be
+ * online due to hot plugins. Callers should check the mask for validity on
+ * return based on its subsequent use.
+ **/
+void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
struct cgroup_subsys_state *css;
struct cpuset *cs;
- bool allowed;
/*
* In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
* and mems_allowed is likely to be empty even if we could get to it,
- * so return true to avoid taking a global lock on the empty check.
+ * so return directly to avoid taking a global lock on the empty check.
*/
- if (!cpuset_v2())
- return true;
+ if (!cgroup || !cpuset_v2()) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
- if (!css)
- return true;
+ if (!css) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
/*
- * Normally, accessing effective_mems would require the cpuset_mutex
- * or callback_lock - but node_isset is atomic and the reference
- * taken via cgroup_get_e_css is sufficient to protect css.
- *
- * Since this interface is intended for use by migration paths, we
- * relax locking here to avoid taking global locks - while accepting
- * there may be rare scenarios where the result may be innaccurate.
+ * The reference taken via cgroup_get_e_css is sufficient to
+ * protect css, but it does not imply safe accesses to effective_mems.
*
- * Reclaim and migration are subject to these same race conditions, and
- * cannot make strong isolation guarantees, so this is acceptable.
+ * Normally, accessing effective_mems would require the cpuset_mutex
+ * or callback_lock - but the correctness of this information is stale
+ * immediately after the query anyway. We do not acquire the lock
+ * during this process to save lock contention in exchange for racing
+ * against mems_allowed rebinds.
*/
cs = container_of(css, struct cpuset, css);
- allowed = node_isset(nid, cs->effective_mems);
+ nodes_copy(*mask, cs->effective_mems);
css_put(css);
- return allowed;
}
/**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 86f43b7e5f710..702c3db624a0c 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5624,9 +5624,21 @@ subsys_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_SWAP */
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
{
- return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
+ nodemask_t allowed;
+
+ if (!memcg)
+ return;
+
+ /*
+ * Since this interface is intended for use by migration paths, and
+ * reclaim and migration are subject to race conditions such as changes
+ * in effective_mems and hot-unpluging of nodes, inaccurate allowed
+ * mask is acceptable.
+ */
+ cpuset_nodes_allowed(memcg->css.cgroup, &allowed);
+ nodes_and(*mask, *mask, allowed);
}
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 614ccf39fe3fa..7724b1a1a8b52 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -344,19 +344,21 @@ static void flush_reclaim_state(struct scan_control *sc)
static bool can_demote(int nid, struct scan_control *sc,
struct mem_cgroup *memcg)
{
- int demotion_nid;
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ nodemask_t allowed_mask;
- if (!numa_demotion_enabled)
+ if (!pgdat || !numa_demotion_enabled)
return false;
if (sc && sc->no_demotion)
return false;
- demotion_nid = next_demotion_node(nid);
- if (demotion_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return false;
- /* If demotion node isn't in the cgroup's mems_allowed, fall back */
- return mem_cgroup_node_allowed(memcg, demotion_nid);
+ /* Filter out nodes that are not in cgroup's mems_allowed. */
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ return !nodes_empty(allowed_mask);
}
static inline bool can_reclaim_anon_pages(struct mem_cgroup *memcg,
@@ -1019,9 +1021,10 @@ static struct folio *alloc_demote_folio(struct folio *src,
* Folios which are not demoted are left on @demote_folios.
*/
static unsigned int demote_folio_list(struct list_head *demote_folios,
- struct pglist_data *pgdat)
+ struct pglist_data *pgdat,
+ struct mem_cgroup *memcg)
{
- int target_nid = next_demotion_node(pgdat->node_id);
+ int target_nid;
unsigned int nr_succeeded;
nodemask_t allowed_mask;
@@ -1033,7 +1036,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
*/
.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
__GFP_NOMEMALLOC | GFP_NOWAIT,
- .nid = target_nid,
.nmask = &allowed_mask,
.reason = MR_DEMOTION,
};
@@ -1041,10 +1043,18 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return 0;
- node_get_allowed_targets(pgdat, &allowed_mask);
+ target_nid = next_demotion_node(pgdat->node_id);
+ if (target_nid == NUMA_NO_NODE)
+ /* No lower-tier nodes or nodes were hot-unplugged. */
+ return 0;
+ if (!node_isset(target_nid, allowed_mask))
+ target_nid = node_random(&allowed_mask);
+ mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
migrate_pages(demote_folios, alloc_demote_folio, NULL,
@@ -1566,7 +1576,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
nr_reclaimed += nr_demoted;
stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 797/844] mm/page_alloc: clear page->private in free_pages_prepare()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (795 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 796/844] mm/vmscan: fix demotion targets checks in reclaim/demotion Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 798/844] net: intel: fix PCI device ID conflict between i40e and ipw2200 Sasha Levin
` (55 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mikhail Gavrilov, Zi Yan, David Hildenbrand (Arm),
Vlastimil Babka, Brendan Jackman, Chris Li, Hugh Dickins,
Johannes Weiner, Kairui Song, Matthew Wilcox (Oracle),
Michal Hocko, Nicholas Piggin, Suren Baghdasaryan, Andrew Morton,
Sasha Levin
From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
[ Upstream commit ac1ea219590c09572ed5992dc233bbf7bb70fef9 ]
Several subsystems (slub, shmem, ttm, etc.) use page->private but don't
clear it before freeing pages. When these pages are later allocated as
high-order pages and split via split_page(), tail pages retain stale
page->private values.
This causes a use-after-free in the swap subsystem. The swap code uses
page->private to track swap count continuations, assuming freshly
allocated pages have page->private == 0. When stale values are present,
swap_count_continued() incorrectly assumes the continuation list is valid
and iterates over uninitialized page->lru containing LIST_POISON values,
causing a crash:
KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107]
RIP: 0010:__do_sys_swapoff+0x1151/0x1860
Fix this by clearing page->private in free_pages_prepare(), ensuring all
freed pages have clean state regardless of previous use.
Link: https://lkml.kernel.org/r/20260207173615.146159-1-mikhail.v.gavrilov@gmail.com
Fixes: 3b8000ae185c ("mm/vmalloc: huge vmalloc backing pages should be split rather than compound")
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Suggested-by: Zi Yan <ziy@nvidia.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kairui Song <ryncsn@gmail.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 48af3d7b47849..04e32adaeb1dd 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1430,6 +1430,7 @@ __always_inline bool __free_pages_prepare(struct page *page,
page_cpupid_reset_last(page);
page->flags.f &= ~PAGE_FLAGS_CHECK_AT_PREP;
+ page->private = 0;
reset_page_owner(page, order);
page_table_check_free(page, order);
pgalloc_tag_sub(page, 1 << order);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 798/844] net: intel: fix PCI device ID conflict between i40e and ipw2200
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (796 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 797/844] mm/page_alloc: clear page->private in free_pages_prepare() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 799/844] atm: fore200e: fix use-after-free in tasklets during device removal Sasha Levin
` (54 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ethan Nelson-Moore, Johannes Berg, Aleksandr Loktionov,
Jakub Kicinski, Sasha Levin
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit d03e094473ecdeb68d853752ba467abe13e1de44 ]
The ID 8086:104f is matched by both i40e and ipw2200. The same device
ID should not be in more than one driver, because in that case, which
driver is used is unpredictable. Fix this by taking advantage of the
fact that i40e devices use PCI_CLASS_NETWORK_ETHERNET and ipw2200
devices use PCI_CLASS_NETWORK_OTHER to differentiate the devices.
Fixes: 2e45d3f4677a ("i40e: Add support for X710 B/P & SFP+ cards")
Cc: stable@vger.kernel.org
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Link: https://patch.msgid.link/20260210021235.16315-1-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/i40e/i40e_main.c | 8 +++++++-
drivers/net/wireless/intel/ipw2x00/ipw2200.c | 8 +++++++-
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d3bc3207054f9..02de186dcc8f5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -75,7 +75,13 @@ static const struct pci_device_id i40e_pci_tbl[] = {
{PCI_VDEVICE(INTEL, I40E_DEV_ID_10G_BASE_T4), 0},
{PCI_VDEVICE(INTEL, I40E_DEV_ID_10G_BASE_T_BC), 0},
{PCI_VDEVICE(INTEL, I40E_DEV_ID_10G_SFP), 0},
- {PCI_VDEVICE(INTEL, I40E_DEV_ID_10G_B), 0},
+ /*
+ * This ID conflicts with ipw2200, but the devices can be differentiated
+ * because i40e devices use PCI_CLASS_NETWORK_ETHERNET and ipw2200
+ * devices use PCI_CLASS_NETWORK_OTHER.
+ */
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, I40E_DEV_ID_10G_B),
+ PCI_CLASS_NETWORK_ETHERNET << 8, 0xffff00, 0},
{PCI_VDEVICE(INTEL, I40E_DEV_ID_KX_X722), 0},
{PCI_VDEVICE(INTEL, I40E_DEV_ID_QSFP_X722), 0},
{PCI_VDEVICE(INTEL, I40E_DEV_ID_SFP_X722), 0},
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
index 09035a77e775f..b0e769da94156 100644
--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
@@ -11387,7 +11387,13 @@ static const struct pci_device_id card_ids[] = {
{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2754, 0, 0, 0},
{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2761, 0, 0, 0},
{PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, 0x2762, 0, 0, 0},
- {PCI_VDEVICE(INTEL, 0x104f), 0},
+ /*
+ * This ID conflicts with i40e, but the devices can be differentiated
+ * because i40e devices use PCI_CLASS_NETWORK_ETHERNET and ipw2200
+ * devices use PCI_CLASS_NETWORK_OTHER.
+ */
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x104f),
+ PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, 0},
{PCI_VDEVICE(INTEL, 0x4220), 0}, /* BG */
{PCI_VDEVICE(INTEL, 0x4221), 0}, /* BG */
{PCI_VDEVICE(INTEL, 0x4223), 0}, /* ABG */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 799/844] atm: fore200e: fix use-after-free in tasklets during device removal
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (797 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 798/844] net: intel: fix PCI device ID conflict between i40e and ipw2200 Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 800/844] function_graph: Restore direct mode when callbacks drop to one Sasha Levin
` (53 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Duoming Zhou, stable, Jijie Shao, Simon Horman, Jakub Kicinski,
Sasha Levin
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 8930878101cd40063888a68af73b1b0f8b6c79bc ]
When the PCA-200E or SBA-200E adapter is being detached, the fore200e
is deallocated. However, the tx_tasklet or rx_tasklet may still be running
or pending, leading to use-after-free bug when the already freed fore200e
is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
One of the race conditions can occur as follows:
CPU 0 (cleanup) | CPU 1 (tasklet)
fore200e_pca_remove_one() | fore200e_interrupt()
fore200e_shutdown() | tasklet_schedule()
kfree(fore200e) | fore200e_tx_tasklet()
| fore200e-> // UAF
Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
synchronize with any pending or running tasklets. Moreover, since
fore200e_reset() could prevent further interrupts or data transfers,
the tasklet_kill() should be placed after fore200e_reset() to prevent
the tasklet from being rescheduled in fore200e_interrupt(). Finally,
it only needs to do tasklet_kill() when the fore200e state is greater
than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
in earlier states. In a word, the tasklet_kill() should be placed in
the FORE200E_STATE_IRQ branch within the switch...case structure.
This bug was identified through static analysis.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@kernel.org
Suggested-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260210094537.9767-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/fore200e.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index f62e385714403..fec081db36dc4 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -373,6 +373,10 @@ fore200e_shutdown(struct fore200e* fore200e)
fallthrough;
case FORE200E_STATE_IRQ:
free_irq(fore200e->irq, fore200e->atm_dev);
+#ifdef FORE200E_USE_TASKLET
+ tasklet_kill(&fore200e->tx_tasklet);
+ tasklet_kill(&fore200e->rx_tasklet);
+#endif
fallthrough;
case FORE200E_STATE_ALLOC_BUF:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 800/844] function_graph: Restore direct mode when callbacks drop to one
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (798 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 799/844] atm: fore200e: fix use-after-free in tasklets during device removal Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 801/844] kbuild: Fix CC_CAN_LINK detection Sasha Levin
` (52 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Shengming Hu, Steven Rostedt (Google), Sasha Levin
From: Shengming Hu <hu.shengming@zte.com.cn>
[ Upstream commit 53b2fae90ff01fede6520ca744ed5e8e366497ba ]
When registering a second fgraph callback, direct path is disabled and
array loop is used instead. When ftrace_graph_active falls back to one,
we try to re-enable direct mode via ftrace_graph_enable_direct(true, ...).
But ftrace_graph_enable_direct() incorrectly disables the static key
rather than enabling it. This leaves fgraph_do_direct permanently off
after first multi-callback transition, so direct fast mode is never
restored.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260213142932519cuWSpEXeS4-UnCvNXnK2P@zte.com.cn
Fixes: cc60ee813b503 ("function_graph: Use static_call and branch to optimize entry function")
Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/fgraph.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c
index cc48d16be43e0..4df766c690f92 100644
--- a/kernel/trace/fgraph.c
+++ b/kernel/trace/fgraph.c
@@ -1303,7 +1303,7 @@ static void ftrace_graph_enable_direct(bool enable_branch, struct fgraph_ops *go
static_call_update(fgraph_func, func);
static_call_update(fgraph_retfunc, retfunc);
if (enable_branch)
- static_branch_disable(&fgraph_do_direct);
+ static_branch_enable(&fgraph_do_direct);
}
static void ftrace_graph_disable_direct(bool disable_branch)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 801/844] kbuild: Fix CC_CAN_LINK detection
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (799 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 800/844] function_graph: Restore direct mode when callbacks drop to one Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 802/844] kbuild: rpm-pkg: Restrict manual debug package creation Sasha Levin
` (51 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mickaël Salaün, Nicolas Schier, Thomas Weißschuh,
Nathan Chancellor, Sasha Levin
From: Mickaël Salaün <mic@digikod.net>
[ Upstream commit be55899b71630c79ad01df54c92e467e47644f87 ]
Most samples cannot be build on some environments because they depend
on CC_CAN_LINK, which is set according to the result of
scripts/cc-can-link.sh called by cc_can_link_user.
Because cc-can-link.sh must now build without warning, it may fail
because it is calling printf() with an empty string:
+ cat
+ gcc -m32 -Werror -Wl,--fatal-warnings -x c - -o /dev/null
<stdin>: In function ‘main’:
<stdin>:4:9: error: zero-length gnu_printf format string [-Werror=format-zero-length]
cc1: all warnings being treated as errors
Fix this warning and the samples build by actually printing something.
Cc: stable@vger.kernel.org
Fixes: d81d9d389b9b ("kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings")
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20260212133544.1331437-1-mic@digikod.net
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/cc-can-link.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/cc-can-link.sh b/scripts/cc-can-link.sh
index e67fd8d7b6841..58dc7dd6d5568 100755
--- a/scripts/cc-can-link.sh
+++ b/scripts/cc-can-link.sh
@@ -5,7 +5,7 @@ cat << "END" | $@ -Werror -Wl,--fatal-warnings -x c - -o /dev/null >/dev/null 2>
#include <stdio.h>
int main(void)
{
- printf("");
+ printf("\n");
return 0;
}
END
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 802/844] kbuild: rpm-pkg: Restrict manual debug package creation
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (800 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 801/844] kbuild: Fix CC_CAN_LINK detection Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 803/844] kernel: rpm-pkg: Restore find-debuginfo.sh approach to -debuginfo package Sasha Levin
` (50 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, Steve French, Stefano Garzarella, Steve French,
Juergen Gross, Nicolas Schier, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 6d6b8b0e28c468263d7fcb071e5cb284ae343df2 ]
Commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package
manually") moved away from the built-in RPM machinery for generating
-debuginfo packages to a more manual way to be compatible with module
signing, as the built-in machinery strips the modules after the
installation process, breaking the signatures.
Unfortunately, prior to rpm 4.20.0, there is a bug where a custom %files
directive is ignored for a -debuginfo subpackage [1], meaning builds
using older versions of RPM (such as on RHEL9 or RHEL10) fail with:
Checking for unpackaged file(s): /usr/lib/rpm/check-files .../rpmbuild/BUILDROOT/kernel-6.19.0_dirty-1.x86_64
error: Installed (but unpackaged) file(s) found:
/debuginfo.list
/usr/lib/debug/.build-id/09/748c214974bfba1522d434a7e0a02e2fd7f29b.debug
/usr/lib/debug/.build-id/0b/b96dd9c7d3689d82e56d2e73b46f53103cc6c7.debug
/usr/lib/debug/.build-id/0e/979a2f34967c7437fd30aabb41de1f0c8b6a66.debug
...
To workaround this, restrict the manual debug info package creation
process to when it is necessary (CONFIG_MODULE_SIG=y) and possible (when
using RPM >= 4.20.0). A follow up change will restore the RPM debuginfo
creation process using a separate internal flag to allow the package to
be built in more situations, as RPM 4.20.0 is a fairly recent version
and the built-in -debuginfo generation works fine when module signing is
disabled.
Cc: stable@vger.kernel.org
Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually")
Link: https://github.com/rpm-software-management/rpm/commit/49f906998f3cf1f4152162ca61ac0869251c380f [1]
Reported-by: Steve French <smfrench@gmail.com>
Closes: https://lore.kernel.org/CAH2r5mugbrHTwnaQwQiYEUVwbtqmvFYf0WZiLrrJWpgT8iwftw@mail.gmail.com/
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Tested-by: Steve French <stfrench@microsoft.com>
Tested-by: Juergen Gross <jgross@suse.com>
Acked-by: Nicolas Schier <nsc@kernel.org>
Link: https://patch.msgid.link/20260210-kbuild-fix-debuginfo-rpm-v1-1-0730b92b14bc@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/package/kernel.spec | 9 +++++----
scripts/package/mkspec | 33 ++++++++++++++++++++++++++++++---
2 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/scripts/package/kernel.spec b/scripts/package/kernel.spec
index 0f1c8de1bd95f..b7deb159f404d 100644
--- a/scripts/package/kernel.spec
+++ b/scripts/package/kernel.spec
@@ -47,12 +47,13 @@ This package provides kernel headers and makefiles sufficient to build modules
against the %{version} kernel package.
%endif
-%if %{with_debuginfo}
+%if %{with_debuginfo_manual}
%package debuginfo
Summary: Debug information package for the Linux kernel
%description debuginfo
This package provides debug information for the kernel image and modules from the
%{version} package.
+%define install_mod_strip 1
%endif
%prep
@@ -67,7 +68,7 @@ patch -p1 < %{SOURCE2}
mkdir -p %{buildroot}/lib/modules/%{KERNELRELEASE}
cp $(%{make} %{makeflags} -s image_name) %{buildroot}/lib/modules/%{KERNELRELEASE}/vmlinuz
# DEPMOD=true makes depmod no-op. We do not package depmod-generated files.
-%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} INSTALL_MOD_STRIP=1 DEPMOD=true modules_install
+%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} %{?install_mod_strip:INSTALL_MOD_STRIP=1} DEPMOD=true modules_install
%{make} %{makeflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install
cp System.map %{buildroot}/lib/modules/%{KERNELRELEASE}
cp .config %{buildroot}/lib/modules/%{KERNELRELEASE}/config
@@ -98,7 +99,7 @@ ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEA
echo "%exclude /lib/modules/%{KERNELRELEASE}/build"
} > %{buildroot}/kernel.list
-%if %{with_debuginfo}
+%if %{with_debuginfo_manual}
# copying vmlinux directly to the debug directory means it will not get
# stripped (but its source paths will still be collected + fixed up)
mkdir -p %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}
@@ -162,7 +163,7 @@ fi
/lib/modules/%{KERNELRELEASE}/build
%endif
-%if %{with_debuginfo}
+%if %{with_debuginfo_manual}
%files -f %{buildroot}/debuginfo.list debuginfo
%defattr (-, root, root)
%exclude /debuginfo.list
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index c7375bfc25a9a..1080395ca0e16 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -23,15 +23,42 @@ else
echo '%define with_devel 0'
fi
+# manually generate -debuginfo package
+with_debuginfo_manual=0
# debuginfo package generation uses find-debuginfo.sh under the hood,
# which only works on uncompressed modules that contain debuginfo
if grep -q CONFIG_DEBUG_INFO=y include/config/auto.conf &&
(! grep -q CONFIG_MODULE_COMPRESS=y include/config/auto.conf) &&
(! grep -q CONFIG_DEBUG_INFO_SPLIT=y include/config/auto.conf); then
-echo '%define with_debuginfo %{?_without_debuginfo: 0} %{?!_without_debuginfo: 1}'
-else
-echo '%define with_debuginfo 0'
+ # If module signing is enabled (which may be required to boot with
+ # lockdown enabled), the find-debuginfo.sh machinery cannot be used
+ # because the signatures will be stripped off the modules. However, due
+ # to an rpm bug in versions prior to 4.20.0
+ #
+ # https://github.com/rpm-software-management/rpm/issues/3057
+ # https://github.com/rpm-software-management/rpm/commit/49f906998f3cf1f4152162ca61ac0869251c380f
+ #
+ # We cannot provide our own debuginfo package because it does not listen
+ # to our custom files list, failing the build due to unpackaged files.
+ # Manually generate the debug info package if using rpm 4.20.0. If not
+ # using rpm 4.20.0, avoid generating a -debuginfo package altogether,
+ # as it is not safe.
+ if grep -q CONFIG_MODULE_SIG=y include/config/auto.conf; then
+ rpm_ver_str=$(rpm --version 2>/dev/null)
+ # Split the version on spaces
+ IFS=' '
+ set -- $rpm_ver_str
+ if [ "${1:-}" = RPM -a "${2:-}" = version ]; then
+ IFS=.
+ set -- $3
+ rpm_ver=$(( 1000000 * $1 + 10000 * $2 + 100 * $3 + ${4:-0} ))
+ if [ "$rpm_ver" -ge 4200000 ]; then
+ with_debuginfo_manual='%{?_without_debuginfo:0}%{?!_without_debuginfo:1}'
+ fi
+ fi
+ fi
fi
+echo "%define with_debuginfo_manual $with_debuginfo_manual"
cat<<EOF
%define ARCH ${ARCH}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 803/844] kernel: rpm-pkg: Restore find-debuginfo.sh approach to -debuginfo package
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (801 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 802/844] kbuild: rpm-pkg: Restrict manual debug package creation Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 804/844] kbuild: rpm-pkg: Fix manual debuginfo generation when using .src.rpm Sasha Levin
` (49 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, Stefano Garzarella, Steve French,
Juergen Gross, Nicolas Schier, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit ffe9ac1ad56df8f915896b97bd7645f522c47ce9 ]
Commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package
manually") effectively reverted commit a7c699d090a1 ("kbuild: rpm-pkg:
build a debuginfo RPM") but the approach it took is not safe for older
RPM releases. Restore commit a7c699d090a1 ("kbuild: rpm-pkg: build a
debuginfo RPM") for the !CONFIG_MODULE_SIG case to allow more
environments and configurations to take advantage of the separate debug
information package process.
Cc: stable@vger.kernel.org
Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually")
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Tested-by: Steve French <stfrench@microsoft.com>
Tested-by: Juergen Gross <jgross@suse.com>
Acked-by: Nicolas Schier <nsc@kernel.org>
Link: https://patch.msgid.link/20260210-kbuild-fix-debuginfo-rpm-v1-2-0730b92b14bc@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/package/kernel.spec | 50 ++++++++++++++++++++++++++++++++++---
scripts/package/mkspec | 5 ++++
2 files changed, 51 insertions(+), 4 deletions(-)
diff --git a/scripts/package/kernel.spec b/scripts/package/kernel.spec
index b7deb159f404d..af682a7054779 100644
--- a/scripts/package/kernel.spec
+++ b/scripts/package/kernel.spec
@@ -2,8 +2,6 @@
%{!?_arch: %define _arch dummy}
%{!?make: %define make make}
%define makeflags %{?_smp_mflags} ARCH=%{ARCH}
-%define __spec_install_post /usr/lib/rpm/brp-compress || :
-%define debug_package %{nil}
Name: kernel
Summary: The Linux Kernel
@@ -56,6 +54,38 @@ This package provides debug information for the kernel image and modules from th
%define install_mod_strip 1
%endif
+%if %{with_debuginfo_rpm}
+# list of debuginfo-related options taken from distribution kernel.spec
+# files
+%undefine _include_minidebuginfo
+%undefine _find_debuginfo_dwz_opts
+%undefine _unique_build_ids
+%undefine _unique_debug_names
+%undefine _unique_debug_srcs
+%undefine _debugsource_packages
+%undefine _debuginfo_subpackages
+%global _find_debuginfo_opts -r
+%global _missing_build_ids_terminate_build 1
+%global _no_recompute_build_ids 1
+%{debug_package}
+
+# later, we make all modules executable so that find-debuginfo.sh strips
+# them up. but they don't actually need to be executable, so remove the
+# executable bit, taking care to do it _after_ find-debuginfo.sh has run
+%define __spec_install_post \
+ %{?__debug_package:%{__debug_install_post}} \
+ %{__arch_install_post} \
+ %{__os_install_post} \
+ find %{buildroot}/lib/modules/%{KERNELRELEASE} -name "*.ko" -type f \\\
+ | xargs --no-run-if-empty chmod u-x
+%else
+%define __spec_install_post /usr/lib/rpm/brp-compress || :
+%endif
+# some (but not all) versions of rpmbuild emit %%debug_package with
+# %%install. since we've already emitted it manually, that would cause
+# a package redefinition error. ensure that doesn't happen
+%define debug_package %{nil}
+
%prep
%setup -q -n linux
cp %{SOURCE1} .config
@@ -99,14 +129,22 @@ ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEA
echo "%exclude /lib/modules/%{KERNELRELEASE}/build"
} > %{buildroot}/kernel.list
-%if %{with_debuginfo_manual}
+%if 0%{with_debuginfo_manual}%{with_debuginfo_rpm} > 0
# copying vmlinux directly to the debug directory means it will not get
# stripped (but its source paths will still be collected + fixed up)
mkdir -p %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}
cp vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}
+%endif
-echo /usr/lib/debug/lib/modules/%{KERNELRELEASE}/vmlinux > %{buildroot}/debuginfo.list
+%if %{with_debuginfo_rpm}
+# make modules executable so that find-debuginfo.sh strips them. this
+# will be undone later in %%__spec_install_post
+find %{buildroot}/lib/modules/%{KERNELRELEASE} -name "*.ko" -type f \
+ | xargs --no-run-if-empty chmod u+x
+%endif
+%if %{with_debuginfo_manual}
+echo /usr/lib/debug/lib/modules/%{KERNELRELEASE}/vmlinux > %{buildroot}/debuginfo.list
while read -r mod; do
mod="${mod%.o}.ko"
dbg="%{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}/kernel/${mod}"
@@ -124,6 +162,10 @@ done < modules.order
%clean
rm -rf %{buildroot}
+%if %{with_debuginfo_rpm}
+rm -f debugfiles.list debuglinks.list debugsourcefiles.list debugsources.list \
+ elfbins.list
+%endif
%post
if [ -x /usr/bin/kernel-install ]; then
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index 1080395ca0e16..c604f8c174e2c 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -23,6 +23,8 @@ else
echo '%define with_devel 0'
fi
+# use %{debug_package} machinery to generate -debuginfo
+with_debuginfo_rpm=0
# manually generate -debuginfo package
with_debuginfo_manual=0
# debuginfo package generation uses find-debuginfo.sh under the hood,
@@ -56,9 +58,12 @@ if grep -q CONFIG_DEBUG_INFO=y include/config/auto.conf &&
with_debuginfo_manual='%{?_without_debuginfo:0}%{?!_without_debuginfo:1}'
fi
fi
+ else
+ with_debuginfo_rpm='%{?_without_debuginfo:0}%{?!_without_debuginfo:1}'
fi
fi
echo "%define with_debuginfo_manual $with_debuginfo_manual"
+echo "%define with_debuginfo_rpm $with_debuginfo_rpm"
cat<<EOF
%define ARCH ${ARCH}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 804/844] kbuild: rpm-pkg: Fix manual debuginfo generation when using .src.rpm
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (802 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 803/844] kernel: rpm-pkg: Restore find-debuginfo.sh approach to -debuginfo package Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 805/844] ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() Sasha Levin
` (48 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Nathan Chancellor, Lukas Herbolt, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit afdfb71c018e9a0aa2e51fb8186d3fb1acdd3f0e ]
Commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package
manually") added uses of OBJCOPY and READELF, variables from Kbuild.
These variables are defined and work properly when using the binrpm-pkg
target because rpmbuild is run within Kbuild. However, these variables
are not defined when building from a source RPM package generated with
the srcrpm-pkg target, breaking the build when generating the debug info
subpackage.
Define a default value for these variables so that these commands
respect the value from Kbuild but continue to work when built from a
source RPM package.
Cc: stable@vger.kernel.org
Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually")
Reported-by: Lukas Herbolt <lukas@herbolt.com>
Closes: https://lore.kernel.org/20260212135855.147906-2-lukas@herbolt.com/
Tested-by: Lukas Herbolt <lukas@herbolt.com>
Link: https://patch.msgid.link/20260213-fix-debuginfo-srcrpm-pkg-v1-1-45cd0c0501b9@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/package/kernel.spec | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/package/kernel.spec b/scripts/package/kernel.spec
index af682a7054779..bccf58bdd45fd 100644
--- a/scripts/package/kernel.spec
+++ b/scripts/package/kernel.spec
@@ -148,11 +148,11 @@ echo /usr/lib/debug/lib/modules/%{KERNELRELEASE}/vmlinux > %{buildroot}/debuginf
while read -r mod; do
mod="${mod%.o}.ko"
dbg="%{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}/kernel/${mod}"
- buildid=$("${READELF}" -n "${mod}" | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p')
+ buildid=$("${READELF:-readelf}" -n "${mod}" | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p')
link="%{buildroot}/usr/lib/debug/.build-id/${buildid}.debug"
mkdir -p "${dbg%/*}" "${link%/*}"
- "${OBJCOPY}" --only-keep-debug "${mod}" "${dbg}"
+ "${OBJCOPY:-objcopy}" --only-keep-debug "${mod}" "${dbg}"
ln -sf --relative "${dbg}" "${link}"
echo "${dbg#%{buildroot}}" >> %{buildroot}/debuginfo.list
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 805/844] ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (803 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 804/844] kbuild: rpm-pkg: Fix manual debuginfo generation when using .src.rpm Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:31 ` [PATCH 6.19 806/844] mm: numa_memblks: Identify the accurate NUMA ID of CFMW Sasha Levin
` (47 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Qanux, Justin Iurman, Jakub Kicinski, Sasha Levin
From: Qanux <qjx1298677004@gmail.com>
[ Upstream commit 6db8b56eed62baacaf37486e83378a72635c04cc ]
On the receive path, __ioam6_fill_trace_data() uses trace->nodelen
to decide how much data to write for each node. It trusts this field
as-is from the incoming packet, with no consistency check against
trace->type (the 24-bit field that tells which data items are
present). A crafted packet can set nodelen=0 while setting type bits
0-21, causing the function to write ~100 bytes past the allocated
region (into skb_shared_info), which corrupts adjacent heap memory
and leads to a kernel panic.
Add a shared helper ioam6_trace_compute_nodelen() in ioam6.c to
derive the expected nodelen from the type field, and use it:
- in ioam6_iptunnel.c (send path, existing validation) to replace
the open-coded computation;
- in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose
nodelen is inconsistent with the type field, before any data is
written.
Per RFC 9197, bits 12-21 are each short (4-octet) fields, so they
are included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to
0xff1ffc00).
Fixes: 9ee11f0fff20 ("ipv6: ioam: Data plane support for Pre-allocated Trace")
Cc: stable@vger.kernel.org
Signed-off-by: Junxi Qian <qjx1298677004@gmail.com>
Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
Link: https://patch.msgid.link/20260211040412.86195-1-qjx1298677004@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ioam6.h | 2 ++
net/ipv6/exthdrs.c | 5 +++++
net/ipv6/ioam6.c | 14 ++++++++++++++
net/ipv6/ioam6_iptunnel.c | 10 +---------
4 files changed, 22 insertions(+), 9 deletions(-)
diff --git a/include/net/ioam6.h b/include/net/ioam6.h
index 2cbbee6e806aa..a75912fe247e6 100644
--- a/include/net/ioam6.h
+++ b/include/net/ioam6.h
@@ -60,6 +60,8 @@ void ioam6_fill_trace_data(struct sk_buff *skb,
struct ioam6_trace_hdr *trace,
bool is_input);
+u8 ioam6_trace_compute_nodelen(u32 trace_type);
+
int ioam6_init(void);
void ioam6_exit(void);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 54088fa0c09d0..310836a0cf17b 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -931,6 +931,11 @@ static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)
if (hdr->opt_len < 2 + sizeof(*trace) + trace->remlen * 4)
goto drop;
+ /* Inconsistent Pre-allocated Trace header */
+ if (trace->nodelen !=
+ ioam6_trace_compute_nodelen(be32_to_cpu(trace->type_be32)))
+ goto drop;
+
/* Ignore if the IOAM namespace is unknown */
ns = ioam6_namespace(dev_net(skb->dev), trace->namespace_id);
if (!ns)
diff --git a/net/ipv6/ioam6.c b/net/ipv6/ioam6.c
index 9553a32000813..08b7ac8c99b7e 100644
--- a/net/ipv6/ioam6.c
+++ b/net/ipv6/ioam6.c
@@ -690,6 +690,20 @@ struct ioam6_namespace *ioam6_namespace(struct net *net, __be16 id)
return rhashtable_lookup_fast(&nsdata->namespaces, &id, rht_ns_params);
}
+#define IOAM6_MASK_SHORT_FIELDS 0xff1ffc00
+#define IOAM6_MASK_WIDE_FIELDS 0x00e00000
+
+u8 ioam6_trace_compute_nodelen(u32 trace_type)
+{
+ u8 nodelen = hweight32(trace_type & IOAM6_MASK_SHORT_FIELDS)
+ * (sizeof(__be32) / 4);
+
+ nodelen += hweight32(trace_type & IOAM6_MASK_WIDE_FIELDS)
+ * (sizeof(__be64) / 4);
+
+ return nodelen;
+}
+
static void __ioam6_fill_trace_data(struct sk_buff *skb,
struct ioam6_namespace *ns,
struct ioam6_trace_hdr *trace,
diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index 1fe7894f14dd9..b9f6d892a566c 100644
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -22,9 +22,6 @@
#include <net/ip6_route.h>
#include <net/addrconf.h>
-#define IOAM6_MASK_SHORT_FIELDS 0xff100000
-#define IOAM6_MASK_WIDE_FIELDS 0xe00000
-
struct ioam6_lwt_encap {
struct ipv6_hopopt_hdr eh;
u8 pad[2]; /* 2-octet padding for 4n-alignment */
@@ -93,13 +90,8 @@ static bool ioam6_validate_trace_hdr(struct ioam6_trace_hdr *trace)
trace->type.bit21 | trace->type.bit23)
return false;
- trace->nodelen = 0;
fields = be32_to_cpu(trace->type_be32);
-
- trace->nodelen += hweight32(fields & IOAM6_MASK_SHORT_FIELDS)
- * (sizeof(__be32) / 4);
- trace->nodelen += hweight32(fields & IOAM6_MASK_WIDE_FIELDS)
- * (sizeof(__be64) / 4);
+ trace->nodelen = ioam6_trace_compute_nodelen(fields);
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 806/844] mm: numa_memblks: Identify the accurate NUMA ID of CFMW
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (804 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 805/844] ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() Sasha Levin
@ 2026-02-28 17:31 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 807/844] fbdev: Use device_create_with_groups() to fix sysfs groups registration race Sasha Levin
` (46 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:31 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Cui Chao, Jonathan Cameron, Gregory Price, Dan Williams,
Mike Rapoport (Microsoft), Sasha Levin
From: Cui Chao <cuichao1753@phytium.com.cn>
[ Upstream commit f043a93fff9e3e3e648b6525483f59104b0819fa ]
In some physical memory layout designs, the address space of CFMW (CXL
Fixed Memory Window) resides between multiple segments of system memory
belonging to the same NUMA node. In numa_cleanup_meminfo, these multiple
segments of system memory are merged into a larger numa_memblk. When
identifying which NUMA node the CFMW belongs to, it may be incorrectly
assigned to the NUMA node of the merged system memory.
When a CXL RAM region is created in userspace, the memory capacity of
the newly created region is not added to the CFMW-dedicated NUMA node.
Instead, it is accumulated into an existing NUMA node (e.g., NUMA0
containing RAM). This makes it impossible to clearly distinguish
between the two types of memory, which may affect memory-tiering
applications.
Example memory layout:
Physical address space:
0x00000000 - 0x1FFFFFFF System RAM (node0)
0x20000000 - 0x2FFFFFFF CXL CFMW (node2)
0x40000000 - 0x5FFFFFFF System RAM (node0)
0x60000000 - 0x7FFFFFFF System RAM (node1)
After numa_cleanup_meminfo, the two node0 segments are merged into one:
0x00000000 - 0x5FFFFFFF System RAM (node0) // CFMW is inside the range
0x60000000 - 0x7FFFFFFF System RAM (node1)
So the CFMW (0x20000000-0x2FFFFFFF) will be incorrectly assigned to node0.
To address this scenario, accurately identifying the correct NUMA node
can be achieved by checking whether the region belongs to both
numa_meminfo and numa_reserved_meminfo.
While this issue is only observed in a QEMU configuration, and no known
end users are impacted by this problem, it is likely that some firmware
implementation is leaving memory map holes in a CXL Fixed Memory Window.
CXL hotplug depends on mapping free window capacity, and it seems to be
only a coincidence to have not hit this problem yet.
Fixes: 779dd20cfb56 ("cxl/region: Add region creation support")
Signed-off-by: Cui Chao <cuichao1753@phytium.com.cn>
Cc: stable@vger.kernel.org
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Gregory Price <gourry@gourry.net>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260213060347.2389818-2-cuichao1753@phytium.com.cn
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/numa_memblks.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/mm/numa_memblks.c b/mm/numa_memblks.c
index 8f5735fda0a21..3f53464240e8d 100644
--- a/mm/numa_memblks.c
+++ b/mm/numa_memblks.c
@@ -570,15 +570,16 @@ static int meminfo_to_nid(struct numa_meminfo *mi, u64 start)
int phys_to_target_node(u64 start)
{
int nid = meminfo_to_nid(&numa_meminfo, start);
+ int reserved_nid = meminfo_to_nid(&numa_reserved_meminfo, start);
/*
- * Prefer online nodes, but if reserved memory might be
- * hot-added continue the search with reserved ranges.
+ * Prefer online nodes unless the address is also described
+ * by reserved ranges, in which case use the reserved nid.
*/
- if (nid != NUMA_NO_NODE)
+ if (nid != NUMA_NO_NODE && reserved_nid == NUMA_NO_NODE)
return nid;
- return meminfo_to_nid(&numa_reserved_meminfo, start);
+ return reserved_nid;
}
EXPORT_SYMBOL_GPL(phys_to_target_node);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 807/844] fbdev: Use device_create_with_groups() to fix sysfs groups registration race
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (805 preceding siblings ...)
2026-02-28 17:31 ` [PATCH 6.19 806/844] mm: numa_memblks: Identify the accurate NUMA ID of CFMW Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 808/844] fbcon: check return value of con2fb_acquire_newinfo() Sasha Levin
` (45 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Hans de Goede, Shixiong Ou, Helge Deller, Sasha Levin
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
[ Upstream commit 68eeb0871e986ae5462439dae881e3a27bcef85f ]
The fbdev sysfs attributes are registered after sending the uevent for
the device creation, leaving a race window where e.g. udev rules may
not be able to access the sysfs attributes because the registration is
not done yet.
Fix this by switching to device_create_with_groups(). This also results in
a nice cleanup. After switching to device_create_with_groups() all that
is left of fb_init_device() is setting the drvdata and that can be passed
to device_create[_with_groups]() too. After which fb_init_device() can
be completely removed.
Dropping fb_init_device() + fb_cleanup_device() in turn allows removing
fb_info.class_flag as they were the only user of this field.
Fixes: 5fc830d6aca1 ("fbdev: Register sysfs groups through device_add_group")
Cc: stable@vger.kernel.org
Cc: Shixiong Ou <oushixiong@kylinos.cn>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbsysfs.c | 36 +++---------------------------
include/linux/fb.h | 1 -
2 files changed, 3 insertions(+), 34 deletions(-)
diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c
index b8344c40073b4..baa2bae0fb5b3 100644
--- a/drivers/video/fbdev/core/fbsysfs.c
+++ b/drivers/video/fbdev/core/fbsysfs.c
@@ -12,8 +12,6 @@
#include "fb_internal.h"
-#define FB_SYSFS_FLAG_ATTR 1
-
static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
{
int err;
@@ -451,33 +449,7 @@ static struct attribute *fb_device_attrs[] = {
NULL,
};
-static const struct attribute_group fb_device_attr_group = {
- .attrs = fb_device_attrs,
-};
-
-static int fb_init_device(struct fb_info *fb_info)
-{
- int ret;
-
- dev_set_drvdata(fb_info->dev, fb_info);
-
- fb_info->class_flag |= FB_SYSFS_FLAG_ATTR;
-
- ret = device_add_group(fb_info->dev, &fb_device_attr_group);
- if (ret)
- fb_info->class_flag &= ~FB_SYSFS_FLAG_ATTR;
-
- return 0;
-}
-
-static void fb_cleanup_device(struct fb_info *fb_info)
-{
- if (fb_info->class_flag & FB_SYSFS_FLAG_ATTR) {
- device_remove_group(fb_info->dev, &fb_device_attr_group);
-
- fb_info->class_flag &= ~FB_SYSFS_FLAG_ATTR;
- }
-}
+ATTRIBUTE_GROUPS(fb_device);
int fb_device_create(struct fb_info *fb_info)
{
@@ -485,14 +457,13 @@ int fb_device_create(struct fb_info *fb_info)
dev_t devt = MKDEV(FB_MAJOR, node);
int ret;
- fb_info->dev = device_create(fb_class, fb_info->device, devt, NULL, "fb%d", node);
+ fb_info->dev = device_create_with_groups(fb_class, fb_info->device, devt, fb_info,
+ fb_device_groups, "fb%d", node);
if (IS_ERR(fb_info->dev)) {
/* Not fatal */
ret = PTR_ERR(fb_info->dev);
pr_warn("Unable to create device for framebuffer %d; error %d\n", node, ret);
fb_info->dev = NULL;
- } else {
- fb_init_device(fb_info);
}
return 0;
@@ -505,7 +476,6 @@ void fb_device_destroy(struct fb_info *fb_info)
if (!fb_info->dev)
return;
- fb_cleanup_device(fb_info);
device_destroy(fb_class, devt);
fb_info->dev = NULL;
}
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 05cc251035da9..c3302d5135466 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -497,7 +497,6 @@ struct fb_info {
#if defined(CONFIG_FB_DEVICE)
struct device *dev; /* This is this fb device */
#endif
- int class_flag; /* private sysfs flags */
#ifdef CONFIG_FB_TILEBLITTING
struct fb_tile_ops *tileops; /* Tile Blitting */
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 808/844] fbcon: check return value of con2fb_acquire_newinfo()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (806 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 807/844] fbdev: Use device_create_with_groups() to fix sysfs groups registration race Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 809/844] fbdev: vt8500lcdfb: fix missing dma_free_coherent() Sasha Levin
` (44 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Andrey Vatoropin, Helge Deller, Sasha Levin
From: Andrey Vatoropin <a.vatoropin@crpt.ru>
[ Upstream commit 011a0502801c8536f64141a2b61362c14f456544 ]
If fbcon_open() fails when called from con2fb_acquire_newinfo() then
info->fbcon_par pointer remains NULL which is later dereferenced.
Add check for return value of the function con2fb_acquire_newinfo() to
avoid it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: d1baa4ffa677 ("fbcon: set_con2fb_map fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbcon.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 7be9e865325d9..a07737dcb45ad 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1068,7 +1068,8 @@ static void fbcon_init(struct vc_data *vc, bool init)
return;
if (!info->fbcon_par)
- con2fb_acquire_newinfo(vc, info, vc->vc_num);
+ if (con2fb_acquire_newinfo(vc, info, vc->vc_num))
+ return;
/* If we are not the first console on this
fb, copy the font from that console */
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 809/844] fbdev: vt8500lcdfb: fix missing dma_free_coherent()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (807 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 808/844] fbcon: check return value of con2fb_acquire_newinfo() Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 810/844] fbdev: of: display_timing: fix refcount leak in of_get_display_timings() Sasha Levin
` (43 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Thomas Fourier, Helge Deller, Sasha Levin
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit 88b3b9924337336a31cefbe99a22ed09401be74a ]
fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not
freed if the error path is reached.
Fixes: e7b995371fe1 ("video: vt8500: Add devicetree support for vt8500-fb and wm8505-fb")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/vt8500lcdfb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/vt8500lcdfb.c b/drivers/video/fbdev/vt8500lcdfb.c
index b08a6fdc53fd2..85c7a99a7d648 100644
--- a/drivers/video/fbdev/vt8500lcdfb.c
+++ b/drivers/video/fbdev/vt8500lcdfb.c
@@ -369,7 +369,7 @@ static int vt8500lcd_probe(struct platform_device *pdev)
if (fbi->palette_cpu == NULL) {
dev_err(&pdev->dev, "Failed to allocate palette buffer\n");
ret = -ENOMEM;
- goto failed_free_io;
+ goto failed_free_mem_virt;
}
irq = platform_get_irq(pdev, 0);
@@ -432,6 +432,9 @@ static int vt8500lcd_probe(struct platform_device *pdev)
failed_free_palette:
dma_free_coherent(&pdev->dev, fbi->palette_size,
fbi->palette_cpu, fbi->palette_phys);
+failed_free_mem_virt:
+ dma_free_coherent(&pdev->dev, fbi->fb.fix.smem_len,
+ fbi->fb.screen_buffer, fbi->fb.fix.smem_start);
failed_free_io:
iounmap(fbi->regbase);
failed_free_res:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 810/844] fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (808 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 809/844] fbdev: vt8500lcdfb: fix missing dma_free_coherent() Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 811/844] fbdev: ffb: fix corrupted video output on Sun FFB1 Sasha Levin
` (42 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Weigang He, Helge Deller, Sasha Levin
From: Weigang He <geoffreyhe2@gmail.com>
[ Upstream commit eacf9840ae1285a1ef47eb0ce16d786e542bd4d7 ]
of_parse_phandle() returns a device_node with refcount incremented,
which is stored in 'entry' and then copied to 'native_mode'. When the
error paths at lines 184 or 192 jump to 'entryfail', native_mode's
refcount is not decremented, causing a refcount leak.
Fix this by changing the goto target from 'entryfail' to 'timingfail',
which properly calls of_node_put(native_mode) before cleanup.
Fixes: cc3f414cf2e4 ("video: add of helper for display timings/videomode")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/of_display_timing.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/video/of_display_timing.c b/drivers/video/of_display_timing.c
index a4cd446ac5a59..a6ec392253c3e 100644
--- a/drivers/video/of_display_timing.c
+++ b/drivers/video/of_display_timing.c
@@ -181,7 +181,7 @@ struct display_timings *of_get_display_timings(const struct device_node *np)
if (disp->num_timings == 0) {
/* should never happen, as entry was already found above */
pr_err("%pOF: no timings specified\n", np);
- goto entryfail;
+ goto timingfail;
}
disp->timings = kcalloc(disp->num_timings,
@@ -189,7 +189,7 @@ struct display_timings *of_get_display_timings(const struct device_node *np)
GFP_KERNEL);
if (!disp->timings) {
pr_err("%pOF: could not allocate timings array\n", np);
- goto entryfail;
+ goto timingfail;
}
disp->num_timings = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 811/844] fbdev: ffb: fix corrupted video output on Sun FFB1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (809 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 810/844] fbdev: of: display_timing: fix refcount leak in of_get_display_timings() Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 812/844] fbcon: Remove struct fbcon_display.inverse Sasha Levin
` (41 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: René Rebe, stable, Helge Deller, Sasha Levin
From: René Rebe <rene@exactco.de>
[ Upstream commit b28da0d092461ac239ff034a8ac3129320177ba3 ]
Fix Sun FFB1 corrupted video out ([1] and [2]) by disabling overlay and
initializing window mode to a known state. The issue never appeared on
my FFB2+/vertical nor Elite3D/M6. It could also depend on the PROM
version.
/SUNW,ffb@1e,0: FFB at 000001fc00000000, type 11, DAC pnum[236c] rev[10] manuf_rev[4]
X (II) /dev/fb0: Detected FFB1, Z-buffer, Single-buffered.
X (II) /dev/fb0: BT9068 (PAC1) ramdac detected (with normal cursor control)
X (II) /dev/fb0: Detected Creator/Creator3D
[1] https://www.instagram.com/p/DUTcSmSjSem/
[2] https://chaos.social/@ReneRebe/116023241660154102
Signed-off-by: René Rebe <rene@exactco.de>
Cc: stable@kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/ffb.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/ffb.c b/drivers/video/fbdev/ffb.c
index 34b6abff9493e..da531b4cb4513 100644
--- a/drivers/video/fbdev/ffb.c
+++ b/drivers/video/fbdev/ffb.c
@@ -335,6 +335,9 @@ struct ffb_dac {
};
#define FFB_DAC_UCTRL 0x1001 /* User Control */
+#define FFB_DAC_UCTRL_OVENAB 0x00000008 /* Overlay Enable */
+#define FFB_DAC_UCTRL_WMODE 0x00000030 /* Window Mode */
+#define FFB_DAC_UCTRL_WM_COMB 0x00000000 /* Window Mode = Combined */
#define FFB_DAC_UCTRL_MANREV 0x00000f00 /* 4-bit Manufacturing Revision */
#define FFB_DAC_UCTRL_MANREV_SHIFT 8
#define FFB_DAC_TGEN 0x6000 /* Timing Generator */
@@ -425,7 +428,7 @@ static void ffb_switch_from_graph(struct ffb_par *par)
{
struct ffb_fbc __iomem *fbc = par->fbc;
struct ffb_dac __iomem *dac = par->dac;
- unsigned long flags;
+ unsigned long flags, uctrl;
spin_lock_irqsave(&par->lock, flags);
FFBWait(par);
@@ -450,6 +453,15 @@ static void ffb_switch_from_graph(struct ffb_par *par)
upa_writel((FFB_DAC_CUR_CTRL_P0 |
FFB_DAC_CUR_CTRL_P1), &dac->value2);
+ /* Disable overlay and window modes. */
+ upa_writel(FFB_DAC_UCTRL, &dac->type);
+ uctrl = upa_readl(&dac->value);
+ uctrl &= ~FFB_DAC_UCTRL_WMODE;
+ uctrl |= FFB_DAC_UCTRL_WM_COMB;
+ uctrl &= ~FFB_DAC_UCTRL_OVENAB;
+ upa_writel(FFB_DAC_UCTRL, &dac->type);
+ upa_writel(uctrl, &dac->value);
+
spin_unlock_irqrestore(&par->lock, flags);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 812/844] fbcon: Remove struct fbcon_display.inverse
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (810 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 811/844] fbdev: ffb: fix corrupted video output on Sun FFB1 Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 813/844] io_uring/zcrx: fix sgtable leak on mapping failures Sasha Levin
` (40 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Thomas Zimmermann, Helge Deller, Sasha Levin
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit 30baedeeeab524172abc0b58cb101e8df86b5be8 ]
The field inverse in struct fbcon_display is unused. Remove it.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: <stable@vger.kernel.org> # v6.0+
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/fbcon.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
index 44ea4ae4bba0d..9cabafd2d91ca 100644
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -30,7 +30,6 @@ struct fbcon_display {
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
u_short scrollmode; /* Scroll Method, use fb_scrollmode() */
#endif
- u_short inverse; /* != 0 text black on white as default */
short yscroll; /* Hardware scrolling */
int vrows; /* number of virtual rows */
int cursor_shape;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 813/844] io_uring/zcrx: fix sgtable leak on mapping failures
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (811 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 812/844] fbcon: Remove struct fbcon_display.inverse Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 814/844] io_uring/zcrx: fix post open error handling Sasha Levin
` (39 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Pavel Begunkov, Jens Axboe, Sasha Levin
From: Pavel Begunkov <asml.silence@gmail.com>
[ Upstream commit a983aae397767e9da931128ff2b5bf9066513ce3 ]
In an unlikely case when io_populate_area_dma() fails, which could only
happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine,
io_zcrx_map_area() will have an initialised and not freed table. It was
supposed to be cleaned up in the error path, but !is_mapped prevents
that.
Fixes: 439a98b972fbb ("io_uring/zcrx: deduplicate area mapping")
Cc: stable@vger.kernel.org
Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/zcrx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 3d398283cf340..b133c85793c9c 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -288,6 +288,9 @@ static int io_zcrx_map_area(struct io_zcrx_ifq *ifq, struct io_zcrx_area *area)
}
ret = io_populate_area_dma(ifq, area);
+ if (ret && !area->mem.is_dmabuf)
+ dma_unmap_sgtable(ifq->dev, &area->mem.page_sg_table,
+ DMA_FROM_DEVICE, IO_DMA_ATTR);
if (ret == 0)
area->is_mapped = true;
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 814/844] io_uring/zcrx: fix post open error handling
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (812 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 813/844] io_uring/zcrx: fix sgtable leak on mapping failures Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 815/844] io_uring/zcrx: check unsupported flags on import Sasha Levin
` (38 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Pavel Begunkov, Jens Axboe, Sasha Levin
From: Pavel Begunkov <asml.silence@gmail.com>
[ Upstream commit 5d540e4508950c674d6feef1d95463d039bbf4f5 ]
Closing a queue doesn't guarantee that all associated page pools are
terminated right away, let the refcounting do the work instead of
releasing the zcrx ctx directly.
Cc: stable@vger.kernel.org
Fixes: e0793de24a9f6 ("io_uring/zcrx: set pp memory provider for an rx queue")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/zcrx.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index b133c85793c9c..84e37900c0682 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -515,9 +515,6 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
.mp_priv = ifq,
};
- if (ifq->if_rxq == -1)
- return;
-
scoped_guard(mutex, &ifq->pp_lock) {
netdev = ifq->netdev;
netdev_tracker = ifq->netdev_tracker;
@@ -525,7 +522,8 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
}
if (netdev) {
- net_mp_close_rxq(netdev, ifq->if_rxq, &p);
+ if (ifq->if_rxq != -1)
+ net_mp_close_rxq(netdev, ifq->if_rxq, &p);
netdev_put(netdev, &netdev_tracker);
}
ifq->if_rxq = -1;
@@ -833,13 +831,12 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
}
return 0;
netdev_put_unlock:
- netdev_put(ifq->netdev, &ifq->netdev_tracker);
netdev_unlock(ifq->netdev);
err:
scoped_guard(mutex, &ctx->mmap_lock)
xa_erase(&ctx->zcrx_ctxs, id);
ifq_free:
- io_zcrx_ifq_free(ifq);
+ zcrx_unregister(ifq);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 815/844] io_uring/zcrx: check unsupported flags on import
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (813 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 814/844] io_uring/zcrx: fix post open error handling Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 816/844] cifs: some missing initializations on replay Sasha Levin
` (37 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Pavel Begunkov, Jens Axboe, Sasha Levin
From: Pavel Begunkov <asml.silence@gmail.com>
[ Upstream commit 7496e658a76a61758b20e27cea8abcfeafe3aec4 ]
The imoorted zcrx registration path checks for ZCRX_REG_IMPORT, as it
should, but doesn't reject any unsupported flags. Fix that.
Cc: stable@vger.kernel.org
Fixes: 00d91481279fb ("io_uring/zcrx: share an ifq between rings")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/zcrx.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 84e37900c0682..d41aa01a26d31 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -677,6 +677,8 @@ static int import_zcrx(struct io_ring_ctx *ctx,
return -EINVAL;
if (reg->if_rxq || reg->rq_entries || reg->area_ptr || reg->region_ptr)
return -EINVAL;
+ if (reg->flags & ~ZCRX_REG_IMPORT)
+ return -EINVAL;
fd = reg->if_idx;
CLASS(fd, f)(fd);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 816/844] cifs: some missing initializations on replay
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (814 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 815/844] io_uring/zcrx: check unsupported flags on import Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 817/844] gpio: nomadik: Add missing IS_ERR() check Sasha Levin
` (36 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Shyam Prasad N, Yuchan Nam, Steve French, Sasha Levin
From: Shyam Prasad N <sprasad@microsoft.com>
[ Upstream commit 14f66f44646333d2bfd7ece36585874fd72f8286 ]
In several places in the code, we have a label to signify
the start of the code where a request can be replayed if
necessary. However, some of these places were missing the
necessary reinitializations of certain local variables
before replay.
This change makes sure that these variables get initialized
after the label.
Cc: stable@vger.kernel.org
Reported-by: Yuchan Nam <entropy1110@gmail.com>
Tested-by: Yuchan Nam <entropy1110@gmail.com>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2ops.c | 2 ++
fs/smb/client/smb2pdu.c | 1 +
2 files changed, 3 insertions(+)
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index d76d79e50e8e7..4eb7879479baf 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -1185,6 +1185,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
replay_again:
/* reinitialize for possible replay */
+ used_len = 0;
flags = CIFS_CP_CREATE_CLOSE_OP;
oplock = SMB2_OPLOCK_LEVEL_NONE;
server = cifs_pick_channel(ses);
@@ -1583,6 +1584,7 @@ smb2_ioctl_query_info(const unsigned int xid,
replay_again:
/* reinitialize for possible replay */
+ buffer = NULL;
flags = CIFS_CP_CREATE_CLOSE_OP;
oplock = SMB2_OPLOCK_LEVEL_NONE;
server = cifs_pick_channel(ses);
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index c7e086dfb1765..758d6f4256726 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2908,6 +2908,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode,
replay_again:
/* reinitialize for possible replay */
+ pc_buf = NULL;
flags = 0;
n_iov = 2;
server = cifs_pick_channel(ses);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 817/844] gpio: nomadik: Add missing IS_ERR() check
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (815 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 816/844] cifs: some missing initializations on replay Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 818/844] io_uring/cmd_net: fix too strict requirement on ioctl Sasha Levin
` (35 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ethan Tidmore, Bartosz Golaszewski, Sasha Levin
From: Ethan Tidmore <ethantidmore06@gmail.com>
[ Upstream commit 58433885ee99e8c96757e82ccf6d50646c4dfe09 ]
The function gpio_device_get_desc() can return an error pointer and is
not checked for one. Add check for error pointer.
Fixes: ddeb66d2cb10f ("gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260214044531.43539-1-ethantidmore06@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-nomadik.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpio/gpio-nomadik.c b/drivers/gpio/gpio-nomadik.c
index 97c5cd33279d5..e22b713166d71 100644
--- a/drivers/gpio/gpio-nomadik.c
+++ b/drivers/gpio/gpio-nomadik.c
@@ -430,6 +430,9 @@ void nmk_gpio_dbg_show_one(struct seq_file *s, struct pinctrl_dev *pctldev,
#ifdef CONFIG_PINCTRL_NOMADIK
if (mode == NMK_GPIO_ALT_C && pctldev) {
desc = gpio_device_get_desc(chip->gpiodev, offset);
+ if (IS_ERR(desc))
+ return;
+
mode = nmk_prcm_gpiocr_get_mode(pctldev, desc_to_gpio(desc));
}
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 818/844] io_uring/cmd_net: fix too strict requirement on ioctl
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (816 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 817/844] gpio: nomadik: Add missing IS_ERR() check Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 819/844] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR Sasha Levin
` (34 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Asbjørn Sloth Tønnesen, Gabriel Krisman Bertazi,
Jens Axboe, Sasha Levin
From: Asbjørn Sloth Tønnesen <ast@fiberby.net>
[ Upstream commit 600b665b903733bd60334e86031b157cc823ee55 ]
Attempting SOCKET_URING_OP_SETSOCKOPT on an AF_NETLINK socket resulted
in an -EOPNOTSUPP, as AF_NETLINK doesn't have an ioctl in its struct
proto, but only in struct proto_ops.
Prior to the blamed commit, io_uring_cmd_sock() only had two cmd_op
operations, both requiring ioctl, thus the check was warranted.
Since then, 4 new cmd_op operations have been added, none of which
depend on ioctl. This patch moves the ioctl check, so it only applies
to the original operations.
AFAICT, the ioctl requirement was unintentional, and it wasn't
visible in the blamed patch within 3 lines of context.
Cc: stable@vger.kernel.org
Fixes: a5d2f99aff6b ("io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT")
Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/cmd_net.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/io_uring/cmd_net.c b/io_uring/cmd_net.c
index 19d3ce2bd20ad..3db34e2d22ee5 100644
--- a/io_uring/cmd_net.c
+++ b/io_uring/cmd_net.c
@@ -159,16 +159,19 @@ int io_uring_cmd_sock(struct io_uring_cmd *cmd, unsigned int issue_flags)
struct proto *prot = READ_ONCE(sk->sk_prot);
int ret, arg = 0;
- if (!prot || !prot->ioctl)
- return -EOPNOTSUPP;
-
switch (cmd->cmd_op) {
case SOCKET_URING_OP_SIOCINQ:
+ if (!prot || !prot->ioctl)
+ return -EOPNOTSUPP;
+
ret = prot->ioctl(sk, SIOCINQ, &arg);
if (ret)
return ret;
return arg;
case SOCKET_URING_OP_SIOCOUTQ:
+ if (!prot || !prot->ioctl)
+ return -EOPNOTSUPP;
+
ret = prot->ioctl(sk, SIOCOUTQ, &arg);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 819/844] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (817 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 818/844] io_uring/cmd_net: fix too strict requirement on ioctl Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 820/844] kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package Sasha Levin
` (33 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Gustavo Salvini, Mark Brown, Sasha Levin
From: Gustavo Salvini <guspatagonico@gmail.com>
[ Upstream commit ff9cadd1a2c0b2665b7377ac79540d66f212e7e3 ]
The ASUS Vivobook Pro 15X (M6501RR) with AMD Ryzen 9 6900HX has an
internal DMIC that is not detected without a DMI quirk entry, as the
BIOS does not set the AcpDmicConnected ACPI _DSD property.
Adding the DMI entry enables the ACP6x DMIC machine driver to probe
successfully.
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Salvini <guspatagonico@gmail.com>
Link: https://patch.msgid.link/20260210155156.29079-1-guspatagonico@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/yc/acp6x-mach.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
index 67f2fee193980..f1a63475100d1 100644
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -696,7 +696,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"),
}
},
-
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Vivobook_ASUSLaptop M6501RR_M6501RR"),
+ }
+ },
{}
};
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 820/844] kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (818 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 819/844] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 821/844] net: arcnet: com20020-pci: fix support for 2.5Mbit cards Sasha Levin
` (32 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Nathan Chancellor, Stefano Garzarella, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit f94711255a73d8938cf3bb405a0af3a4d2700ed1 ]
Stefano reports that after commit 62089b804895 ("kbuild: rpm-pkg:
Generate debuginfo package manually"), building with an rpm package
using rpm 4.20.0 fails with:
RPM build errors:
Dependency tokens must begin with alpha-numeric, '_' or '/': #�) = 0x0d000002
Dependency tokens must begin with alpha-numeric, '_' or '/': �) = 0x0d000000
Dependency tokens must begin with alpha-numeric, '_' or '/': ) = 0x7c0e000000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800
This error comes from the automatic requirements feature of rpm. The
-debuginfo subpackage has no dependencies, so disable this feature with
'AutoReq: 0' for this subpackage, avoiding the error. This matches the
official %_debug_template macro that rpm provides. While automatic
provides should be default enabled, be explicit like %_debug_template
does.
Additionally, while in the area, add the manual debug information
package to the Development/Debug group, further aligning with
%_debug_template.
Cc: stable@vger.kernel.org
Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually")
Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Closes: https://lore.kernel.org/CAGxU2F7FFNgb781_A7a1oL63n9Oy8wsyWceKhUpeZ6mLk=focw@mail.gmail.com/
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20260216-improve-manual-debuginfo-template-v1-1-e584b3f8d3be@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/package/kernel.spec | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/package/kernel.spec b/scripts/package/kernel.spec
index bccf58bdd45fd..b3c956205af00 100644
--- a/scripts/package/kernel.spec
+++ b/scripts/package/kernel.spec
@@ -48,6 +48,9 @@ against the %{version} kernel package.
%if %{with_debuginfo_manual}
%package debuginfo
Summary: Debug information package for the Linux kernel
+Group: Development/Debug
+AutoReq: 0
+AutoProv: 1
%description debuginfo
This package provides debug information for the kernel image and modules from the
%{version} package.
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 821/844] net: arcnet: com20020-pci: fix support for 2.5Mbit cards
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (819 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 820/844] kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 822/844] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise Sasha Levin
` (31 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Ethan Nelson-Moore, Simon Horman, Paolo Abeni, Sasha Levin
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit c7d9be66b71af490446127c6ffcb66d6bb71b8b9 ]
Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
converted the com20020-pci driver to use a card info structure instead
of a single flag mask in driver_data. However, it failed to take into
account that in the original code, driver_data of 0 indicates a card
with no special flags, not a card that should not have any card info
structure. This introduced a null pointer dereference when cards with
no flags were probed.
Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in
com20020pci_probe()") then papered over this issue by rejecting cards
with no driver_data instead of resolving the problem at its source.
Fix the original issue by introducing a new card info structure for
2.5Mbit cards that does not set any flags and using it if no
driver_data is present.
Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()")
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/arcnet/com20020-pci.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index 0472bcdff1307..b5729d6c0b47c 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -115,6 +115,8 @@ static const struct attribute_group com20020_state_group = {
.attrs = com20020_state_attrs,
};
+static struct com20020_pci_card_info card_info_2p5mbit;
+
static void com20020pci_remove(struct pci_dev *pdev);
static int com20020pci_probe(struct pci_dev *pdev,
@@ -140,7 +142,7 @@ static int com20020pci_probe(struct pci_dev *pdev,
ci = (struct com20020_pci_card_info *)id->driver_data;
if (!ci)
- return -EINVAL;
+ ci = &card_info_2p5mbit;
priv->ci = ci;
mm = &ci->misc_map;
@@ -347,6 +349,18 @@ static struct com20020_pci_card_info card_info_5mbit = {
.flags = ARC_IS_5MBIT,
};
+static struct com20020_pci_card_info card_info_2p5mbit = {
+ .name = "ARC-PCI",
+ .devcount = 1,
+ .chan_map_tbl = {
+ {
+ .bar = 2,
+ .offset = 0x00,
+ .size = 0x08,
+ },
+ },
+};
+
static struct com20020_pci_card_info card_info_sohard = {
.name = "SOHARD SH ARC-PCI",
.devcount = 1,
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 822/844] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (820 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 821/844] net: arcnet: com20020-pci: fix support for 2.5Mbit cards Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 823/844] net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle Sasha Levin
` (30 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jia Yao, Matthew Auld, Matthew Brost, Shuicheng Lin,
Himal Prasad Ghimiray, Thomas Hellström, Rodrigo Vivi,
Sasha Levin
From: Jia Yao <jia.yao@intel.com>
[ Upstream commit fbbe32618e97eff81577a01eb7d9adcd64a216d7 ]
When user provides a bogus pat_index value through the madvise IOCTL, the
xe_pat_index_get_coh_mode() function performs an array access without
validating bounds. This allows a malicious user to trigger an out-of-bounds
kernel read from the xe->pat.table array.
The vulnerability exists because the validation in madvise_args_are_sane()
directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without
first checking if pat_index is within [0, xe->pat.n_entries).
Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug
builds, it still performs the unsafe array access in production kernels.
v2(Matthew Auld)
- Using array_index_nospec() to mitigate spectre attacks when the value
is used
v3(Matthew Auld)
- Put the declarations at the start of the block
Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe")
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v6.18+
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Jia Yao <jia.yao@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260205161529.1819276-1-jia.yao@intel.com
(cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_vm_madvise.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
index cad3cf627c3f2..fe7e1b45f5c0c 100644
--- a/drivers/gpu/drm/xe/xe_vm_madvise.c
+++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
@@ -268,8 +268,13 @@ static bool madvise_args_are_sane(struct xe_device *xe, const struct drm_xe_madv
break;
case DRM_XE_MEM_RANGE_ATTR_PAT:
{
- u16 coh_mode = xe_pat_index_get_coh_mode(xe, args->pat_index.val);
+ u16 pat_index, coh_mode;
+ if (XE_IOCTL_DBG(xe, args->pat_index.val >= xe->pat.n_entries))
+ return false;
+
+ pat_index = array_index_nospec(args->pat_index.val, xe->pat.n_entries);
+ coh_mode = xe_pat_index_get_coh_mode(xe, pat_index);
if (XE_IOCTL_DBG(xe, !coh_mode))
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 823/844] net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (821 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 822/844] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 824/844] net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Sasha Levin
` (29 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Thomas Fourier, Jakub Kicinski, Sasha Levin
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit ffe68c3766997d82e9ccaf1cdbd47eba269c4aa2 ]
dma_free_coherent() in error path takes priv->rx_buf.alloc_len as
the dma handle. This would lead to improper unmapping of the buffer.
Change the dma handle to priv->rx_buf.alloc_phys.
Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Link: https://patch.msgid.link/20260213164340.77272-2-fourier.thomas@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ec_bhf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c
index 67275aa4f65b2..0c86cbb0313c3 100644
--- a/drivers/net/ethernet/ec_bhf.c
+++ b/drivers/net/ethernet/ec_bhf.c
@@ -423,7 +423,7 @@ static int ec_bhf_open(struct net_device *net_dev)
error_rx_free:
dma_free_coherent(dev, priv->rx_buf.alloc_len, priv->rx_buf.alloc,
- priv->rx_buf.alloc_len);
+ priv->rx_buf.alloc_phys);
out:
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 824/844] net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (822 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 823/844] net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 825/844] gpio: swnode: restore the swnode-name-against-chip-label matching Sasha Levin
` (28 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ruitong Liu, Jakub Kicinski, Sasha Levin
From: Ruitong Liu <cnitlrt@gmail.com>
[ Upstream commit be054cc66f739a9ba615dba9012a07fab8e7dd6f ]
Commit 38a6f0865796 ("net: sched: support hash selecting tx queue")
added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is
computed as:
mapping_mod = queue_mapping_max - queue_mapping + 1;
The range size can be 65536 when the requested range covers all possible
u16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX).
That value cannot be represented in a u16 and previously wrapped to 0,
so tcf_skbedit_hash() could trigger a divide-by-zero:
queue_mapping += skb_get_hash(skb) % params->mapping_mod;
Compute mapping_mod in a wider type and reject ranges larger than U16_MAX
to prevent params->mapping_mod from becoming 0 and avoid the crash.
Fixes: 38a6f0865796 ("net: sched: support hash selecting tx queue")
Cc: stable@vger.kernel.org # 6.12+
Signed-off-by: Ruitong Liu <cnitlrt@gmail.com>
Link: https://patch.msgid.link/20260213175948.1505257-1-cnitlrt@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_skbedit.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 8c1d1554f6575..5450c1293eb50 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -126,7 +126,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
struct tcf_skbedit *d;
u32 flags = 0, *priority = NULL, *mark = NULL, *mask = NULL;
u16 *queue_mapping = NULL, *ptype = NULL;
- u16 mapping_mod = 1;
+ u32 mapping_mod = 1;
bool exists = false;
int ret = 0, err;
u32 index;
@@ -194,6 +194,10 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
}
mapping_mod = *queue_mapping_max - *queue_mapping + 1;
+ if (mapping_mod > U16_MAX) {
+ NL_SET_ERR_MSG_MOD(extack, "The range of queue_mapping is invalid.");
+ return -EINVAL;
+ }
flags |= SKBEDIT_F_TXQ_SKBHASH;
}
if (*pure_flags & SKBEDIT_F_INHERITDSFIELD)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 825/844] gpio: swnode: restore the swnode-name-against-chip-label matching
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (823 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 824/844] net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 826/844] gpio: sysfs: fix chip removal with GPIOs exported over sysfs Sasha Levin
` (27 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Bartosz Golaszewski, Andy Shevchenko, Hans de Goede, Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit ff91965ad8b214e0771bc5a15253f14f583a7649 ]
Using the remote firmware node for software node lookup is the right
thing to do. The GPIO controller we want to resolve should have the
software node we scooped out of the reference attached to it. However,
there are existing users who abuse the software node API by creating
dummy swnodes whose name is set to the expected label string of the GPIO
controller whose pins they want to control and use them in their local
swnode references as GPIO properties.
This used to work when we compared the software node's name to the
chip's label. When we switched to using a real fwnode lookup, these
users broke down because the firmware nodes in question were never
attached to the controllers they were looking for.
Restore the label matching as a fallback to fix the broken users but add
a big FIXME urging for a better solution.
Cc: stable@vger.kernel.org # v6.18, v6.19
Fixes: 216c12047571 ("gpio: swnode: allow referencing GPIO chips by firmware nodes")
Link: https://lore.kernel.org/all/aYkdKfP5fg6iywgr@jekhomev/
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260211085313.16792-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-swnode.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/gpio/gpiolib-swnode.c b/drivers/gpio/gpiolib-swnode.c
index b44f35d684590..f02f5a61ddb83 100644
--- a/drivers/gpio/gpiolib-swnode.c
+++ b/drivers/gpio/gpiolib-swnode.c
@@ -43,6 +43,25 @@ static struct gpio_device *swnode_get_gpio_device(struct fwnode_handle *fwnode)
fwnode_lookup:
gdev = gpio_device_find_by_fwnode(fwnode);
+ if (!gdev && gdev_node && gdev_node->name)
+ /*
+ * FIXME: We shouldn't need to compare the GPIO controller's
+ * label against the software node that is supposedly attached
+ * to it. However there are currently GPIO users that - knowing
+ * the expected label of the GPIO chip whose pins they want to
+ * control - set up dummy software nodes named after those GPIO
+ * controllers, which aren't actually attached to them. In this
+ * case gpio_device_find_by_fwnode() will fail as no device on
+ * the GPIO bus is actually associated with the fwnode we're
+ * looking for.
+ *
+ * As a fallback: continue checking the label if we have no
+ * match. However, the situation described above is an abuse
+ * of the software node API and should be phased out and the
+ * following line - eventually removed.
+ */
+ gdev = gpio_device_find_by_label(gdev_node->name);
+
return gdev ?: ERR_PTR(-EPROBE_DEFER);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 826/844] gpio: sysfs: fix chip removal with GPIOs exported over sysfs
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (824 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 825/844] gpio: swnode: restore the swnode-name-against-chip-label matching Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 827/844] x86/kexec: Copy ACPI root pointer address from config table Sasha Levin
` (26 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Bartosz Golaszewski, Sasha Levin
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit 6766f59012301f1bf3f46c6e7149caca45d92309 ]
Currently if we export a GPIO over sysfs and unbind the parent GPIO
controller, the exported attribute will remain under /sys/class/gpio
because once we remove the parent device, we can no longer associate the
descriptor with it in gpiod_unexport() and never drop the final
reference.
Rework the teardown code: provide an unlocked variant of
gpiod_unexport() and remove all exported GPIOs with the sysfs_lock taken
before unregistering the parent device itself. This is done to prevent
any new exports happening before we unregister the device completely.
Cc: stable@vger.kernel.org
Fixes: 1cd53df733c2 ("gpio: sysfs: don't look up exported lines as class devices")
Link: https://patch.msgid.link/20260212133505.81516-1-bartosz.golaszewski@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-sysfs.c | 106 ++++++++++++++++++-----------------
1 file changed, 55 insertions(+), 51 deletions(-)
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index cd553acf3055e..d4a46a0a37d8f 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -919,63 +919,68 @@ int gpiod_export_link(struct device *dev, const char *name,
}
EXPORT_SYMBOL_GPL(gpiod_export_link);
-/**
- * gpiod_unexport - reverse effect of gpiod_export()
- * @desc: GPIO to make unavailable
- *
- * This is implicit on gpiod_free().
- */
-void gpiod_unexport(struct gpio_desc *desc)
+static void gpiod_unexport_unlocked(struct gpio_desc *desc)
{
struct gpiod_data *tmp, *desc_data = NULL;
struct gpiodev_data *gdev_data;
struct gpio_device *gdev;
- if (!desc) {
- pr_warn("%s: invalid GPIO\n", __func__);
+ if (!test_bit(GPIOD_FLAG_EXPORT, &desc->flags))
return;
- }
- scoped_guard(mutex, &sysfs_lock) {
- if (!test_bit(GPIOD_FLAG_EXPORT, &desc->flags))
- return;
-
- gdev = gpiod_to_gpio_device(desc);
- gdev_data = gdev_get_data(gdev);
- if (!gdev_data)
- return;
+ gdev = gpiod_to_gpio_device(desc);
+ gdev_data = gdev_get_data(gdev);
+ if (!gdev_data)
+ return;
- list_for_each_entry(tmp, &gdev_data->exported_lines, list) {
- if (gpiod_is_equal(desc, tmp->desc)) {
- desc_data = tmp;
- break;
- }
+ list_for_each_entry(tmp, &gdev_data->exported_lines, list) {
+ if (gpiod_is_equal(desc, tmp->desc)) {
+ desc_data = tmp;
+ break;
}
+ }
- if (!desc_data)
- return;
+ if (!desc_data)
+ return;
- list_del(&desc_data->list);
- clear_bit(GPIOD_FLAG_EXPORT, &desc->flags);
+ list_del(&desc_data->list);
+ clear_bit(GPIOD_FLAG_EXPORT, &desc->flags);
#if IS_ENABLED(CONFIG_GPIO_SYSFS_LEGACY)
- sysfs_put(desc_data->value_kn);
- device_unregister(desc_data->dev);
-
- /*
- * Release irq after deregistration to prevent race with
- * edge_store.
- */
- if (desc_data->irq_flags)
- gpio_sysfs_free_irq(desc_data);
+ sysfs_put(desc_data->value_kn);
+ device_unregister(desc_data->dev);
+
+ /*
+ * Release irq after deregistration to prevent race with
+ * edge_store.
+ */
+ if (desc_data->irq_flags)
+ gpio_sysfs_free_irq(desc_data);
#endif /* CONFIG_GPIO_SYSFS_LEGACY */
- sysfs_remove_groups(desc_data->parent,
- desc_data->chip_attr_groups);
- }
+ sysfs_remove_groups(desc_data->parent,
+ desc_data->chip_attr_groups);
mutex_destroy(&desc_data->mutex);
kfree(desc_data);
}
+
+/**
+ * gpiod_unexport - reverse effect of gpiod_export()
+ * @desc: GPIO to make unavailable
+ *
+ * This is implicit on gpiod_free().
+ */
+void gpiod_unexport(struct gpio_desc *desc)
+{
+ if (!desc) {
+ pr_warn("%s: invalid GPIO\n", __func__);
+ return;
+ }
+
+ guard(mutex)(&sysfs_lock);
+
+ gpiod_unexport_unlocked(desc);
+}
EXPORT_SYMBOL_GPL(gpiod_unexport);
int gpiochip_sysfs_register(struct gpio_device *gdev)
@@ -1054,29 +1059,28 @@ void gpiochip_sysfs_unregister(struct gpio_device *gdev)
struct gpio_desc *desc;
struct gpio_chip *chip;
- scoped_guard(mutex, &sysfs_lock) {
- data = gdev_get_data(gdev);
- if (!data)
- return;
+ guard(mutex)(&sysfs_lock);
-#if IS_ENABLED(CONFIG_GPIO_SYSFS_LEGACY)
- device_unregister(data->cdev_base);
-#endif /* CONFIG_GPIO_SYSFS_LEGACY */
- device_unregister(data->cdev_id);
- kfree(data);
- }
+ data = gdev_get_data(gdev);
+ if (!data)
+ return;
guard(srcu)(&gdev->srcu);
-
chip = srcu_dereference(gdev->chip, &gdev->srcu);
if (!chip)
return;
/* unregister gpiod class devices owned by sysfs */
for_each_gpio_desc_with_flag(chip, desc, GPIOD_FLAG_SYSFS) {
- gpiod_unexport(desc);
+ gpiod_unexport_unlocked(desc);
gpiod_free(desc);
}
+
+#if IS_ENABLED(CONFIG_GPIO_SYSFS_LEGACY)
+ device_unregister(data->cdev_base);
+#endif /* CONFIG_GPIO_SYSFS_LEGACY */
+ device_unregister(data->cdev_id);
+ kfree(data);
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 827/844] x86/kexec: Copy ACPI root pointer address from config table
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (825 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 826/844] gpio: sysfs: fix chip removal with GPIOs exported over sysfs Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 828/844] io_uring/zcrx: fix user_ref race between scrub and refill paths Sasha Levin
` (25 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Ard Biesheuvel, Dave Young, Sasha Levin
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit e00ac9e5afb5d80c0168ec88d8e8662a54af8249 ]
Dave reports that kexec may fail when the first kernel boots via the EFI
stub but without EFI runtime services, as in that case, the RSDP address
field in struct bootparams is never assigned. Kexec copies this value
into the version of struct bootparams that it provides to the incoming
kernel, which may have no other means to locate the ACPI root pointer.
So take the value from the EFI config tables if no root pointer has been
set in the first kernel's struct bootparams.
Fixes: a1b87d54f4e4 ("x86/efistub: Avoid legacy decompressor when doing EFI boot")
Cc: <stable@vger.kernel.org> # v6.1
Reported-by: Dave Young <dyoung@redhat.com>
Tested-by: Dave Young <dyoung@redhat.com>
Link: https://lore.kernel.org/linux-efi/aZQg_tRQmdKNadCg@darkstar.users.ipa.redhat.com/
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/kexec-bzimage64.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index c3244ac680d14..f3b451eb49be1 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -192,6 +192,13 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
struct efi_info *current_ei = &boot_params.efi_info;
struct efi_info *ei = ¶ms->efi_info;
+ if (!params->acpi_rsdp_addr) {
+ if (efi.acpi20 != EFI_INVALID_TABLE_ADDR)
+ params->acpi_rsdp_addr = efi.acpi20;
+ else if (efi.acpi != EFI_INVALID_TABLE_ADDR)
+ params->acpi_rsdp_addr = efi.acpi;
+ }
+
if (!efi_enabled(EFI_RUNTIME_SERVICES))
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 828/844] io_uring/zcrx: fix user_ref race between scrub and refill paths
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (826 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 827/844] x86/kexec: Copy ACPI root pointer address from config table Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 829/844] rust: irq: add `'static` bounds to irq callbacks Sasha Levin
` (24 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Kai Aizen, Pavel Begunkov, Jens Axboe, Sasha Levin
From: Kai Aizen <kai@snailsploit.com>
[ Upstream commit 003049b1c4fb8aabb93febb7d1e49004f6ad653b ]
The io_zcrx_put_niov_uref() function uses a non-atomic
check-then-decrement pattern (atomic_read followed by separate
atomic_dec) to manipulate user_refs. This is serialized against other
callers by rq_lock, but io_zcrx_scrub() modifies the same counter with
atomic_xchg() WITHOUT holding rq_lock.
On SMP systems, the following race exists:
CPU0 (refill, holds rq_lock) CPU1 (scrub, no rq_lock)
put_niov_uref:
atomic_read(uref) - 1
// window opens
atomic_xchg(uref, 0) - 1
return_niov_freelist(niov) [PUSH #1]
// window closes
atomic_dec(uref) - wraps to -1
returns true
return_niov(niov)
return_niov_freelist(niov) [PUSH #2: DOUBLE-FREE]
The same niov is pushed to the freelist twice, causing free_count to
exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds
write (a u32 value) past the kvmalloc'd freelist array into the adjacent
slab object.
Fix this by replacing the non-atomic read-then-dec in
io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically
tests and decrements user_refs. This makes the operation safe against
concurrent atomic_xchg from scrub without requiring scrub to acquire
rq_lock.
Fixes: 34a3e60821ab ("io_uring/zcrx: implement zerocopy receive pp memory provider")
Cc: stable@vger.kernel.org
Signed-off-by: Kai Aizen <kai@snailsploit.com>
[pavel: removed a warning and a comment]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/zcrx.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index d41aa01a26d31..93da8933a91fa 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -337,10 +337,14 @@ static inline atomic_t *io_get_user_counter(struct net_iov *niov)
static bool io_zcrx_put_niov_uref(struct net_iov *niov)
{
atomic_t *uref = io_get_user_counter(niov);
+ int old;
+
+ old = atomic_read(uref);
+ do {
+ if (unlikely(old == 0))
+ return false;
+ } while (!atomic_try_cmpxchg(uref, &old, old - 1));
- if (unlikely(!atomic_read(uref)))
- return false;
- atomic_dec(uref);
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 829/844] rust: irq: add `'static` bounds to irq callbacks
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (827 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 828/844] io_uring/zcrx: fix user_ref race between scrub and refill paths Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 830/844] rust: pin-init: replace clippy `expect` with `allow` Sasha Levin
` (23 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Benno Lossin, Gary Guo, Daniel Almeida, Danilo Krummrich,
Miguel Ojeda, Sasha Levin
From: Benno Lossin <lossin@kernel.org>
[ Upstream commit 621609f1e5ca43a75edd497dd1c28bd84aa66433 ]
These callback functions take a generic `T` that is used in the body as
the generic argument in `Registration` and `ThreadedRegistration`. Those
types require `T: 'static`, but due to a compiler bug this requirement
isn't propagated to the function. Thus add the bound. This was caught in
the upstream Rust CI [1].
[ The three errors looked similar and will start appearing with Rust
1.95.0 (expected 2026-04-16). The first one was:
error[E0310]: the parameter type `T` may not live long enough
Error: --> rust/kernel/irq/request.rs:266:43
|
266 | let registration = unsafe { &*(ptr as *const Registration<T>) };
| ^^^^^^^^^^^^^^^^^^^^^^
| |
| the parameter type `T` must be valid for the static lifetime...
| ...so that the type `T` will meet its required lifetime bounds
|
help: consider adding an explicit lifetime bound
|
264 | unsafe extern "C" fn handle_irq_callback<T: Handler + 'static>(_irq: i32, ptr: *mut c_void) -> c_uint {
| +++++++++
- Miguel ]
Link: https://github.com/rust-lang/rust/pull/149389 [1]
Signed-off-by: Benno Lossin <lossin@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 29e16fcd67ee ("rust: irq: add &Device<Bound> argument to irq callbacks")
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Acked-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/rust-for-linux/20260217222425.8755-1-cole@unwrap.rs/
Link: https://patch.msgid.link/20260214092740.3201946-1-lossin@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/irq/request.rs | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/rust/kernel/irq/request.rs b/rust/kernel/irq/request.rs
index b150563fdef80..2ceeaeb0543a4 100644
--- a/rust/kernel/irq/request.rs
+++ b/rust/kernel/irq/request.rs
@@ -261,7 +261,10 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
/// # Safety
///
/// This function should be only used as the callback in `request_irq`.
-unsafe extern "C" fn handle_irq_callback<T: Handler>(_irq: i32, ptr: *mut c_void) -> c_uint {
+unsafe extern "C" fn handle_irq_callback<T: Handler + 'static>(
+ _irq: i32,
+ ptr: *mut c_void,
+) -> c_uint {
// SAFETY: `ptr` is a pointer to `Registration<T>` set in `Registration::new`
let registration = unsafe { &*(ptr as *const Registration<T>) };
// SAFETY: The irq callback is removed before the device is unbound, so the fact that the irq
@@ -480,7 +483,7 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
/// # Safety
///
/// This function should be only used as the callback in `request_threaded_irq`.
-unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler>(
+unsafe extern "C" fn handle_threaded_irq_callback<T: ThreadedHandler + 'static>(
_irq: i32,
ptr: *mut c_void,
) -> c_uint {
@@ -496,7 +499,10 @@ pub fn synchronize(&self, dev: &Device<Bound>) -> Result {
/// # Safety
///
/// This function should be only used as the callback in `request_threaded_irq`.
-unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler>(_irq: i32, ptr: *mut c_void) -> c_uint {
+unsafe extern "C" fn thread_fn_callback<T: ThreadedHandler + 'static>(
+ _irq: i32,
+ ptr: *mut c_void,
+) -> c_uint {
// SAFETY: `ptr` is a pointer to `ThreadedRegistration<T>` set in `ThreadedRegistration::new`
let registration = unsafe { &*(ptr as *const ThreadedRegistration<T>) };
// SAFETY: The irq callback is removed before the device is unbound, so the fact that the irq
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 830/844] rust: pin-init: replace clippy `expect` with `allow`
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (828 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 829/844] rust: irq: add `'static` bounds to irq callbacks Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 831/844] arm64: Force the use of CNTVCT_EL0 in __delay() Sasha Levin
` (22 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Benno Lossin, Miguel Ojeda, Sasha Levin
From: Benno Lossin <lossin@kernel.org>
[ Upstream commit a58b8764aed9648357b1c5b6368c9943ba33b7f9 ]
`clippy` has changed behavior in [1] (Rust 1.95) where it no longer
warns about the `let_and_return` lint when a comment is placed between
the let binding and the return expression. Nightly thus fails to build,
because the expectation is no longer fulfilled.
Thus replace the expectation with an `allow`.
[ The errors were:
error: this lint expectation is unfulfilled
--> rust/pin-init/src/lib.rs:1279:10
|
1279 | #[expect(clippy::let_and_return)]
| ^^^^^^^^^^^^^^^^^^^^^^
|
= note: `-D unfulfilled-lint-expectations` implied by `-D warnings`
= help: to override `-D warnings` add `#[allow(unfulfilled_lint_expectations)]`
error: this lint expectation is unfulfilled
--> rust/pin-init/src/lib.rs:1295:10
|
1295 | #[expect(clippy::let_and_return)]
| ^^^^^^^^^^^^^^^^^^^^^^
- Miguel ]
Link: https://github.com/rust-lang/rust-clippy/pull/16461 [1]
Signed-off-by: Benno Lossin <lossin@kernel.org>
Cc: stable@vger.kernel.org # Needed in 6.18.y and later.
Link: https://patch.msgid.link/20260215132232.1549861-1-lossin@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/pin-init/src/lib.rs | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/rust/pin-init/src/lib.rs b/rust/pin-init/src/lib.rs
index 8dc9dd5ac6fd3..3da65db9e2dd3 100644
--- a/rust/pin-init/src/lib.rs
+++ b/rust/pin-init/src/lib.rs
@@ -1276,13 +1276,13 @@ unsafe fn __pinned_init(self, slot: *mut T) -> Result<(), E> {
///
/// - `*mut U` must be castable to `*mut T` and any value of type `T` written through such a
/// pointer must result in a valid `U`.
-#[expect(clippy::let_and_return)]
pub const unsafe fn cast_pin_init<T, U, E>(init: impl PinInit<T, E>) -> impl PinInit<U, E> {
// SAFETY: initialization delegated to a valid initializer. Cast is valid by function safety
// requirements.
let res = unsafe { pin_init_from_closure(|ptr: *mut U| init.__pinned_init(ptr.cast::<T>())) };
// FIXME: remove the let statement once the nightly-MSRV allows it (1.78 otherwise encounters a
// cycle when computing the type returned by this function)
+ #[allow(clippy::let_and_return)]
res
}
@@ -1292,13 +1292,13 @@ unsafe fn __pinned_init(self, slot: *mut T) -> Result<(), E> {
///
/// - `*mut U` must be castable to `*mut T` and any value of type `T` written through such a
/// pointer must result in a valid `U`.
-#[expect(clippy::let_and_return)]
pub const unsafe fn cast_init<T, U, E>(init: impl Init<T, E>) -> impl Init<U, E> {
// SAFETY: initialization delegated to a valid initializer. Cast is valid by function safety
// requirements.
let res = unsafe { init_from_closure(|ptr: *mut U| init.__init(ptr.cast::<T>())) };
// FIXME: remove the let statement once the nightly-MSRV allows it (1.78 otherwise encounters a
// cycle when computing the type returned by this function)
+ #[allow(clippy::let_and_return)]
res
}
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 831/844] arm64: Force the use of CNTVCT_EL0 in __delay()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (829 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 830/844] rust: pin-init: replace clippy `expect` with `allow` Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-03-02 7:07 ` Jiri Slaby
2026-02-28 17:32 ` [PATCH 6.19 832/844] drm/amd/display: Correct logic check error for fastboot Sasha Levin
` (21 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Marc Zyngier, Hyesoo Yu, Quentin Perret, Will Deacon, Sasha Levin
From: Marc Zyngier <maz@kernel.org>
[ Upstream commit 29cc0f3aa7c64d3b3cb9d94c0a0984ba6717bf72 ]
Quentin forwards a report from Hyesoo Yu, describing an interesting
problem with the use of WFxT in __delay() when a vcpu is loaded and
that KVM is *not* in VHE mode (either nVHE or hVHE).
In this case, CNTVOFF_EL2 is set to a non-zero value to reflect the
state of the guest virtual counter. At the same time, __delay() is
using get_cycles() to read the counter value, which is indirected to
reading CNTPCT_EL0.
The core of the issue is that WFxT is using the *virtual* counter,
while the kernel is using the physical counter, and that the offset
introduces a really bad discrepancy between the two.
Fix this by forcing the use of CNTVCT_EL0, making __delay() consistent
irrespective of the value of CNTVOFF_EL2.
Reported-by: Hyesoo Yu <hyesoo.yu@samsung.com>
Reported-by: Quentin Perret <qperret@google.com>
Reviewed-by: Quentin Perret <qperret@google.com>
Fixes: 7d26b0516a0d ("arm64: Use WFxT for __delay() when possible")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/ktosachvft2cgqd5qkukn275ugmhy6xrhxur4zqpdxlfr3qh5h@o3zrfnsq63od
Cc: stable@vger.kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/lib/delay.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/lib/delay.c b/arch/arm64/lib/delay.c
index cb2062e7e2340..d02341303899e 100644
--- a/arch/arm64/lib/delay.c
+++ b/arch/arm64/lib/delay.c
@@ -23,9 +23,20 @@ static inline unsigned long xloops_to_cycles(unsigned long xloops)
return (xloops * loops_per_jiffy * HZ) >> 32;
}
+/*
+ * Force the use of CNTVCT_EL0 in order to have the same base as WFxT.
+ * This avoids some annoying issues when CNTVOFF_EL2 is not reset 0 on a
+ * KVM host running at EL1 until we do a vcpu_put() on the vcpu. When
+ * running at EL2, the effective offset is always 0.
+ *
+ * Note that userspace cannot change the offset behind our back either,
+ * as the vcpu mutex is held as long as KVM_RUN is in progress.
+ */
+#define __delay_cycles() __arch_counter_get_cntvct_stable()
+
void __delay(unsigned long cycles)
{
- cycles_t start = get_cycles();
+ cycles_t start = __delay_cycles();
if (alternative_has_cap_unlikely(ARM64_HAS_WFXT)) {
u64 end = start + cycles;
@@ -35,17 +46,17 @@ void __delay(unsigned long cycles)
* early, use a WFET loop to complete the delay.
*/
wfit(end);
- while ((get_cycles() - start) < cycles)
+ while ((__delay_cycles() - start) < cycles)
wfet(end);
} else if (arch_timer_evtstrm_available()) {
const cycles_t timer_evt_period =
USECS_TO_CYCLES(ARCH_TIMER_EVT_STREAM_PERIOD_US);
- while ((get_cycles() - start + timer_evt_period) < cycles)
+ while ((__delay_cycles() - start + timer_evt_period) < cycles)
wfe();
}
- while ((get_cycles() - start) < cycles)
+ while ((__delay_cycles() - start) < cycles)
cpu_relax();
}
EXPORT_SYMBOL(__delay);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 831/844] arm64: Force the use of CNTVCT_EL0 in __delay()
2026-02-28 17:32 ` [PATCH 6.19 831/844] arm64: Force the use of CNTVCT_EL0 in __delay() Sasha Levin
@ 2026-03-02 7:07 ` Jiri Slaby
2026-03-02 14:01 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Jiri Slaby @ 2026-03-02 7:07 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Marc Zyngier, Hyesoo Yu, Quentin Perret, Will Deacon
On 28. 02. 26, 18:32, Sasha Levin wrote:
> From: Marc Zyngier <maz@kernel.org>
>
> [ Upstream commit 29cc0f3aa7c64d3b3cb9d94c0a0984ba6717bf72 ]
...
> --- a/arch/arm64/lib/delay.c
> +++ b/arch/arm64/lib/delay.c
> @@ -23,9 +23,20 @@ static inline unsigned long xloops_to_cycles(unsigned long xloops)
> return (xloops * loops_per_jiffy * HZ) >> 32;
> }
>
> +/*
> + * Force the use of CNTVCT_EL0 in order to have the same base as WFxT.
> + * This avoids some annoying issues when CNTVOFF_EL2 is not reset 0 on a
> + * KVM host running at EL1 until we do a vcpu_put() on the vcpu. When
> + * running at EL2, the effective offset is always 0.
> + *
> + * Note that userspace cannot change the offset behind our back either,
> + * as the vcpu mutex is held as long as KVM_RUN is in progress.
> + */
> +#define __delay_cycles() __arch_counter_get_cntvct_stable()
This needs:
e5cb94ba5f96 arm64: Fix sampling the "stable" virtual counter in
preemptible section
--
js
suse labs
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 831/844] arm64: Force the use of CNTVCT_EL0 in __delay()
2026-03-02 7:07 ` Jiri Slaby
@ 2026-03-02 14:01 ` Sasha Levin
0 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-03-02 14:01 UTC (permalink / raw)
To: Jiri Slaby
Cc: linux-kernel, stable, Marc Zyngier, Hyesoo Yu, Quentin Perret,
Will Deacon
On Mon, Mar 02, 2026 at 08:07:29AM +0100, Jiri Slaby wrote:
>On 28. 02. 26, 18:32, Sasha Levin wrote:
>>From: Marc Zyngier <maz@kernel.org>
>>
>>[ Upstream commit 29cc0f3aa7c64d3b3cb9d94c0a0984ba6717bf72 ]
>...
>>--- a/arch/arm64/lib/delay.c
>>+++ b/arch/arm64/lib/delay.c
>>@@ -23,9 +23,20 @@ static inline unsigned long xloops_to_cycles(unsigned long xloops)
>> return (xloops * loops_per_jiffy * HZ) >> 32;
>> }
>>+/*
>>+ * Force the use of CNTVCT_EL0 in order to have the same base as WFxT.
>>+ * This avoids some annoying issues when CNTVOFF_EL2 is not reset 0 on a
>>+ * KVM host running at EL1 until we do a vcpu_put() on the vcpu. When
>>+ * running at EL2, the effective offset is always 0.
>>+ *
>>+ * Note that userspace cannot change the offset behind our back either,
>>+ * as the vcpu mutex is held as long as KVM_RUN is in progress.
>>+ */
>>+#define __delay_cycles() __arch_counter_get_cntvct_stable()
>
>This needs:
>e5cb94ba5f96 arm64: Fix sampling the "stable" virtual counter in
>preemptible section
Queued up, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* [PATCH 6.19 832/844] drm/amd/display: Correct logic check error for fastboot
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (830 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 831/844] arm64: Force the use of CNTVCT_EL0 in __delay() Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 833/844] drm/amdgpu: keep vga memory on MacBooks with switchable graphics Sasha Levin
` (20 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Charlene Liu, Mario Limonciello, Ovidiu Bunea, Ray Wu,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Charlene Liu <Charlene.Liu@amd.com>
[ Upstream commit b6a65009e7ce3f0cc72da18f186adb60717b51a0 ]
[Why]
Fix fastboot broken in driver.
This is caused by an open source backport change 7495962c.
from the comment, the intended check is to disable fastboot
for pre-DCN10. but the logic check is reversed, and causes
fastboot to be disabled on all DCN10 and after.
fastboot is for driver trying to pick up bios used hw setting
and bypass reprogramming the hw if dc_validate_boot_timing()
condition meets.
Fixes: 7495962cbceb ("drm/amd/display: Disable fastboot on DCE 6 too")
Cc: stable@vger.kernel.org
Reviewed-by: Mario Limonciello <Mario.Limonciello@amd.com>
Reviewed-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
index 3d2673a22759a..8b8410ef3e47a 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -1941,8 +1941,8 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context)
get_edp_streams(context, edp_streams, &edp_stream_num);
- /* Check fastboot support, disable on DCE 6-8 because of blank screens */
- if (edp_num && edp_stream_num && dc->ctx->dce_version < DCE_VERSION_10_0) {
+ /* Check fastboot support, disable on DCE 6-8-10 because of blank screens */
+ if (edp_num && edp_stream_num && dc->ctx->dce_version > DCE_VERSION_10_0) {
for (i = 0; i < edp_num; i++) {
edp_link = edp_links[i];
if (edp_link != edp_streams[0]->link)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 833/844] drm/amdgpu: keep vga memory on MacBooks with switchable graphics
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (831 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 832/844] drm/amd/display: Correct logic check error for fastboot Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 834/844] net: nfc: nci: Fix parameter validation for packet data Sasha Levin
` (19 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Alex Deucher, Mario Kleiner, Sasha Levin
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit 096bb75e13cc508d3915b7604e356bcb12b17766 ]
On Intel MacBookPros with switchable graphics, when the iGPU
is enabled, the address of VRAM gets put at 0 in the dGPU's
virtual address space. This is non-standard and seems to cause
issues with the cursor if it ends up at 0. We have the framework
to reserve memory at 0 in the address space, so enable it here if
the vram start address is 0.
Reviewed-and-tested-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4302
Cc: stable@vger.kernel.org
Cc: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
index 2b37398337afc..b8613888c5c33 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -1019,6 +1019,16 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)
case CHIP_RENOIR:
adev->mman.keep_stolen_vga_memory = true;
break;
+ case CHIP_POLARIS10:
+ case CHIP_POLARIS11:
+ case CHIP_POLARIS12:
+ /* MacBookPros with switchable graphics put VRAM at 0 when
+ * the iGPU is enabled which results in cursor issues if
+ * the cursor ends up at 0. Reserve vram at 0 in that case.
+ */
+ if (adev->gmc.vram_start == 0)
+ adev->mman.keep_stolen_vga_memory = true;
+ break;
default:
adev->mman.keep_stolen_vga_memory = false;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 834/844] net: nfc: nci: Fix parameter validation for packet data
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (832 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 833/844] drm/amdgpu: keep vga memory on MacBooks with switchable graphics Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 835/844] ring-buffer: Fix possible dereference of uninitialized pointer Sasha Levin
` (18 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michael Thalmeier, syzbot+740e04c2a93467a0f8c8, Jakub Kicinski,
Sasha Levin
From: Michael Thalmeier <michael.thalmeier@hale.at>
[ Upstream commit 571dcbeb8e635182bb825ae758399831805693c2 ]
Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for
packet data") communication with nci nfc chips is not working any more.
The mentioned commit tries to fix access of uninitialized data, but
failed to understand that in some cases the data packet is of variable
length and can therefore not be compared to the maximum packet length
given by the sizeof(struct).
Fixes: 9c328f54741b ("net: nfc: nci: Add parameter validation for packet data")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Reported-by: syzbot+740e04c2a93467a0f8c8@syzkaller.appspotmail.com
Link: https://patch.msgid.link/20260218083000.301354-1-michael.thalmeier@hale.at
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/ntf.c | 159 ++++++++++++++++++++++++++++++++++++++++------
1 file changed, 141 insertions(+), 18 deletions(-)
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index 418b84e2b2605..c96512bb86531 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -58,7 +58,7 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
struct nci_conn_info *conn_info;
int i;
- if (skb->len < sizeof(struct nci_core_conn_credit_ntf))
+ if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries))
return -EINVAL;
ntf = (struct nci_core_conn_credit_ntf *)skb->data;
@@ -68,6 +68,10 @@ static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
if (ntf->num_entries > NCI_MAX_NUM_CONN)
ntf->num_entries = NCI_MAX_NUM_CONN;
+ if (skb->len < offsetofend(struct nci_core_conn_credit_ntf, num_entries) +
+ ntf->num_entries * sizeof(struct conn_credit_entry))
+ return -EINVAL;
+
/* update the credits */
for (i = 0; i < ntf->num_entries; i++) {
ntf->conn_entries[i].conn_id =
@@ -138,23 +142,48 @@ static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
static const __u8 *
nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
struct rf_tech_specific_params_nfca_poll *nfca_poll,
- const __u8 *data)
+ const __u8 *data, ssize_t data_len)
{
+ /* Check if we have enough data for sens_res (2 bytes) */
+ if (data_len < 2)
+ return ERR_PTR(-EINVAL);
+
nfca_poll->sens_res = __le16_to_cpu(*((__le16 *)data));
data += 2;
+ data_len -= 2;
+
+ /* Check if we have enough data for nfcid1_len (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
nfca_poll->nfcid1_len = min_t(__u8, *data++, NFC_NFCID1_MAXSIZE);
+ data_len--;
pr_debug("sens_res 0x%x, nfcid1_len %d\n",
nfca_poll->sens_res, nfca_poll->nfcid1_len);
+ /* Check if we have enough data for nfcid1 */
+ if (data_len < nfca_poll->nfcid1_len)
+ return ERR_PTR(-EINVAL);
+
memcpy(nfca_poll->nfcid1, data, nfca_poll->nfcid1_len);
data += nfca_poll->nfcid1_len;
+ data_len -= nfca_poll->nfcid1_len;
+
+ /* Check if we have enough data for sel_res_len (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
nfca_poll->sel_res_len = *data++;
+ data_len--;
+
+ if (nfca_poll->sel_res_len != 0) {
+ /* Check if we have enough data for sel_res (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
- if (nfca_poll->sel_res_len != 0)
nfca_poll->sel_res = *data++;
+ }
pr_debug("sel_res_len %d, sel_res 0x%x\n",
nfca_poll->sel_res_len,
@@ -166,12 +195,21 @@ nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
static const __u8 *
nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
struct rf_tech_specific_params_nfcb_poll *nfcb_poll,
- const __u8 *data)
+ const __u8 *data, ssize_t data_len)
{
+ /* Check if we have enough data for sensb_res_len (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
+
nfcb_poll->sensb_res_len = min_t(__u8, *data++, NFC_SENSB_RES_MAXSIZE);
+ data_len--;
pr_debug("sensb_res_len %d\n", nfcb_poll->sensb_res_len);
+ /* Check if we have enough data for sensb_res */
+ if (data_len < nfcb_poll->sensb_res_len)
+ return ERR_PTR(-EINVAL);
+
memcpy(nfcb_poll->sensb_res, data, nfcb_poll->sensb_res_len);
data += nfcb_poll->sensb_res_len;
@@ -181,14 +219,29 @@ nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
static const __u8 *
nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
struct rf_tech_specific_params_nfcf_poll *nfcf_poll,
- const __u8 *data)
+ const __u8 *data, ssize_t data_len)
{
+ /* Check if we have enough data for bit_rate (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
+
nfcf_poll->bit_rate = *data++;
+ data_len--;
+
+ /* Check if we have enough data for sensf_res_len (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
+
nfcf_poll->sensf_res_len = min_t(__u8, *data++, NFC_SENSF_RES_MAXSIZE);
+ data_len--;
pr_debug("bit_rate %d, sensf_res_len %d\n",
nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
+ /* Check if we have enough data for sensf_res */
+ if (data_len < nfcf_poll->sensf_res_len)
+ return ERR_PTR(-EINVAL);
+
memcpy(nfcf_poll->sensf_res, data, nfcf_poll->sensf_res_len);
data += nfcf_poll->sensf_res_len;
@@ -198,22 +251,49 @@ nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
static const __u8 *
nci_extract_rf_params_nfcv_passive_poll(struct nci_dev *ndev,
struct rf_tech_specific_params_nfcv_poll *nfcv_poll,
- const __u8 *data)
+ const __u8 *data, ssize_t data_len)
{
+ /* Skip 1 byte (reserved) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
+
++data;
+ data_len--;
+
+ /* Check if we have enough data for dsfid (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
+
nfcv_poll->dsfid = *data++;
+ data_len--;
+
+ /* Check if we have enough data for uid (8 bytes) */
+ if (data_len < NFC_ISO15693_UID_MAXSIZE)
+ return ERR_PTR(-EINVAL);
+
memcpy(nfcv_poll->uid, data, NFC_ISO15693_UID_MAXSIZE);
data += NFC_ISO15693_UID_MAXSIZE;
+
return data;
}
static const __u8 *
nci_extract_rf_params_nfcf_passive_listen(struct nci_dev *ndev,
struct rf_tech_specific_params_nfcf_listen *nfcf_listen,
- const __u8 *data)
+ const __u8 *data, ssize_t data_len)
{
+ /* Check if we have enough data for local_nfcid2_len (1 byte) */
+ if (data_len < 1)
+ return ERR_PTR(-EINVAL);
+
nfcf_listen->local_nfcid2_len = min_t(__u8, *data++,
NFC_NFCID2_MAXSIZE);
+ data_len--;
+
+ /* Check if we have enough data for local_nfcid2 */
+ if (data_len < nfcf_listen->local_nfcid2_len)
+ return ERR_PTR(-EINVAL);
+
memcpy(nfcf_listen->local_nfcid2, data, nfcf_listen->local_nfcid2_len);
data += nfcf_listen->local_nfcid2_len;
@@ -364,7 +444,7 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
const __u8 *data;
bool add_target = true;
- if (skb->len < sizeof(struct nci_rf_discover_ntf))
+ if (skb->len < offsetofend(struct nci_rf_discover_ntf, rf_tech_specific_params_len))
return -EINVAL;
data = skb->data;
@@ -380,26 +460,42 @@ static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
pr_debug("rf_tech_specific_params_len %d\n",
ntf.rf_tech_specific_params_len);
+ if (skb->len < (data - skb->data) +
+ ntf.rf_tech_specific_params_len + sizeof(ntf.ntf_type))
+ return -EINVAL;
+
if (ntf.rf_tech_specific_params_len > 0) {
switch (ntf.rf_tech_and_mode) {
case NCI_NFC_A_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfca_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfca_poll), data);
+ &(ntf.rf_tech_specific_params.nfca_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
break;
case NCI_NFC_B_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfcb_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfcb_poll), data);
+ &(ntf.rf_tech_specific_params.nfcb_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
break;
case NCI_NFC_F_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfcf_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfcf_poll), data);
+ &(ntf.rf_tech_specific_params.nfcf_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
break;
case NCI_NFC_V_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfcv_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfcv_poll), data);
+ &(ntf.rf_tech_specific_params.nfcv_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
break;
default:
@@ -596,7 +692,7 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
const __u8 *data;
int err = NCI_STATUS_OK;
- if (skb->len < sizeof(struct nci_rf_intf_activated_ntf))
+ if (skb->len < offsetofend(struct nci_rf_intf_activated_ntf, rf_tech_specific_params_len))
return -EINVAL;
data = skb->data;
@@ -628,26 +724,41 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
if (ntf.rf_interface == NCI_RF_INTERFACE_NFCEE_DIRECT)
goto listen;
+ if (skb->len < (data - skb->data) + ntf.rf_tech_specific_params_len)
+ return -EINVAL;
+
if (ntf.rf_tech_specific_params_len > 0) {
switch (ntf.activation_rf_tech_and_mode) {
case NCI_NFC_A_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfca_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfca_poll), data);
+ &(ntf.rf_tech_specific_params.nfca_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return -EINVAL;
break;
case NCI_NFC_B_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfcb_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfcb_poll), data);
+ &(ntf.rf_tech_specific_params.nfcb_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return -EINVAL;
break;
case NCI_NFC_F_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfcf_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfcf_poll), data);
+ &(ntf.rf_tech_specific_params.nfcf_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return -EINVAL;
break;
case NCI_NFC_V_PASSIVE_POLL_MODE:
data = nci_extract_rf_params_nfcv_passive_poll(ndev,
- &(ntf.rf_tech_specific_params.nfcv_poll), data);
+ &(ntf.rf_tech_specific_params.nfcv_poll), data,
+ ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return -EINVAL;
break;
case NCI_NFC_A_PASSIVE_LISTEN_MODE:
@@ -657,7 +768,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
case NCI_NFC_F_PASSIVE_LISTEN_MODE:
data = nci_extract_rf_params_nfcf_passive_listen(ndev,
&(ntf.rf_tech_specific_params.nfcf_listen),
- data);
+ data, ntf.rf_tech_specific_params_len);
+ if (IS_ERR(data))
+ return -EINVAL;
break;
default:
@@ -668,6 +781,13 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
}
}
+ if (skb->len < (data - skb->data) +
+ sizeof(ntf.data_exch_rf_tech_and_mode) +
+ sizeof(ntf.data_exch_tx_bit_rate) +
+ sizeof(ntf.data_exch_rx_bit_rate) +
+ sizeof(ntf.activation_params_len))
+ return -EINVAL;
+
ntf.data_exch_rf_tech_and_mode = *data++;
ntf.data_exch_tx_bit_rate = *data++;
ntf.data_exch_rx_bit_rate = *data++;
@@ -679,6 +799,9 @@ static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
pr_debug("data_exch_rx_bit_rate 0x%x\n", ntf.data_exch_rx_bit_rate);
pr_debug("activation_params_len %d\n", ntf.activation_params_len);
+ if (skb->len < (data - skb->data) + ntf.activation_params_len)
+ return -EINVAL;
+
if (ntf.activation_params_len > 0) {
switch (ntf.rf_interface) {
case NCI_RF_INTERFACE_ISO_DEP:
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 835/844] ring-buffer: Fix possible dereference of uninitialized pointer
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (833 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 834/844] net: nfc: nci: Fix parameter validation for packet data Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 836/844] tracing: ring-buffer: Fix to check event length before using Sasha Levin
` (17 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Daniil Dulov, kernel test robot, Dan Carpenter,
Masami Hiramatsu (Google), Steven Rostedt (Google), Sasha Levin
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit f1547779402c4cd67755c33616b7203baa88420b ]
There is a pointer head_page in rb_meta_validate_events() which is not
initialized at the beginning of a function. This pointer can be dereferenced
if there is a failure during reader page validation. In this case the control
is passed to "invalid" label where the pointer is dereferenced in a loop.
To fix the issue initialize orig_head and head_page before calling
rb_validate_buffer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Cc: stable@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Link: https://patch.msgid.link/20260213100130.2013839-1-d.dulov@aladdin.ru
Closes: https://lore.kernel.org/r/202406130130.JtTGRf7W-lkp@intel.com/
Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 630221b00838e..ad08430347b06 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1918,6 +1918,8 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
if (!meta || !meta->head_buffer)
return;
+ orig_head = head_page = cpu_buffer->head_page;
+
/* Do the reader page first */
ret = rb_validate_buffer(cpu_buffer->reader_page->page, cpu_buffer->cpu);
if (ret < 0) {
@@ -1928,7 +1930,6 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
entry_bytes += local_read(&cpu_buffer->reader_page->page->commit);
local_set(&cpu_buffer->reader_page->entries, ret);
- orig_head = head_page = cpu_buffer->head_page;
ts = head_page->page->time_stamp;
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 836/844] tracing: ring-buffer: Fix to check event length before using
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (834 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 835/844] ring-buffer: Fix possible dereference of uninitialized pointer Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 837/844] fgraph: Do not call handlers direct when not using ftrace_ops Sasha Levin
` (16 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Masami Hiramatsu (Google), Mathieu Desnoyers,
Steven Rostedt (Google), Sasha Levin
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
[ Upstream commit 912b0ee248c529a4f45d1e7f568dc1adddbf2a4a ]
Check the event length before adding it for accessing next index in
rb_read_data_buffer(). Since this function is used for validating
possibly broken ring buffers, the length of the event could be broken.
In that case, the new event (e + len) can point a wrong address.
To avoid invalid memory access at boot, check whether the length of
each event is in the possible range before using it.
Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events")
Link: https://patch.msgid.link/177123421541.142205.9414352170164678966.stgit@devnote2
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index ad08430347b06..2f44063c666f2 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1848,6 +1848,7 @@ static int rb_read_data_buffer(struct buffer_data_page *dpage, int tail, int cpu
struct ring_buffer_event *event;
u64 ts, delta;
int events = 0;
+ int len;
int e;
*delta_ptr = 0;
@@ -1855,9 +1856,12 @@ static int rb_read_data_buffer(struct buffer_data_page *dpage, int tail, int cpu
ts = dpage->time_stamp;
- for (e = 0; e < tail; e += rb_event_length(event)) {
+ for (e = 0; e < tail; e += len) {
event = (struct ring_buffer_event *)(dpage->data + e);
+ len = rb_event_length(event);
+ if (len <= 0 || len > tail - e)
+ return -1;
switch (event->type_len) {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 837/844] fgraph: Do not call handlers direct when not using ftrace_ops
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (835 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 836/844] tracing: ring-buffer: Fix to check event length before using Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 838/844] tracing: Fix checking of freed trace_event_file for hist files Sasha Levin
` (15 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers, Mark Rutland,
Sasha Levin
From: Steven Rostedt <rostedt@goodmis.org>
[ Upstream commit f4ff9f646a4d373f9e895c2f0073305da288bc0a ]
The function graph tracer was modified to us the ftrace_ops of the
function tracer. This simplified the code as well as allowed more features
of the function graph tracer.
Not all architectures were converted over as it required the
implementation of HAVE_DYNAMIC_FTRACE_WITH_ARGS to implement. For those
architectures, it still did it the old way where the function graph tracer
handle was called by the function tracer trampoline. The handler then had
to check the hash to see if the registered handlers wanted to be called by
that function or not.
In order to speed up the function graph tracer that used ftrace_ops, if
only one callback was registered with function graph, it would call its
function directly via a static call.
Now, if the architecture does not support the use of using ftrace_ops and
still has the ftrace function trampoline calling the function graph
handler, then by doing a direct call it removes the check against the
handler's hash (list of functions it wants callbacks to), and it may call
that handler for functions that the handler did not request calls for.
On 32bit x86, which does not support the ftrace_ops use with function
graph tracer, it shows the issue:
~# trace-cmd start -p function -l schedule
~# trace-cmd show
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
2) * 11898.94 us | schedule();
3) # 1783.041 us | schedule();
1) | schedule() {
------------------------------------------
1) bash-8369 => kworker-7669
------------------------------------------
1) | schedule() {
------------------------------------------
1) kworker-7669 => bash-8369
------------------------------------------
1) + 97.004 us | }
1) | schedule() {
[..]
Now by starting the function tracer is another instance:
~# trace-cmd start -B foo -p function
This causes the function graph tracer to trace all functions (because the
function trace calls the function graph tracer for each on, and the
function graph trace is doing a direct call):
~# trace-cmd show
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
1) 1.669 us | } /* preempt_count_sub */
1) + 10.443 us | } /* _raw_spin_unlock_irqrestore */
1) | tick_program_event() {
1) | clockevents_program_event() {
1) 1.044 us | ktime_get();
1) 6.481 us | lapic_next_event();
1) + 10.114 us | }
1) + 11.790 us | }
1) ! 181.223 us | } /* hrtimer_interrupt */
1) ! 184.624 us | } /* __sysvec_apic_timer_interrupt */
1) | irq_exit_rcu() {
1) 0.678 us | preempt_count_sub();
When it should still only be tracing the schedule() function.
To fix this, add a macro FGRAPH_NO_DIRECT to be set to 0 when the
architecture does not support function graph use of ftrace_ops, and set to
1 otherwise. Then use this macro to know to allow function graph tracer to
call the handlers directly or not.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Link: https://patch.msgid.link/20260218104244.5f14dade@gandalf.local.home
Fixes: cc60ee813b503 ("function_graph: Use static_call and branch to optimize entry function")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ftrace.h | 13 ++++++++++---
kernel/trace/fgraph.c | 12 +++++++++++-
2 files changed, 21 insertions(+), 4 deletions(-)
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index fa74ae5cc9dae..d029afcd22a5d 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -1064,10 +1064,17 @@ static inline bool is_ftrace_trampoline(unsigned long addr)
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
#ifndef ftrace_graph_func
-#define ftrace_graph_func ftrace_stub
-#define FTRACE_OPS_GRAPH_STUB FTRACE_OPS_FL_STUB
+# define ftrace_graph_func ftrace_stub
+# define FTRACE_OPS_GRAPH_STUB FTRACE_OPS_FL_STUB
+/*
+ * The function graph is called every time the function tracer is called.
+ * It must always test the ops hash and cannot just directly call
+ * the handler.
+ */
+# define FGRAPH_NO_DIRECT 1
#else
-#define FTRACE_OPS_GRAPH_STUB 0
+# define FTRACE_OPS_GRAPH_STUB 0
+# define FGRAPH_NO_DIRECT 0
#endif
#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c
index 4df766c690f92..40d373d65f9b9 100644
--- a/kernel/trace/fgraph.c
+++ b/kernel/trace/fgraph.c
@@ -539,7 +539,11 @@ static struct fgraph_ops fgraph_stub = {
static struct fgraph_ops *fgraph_direct_gops = &fgraph_stub;
DEFINE_STATIC_CALL(fgraph_func, ftrace_graph_entry_stub);
DEFINE_STATIC_CALL(fgraph_retfunc, ftrace_graph_ret_stub);
+#if FGRAPH_NO_DIRECT
+static DEFINE_STATIC_KEY_FALSE(fgraph_do_direct);
+#else
static DEFINE_STATIC_KEY_TRUE(fgraph_do_direct);
+#endif
/**
* ftrace_graph_stop - set to permanently disable function graph tracing
@@ -843,7 +847,7 @@ __ftrace_return_to_handler(struct ftrace_regs *fregs, unsigned long frame_pointe
bitmap = get_bitmap_bits(current, offset);
#ifdef CONFIG_HAVE_STATIC_CALL
- if (static_branch_likely(&fgraph_do_direct)) {
+ if (!FGRAPH_NO_DIRECT && static_branch_likely(&fgraph_do_direct)) {
if (test_bit(fgraph_direct_gops->idx, &bitmap))
static_call(fgraph_retfunc)(&trace, fgraph_direct_gops, fregs);
} else
@@ -1285,6 +1289,9 @@ static void ftrace_graph_enable_direct(bool enable_branch, struct fgraph_ops *go
trace_func_graph_ret_t retfunc = NULL;
int i;
+ if (FGRAPH_NO_DIRECT)
+ return;
+
if (gops) {
func = gops->entryfunc;
retfunc = gops->retfunc;
@@ -1308,6 +1315,9 @@ static void ftrace_graph_enable_direct(bool enable_branch, struct fgraph_ops *go
static void ftrace_graph_disable_direct(bool disable_branch)
{
+ if (FGRAPH_NO_DIRECT)
+ return;
+
if (disable_branch)
static_branch_disable(&fgraph_do_direct);
static_call_update(fgraph_func, ftrace_graph_entry_stub);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 838/844] tracing: Fix checking of freed trace_event_file for hist files
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (836 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 837/844] fgraph: Do not call handlers direct when not using ftrace_ops Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 839/844] tracing: Wake up poll waiters for hist files when removing an event Sasha Levin
` (14 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Petr Pavlu, Mathieu Desnoyers, Tom Zanussi,
Masami Hiramatsu (Google), Steven Rostedt (Google), Sasha Levin
From: Petr Pavlu <petr.pavlu@suse.com>
[ Upstream commit f0a0da1f907e8488826d91c465f7967a56a95aca ]
The event_hist_open() and event_hist_poll() functions currently retrieve
a trace_event_file pointer from a file struct by invoking
event_file_data(), which simply returns file->f_inode->i_private. The
functions then check if the pointer is NULL to determine whether the event
is still valid. This approach is flawed because i_private is assigned when
an eventfs inode is allocated and remains set throughout its lifetime.
Instead, the code should call event_file_file(), which checks for
EVENT_FILE_FL_FREED. Using the incorrect access function may result in the
code potentially opening a hist file for an event that is being removed or
becoming stuck while polling on this file.
Correct the access method to event_file_file() in both functions.
Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Link: https://patch.msgid.link/20260219162737.314231-2-petr.pavlu@suse.com
Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_events_hist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 7e50df8b800b1..864aa33712ce4 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai
guard(mutex)(&event_mutex);
- event_file = event_file_data(file);
+ event_file = event_file_file(file);
if (!event_file)
return EPOLLERR;
@@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct file *file)
guard(mutex)(&event_mutex);
- event_file = event_file_data(file);
+ event_file = event_file_file(file);
if (!event_file) {
ret = -ENODEV;
goto err;
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 839/844] tracing: Wake up poll waiters for hist files when removing an event
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (837 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 838/844] tracing: Fix checking of freed trace_event_file for hist files Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 840/844] rust: list: Add unsafe blocks for container_of and safety comments Sasha Levin
` (13 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Petr Pavlu, Mathieu Desnoyers, Tom Zanussi,
Masami Hiramatsu (Google), Steven Rostedt (Google), Sasha Levin
From: Petr Pavlu <petr.pavlu@suse.com>
[ Upstream commit 9678e53179aa7e907360f5b5b275769008a69b80 ]
The event_hist_poll() function attempts to verify whether an event file is
being removed, but this check may not occur or could be unnecessarily
delayed. This happens because hist_poll_wakeup() is currently invoked only
from event_hist_trigger() when a hist command is triggered. If the event
file is being removed, no associated hist command will be triggered and a
waiter will be woken up only after an unrelated hist command is triggered.
Fix the issue by adding a call to hist_poll_wakeup() in
remove_event_file_dir() after setting the EVENT_FILE_FL_FREED flag. This
ensures that a task polling on a hist file is woken up and receives
EPOLLERR.
Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Link: https://patch.msgid.link/20260219162737.314231-3-petr.pavlu@suse.com
Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/trace_events.h | 5 +++++
kernel/trace/trace_events.c | 3 +++
2 files changed, 8 insertions(+)
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 3690221ba3d80..f925034e402dc 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -683,6 +683,11 @@ static inline void hist_poll_wakeup(void)
#define hist_poll_wait(file, wait) \
poll_wait(file, &hist_poll_wq, wait)
+
+#else
+static inline void hist_poll_wakeup(void)
+{
+}
#endif
#define __TRACE_EVENT_FLAGS(name, value) \
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 2c6d3e33b9fb4..ec66170637102 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct trace_event_file *file)
free_event_filter(file->filter);
file->flags |= EVENT_FILE_FL_FREED;
event_file_put(file);
+
+ /* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */
+ hist_poll_wakeup();
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 840/844] rust: list: Add unsafe blocks for container_of and safety comments
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (838 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 839/844] tracing: Wake up poll waiters for hist files when removing an event Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 841/844] NTB: ntb_transport: Fix too small buffer for debugfs_name Sasha Levin
` (12 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Philipp Stanner, Alice Ryhl, Gary Guo, Miguel Ojeda, Sasha Levin
From: Philipp Stanner <phasta@kernel.org>
[ Upstream commit 97b281d7edb2ae662365be2809cd728470119720 ]
impl_list_item_mod.rs calls container_of! without unsafe blocks at a
couple of places. Since container_of! is unsafe, the blocks are strictly
necessary.
The problem was so far not visible because the "unsafe-op-in-unsafe-fn"
check is a lint rather than a hard compiler error, and Rust suppresses
lints triggered inside of a macro from another crate.
Thus, the error becomes only visible once someone from within the kernel
crate tries to use linked lists:
error[E0133]: call to unsafe function `core::ptr::mut_ptr::<impl *mut T>::byte_sub`
is unsafe and requires unsafe block
--> rust/kernel/lib.rs:252:29
|
252 | let container_ptr = field_ptr.byte_sub(offset).cast::<$Container>();
| ^^^^^^^^^^^^^^^^^^^^^^^^^^ call to unsafe function
|
::: rust/kernel/drm/jq.rs:98:1
|
98 | / impl_list_item! {
99 | | impl ListItem<0> for BasicItem { using ListLinks { self.links }; }
100 | | }
| |_- in this macro invocation
|
note: an unsafe function restricts its caller, but its body is safe by default
--> rust/kernel/list/impl_list_item_mod.rs:216:13
|
216 | unsafe fn view_value(me: *mut $crate::list::ListLinks<$num>) -> *const Self {
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
::: rust/kernel/drm/jq.rs:98:1
|
98 | / impl_list_item! {
99 | | impl ListItem<0> for BasicItem { using ListLinks { self.links }; }
100 | | }
| |_- in this macro invocation
= note: requested on the command line with `-D unsafe-op-in-unsafe-fn`
= note: this error originates in the macro `$crate::container_of` which comes
from the expansion of the macro `impl_list_item`
Therefore, add unsafe blocks to container_of! calls to fix the issue.
[ As discussed, let's fix the build for those that want to use the
macro within the `kernel` crate now and we can discuss the proper
safety comments afterwards. Thus I removed the ones from the patch.
However, we cannot just avoid the comments with `CLIPPY=1`, so I
provided placeholders for now, like we did in the past. They were
also needed for an `unsafe impl`.
While I am not happy about it, it isn't worse than the current
status (the comments were meant to be there), and at least this
shows what is missing -- our pre-existing "good first issue" [1]
may motivate new contributors to complete them properly.
Finally, I moved one of the existing safety comments one line down
so that Clippy could locate it.
Link: https://github.com/Rust-for-Linux/linux/issues/351 [1]
- Miguel ]
Cc: stable@vger.kernel.org
Fixes: c77f85b347dd ("rust: list: remove OFFSET constants")
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Philipp Stanner <phasta@kernel.org>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260216131613.45344-3-phasta@kernel.org
[ Fixed formatting. Reworded to fix the lint suppression
explanation. Indent build error. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
rust/kernel/list/impl_list_item_mod.rs | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/rust/kernel/list/impl_list_item_mod.rs b/rust/kernel/list/impl_list_item_mod.rs
index 202bc6f97c132..ee53d0387e63d 100644
--- a/rust/kernel/list/impl_list_item_mod.rs
+++ b/rust/kernel/list/impl_list_item_mod.rs
@@ -84,11 +84,12 @@ macro_rules! impl_has_list_links_self_ptr {
// right type.
unsafe impl$(<$($generics)*>)? $crate::list::HasSelfPtr<$item_type $(, $id)?> for $self {}
+ // SAFETY: TODO.
unsafe impl$(<$($generics)*>)? $crate::list::HasListLinks$(<$id>)? for $self {
#[inline]
unsafe fn raw_get_list_links(ptr: *mut Self) -> *mut $crate::list::ListLinks$(<$id>)? {
- // SAFETY: The caller promises that the pointer is not dangling.
let ptr: *mut $crate::list::ListLinksSelfPtr<$item_type $(, $id)?> =
+ // SAFETY: The caller promises that the pointer is not dangling.
unsafe { ::core::ptr::addr_of_mut!((*ptr)$(.$field)*) };
ptr.cast()
}
@@ -217,7 +218,7 @@ unsafe fn view_value(me: *mut $crate::list::ListLinks<$num>) -> *const Self {
// SAFETY: `me` originates from the most recent call to `prepare_to_insert`, so it
// points at the field `$field` in a value of type `Self`. Thus, reversing that
// operation is still in-bounds of the allocation.
- $crate::container_of!(me, Self, $($field).*)
+ unsafe { $crate::container_of!(me, Self, $($field).*) }
}
// GUARANTEES:
@@ -242,7 +243,7 @@ unsafe fn post_remove(me: *mut $crate::list::ListLinks<$num>) -> *const Self {
// SAFETY: `me` originates from the most recent call to `prepare_to_insert`, so it
// points at the field `$field` in a value of type `Self`. Thus, reversing that
// operation is still in-bounds of the allocation.
- $crate::container_of!(me, Self, $($field).*)
+ unsafe { $crate::container_of!(me, Self, $($field).*) }
}
}
)*};
@@ -270,9 +271,12 @@ unsafe fn prepare_to_insert(me: *const Self) -> *mut $crate::list::ListLinks<$nu
// SAFETY: The caller promises that `me` points at a valid value of type `Self`.
let links_field = unsafe { <Self as $crate::list::ListItem<$num>>::view_links(me) };
- let container = $crate::container_of!(
- links_field, $crate::list::ListLinksSelfPtr<Self, $num>, inner
- );
+ // SAFETY: TODO.
+ let container = unsafe {
+ $crate::container_of!(
+ links_field, $crate::list::ListLinksSelfPtr<Self, $num>, inner
+ )
+ };
// SAFETY: By the same reasoning above, `links_field` is a valid pointer.
let self_ptr = unsafe {
@@ -319,9 +323,12 @@ unsafe fn view_links(me: *const Self) -> *mut $crate::list::ListLinks<$num> {
// `ListArc` containing `Self` until the next call to `post_remove`. The value cannot
// be destroyed while a `ListArc` reference exists.
unsafe fn view_value(links_field: *mut $crate::list::ListLinks<$num>) -> *const Self {
- let container = $crate::container_of!(
- links_field, $crate::list::ListLinksSelfPtr<Self, $num>, inner
- );
+ // SAFETY: TODO.
+ let container = unsafe {
+ $crate::container_of!(
+ links_field, $crate::list::ListLinksSelfPtr<Self, $num>, inner
+ )
+ };
// SAFETY: By the same reasoning above, `links_field` is a valid pointer.
let self_ptr = unsafe {
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 841/844] NTB: ntb_transport: Fix too small buffer for debugfs_name
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (839 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 840/844] rust: list: Add unsafe blocks for container_of and safety comments Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 842/844] ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() Sasha Levin
` (11 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Koichiro Den, Frank Li, Dave Jiang, Jon Mason, Sasha Levin
From: Koichiro Den <den@valinux.co.jp>
[ Upstream commit 6a4b50585d74fe45d3ade1e3e86ba8aae79761a5 ]
The buffer used for "qp%d" was only 4 bytes, which truncates names like
"qp10" to "qp1" and causes multiple queues to share the same directory.
Enlarge the buffer and use sizeof() to avoid truncation.
Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
Cc: <stable@vger.kernel.org> # v3.9+
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ntb/ntb_transport.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 71d4bb25f7fdd..4d00263ebc934 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1236,9 +1236,9 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
qp->tx_max_entry = tx_size / qp->tx_max_frame;
if (nt->debugfs_node_dir) {
- char debugfs_name[4];
+ char debugfs_name[8];
- snprintf(debugfs_name, 4, "qp%d", qp_num);
+ snprintf(debugfs_name, sizeof(debugfs_name), "qp%d", qp_num);
qp->debugfs_dir = debugfs_create_dir(debugfs_name,
nt->debugfs_node_dir);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 842/844] ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (840 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 841/844] NTB: ntb_transport: Fix too small buffer for debugfs_name Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 843/844] Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" Sasha Levin
` (10 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nathan Chancellor, kernel test robot, Takashi Iwai, Sasha Levin
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit 0585c53b21541cd6b17ad5ab41b371a0d52e358c ]
When building with clang older than 17 targeting architectures that use
asm goto for their get_user() and put_user(), such as arm64, after
commit f3d233daf011 ("ALSA: pcm: Relax __free() variable declarations"),
there are bogus errors around skipping over a variable declared with the
cleanup attribute:
sound/core/pcm_native.c:3308:6: error: cannot jump from this asm goto statement to one of its possible targets
if (put_user(result, &_xfern->result))
^
...
arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm'
asm goto(
^
sound/core/pcm_native.c:3295:6: note: possible target of asm goto statement
if (put_user(0, &_xfern->result))
^
...
sound/core/pcm_native.c:3300:8: note: jump exits scope of variable with __attribute__((cleanup))
void *bufs __free(kfree) =
^
clang-17 fixed a bug in clang's jump scope checker [1] where all labels
in a function were checked as valid targets for all asm goto instances
in a function, regardless of whether they were actual targets in a
paricular asm goto's provided list of labels.
To workaround this, revert the change done to
snd_pcm_xfern_frames_ioctl() by commit f3d233daf011 ("ALSA: pcm: Relax
__free() variable declarations") to avoid a variable declared with
cleanup from existing between multiple uses of asm goto. There are no
other uses of cleanup in this function so there should be low risk from
moving this variable back to the top of the function.
Link: https://github.com/ClangBuiltLinux/linux/issues/1886 [1]
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202512190802.i4Jzbcsl-lkp@intel.com/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260106-pcm_native-revert-var-move-free-for-old-clang-v1-1-06a03693423d@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/pcm_native.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 844ee1b4d286f..0a358d94b17c6 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3291,6 +3291,7 @@ static int snd_pcm_xfern_frames_ioctl(struct snd_pcm_substream *substream,
{
struct snd_xfern xfern;
struct snd_pcm_runtime *runtime = substream->runtime;
+ void *bufs __free(kfree) = NULL;
snd_pcm_sframes_t result;
if (runtime->state == SNDRV_PCM_STATE_OPEN)
@@ -3302,8 +3303,7 @@ static int snd_pcm_xfern_frames_ioctl(struct snd_pcm_substream *substream,
if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
return -EFAULT;
- void *bufs __free(kfree) =
- memdup_array_user(xfern.bufs, runtime->channels, sizeof(void *));
+ bufs = memdup_array_user(xfern.bufs, runtime->channels, sizeof(void *));
if (IS_ERR(bufs))
return PTR_ERR(bufs);
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 843/844] Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()"
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (841 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 842/844] ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 17:32 ` [PATCH 6.19 844/844] Linux 6.19.6-rc1 Sasha Levin
` (9 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sasha Levin, Athul Krishna
This reverts commit 0089ce1c056aee547115bdc25c223f8f88c08498 which is
upstream commit 6cfed39c2ce64ac024bbde458a9727105e0b8c66.
This commit is causing a suspend regression on systems such as the Asus
Zephyrus G14 (GA402RJ) with Ryzen 7 6700H: when suspending, the display
turns off but the device fails to fully power down. This is not seen
with v7.0-rc1 which indicates that there are changes missing. Therefore,
revert this change.
Link: https://lore.kernel.org/all/lA7Dz_m7_nCF8KkRyEOcSCLg799Mm9_DN2r9hx7ISjw32OoKiB1r_YjGHIFX8vgqxpOkVJ8d_yHb-VsGAvIWC942D4-zdWxAIP4_k6ZIQi8=@protonmail.com/
Fixes: 0089ce1c056a ("ACPI: processor: Update cpuidle driver check in __acpi_processor_start()")
Reported-by: Athul Krishna <athul.krishna.kr@protonmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 7644de24d2faa..65e779be64ffc 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -166,7 +166,7 @@ static int __acpi_processor_start(struct acpi_device *device)
if (result && !IS_ENABLED(CONFIG_ACPI_CPU_FREQ_PSS))
dev_dbg(&device->dev, "CPPC data invalid or not present\n");
- if (cpuidle_get_driver() == &acpi_idle_driver)
+ if (!cpuidle_get_driver() || cpuidle_get_driver() == &acpi_idle_driver)
acpi_processor_power_init(pr);
acpi_pss_perf_init(pr);
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* [PATCH 6.19 844/844] Linux 6.19.6-rc1
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (842 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 843/844] Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" Sasha Levin
@ 2026-02-28 17:32 ` Sasha Levin
2026-02-28 18:12 ` [PATCH 6.19 000/844] 6.19.6-rc1 review Ronald Warsow
` (8 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-02-28 17:32 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Sasha Levin
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Makefile b/Makefile
index f486050e0bee4..4a101ca9a0456 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 6
PATCHLEVEL = 19
-SUBLEVEL = 5
-EXTRAVERSION =
+SUBLEVEL = 6
+EXTRAVERSION = -rc1
NAME = Baby Opossum Posse
# *DOCUMENTATION*
--
2.51.0
^ permalink raw reply related [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (843 preceding siblings ...)
2026-02-28 17:32 ` [PATCH 6.19 844/844] Linux 6.19.6-rc1 Sasha Levin
@ 2026-02-28 18:12 ` Ronald Warsow
2026-02-28 22:13 ` Woody Suwalski
2026-03-01 2:46 ` Peter Schneider
` (7 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Ronald Warsow @ 2026-02-28 18:12 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
On 28.02.26 18:18, Sasha Levin wrote:
>
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
It would be nice to have a download link to an patch-*.gz what Greg
usually provides.
ron
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 18:12 ` [PATCH 6.19 000/844] 6.19.6-rc1 review Ronald Warsow
@ 2026-02-28 22:13 ` Woody Suwalski
2026-02-28 23:41 ` Barry K. Nathan
` (2 more replies)
0 siblings, 3 replies; 879+ messages in thread
From: Woody Suwalski @ 2026-02-28 22:13 UTC (permalink / raw)
To: Ronald Warsow, Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
Ronald Warsow wrote:
> On 28.02.26 18:18, Sasha Levin wrote:
>>
>> This is the start of the stable review cycle for the 6.19.6 release.
>> There are 844 patches in this series, all will be posted as a response
>> to this one. If anyone has any issues with these being applied, please
>> let me know.
>>
>> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
>> Anything received after that time might be too late.
>>
>> The whole patch series can be found in one patch at:
>> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
>> or in the git tree and branch at:
>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
>> linux-6.19.y
>> and the diffstat can be found below.
>>
>
> It would be nice to have a download link to an patch-*.gz what Greg
> usually provides.
>
> ron
>
I second this request. Trying to setup a build for 5.10.252-rc1 was
tricky...
We need something similar to
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.251-rc1.gz
Thanks, Woody
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 22:13 ` Woody Suwalski
@ 2026-02-28 23:41 ` Barry K. Nathan
2026-03-01 0:33 ` Peter Schneider
2026-03-01 1:17 ` Sasha Levin
2 siblings, 0 replies; 879+ messages in thread
From: Barry K. Nathan @ 2026-02-28 23:41 UTC (permalink / raw)
To: Woody Suwalski, Ronald Warsow, Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
On 2/28/26 14:13, Woody Suwalski wrote:
> Ronald Warsow wrote:
>> On 28.02.26 18:18, Sasha Levin wrote:
>>>
>>> This is the start of the stable review cycle for the 6.19.6 release.
>>> There are 844 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-
>>> rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
>>> or in the git tree and branch at:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-
>>> rc.git linux-6.19.y
>>> and the diffstat can be found below.
>>>
>>
>> It would be nice to have a download link to an patch-*.gz what Greg
>> usually provides.
>>
>> ron
>>
> I second this request. Trying to setup a build for 5.10.252-rc1 was
> tricky...
> We need something similar to
>
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/
> patch-5.10.251-rc1.gz
>
> Thanks, Woody
I didn't find things particularly difficult for 5.10.252-rc1 through
6.12.75-rc1 (the "hardest" part was renaming the file after each
download), but I get this while trying to apply the patches for
6.18.16-rc1/6.19.6-rc1:
patching file arch/powerpc/platforms/pseries/msi.c
patching file arch/x86/kvm/x86.c
(Patch is indented 2 spaces.)
can't find file to patch at input line 41896
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|--
|cgit 1.2.3-korg
|
|
|From 1d0d76474aeadb174d9fbd27b9f2e9b5cfc124c6 Mon Sep 17 00:00:00 2001
|From: Sean Christopherson <seanjc@google.com>
|Date: Tue, 16 Dec 2025 08:17:54 -0800
|Subject: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
| succeeding
|
|[ Upstream commit fc3ba56385d03501eb582e4b86691ba378e556f9 ]
|
|Drop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing
|as it is trivially easy to trigger from userspace by modifying CPUID after
|loading CR3. E.g. modifying the state restoration selftest like so:
|
| --- tools/testing/selftests/kvm/x86/state_test.c
| +++ tools/testing/selftests/kvm/x86/state_test.c
--------------------------
File to patch:
As it turns out, GNU patch (v2.7.6 on Debian 12 bookworm, or v2.8 on
Debian 13 trixie, I tested both) is misinterpreting part of the commit
comment for vm-nsvm-remove-a-user-triggerable-warn-on-nested_sv.patch
and trying to apply that part of the commit description as a patch.
Pressing Enter twice at this prompt causes patch to skip this
incorrectly detected hunk, and all of the actual patches end up being
applied correctly, but it's still an unexpected surprise and I had to
stop and figure out what was going on.
With the way the stable rc patches are usually posted on kernel.org,
the patch file would've omitted the commit comments, thus avoiding
this problem.
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 22:13 ` Woody Suwalski
2026-02-28 23:41 ` Barry K. Nathan
@ 2026-03-01 0:33 ` Peter Schneider
2026-03-01 1:17 ` Sasha Levin
2 siblings, 0 replies; 879+ messages in thread
From: Peter Schneider @ 2026-03-01 0:33 UTC (permalink / raw)
To: Woody Suwalski, Ronald Warsow, Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
Am 28.02.2026 um 23:13 schrieb Woody Suwalski:
> Ronald Warsow wrote:
>> On 28.02.26 18:18, Sasha Levin wrote:
>>>
>>> This is the start of the stable review cycle for the 6.19.6 release.
>>> There are 844 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
>>> Anything received after that time might be too late.
>>>
>>> The whole patch series can be found in one patch at:
>>> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
>>> or in the git tree and branch at:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
>>> and the diffstat can be found below.
>>>
>>
>> It would be nice to have a download link to an patch-*.gz what Greg usually provides.
>>
>> ron
>>
> I second this request. Trying to setup a build for 5.10.252-rc1 was tricky...
> We need something similar to
>
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.251-rc1.gz
>
> Thanks, Woody
>
Do you guys really still use tarballs and patches instead of just git pulling stable RCs for testing? I'm in shock...
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 22:13 ` Woody Suwalski
2026-02-28 23:41 ` Barry K. Nathan
2026-03-01 0:33 ` Peter Schneider
@ 2026-03-01 1:17 ` Sasha Levin
2 siblings, 0 replies; 879+ messages in thread
From: Sasha Levin @ 2026-03-01 1:17 UTC (permalink / raw)
To: Woody Suwalski
Cc: Ronald Warsow, linux-kernel, stable, gregkh, patches, torvalds,
akpm, linux, shuah, patches, lkft-triage, pavel, jonathanh,
f.fainelli, sudipm.mukherjee, conor, hargar, broonie, achill, sr
On Sat, Feb 28, 2026 at 05:13:59PM -0500, Woody Suwalski wrote:
>Ronald Warsow wrote:
>>On 28.02.26 18:18, Sasha Levin wrote:
>>>
>>>This is the start of the stable review cycle for the 6.19.6 release.
>>>There are 844 patches in this series, all will be posted as a response
>>>to this one. If anyone has any issues with these being applied, please
>>>let me know.
>>>
>>>Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
>>>Anything received after that time might be too late.
>>>
>>>The whole patch series can be found in one patch at:
>>>https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
>>>or in the git tree and branch at:
>>>git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
>>>linux-6.19.y
>>>and the diffstat can be found below.
>>>
>>
>>It would be nice to have a download link to an patch-*.gz what Greg
>>usually provides.
>>
>>ron
>>
>I second this request. Trying to setup a build for 5.10.252-rc1 was
>tricky...
>We need something similar to
>
>https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.251-rc1.gz
I've provided a link to the patchfile in the mail:
>>>The whole patch series can be found in one patch at:
>>>https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (844 preceding siblings ...)
2026-02-28 18:12 ` [PATCH 6.19 000/844] 6.19.6-rc1 review Ronald Warsow
@ 2026-03-01 2:46 ` Peter Schneider
2026-03-01 8:36 ` Takeshi Ogasawara
` (6 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Peter Schneider @ 2026-03-01 2:46 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 28.02.2026 um 18:18 schrieb Sasha Levin:
>
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (845 preceding siblings ...)
2026-03-01 2:46 ` Peter Schneider
@ 2026-03-01 8:36 ` Takeshi Ogasawara
2026-03-01 8:49 ` Barry K. Nathan
` (5 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Takeshi Ogasawara @ 2026-03-01 8:36 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, gregkh, patches, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Hi Sasha
On Sun, Mar 1, 2026 at 2:32 AM Sasha Levin <sashal@kernel.org> wrote:
>
>
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> Thanks,
> Sasha
>
6.19.6-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.19.6-rc1rv-gbf28ec292fb6
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20260209, GNU ld (GNU
Binutils) 2.46) #1 SMP PREEMPT_DYNAMIC Sun Mar 1 17:00:33 JST 2026
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (846 preceding siblings ...)
2026-03-01 8:36 ` Takeshi Ogasawara
@ 2026-03-01 8:49 ` Barry K. Nathan
2026-03-01 16:43 ` Barry K. Nathan
2026-03-01 8:54 ` Brett A C Sheffield
` (4 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Barry K. Nathan @ 2026-03-01 8:49 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 2/28/26 09:18, Sasha Levin wrote:
>
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> Thanks,
> Sasha
Unfortunately, 6.19.6-rc1 won't even build for me:
Warning: drivers/gpu/drm/i915/intel_wakeref.h:156 expecting prototype for __intel_wakeref_put(). Prototype was for INTEL_WAKEREF_PUT_ASYNC() instead
1 warnings as errors
make[9]: *** [drivers/gpu/drm/i915/Makefile:449: drivers/gpu/drm/i915/intel_wakeref.hdrtest] Error 3
make[8]: *** [scripts/Makefile.build:546: drivers/gpu/drm/i915] Error 2
make[8]: *** Waiting for unfinished jobs....
This only happens with 6.19.6-rc1, not any of this weekend's other
stable rc's. (I'm still testing 6.12.75-rc1 and 6.18.16-rc1, but
they're doing well so far. I have successfully built 5.15.202-rc1
and 6.1.165-rc1 but I won't have a chance to do any further testing
of them before they're released.)
As soon as I can (in the next hour or two) I'll minimize my config
a little to shorten the compile time, then I'll start bisecting.
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-03-01 8:49 ` Barry K. Nathan
@ 2026-03-01 16:43 ` Barry K. Nathan
2026-03-02 0:49 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Barry K. Nathan @ 2026-03-01 16:43 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 3/1/26 00:49, Barry K. Nathan wrote:
> Unfortunately, 6.19.6-rc1 won't even build for me:
>
> Warning: drivers/gpu/drm/i915/intel_wakeref.h:156 expecting prototype for __intel_wakeref_put(). Prototype was for INTEL_WAKEREF_PUT_ASYNC() instead
> 1 warnings as errors
> make[9]: *** [drivers/gpu/drm/i915/Makefile:449: drivers/gpu/drm/i915/intel_wakeref.hdrtest] Error 3
> make[8]: *** [scripts/Makefile.build:546: drivers/gpu/drm/i915] Error 2
> make[8]: *** Waiting for unfinished jobs....
>
> This only happens with 6.19.6-rc1, not any of this weekend's other
> stable rc's. (I'm still testing 6.12.75-rc1 and 6.18.16-rc1, but
> they're doing well so far. I have successfully built 5.15.202-rc1
> and 6.1.165-rc1 but I won't have a chance to do any further testing
> of them before they're released.)
>
> As soon as I can (in the next hour or two) I'll minimize my config
> a little to shorten the compile time, then I'll start bisecting.
Result of bisecting:
first bad commit: [0ef5d235ab57bc90831ddf38eb1742ff68f345e1]
docs: kdoc: fix logic to handle unissued warnings
This commit breaks the i915 DRM build if (and only if)
CONFIG_DRM_I915_WERROR=y, whether CONFIG_WERROR is enabled or
disabled. However, the "bad" commit is definitely fixing a real
bug, and this build failure doesn't happen on current mainline
as of this writing (commit eb71ab2bf722), so I don't think
dropping the patch is the correct way forward.
Rather, adding commit 524696a19e34598c9173fdd5b32fb7e5d16a91d3
drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
(it applies cleanly) fixes the warning, thereby fixing the build.
The resulting kernel works fine in my testing, too. I'm using
6.19.6-rc1 + 524696a19e34598c9173fdd5b32fb7e5d16a91d3 to write
and send this email from my ThinkPad T14 Gen 1, which uses the
i915 DRM driver for its Intel integrated graphics. (I also
tested it on my 2017 MacBook Air, which also uses i915 DRM for
its Intel integrated graphics.)
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-03-01 16:43 ` Barry K. Nathan
@ 2026-03-02 0:49 ` Sasha Levin
2026-03-02 6:34 ` Barry K. Nathan
0 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-03-02 0:49 UTC (permalink / raw)
To: Barry K. Nathan
Cc: linux-kernel, stable, gregkh, patches, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Sun, Mar 01, 2026 at 08:43:43AM -0800, Barry K. Nathan wrote:
>On 3/1/26 00:49, Barry K. Nathan wrote:
>>Unfortunately, 6.19.6-rc1 won't even build for me:
>>
>>Warning: drivers/gpu/drm/i915/intel_wakeref.h:156 expecting prototype for __intel_wakeref_put(). Prototype was for INTEL_WAKEREF_PUT_ASYNC() instead
>>1 warnings as errors
>>make[9]: *** [drivers/gpu/drm/i915/Makefile:449: drivers/gpu/drm/i915/intel_wakeref.hdrtest] Error 3
>>make[8]: *** [scripts/Makefile.build:546: drivers/gpu/drm/i915] Error 2
>>make[8]: *** Waiting for unfinished jobs....
>>
>>This only happens with 6.19.6-rc1, not any of this weekend's other
>>stable rc's. (I'm still testing 6.12.75-rc1 and 6.18.16-rc1, but
>>they're doing well so far. I have successfully built 5.15.202-rc1
>>and 6.1.165-rc1 but I won't have a chance to do any further testing
>>of them before they're released.)
>>
>>As soon as I can (in the next hour or two) I'll minimize my config
>>a little to shorten the compile time, then I'll start bisecting.
>
>Result of bisecting:
>first bad commit: [0ef5d235ab57bc90831ddf38eb1742ff68f345e1]
>docs: kdoc: fix logic to handle unissued warnings
>
>This commit breaks the i915 DRM build if (and only if)
>CONFIG_DRM_I915_WERROR=y, whether CONFIG_WERROR is enabled or
>disabled. However, the "bad" commit is definitely fixing a real
>bug, and this build failure doesn't happen on current mainline
>as of this writing (commit eb71ab2bf722), so I don't think
>dropping the patch is the correct way forward.
>
>Rather, adding commit 524696a19e34598c9173fdd5b32fb7e5d16a91d3
> drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
>(it applies cleanly) fixes the warning, thereby fixing the build.
>
>The resulting kernel works fine in my testing, too. I'm using
>6.19.6-rc1 + 524696a19e34598c9173fdd5b32fb7e5d16a91d3 to write
>and send this email from my ThinkPad T14 Gen 1, which uses the
>i915 DRM driver for its Intel integrated graphics. (I also
>tested it on my 2017 MacBook Air, which also uses i915 DRM for
>its Intel integrated graphics.)
I'll queue 524696a19e345 up, thanks for the report!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-03-02 0:49 ` Sasha Levin
@ 2026-03-02 6:34 ` Barry K. Nathan
0 siblings, 0 replies; 879+ messages in thread
From: Barry K. Nathan @ 2026-03-02 6:34 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, gregkh, patches, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On 3/1/26 16:49, Sasha Levin wrote:
> On Sun, Mar 01, 2026 at 08:43:43AM -0800, Barry K. Nathan wrote:
>> On 3/1/26 00:49, Barry K. Nathan wrote:
>>> Unfortunately, 6.19.6-rc1 won't even build for me:
>>>
>>> Warning: drivers/gpu/drm/i915/intel_wakeref.h:156 expecting prototype for __intel_wakeref_put(). Prototype was for INTEL_WAKEREF_PUT_ASYNC() instead
>>> 1 warnings as errors
>>> make[9]: *** [drivers/gpu/drm/i915/Makefile:449: drivers/gpu/drm/i915/intel_wakeref.hdrtest] Error 3
>>> make[8]: *** [scripts/Makefile.build:546: drivers/gpu/drm/i915] Error 2
>>> make[8]: *** Waiting for unfinished jobs....
>>>
>>> This only happens with 6.19.6-rc1, not any of this weekend's other
>>> stable rc's. (I'm still testing 6.12.75-rc1 and 6.18.16-rc1, but
>>> they're doing well so far. I have successfully built 5.15.202-rc1
>>> and 6.1.165-rc1 but I won't have a chance to do any further testing
>>> of them before they're released.)
>>>
>>> As soon as I can (in the next hour or two) I'll minimize my config
>>> a little to shorten the compile time, then I'll start bisecting.
>>
>> Result of bisecting:
>> first bad commit: [0ef5d235ab57bc90831ddf38eb1742ff68f345e1]
>> docs: kdoc: fix logic to handle unissued warnings
>>
>> This commit breaks the i915 DRM build if (and only if)
>> CONFIG_DRM_I915_WERROR=y, whether CONFIG_WERROR is enabled or
>> disabled. However, the "bad" commit is definitely fixing a real
>> bug, and this build failure doesn't happen on current mainline
>> as of this writing (commit eb71ab2bf722), so I don't think
>> dropping the patch is the correct way forward.
>>
>> Rather, adding commit 524696a19e34598c9173fdd5b32fb7e5d16a91d3
>> drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
>> (it applies cleanly) fixes the warning, thereby fixing the build.
>>
>> The resulting kernel works fine in my testing, too. I'm using
>> 6.19.6-rc1 + 524696a19e34598c9173fdd5b32fb7e5d16a91d3 to write
>> and send this email from my ThinkPad T14 Gen 1, which uses the
>> i915 DRM driver for its Intel integrated graphics. (I also
>> tested it on my 2017 MacBook Air, which also uses i915 DRM for
>> its Intel integrated graphics.)
>
> I'll queue 524696a19e345 up, thanks for the report!
You're welcome.
Tested-by: Barry K. Nathan <barryn@pobox.com>
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (847 preceding siblings ...)
2026-03-01 8:49 ` Barry K. Nathan
@ 2026-03-01 8:54 ` Brett A C Sheffield
2026-03-01 12:05 ` Mark Brown
` (3 subsequent siblings)
852 siblings, 0 replies; 879+ messages in thread
From: Brett A C Sheffield @ 2026-03-01 8:54 UTC (permalink / raw)
To: sashal
Cc: linux-kernel, stable, gregkh, patches, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.19.6-rc1-gbf28ec292fb6 #2 SMP PREEMPT_DYNAMIC Sun Mar 1 07:56:57 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (848 preceding siblings ...)
2026-03-01 8:54 ` Brett A C Sheffield
@ 2026-03-01 12:05 ` Mark Brown
2026-03-01 15:15 ` Peter Schneider
2026-03-01 21:49 ` Ron Economos
` (2 subsequent siblings)
852 siblings, 1 reply; 879+ messages in thread
From: Mark Brown @ 2026-03-01 12:05 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel, stable, gregkh, patches, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr
[-- Attachment #1: Type: text/plain, Size: 760 bytes --]
On Sat, Feb 28, 2026 at 12:18:33PM -0500, Sasha Levin wrote:
>
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
I've previously noted that releasing -rcs on a Friday afternoon isn't
good for ensuring coverage (this was what happened with 6.19.2 and
related releases...), the same is also true for releasing them on a
Saturday with a deadline that's very early on Monday for a lot of the
world.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-03-01 12:05 ` Mark Brown
@ 2026-03-01 15:15 ` Peter Schneider
2026-03-01 16:11 ` Sasha Levin
0 siblings, 1 reply; 879+ messages in thread
From: Peter Schneider @ 2026-03-01 15:15 UTC (permalink / raw)
To: Mark Brown, Sasha Levin, Greg Kroah-Hartman
Cc: linux-kernel, stable, patches, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr
Am 01.03.2026 um 13:05 schrieb Mark Brown:
[...]
> I've previously noted that releasing -rcs on a Friday afternoon isn't
> good for ensuring coverage (this was what happened with 6.19.2 and
> related releases...), the same is also true for releasing them on a
> Saturday with a deadline that's very early on Monday for a lot of the
> world.
I second that, and would like to suggest that when a stable RC release is done on a Friday afternoon or even on a
Saturday, it would be better to extend the response deadline until Tuesday afternoon, so that people who want to help
with testing have a chance to do so without having to "sacrifice" weekend/family time.
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-03-01 15:15 ` Peter Schneider
@ 2026-03-01 16:11 ` Sasha Levin
2026-03-01 16:20 ` Mark Brown
0 siblings, 1 reply; 879+ messages in thread
From: Sasha Levin @ 2026-03-01 16:11 UTC (permalink / raw)
To: Peter Schneider
Cc: Mark Brown, Greg Kroah-Hartman, linux-kernel, stable, patches,
torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
jonathanh, f.fainelli, sudipm.mukherjee, rwarsow, conor, hargar,
achill, sr
On Sun, Mar 01, 2026 at 04:15:04PM +0100, Peter Schneider wrote:
>Am 01.03.2026 um 13:05 schrieb Mark Brown:
>[...]
>>I've previously noted that releasing -rcs on a Friday afternoon isn't
>>good for ensuring coverage (this was what happened with 6.19.2 and
>>related releases...), the same is also true for releasing them on a
>>Saturday with a deadline that's very early on Monday for a lot of the
>>world.
>
>I second that, and would like to suggest that when a stable RC release
>is done on a Friday afternoon or even on a Saturday, it would be
>better to extend the response deadline until Tuesday afternoon, so
>that people who want to help with testing have a chance to do so
>without having to "sacrifice" weekend/family time.
As far as the -rc goes, we just release it whenever our queues get longer. I
don't think that that matters if that goes out on a Friday.
For the release deadline, you definitely shouldn't sacrifice personal time to
test: at the end of the day, releasing is a judgement call, and if we don't see
the usual reports then we will hold off the release for a bit until we know
what is going on.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-03-01 16:11 ` Sasha Levin
@ 2026-03-01 16:20 ` Mark Brown
0 siblings, 0 replies; 879+ messages in thread
From: Mark Brown @ 2026-03-01 16:20 UTC (permalink / raw)
To: Sasha Levin
Cc: Peter Schneider, Greg Kroah-Hartman, linux-kernel, stable,
patches, torvalds, akpm, linux, shuah, patches, lkft-triage,
pavel, jonathanh, f.fainelli, sudipm.mukherjee, rwarsow, conor,
hargar, achill, sr
[-- Attachment #1: Type: text/plain, Size: 685 bytes --]
On Sun, Mar 01, 2026 at 11:11:12AM -0500, Sasha Levin wrote:
> For the release deadline, you definitely shouldn't sacrifice personal time to
> test: at the end of the day, releasing is a judgement call, and if we don't see
> the usual reports then we will hold off the release for a bit until we know
> what is going on.
I know that I will be put off looking at things if I see the deadline
has passed, it always seems likely that either the release happened
already (as happened with the ones I mentioned where there was a
regression, I only reported that because there were a bunch of very
clear reports about an issue I knew about from my tooling) or it'll race
with me checking.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 879+ messages in thread
* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (849 preceding siblings ...)
2026-03-01 12:05 ` Mark Brown
@ 2026-03-01 21:49 ` Ron Economos
2026-03-01 23:48 ` Miguel Ojeda
2026-03-02 0:53 ` Hardik Garg
852 siblings, 0 replies; 879+ messages in thread
From: Ron Economos @ 2026-03-01 21:49 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: gregkh, patches, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 2/28/26 09:18, Sasha Levin wrote:
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=linux-6.19.y&id2=v6.19.5
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> Thanks,
> Sasha
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (850 preceding siblings ...)
2026-03-01 21:49 ` Ron Economos
@ 2026-03-01 23:48 ` Miguel Ojeda
2026-03-02 0:53 ` Hardik Garg
852 siblings, 0 replies; 879+ messages in thread
From: Miguel Ojeda @ 2026-03-01 23:48 UTC (permalink / raw)
To: sashal
Cc: achill, akpm, broonie, conor, f.fainelli, gregkh, hargar,
jonathanh, linux-kernel, linux, lkft-triage, patches, patches,
pavel, rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda
On Sat, 28 Feb 2026 12:18:33 -0500 Sasha Levin <sashal@kernel.org> wrote:
>
> This is the start of the stable review cycle for the 6.19.6 release.
> There are 844 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Mar 2 05:32:25 PM UTC 2026.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Compared to 6.19.4, the `COMPAT` build error is now fixed. The other
warning fix (`unwrap_or`) will still take time to arrive.
And like 6.18.y, I am seeing a trivial Clippy warning on Rust nightly --
we will most likely send the same targeted backport to clean it:
https://lore.kernel.org/rust-for-linux/CANiq72nWYJna_hdFxjQCQZK6yJBrr1Mb86iKavivV0U0BgufeA@mail.gmail.com/
On top of that, I noticed an `objtool` warning in loongarch64, but it
happens on mainline too, so we will deal with it there:
https://lore.kernel.org/rust-for-linux/CANiq72mAQxbRJZDnik3Qmd4phvFwPA01O2jwaaXRh_T+2=L-qA@mail.gmail.com/
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 879+ messages in thread* Re: [PATCH 6.19 000/844] 6.19.6-rc1 review
2026-02-28 17:18 [PATCH 6.19 000/844] 6.19.6-rc1 review Sasha Levin
` (851 preceding siblings ...)
2026-03-01 23:48 ` Miguel Ojeda
@ 2026-03-02 0:53 ` Hardik Garg
852 siblings, 0 replies; 879+ messages in thread
From: Hardik Garg @ 2026-03-02 0:53 UTC (permalink / raw)
To: sashal
Cc: achill, akpm, broonie, conor, f.fainelli, gregkh, hargar,
jonathanh, linux-kernel, linux, lkft-triage, patches, patches,
pavel, rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Hardik Garg
The kernel, bpf tool, perf tool, and kselftest builds fine for
v6.19.6-rc1 on x86 and arm64 Azure VM.
Tested-by: Hardik Garg <hargar@linux.microsoft.com>
Thanks,
Hardik
^ permalink raw reply [flat|nested] 879+ messages in thread