* [PATCH 6.18 000/614] 6.18.2-rc1 review
@ 2025-12-16 11:06 Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 001/614] smack: fix bug: SMACK64TRANSMUTE set on non-directory Greg Kroah-Hartman
` (627 more replies)
0 siblings, 628 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.18.2 release.
There are 614 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.18.2-rc1
Junrui Luo <moonafterrain@outlook.com>
ALSA: wavefront: Fix integer overflow in sample size validation
Junrui Luo <moonafterrain@outlook.com>
ALSA: wavefront: Clear substream pointers on close
Denis Arefev <arefev@swemel.ru>
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
Antheas Kapenekakis <lkml@antheas.dev>
ALSA: hda/tas2781: fix speaker id retrieval for multiple probes
Antheas Kapenekakis <lkml@antheas.dev>
ALSA: hda/realtek: Add match for ASUS Xbox Ally projects
Junrui Luo <moonafterrain@outlook.com>
ALSA: dice: fix buffer overflow in detect_stream_formats()
Sven Peter <sven@kernel.org>
usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
Duoming Zhou <duoming@zju.edu.cn>
usb: typec: ucsi: fix use-after-free caused by uec->work
Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
usb: phy: Initialize struct usb_phy list_head
Duoming Zhou <duoming@zju.edu.cn>
usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe()
Haotien Hsu <haotienh@nvidia.com>
usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
efi/cper: Adjust infopfx size to accept an extra space
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
efi/cper: Add a new helper function to print bitmasks
Evan Li <evan.li@linux.alibaba.com>
perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common()
Dmitry Antipov <dmantipov@yandex.ru>
ocfs2: fix memory leak in ocfs2_merge_rec_left()
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
cpu: Make atomic hotplug callbacks run with interrupts disabled on UP
Dan Carpenter <dan.carpenter@linaro.org>
irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
Thaumy Cheng <thaumy.love@gmail.com>
perf/core: Fix missing read event generation on task exit
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: core: Fix an error handler crash
Duoming Zhou <duoming@zju.edu.cn>
scsi: imm: Fix use-after-free bug caused by unfinished delayed work
Haotian Zhang <vulab@iscas.ac.cn>
dm log-writes: Add missing set_freezable() for freezable kthread
Alexey Simakov <bigalex934@gmail.com>
dm-raid: fix possible NULL dereference with undefined raid type
Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
ASoC: amd: acp: update tdm channels for specific DAI
Mohamed Khalfella <mkhalfella@purestorage.com>
block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation
Jani Nikula <jani.nikula@intel.com>
drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init
Jani Nikula <jani.nikula@intel.com>
drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc()
Jani Nikula <jani.nikula@intel.com>
drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit
Jani Nikula <jani.nikula@intel.com>
drm/xe/fbdev: use the same 64-byte stride alignment as i915
Liyuan Pang <pangliyuan1@huawei.com>
ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
Junrui Luo <moonafterrain@outlook.com>
ALSA: firewire-motu: add bounds check in put_user loop for DSP events
Javier Martinez Canillas <javierm@redhat.com>
regulator: spacemit: Align input supply name with the DT binding
Nuno Sá <nuno.sa@analog.com>
rtc: max31335: Fix ignored return value in set_alarm
Haotian Zhang <vulab@iscas.ac.cn>
rtc: gamecube: Check the return value of ioremap()
Xiaogang Chen <xiaogang.chen@amd.com>
drm/amdkfd: Use huge page size to check split svm range alignment
Andres J Rosa <andyrosa@gmail.com>
ALSA: uapi: Fix typo in asound.h comment
Dave Kleikamp <dave.kleikamp@oracle.com>
dma/pool: eliminate alloc_pages warning in atomic_pool_expand
Troy Mitchell <troy.mitchell@linux.spacemit.com>
i2c: spacemit: fix detect issue
Kathara Sasikumar <katharasasikumar007@gmail.com>
docs: hwmon: fix link to g762 devicetree binding
Arnd Bergmann <arnd@arndb.de>
gpio: tb10x: fix OF_GPIO dependency
Mike Snitzer <snitzer@kernel.org>
nfs/localio: remove 61 byte hole from needless ____cacheline_aligned
Mike Snitzer <snitzer@hammerspace.com>
nfs/localio: remove alignment size checking in nfs_is_local_dio_possible
David Howells <dhowells@redhat.com>
cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
David Howells <dhowells@redhat.com>
cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
René Rebe <rene@exactco.de>
drm/nouveau: fix circular dep oops from vendored i2c encoder
Madhur Kumar <madhurkumar004@gmail.com>
drm/nouveau: refactor deprecated strcpy
Junrui Luo <moonafterrain@outlook.com>
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
Mark Brown <broonie@kernel.org>
regulator: fixed: Rely on the core freeing the enable GPIO
Dan Carpenter <dan.carpenter@linaro.org>
drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties()
Caleb Sander Mateos <csander@purestorage.com>
io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
Israel Rukshin <israelr@nvidia.com>
nvme-auth: use kvfree() for memory allocated with kvcalloc()
Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
block: fix memory leak in __blkdev_issue_zero_pages
shechenglong <shechenglong@xfusion.com>
block: fix comment for op_is_zone_mgmt() to include RESET_ALL
Arnd Bergmann <arnd@arndb.de>
drm/panel: novatek-nt35560: avoid on-stack device structure
Cong Zhang <cong.zhang@oss.qualcomm.com>
blk-mq: Abort suspend when wakeup events are pending
Daeho Jeong <daehojeong@google.com>
f2fs: revert summary entry count from 2048 to 512 in 16kb block support
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: ak5558: Disable regulator when error happens
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: ak4458: Disable regulator when error happens
Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
ASoC: amd: acp: Audio is not resuming after s0ix
Haotian Zhang <vulab@iscas.ac.cn>
ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
Anton Khirnov <anton@khirnov.net>
platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
Armin Wolf <W_Armin@gmx.de>
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Fix inheritance of the block sizes when automounting
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
Trond Myklebust <trond.myklebust@hammerspace.com>
Revert "nfs: ignore SB_RDONLY when mounting nfs"
Trond Myklebust <trond.myklebust@hammerspace.com>
Revert "nfs: clear SB_RDONLY before getting superblock"
Trond Myklebust <trond.myklebust@hammerspace.com>
Revert "nfs: ignore SB_RDONLY when remounting nfs"
Akash Goel <akash.goel@arm.com>
drm/panthor: Prevent potential UAF in group creation
Jonathan Curley <jcurley@purestorage.com>
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Initialise verifiers for visible dentries in readdir and lookup
Armin Wolf <W_Armin@gmx.de>
fs/nls: Fix utf16 to utf8 conversion
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Avoid changing nlink when file removes and attribute updates race
Abel Vesa <abel.vesa@linaro.org>
kbuild: install-extmod-build: Properly fix CC expansion when ccache is used
Haotian Zhang <vulab@iscas.ac.cn>
rtc: amlogic-a4: fix double free caused by devm
Daeho Jeong <daehojeong@google.com>
f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
Xi Pardee <xi.pardee@linux.intel.com>
platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
John Stultz <jstultz@google.com>
sched/core: Fix psi_dequeue() for Proxy Execution
xupengbo <xupengbo@oppo.com>
sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out
Eric Sandeen <sandeen@redhat.com>
9p: fix cache/debug options printing in v9fs_show_options
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
Ian Rogers <irogers@google.com>
perf stat: Allow no events to open if this is a "--null" run
Haotian Zhang <vulab@iscas.ac.cn>
pinctrl: single: Fix incorrect type for error return variable
Ian Rogers <irogers@google.com>
perf hist: In init, ensure mem_info is put on error paths
Ian Rogers <irogers@google.com>
perf kvm: Fix debug assertion
Namhyung Kim <namhyung@kernel.org>
perf tools: Fix split kallsyms DSO counting
Namhyung Kim <namhyung@kernel.org>
perf tools: Mark split kallsyms DSOs as loaded
Namjae Jeon <linkinjeon@kernel.org>
exfat: fix divide-by-zero in exfat_allocate_bitmap
Shuhao Fu <sfual@cse.ust.hk>
exfat: fix refcount leak in exfat_find
Namhyung Kim <namhyung@kernel.org>
perf jitdump: Add sym/str-tables to build-ID generation
Xiang Mei <xmei5@asu.edu>
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: xrs700x: reject unsupported HSR configurations
Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
net: hsr: create an API to get hsr port type
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: fix BCM5325/65 ARL entry VIDs
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: add support for bcm63xx ARL entry format
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: use same ARL search result offset for BCM5325/65
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: add support for 5389/5397/5398 ARL entry format
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: move ARL entry functions into ops struct
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: split reading search entry into their own functions
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: move writing ARL entries into their own functions
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: move reading ARL entries into their own function
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: fix extracting VID from entry for BCM5325/65
Jonas Gorski <jonas.gorski@gmail.com>
net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65
Christophe Leroy (CS GROUP) <chleroy@kernel.org>
um: Disable KASAN_INLINE when STATIC_LINK is selected
Stefan Metzmacher <metze@samba.org>
smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall()
Stefan Metzmacher <metze@samba.org>
smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler()
Stefan Metzmacher <metze@samba.org>
smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}()
Stefan Metzmacher <metze@samba.org>
smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper
Johan Hovold <johan@kernel.org>
clk: keystone: fix compile testing
Yu Kuai <yukuai@fnnas.com>
md/raid5: fix IO hang when array is broken with IO inflight
Alexandru Gagniuc <mr.nuke.me@gmail.com>
remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
Kumar Kartikeya Dwivedi <memxor@gmail.com>
rqspinlock: Use trylock fallback when per-CPU rqnode is busy
Kumar Kartikeya Dwivedi <memxor@gmail.com>
rqspinlock: Enclose lock/unlock within lock entry acquisitions
Ivan Stepchenko <sid@itb.spb.ru>
mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
Breno Leitao <leitao@debian.org>
net: netpoll: initialize work queue before error checks
Hangbin Liu <liuhangbin@gmail.com>
selftests: bonding: add delay before each xvlan_over_bond connectivity check
Robert Marko <robimarko@gmail.com>
net: phy: aquantia: check for NVMEM deferral
Mickaël Salaün <mic@digikod.net>
landlock: Fix handling of disconnected directories
Alex Williamson <alex.williamson@nvidia.com>
vfio/pci: Use RCU for error/request triggers to avoid circular locking
Dev Jain <dev.jain@arm.com>
arm64/pageattr: Propagate return value from __change_memory_common
Tianchu Chen <flynnnchen@tencent.com>
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
Haotian Zhang <vulab@iscas.ac.cn>
mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
Alexey Kodanev <aleksei.kodanev@bell-sw.com>
net: stmmac: fix rx limit check in stmmac_rx_zc()
Antoine Tenart <atenart@kernel.org>
net: vxlan: prevent NULL deref in vxlan_xmit_one
Michal Schmidt <mschmidt@redhat.com>
iavf: Implement settime64 with -EOPNOTSUPP
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nft_connlimit: update the count if add was skipped
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nf_conncount: rework API to use sk_buff directly
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
Ilias Stamatis <ilstam@amazon.com>
Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
Chen-Yu Tsai <wenst@chromium.org>
arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1
sparkhuang <huangshaobo3@xiaomi.com>
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
Marek Szyprowski <m.szyprowski@samsung.com>
ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend
Marek Szyprowski <m.szyprowski@samsung.com>
ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend
Marek Szyprowski <m.szyprowski@samsung.com>
ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend
Marek Szyprowski <m.szyprowski@samsung.com>
ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend
Marek Szyprowski <m.szyprowski@samsung.com>
soc: samsung: exynos-pmu: Fix structure initialization
Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND
Cezary Rojewski <cezary.rojewski@intel.com>
ASoC: Intel: catpt: Fix error path in hw_params()
Michael S. Tsirkin <mst@redhat.com>
virtio: clean up features qword/dword terms
Alok Tiwari <alok.a.tiwari@oracle.com>
vdpa/pds: use %pe for ERR_PTR() in event handler registration
Mike Christie <michael.christie@oracle.com>
vhost: Fix kthread worker cgroup failure handling
Alok Tiwari <alok.a.tiwari@oracle.com>
vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
Michael S. Tsirkin <mst@redhat.com>
virtio: fix map ops comment
Michael S. Tsirkin <mst@redhat.com>
virtio: fix virtqueue_set_affinity() docs
Michael S. Tsirkin <mst@redhat.com>
virtio: standardize Returns documentation style
Michael S. Tsirkin <mst@redhat.com>
virtio: fix grammar in virtio_map_ops docs
Michael S. Tsirkin <mst@redhat.com>
virtio: fix grammar in virtio_queue_info docs
Michael S. Tsirkin <mst@redhat.com>
virtio: fix whitespace in virtio_config_ops
Michael S. Tsirkin <mst@redhat.com>
virtio: fix typo in virtio_device_ready() comment
Kriish Sharma <kriish.sharma2006@gmail.com>
virtio: fix kernel-doc for mapping/free_coherent functions
Alok Tiwari <alok.a.tiwari@oracle.com>
virtio_vdpa: fix misleading return in void function
Guenter Roeck <linux@roeck-us.net>
of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
Willem de Bruijn <willemb@google.com>
selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests
Yongjian Sun <sunyongjian1@huawei.com>
ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
Edward Adam Davis <eadavis@qq.com>
bpf: Fix exclusive map memory leak
Matthieu Buffet <matthieu@buffet.re>
selftests/landlock: Fix makefile header list
Kevin Brodsky <kevin.brodsky@arm.com>
ublk: prevent invalid access with DEBUG
René Rebe <rene@exactco.de>
ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
Haotian Zhang <vulab@iscas.ac.cn>
hwmon: sy7636a: Fix regulator_enable resource leak on error path
Eric Huang <jinhuieric.huang@amd.com>
drm/amdkfd: assign AID to uuid in topology for SPX mode
Dan Carpenter <dan.carpenter@linaro.org>
drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
Will Rosenberg <whrosenb@asu.edu>
kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
misc: rp1: Fix an error handling path in rp1_probe()
Christoph Hellwig <hch@lst.de>
fs: lift the FMODE_NOCMTIME check into file_update_time_flags
Christoph Hellwig <hch@lst.de>
fs: refactor file timestamp update logic
Haotian Zhang <vulab@iscas.ac.cn>
greybus: gb-beagleplay: Fix timeout handling in bootloader functions
Alexandre Courbot <acourbot@nvidia.com>
firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_xcvr: clear the channel status control memory
Andreas Gruenbacher <agruenba@redhat.com>
gfs2: Prevent recursive memory reclaim
Jaroslav Kysela <perex@perex.cz>
ASoC: nau8325: add missing build config
Jaroslav Kysela <perex@perex.cz>
ASoC: nau8325: use simple i2c probe function
Johan Hovold <johan@kernel.org>
clocksource/drivers/nxp-stm: Prevent driver unbind
Johan Hovold <johan@kernel.org>
clocksource/drivers/nxp-stm: Fix section mismatches
Johan Hovold <johan@kernel.org>
clocksource/drivers/nxp-pit: Prevent driver unbind
Johan Hovold <johan@kernel.org>
clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind
Johan Hovold <johan@kernel.org>
clocksource/drivers/stm: Fix double deregistration on probe failure
Haotian Zhang <vulab@iscas.ac.cn>
clocksource/drivers/ralink: Fix resource leaks in init error path
Akash Goel <akash.goel@arm.com>
drm/panthor: Avoid adding of kernel BOs to extobj list
Guillaume La Roque <glaroque@baylibre.com>
arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs
Jijun Wang <jijun.wang@intel.com>
RDMA/irdma: Fix SRQ shadow area address initialization
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Remove doorbell elision logic
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+
Jacob Moroni <jmoroni@google.com>
RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
Anil Samal <anil.samal@intel.com>
RDMA/irdma: Add missing mutex destroy
Krzysztof Czurylo <krzysztof.czurylo@intel.com>
RDMA/irdma: Fix SIGBUS in AEQ destroy
Tatyana Nikolova <tatyana.e.nikolova@intel.com>
RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2
Krzysztof Czurylo <krzysztof.czurylo@intel.com>
RDMA/irdma: Fix data race in irdma_free_pble
Krzysztof Czurylo <krzysztof.czurylo@intel.com>
RDMA/irdma: Fix data race in irdma_sc_ccq_arm
Stephan Gerhold <stephan.gerhold@linaro.org>
iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
Randy Dunlap <rdunlap@infradead.org>
backlight: lp855x: Fix lp855x.h kernel-doc warnings
Luca Ceresoli <luca.ceresoli@bootlin.com>
backlight: led-bl: Add devlink to supplier LEDs
Ria Thomas <ria.thomas@morsemicro.com>
wifi: ieee80211: correct FILS status codes
Christoph Hellwig <hch@lst.de>
iomap: allocate s_dio_done_wq for async reads as well
Christoph Hellwig <hch@lst.de>
iomap: always run error completions in user context
David Gow <davidgow@google.com>
um: Don't rename vmap to kernel_vmap
Timur Tabi <ttabi@nvidia.com>
drm/nouveau: restrict the flush page to a 32-bit address
Shawn Lin <shawn.lin@rock-chips.com>
PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
Filipe Manana <fdmanana@suse.com>
btrfs: fix leaf leak in an error path in btrfs_del_items()
Qu Wenruo <wqu@suse.com>
btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe()
Boris Burkov <boris@bur.io>
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
Miquel Sabaté Solà <mssola@mssola.com>
btrfs: fix double free of qgroup record after failure to add delayed ref head
Alan Maguire <alan.maguire@oracle.com>
selftests/bpf: Allow selftests to build with older xxd
Alan Maguire <alan.maguire@oracle.com>
bpftool: Allow bpftool to build with openssl < 3
Ryan Huang <tzukui@google.com>
iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
Jianglei Nie <niejianglei2021@163.com>
staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
Dinh Nguyen <dinguyen@kernel.org>
firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
Zilin Guan <zilin@seu.edu.cn>
mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work()
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: skip deflink accounting for offchannel links
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: Move mt76_abort_scan out of mt76_reset_device()
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event()
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix EMI rings for RRO
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart()
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix MLO set key and group key issues
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix MLD group index assignment
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: set link_valid field when initializing wcid
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix teardown command for an MLD peer
Shayne Chen <shayne.chen@mediatek.com>
wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv()
Howard Hsu <howard-yh.hsu@mediatek.com>
wifi: mt76: mt7996: fix implicit beamforming support for mt7992
StanleyYP Wang <StanleyYP.Wang@mediatek.com>
wifi: mt76: mt7996: fix max nss value when getting rx chainmask
Fedor Pchelkin <pchelkin@ispras.ru>
Revert "wifi: mt76: mt792x: improve monitor interface handling"
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
Lorenzo Bianconi <lorenzo@kernel.org>
wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
Shenghao Ding <shenghao-ding@ti.com>
ASoC: tas2781: correct the wrong period
Baojun Xu <baojun.xu@ti.com>
ASoC: tas2781: Correct the wrong chip ID for reset variable check
Herbert Xu <herbert@gondor.apana.org.au>
crypto: ahash - Zero positive err value in ahash_update_finish
Herbert Xu <herbert@gondor.apana.org.au>
crypto: ahash - Fix crypto_ahash_import with partial block data
Selvin Xavier <selvin.xavier@broadcom.com>
RDMA/bnxt_re: Pass correct flag for dma mr creation
Selvin Xavier <selvin.xavier@broadcom.com>
RDMA/bnxt_re: Fix the inline size for GenP7 devices
Gao Xiang <xiang@kernel.org>
erofs: limit the level of fs stacking for file-backed mounts
Gao Xiang <xiang@kernel.org>
erofs: correct FSDAX detection
Fangyu Yu <fangyu.yu@linux.alibaba.com>
RISC-V: KVM: Fix guest page fault within HLV* instructions
Pengjie Zhang <zhangpengjie2@huawei.com>
PM / devfreq: hisi: Fix potential UAF in OPP handling
Haotian Zhang <vulab@iscas.ac.cn>
crypto: ccree - Correctly handle return of sg_nents_for_len
Haotian Zhang <vulab@iscas.ac.cn>
crypto: starfive - Correctly handle return of sg_nents_for_len
Martin Teichmann <martin.teichmann@xfel.eu>
bpf: properly verify tail call behavior
Xing Guo <higuoxing@gmail.com>
selftests/bpf: Update test_tag to use sha256
Matt Bobrowski <mattbobrowski@google.com>
selftests/bpf: Improve reliability of test_perf_branches_no_hw()
Matt Bobrowski <mattbobrowski@google.com>
selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
Dan Carpenter <dan.carpenter@linaro.org>
regulator: pca9450: Fix error code in probe()
Gopi Krishna Menon <krishnagopi487@gmail.com>
usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
Jisheng Zhang <jszhang@kernel.org>
usb: dwc2: fix hang during suspend if set as peripheral
Jisheng Zhang <jszhang@kernel.org>
usb: dwc2: fix hang during shutdown if set as peripheral
Oliver Neukum <oneukum@suse.com>
usb: chaoskey: fix locking for O_NONBLOCK
Zhao Yipeng <zhaoyipeng5@huawei.com>
ima: Handle error code returned by ima_filter_rule_match()
Ivan Pravdin <ipravdin.official@gmail.com>
rtla: Fix -a overriding -t argument
Tomas Glozar <tglozar@redhat.com>
rtla/tests: Fix osnoise test calling timerlat
Tomas Glozar <tglozar@redhat.com>
rtla/tests: Extend action tests to 5s
Jason Tian <jason@os.amperecomputing.com>
RAS: Report all ARM processor CPER information to userspace
Seungjin Bae <eeodqql09@gmail.com>
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
Charles Mirabile <cmirabil@redhat.com>
clk: spacemit: Set clk_hw_onecell_data::num before using flex array
Chen Ridong <chenridong@huawei.com>
cpuset: Treat cpusets in attaching as populated
Alexander Dahl <ada@thorsis.com>
net: phy: adin1100: Fix software power-down ready condition
Matt Bobrowski <mattbobrowski@google.com>
selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names
Charles Keepax <ckeepax@opensource.cirrus.com>
ASoC: SDCA: Fix missing dash in HIDE DisCo property
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode
Xiaolei Wang <xiaolei.wang@windriver.com>
phy: freescale: Initialize priv->lock
Shawn Lin <shawn.lin@rock-chips.com>
phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562
Shawn Lin <shawn.lin@rock-chips.com>
phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
Fenglin Wu <fenglin.wu@oss.qualcomm.com>
leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
Yuntao Wang <yuntao.wang@linux.dev>
of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho()
Yuntao Wang <yuntao.wang@linux.dev>
of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range()
Yuntao Wang <yuntao.wang@linux.dev>
of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()
Yuntao Wang <yuntao.wang@linux.dev>
of/fdt: Consolidate duplicate code into helper functions
Haotian Zhang <vulab@iscas.ac.cn>
mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
Haotian Zhang <vulab@iscas.ac.cn>
mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
Tomas Glozar <tglozar@redhat.com>
tools/rtla: Fix --on-threshold always triggering
Costa Shulyupin <costa.shul@redhat.com>
tools/rtla: Fix unassigned nr_cpus
Chien Wong <m@xv97.com>
wifi: mac80211: fix CMAC functions not handling errors
Aashish Sharma <aashish@aashishsharma.net>
iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
Vineeth Pillai (Google) <vineeth@bitbyteword.org>
iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD
Vladimir Oltean <vladimir.oltean@nxp.com>
net: phy: realtek: create rtl8211f_config_rgmii_delay()
Zilin Guan <zilin@seu.edu.cn>
scsi: qla2xxx: Fix improper freeing of purex item
Shawn Lin <shawn.lin@rock-chips.com>
scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
pwm: bcm2835: Make sure the channel is enabled after pwm_request()
Leo Yan <leo.yan@arm.com>
perf arm_spe: Fix memset subclass in operation
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: clear RA flags when adding a static route
Longbin Li <looong.bin@gmail.com>
spi: sophgo: Fix incorrect use of bus width value macros
Akhil P Oommen <akhilpo@oss.qualcomm.com>
drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
Akhil P Oommen <akhilpo@oss.qualcomm.com>
drm/msm/a6xx: Fix the gemnoc workaround
Akhil P Oommen <akhilpo@oss.qualcomm.com>
drm/msm/a6xx: Flush LRZ cache before PT switch
Jay Liu <jay.liu@mediatek.com>
drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
Edward Adam Davis <eadavis@qq.com>
fs/ntfs3: Prevent memory leaks in add sub record
Edward Adam Davis <eadavis@qq.com>
fs/ntfs3: out1 also needs to put mi
Ovidiu Panait <ovidiu.panait.rb@renesas.com>
net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr()
Ritesh Harjani (IBM) <ritesh.list@gmail.com>
powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
Ritesh Harjani (IBM) <ritesh.list@gmail.com>
powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
Pu Lehui <pulehui@huawei.com>
bpf: Fix invalid prog->stats access when update_effective_progs fails
Inochi Amaoto <inochiama@gmail.com>
net: stmmac: dwmac-sophgo: Add phy interface filter
Inochi Amaoto <inochiama@gmail.com>
net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
Christian Bruel <christian.bruel@foss.st.com>
PCI: stm32: Fix EP page_size alignment
Christian Bruel <christian.bruel@foss.st.com>
PCI: stm32: Fix LTSSM EP race with start link
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/msm/a2xx: stop over-complaining about the legacy firmware
Huiwen He <hehuiwen@kylinos.cn>
drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()
Huiwen He <hehuiwen@kylinos.cn>
drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs()
Guenter Roeck <linux@roeck-us.net>
block/blk-throttle: Fix throttle slice time for SSDs
Alexander Stein <alexander.stein@ew.tq-group.com>
arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz
Markus Niebel <Markus.Niebel@ew.tq-group.com>
arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name
Sergey Bashirov <sergeybashirov@gmail.com>
NFSD/blocklayout: Fix minlength check in proc_layoutget
Al Viro <viro@zeniv.linux.org.uk>
tracefs: fix a leak in eventfs_create_events_dir()
Al Viro <viro@zeniv.linux.org.uk>
fuse_ctl_add_conn(): fix nlink breakage in case of early failure
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
iio: core: Clean up device correctly on iio_device_alloc() failure
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
iio: core: add missing mutex_destroy in iio_dev_release()
Haotian Zhang <vulab@iscas.ac.cn>
watchdog: starfive: Fix resource leak in probe error path
Haotian Zhang <vulab@iscas.ac.cn>
watchdog: wdat_wdt: Fix ACPI table leak in probe function
Nuno Das Neves <nunodasneves@linux.microsoft.com>
mshv: Fix create memory region overlap check
Nuno Das Neves <nunodasneves@linux.microsoft.com>
mshv: Fix deposit memory in MSHV_ROOT_HVCALL
Martin KaFai Lau <martin.lau@kernel.org>
bpf: Check skb->transport_header is set in bpf_skb_check_mtu
Alexei Starovoitov <ast@kernel.org>
selftests/bpf: Fix failure paths in send_signal test
Menglong Dong <menglong8.dong@gmail.com>
bpf: Handle return value of ftrace_set_filter_ip in register_fentry
Sahil Chandna <chandna.sahil@gmail.com>
bpf: Prevent nesting overflow in bpf_try_get_buffers
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Prevent resource tree corruption when BAR resize fails
Aaron Kling <webgeek1234@gmail.com>
soc/tegra: fuse: speedo-tegra210: Update speedo IDs
Rene Rebe <rene@exactco.de>
ps3disk: use memcpy_{from,to}_bvec index
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
Praveen Talari <praveen.talari@oss.qualcomm.com>
arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
pwm: Simplify printf to emit chip->npwm in $debugfs/pwm
Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
s390/fpu: Fix false-positive kmsan report in fpu_vstl()
Zilin Guan <zilin@seu.edu.cn>
crypto: iaa - Fix incorrect return value in save_iaa_wq()
Ian Rogers <irogers@google.com>
perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
FUKAUMI Naoki <naoki@radxa.com>
arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
FUKAUMI Naoki <naoki@radxa.com>
arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
FUKAUMI Naoki <naoki@radxa.com>
arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
soc: renesas: r9a09g056-sys: Populate max_register
Siddharth Vadapalli <s-vadapalli@ti.com>
PCI: keystone: Exit ks_pcie_probe() for invalid mode
Leon Hwang <leon.hwang@linux.dev>
bpf: Free special fields when update [lru_,]percpu_hash maps
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Fix deadlock between context destroy and job timeout
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Clear mailbox interrupt register during channel creation
Chaitanya S Prakash <chaitanyas.prakash@arm.com>
arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors
Haotian Zhang <vulab@iscas.ac.cn>
leds: netxbig: Fix GPIO descriptor leak in error paths
Haotian Zhang <vulab@iscas.ac.cn>
scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
Tony Battersby <tonyb@cybernetics.com>
scsi: qla2xxx: Clear cmds after chip reset
Haotian Zhang <vulab@iscas.ac.cn>
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: use correct endian in ocfs2_dinode_has_extents
Dmitry Antipov <dmantipov@yandex.ru>
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
lib/vsprintf: Check pointer before dereferencing in time_and_date()
Haotian Zhang <vulab@iscas.ac.cn>
clk: renesas: r9a06g032: Fix memory leak in error path
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
clk: renesas: r9a09g077: Propagate rate changes to parent clocks
Jayesh Choudhary <j-choudhary@ti.com>
drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook
Jayesh Choudhary <j-choudhary@ti.com>
drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features
Namhyung Kim <namhyung@kernel.org>
perf tools: Fix missing feature check for inherit + SAMPLE_READ
Leo Yan <leo.yan@arm.com>
coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF
Leo Yan <leo.yan@arm.com>
coresight: etm4x: Add context synchronization before enabling trace
Leo Yan <leo.yan@arm.com>
coresight: etm4x: Correct polling IDLE bit
Leo Yan <leo.yan@arm.com>
coresight: etm3x: Always set tracer's device mode on target CPU
Leo Yan <leo.yan@arm.com>
coresight: etm4x: Always set tracer's device mode on target CPU
Leo Yan <leo.yan@arm.com>
coresight: Change device mode to atomic type
Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
fs/ntfs3: Initialize allocated memory before use
David Wei <dw@davidwei.uk>
io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock
David Wei <dw@davidwei.uk>
net: export netdev_get_by_index_lock()
Zheng Qixing <zhengqixing@huawei.com>
nbd: defer config unlock in nbd_genl_connect
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
Long Li <leo.lilong@huawei.com>
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/32: Fix unpaired stwcx. on interrupt exit
Sourabh Jain <sourabhjain@linux.ibm.com>
powerpc/kdump: Fix size calculation for hot-removed memory ranges
Gautham R. Shenoy <gautham.shenoy@amd.com>
cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
Li Nan <linan122@huawei.com>
md: init bioset in mddev_init
Li Nan <linan122@huawei.com>
md: delete md_redundancy_group when array is becoming inactive
Bean Huo <beanhuo@micron.com>
scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
Akash Goel <akash.goel@arm.com>
drm/panthor: Fix potential memleak of vma structure
Edward Adam Davis <eadavis@qq.com>
ntfs3: init run lock for extend inode
Carl Worth <carl@os.amperecomputing.com>
coresight: tmc: add the handle of the event to the path
Jihed Chaibi <jihed.chaibi.dev@gmail.com>
ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties
Ma Ke <make24@iscas.ac.cn>
RDMA/rtrs: server: Fix error handling in get_or_create_srv
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
dt-bindings: PCI: amlogic: Fix the register name of the DBI region
Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
iio: imu: bmi270: fix dev_err_probe error msg
Johan Hovold <johan@kernel.org>
staging: most: remove broken i2c driver
Mike McGowen <mike.mcgowen@microchip.com>
scsi: smartpqi: Fix device resources accessed after device removal
Haotian Zhang <vulab@iscas.ac.cn>
scsi: stex: Fix reboot_notifier leak in probe error path
Zheng Qixing <zhengqixing@huawei.com>
nbd: defer config put in recv_work
Xiao Ni <xni@redhat.com>
md: avoid repeated calls to del_gendisk
Yun Zhou <yun.zhou@windriver.com>
md: fix rcu protection in md_wakeup_thread
Xiao Ni <xni@redhat.com>
md: delete mddev kobj before deleting gendisk kobj
Gabor Juhos <j4g8y7@gmail.com>
regulator: core: disable supply if enabling main regulator fails
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Correct large PEBS flag check
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86: Fix NULL event access and potential PEBS record loss
Pavel Begunkov <asml.silence@gmail.com>
io_uring: use WRITE_ONCE for user shared memory
FUKAUMI Naoki <naoki@radxa.com>
arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T
Dan Carpenter <dan.carpenter@linaro.org>
hfs: fix potential use after free in hfs_correct_next_unused_CNID()
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Fix dma_fence leak when job is canceled
Zhang Yi <yi.zhang@huawei.com>
ext4: correct the checking of quota files before moving extents
Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
wifi: ath12k: Fix timeout error during beacon stats retrieval
Haotian Zhang <vulab@iscas.ac.cn>
mfd: da9055: Fix missing regmap_del_irq_chip() in error path
Namhyung Kim <namhyung@kernel.org>
perf annotate: Fix build with NO_SLANG=1
Fedor Pchelkin <pchelkin@ispras.ru>
wifi: rtw89: usb: fix leak in rtw89_usb_write_port()
Fedor Pchelkin <pchelkin@ispras.ru>
wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler()
Wang Liang <wangliang74@huawei.com>
locktorture: Fix memory leak in param_set_cpumask()
Usama Arif <usamaarif642@gmail.com>
efi/libstub: Fix page table access in 5-level to 4-level paging transition
Usama Arif <usamaarif642@gmail.com>
x86/boot: Fix page table access in 5-level to 4-level paging transition
Xiaoqi Zhuang <xiaoqi.zhuang@oss.qualcomm.com>
coresight: ETR: Fix ETR buffer use-after-free issue
Niklas Cassel <cassel@kernel.org>
arm64: tegra: Add pinctrl definitions for pcie-ep nodes
Peter Zijlstra <peterz@infradead.org>
entry,unwind/deferred: Fix unwind_reset_info() placement
Jihed Chaibi <jihed.chaibi.dev@gmail.com>
ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
Jihed Chaibi <jihed.chaibi.dev@gmail.com>
ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
Yegor Yefremov <yegorslists@googlemail.com>
ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
Geert Uytterhoeven <geert+renesas@glider.be>
ARM: dts: am33xx: Add missing serial console speed
Alan Maguire <alan.maguire@oracle.com>
libbpf: Fix parsing of multi-split BTF
Vishwaroop A <va@nvidia.com>
spi: tegra210-quad: Fix timeout handling
Matthew Brost <matthew.brost@intel.com>
drm/xe: Enforce correct user fence signaling order using
Christian Brauner <brauner@kernel.org>
cleanup: fix scoped_class()
Songtang Liu <liusongtang@bytedance.com>
iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show
Christian Brauner <brauner@kernel.org>
ns: initialize ns_list_node for initial namespaces
Christian Brauner <brauner@kernel.org>
ns: add NS_COMMON_INIT()
Thomas Richard (TI.com) <thomas.richard@bootlin.com>
firmware: ti_sci: Set IO Isolation only if the firmware is capable
Boris Brezillon <boris.brezillon@collabora.com>
drm/panthor: Fix UAF on kernel BO VA nodes
Ketil Johnsen <ketil.johnsen@arm.com>
drm/panthor: Fix race with suspend during unplug
Ketil Johnsen <ketil.johnsen@arm.com>
drm/panthor: Fix UAF race between device unplug and FW event processing
Boris Brezillon <boris.brezillon@collabora.com>
drm/panthor: Fix group_free_queue() for partially initialized queues
Boris Brezillon <boris.brezillon@collabora.com>
drm/panthor: Handle errors returned by drm_sched_entity_init()
Tingmao Wang <m@maowtm.org>
fs/9p: Don't open remote file with APPEND mode when writeback cache is used
Mike Christie <michael.christie@oracle.com>
scsi: target: Fix LUN/device R/W and total command stats
Bart Van Assche <bvanassche@acm.org>
scsi: target: Do not write NUL characters into ASCII configfs output
Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
power: supply: apm_power: only unset own apm_get_power_status
Val Packett <val@packett.cool>
power: supply: qcom_battmgr: support disabling charge control
Val Packett <val@packett.cool>
power: supply: qcom_battmgr: clamp charge control thresholds
Ivan Abramov <i.abramov@mt-integration.ru>
power: supply: wm831x: Check wm831x_set_bits() return value
Murad Masimov <m.masimov@mt-integration.ru>
power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()
Ivan Abramov <i.abramov@mt-integration.ru>
power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()
Ivan Abramov <i.abramov@mt-integration.ru>
power: supply: max17040: Check iio_read_channel_processed() return code
Ivan Abramov <i.abramov@mt-integration.ru>
power: supply: cw2015: Check devm_delayed_work_autocancel() return code
Haotian Zhang <vulab@iscas.ac.cn>
power: supply: rt5033_charger: Fix device node reference leaks
Frederic Weisbecker <frederic@kernel.org>
timers/migration: Fix imbalanced NUMA trees
Frederic Weisbecker <frederic@kernel.org>
timers/migration: Remove locking on group connection
Frederic Weisbecker <frederic@kernel.org>
timers/migration: Convert "while" loops to use "for"
Taniya Das <taniya.das@oss.qualcomm.com>
clk: qcom: tcsrcc-glymur: Update register offsets for clock refs
Shuai Xue <xueshuai@linux.alibaba.com>
perf record: skip synthesize event when open evsel failed
Namhyung Kim <namhyung@kernel.org>
perf lock contention: Load kernel map before lookup
Geert Uytterhoeven <geert+renesas@glider.be>
drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
Christian Brauner <brauner@kernel.org>
cgroup: add cgroup namespace to tree after owner is set
Marek Vasut <marek.vasut+renesas@mailbox.org>
arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels
Kuan-Wei Chiu <visitorckw@gmail.com>
interconnect: debugfs: Fix incorrect error handling for NULL path
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Fix incorrect command state for timed out job
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
wifi: ath12k: unassign arvif on scan vdev create failure
Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath12k: fix error handling in creating hardware group
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath12k: fix reusing m3 memory
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
Jacob Keller <jacob.e.keller@intel.com>
docs: kdoc: fix duplicate section warning message
Arnd Bergmann <arnd@arndb.de>
random: use offstack cpumask when necessary
Stanley Chu <yschu@nuvoton.com>
i3c: master: svc: Prevent incomplete IBI transaction
Frank Li <Frank.Li@nxp.com>
i3c: fix refcount inconsistency in i3c_master_register
Aniket Limaye <a-limaye@ti.com>
arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration
Christian Brauner <brauner@kernel.org>
pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info
Christian Brauner <brauner@kernel.org>
pidfs: add missing PIDFD_INFO_SIZE_VER1
Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
accel/ivpu: Fix race condition when unbinding BOs
Danilo Krummrich <dakr@kernel.org>
drm: nova: select NOVA_CORE
Haotian Zhang <vulab@iscas.ac.cn>
pinctrl: stm32: fix hwspinlock resource leak in probe function
Haotian Zhang <vulab@iscas.ac.cn>
soc: qcom: smem: fix hwspinlock resource leak in probe error paths
Taniya Das <taniya.das@oss.qualcomm.com>
clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops
Benjamin Berg <benjamin.berg@intel.com>
tools/nolibc/dirent: avoid errno in readdir_r
Benjamin Berg <benjamin.berg@intel.com>
tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
Maciej Falkowski <maciej.falkowski@linux.intel.com>
accel/ivpu: Remove skip of dma unmap for imported buffers
Tengda Wu <wutengda@huaweicloud.com>
x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
Marek Vasut <marek.vasut+renesas@mailbox.org>
drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros
Peter Zijlstra <peterz@infradead.org>
task_work: Fix NMI race condition
Zhang Rui <rui.zhang@intel.com>
perf/x86/intel/cstate: Remove PC3 support from LunarLake
Arnaud Lecomte <contact@arnaud-lcm.com>
bpf: Fix stackmap overflow check in __bpf_get_stackid()
Arnaud Lecomte <contact@arnaud-lcm.com>
bpf: Refactor stack map trace depth calculation into helper function
Haotian Zhang <vulab@iscas.ac.cn>
mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove
Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
mtd: nand: relax ECC parameter validation check
Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
Revert "mtd: rawnand: marvell: fix layouts"
Li Qiang <liqiang01@kylinos.cn>
wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload()
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/userq: fix SDMA and compute validation
Prike Liang <Prike.Liang@amd.com>
drm/amdgpu: add userq object va track helpers
Wolfram Sang <wsa+renesas@sang-engineering.com>
ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
Wolfram Sang <wsa+renesas@sang-engineering.com>
ARM: dts: renesas: gose: Remove superfluous port property
Zhu Yanjun <yanjun.zhu@linux.dev>
RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
Loic Poulain <loic.poulain@oss.qualcomm.com>
arm64: dts: qcom: qcm2290: Fix camss register prop ordering
Kuniyuki Iwashima <kuniyu@google.com>
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
Horatiu Vultur <horatiu.vultur@microchip.com>
phy: mscc: Fix PTP for VSC8574 and VSC8572
Michal Suchanek <msuchanek@suse.de>
perf hwmon_pmu: Fix uninitialized variable warning
Eric Gonçalves <ghatto404@gmail.com>
arm64: dts: qcom: sm8250-samsung-common: correct reserved pins
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name
Pengyu Luo <mitltlatltl@gmail.com>
arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels
Val Packett <val@packett.cool>
arm64: dts: qcom: x1-dell-thena: remove dp data-lanes
Val Packett <val@packett.cool>
arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD
Alexander Martinz <amartinz@shiftphones.com>
arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node
Neil Armstrong <neil.armstrong@linaro.org>
arm64: dts: qcom: sm8650: set ufs as dma coherent
Luca Weiss <luca.weiss@fairphone.com>
arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node
Gergo Koteles <soyer@irl.hu>
arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
Dzmitry Sankouski <dsankouski@gmail.com>
arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts
Dzmitry Sankouski <dsankouski@gmail.com>
arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells
Willy Tarreau <w@1wt.eu>
tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions
Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller
Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller
Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller
Peng Fan <peng.fan@nxp.com>
firmware: imx: scu-irq: fix OF node leak in
Randolph Sapp <rs@ti.com>
arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context
Thomas Richard <thomas.richard@bootlin.com>
leds: upboard: Fix module alias
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: remove duplicate call to ice_deinit_hw() on error paths
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: move ice_deinit_dev() to the end of deinit paths
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: extract ice_init_dev() from ice_init()
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: move ice_init_pf() out of ice_init_dev()
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf()
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: move ice_init_interrupt_scheme() prior ice_init_pf()
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: move service task start out of ice_init_pf()
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Fix uninitialized return value
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath12k: restore register window after global reset
Len Brown <len.brown@intel.com>
tools/power turbostat: Regression fix Uncore MHz printed in hex
Heiko Carstens <hca@linux.ibm.com>
s390/ap: Don't leak debug feature files if AP instructions are not available
Bart Van Assche <bvanassche@acm.org>
scsi: ufs: core: Move the ufshcd_enable_intr() declaration
Heiko Carstens <hca@linux.ibm.com>
s390/smp: Fix fallback CPU detection
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath11k: fix peer HE MCS assignment
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath11k: fix VHT MCS assignment
nieweiqiang <nieweiqiang@huawei.com>
crypto: hisilicon/qm - restore original qos values
Thorsten Blum <thorsten.blum@linux.dev>
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
Haotian Zhang <vulab@iscas.ac.cn>
soc: qcom: gsbi: fix double disable caused by devm
Luca Weiss <luca.weiss@fairphone.com>
clk: qcom: camcc-sm7150: Fix PLL config of PLL2
Luca Weiss <luca.weiss@fairphone.com>
clk: qcom: camcc-sm6350: Fix PLL config of PLL2
Luo Jie <quic_luoj@quicinc.com>
clk: qcom: gcc-ipq5424: Correct the icc_first_node_id
Taniya Das <taniya.das@oss.qualcomm.com>
clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks
Taniya Das <taniya.das@oss.qualcomm.com>
clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other
Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other
Sherry Sun <sherry.sun@nxp.com>
tty: serial: imx: Only configure the wake register when device is set as wakeup source
Li Qiang <liqiang01@kylinos.cn>
uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
Geert Uytterhoeven <geert+renesas@glider.be>
PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
Peter Griffin <peter.griffin@linaro.org>
arm64: dts: exynos: gs101: fix sysreg_apm reg property
Peter Griffin <peter.griffin@linaro.org>
arm64: dts: exynos: gs101: fix clock module unit reg sizes
Tianyou Li <tianyou.li@intel.com>
perf annotate: Check return value of evsel__get_arch() properly
Joy Zou <joy.zou@nxp.com>
arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan
Tim Harvey <tharvey@gateworks.com>
arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
Tim Harvey <tharvey@gateworks.com>
arm64: dts: imx8mp-venice-gw702x: remove off-board uart
Tim Harvey <tharvey@gateworks.com>
arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
Tim Harvey <tharvey@gateworks.com>
arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props
Daniel Borkmann <daniel@iogearbox.net>
bpf: Do not let BPF test infra emit invalid GSO types to stack
Bart Van Assche <bvanassche@acm.org>
block/mq-deadline: Switch back to a single dispatch list
Bart Van Assche <bvanassche@acm.org>
block/mq-deadline: Introduce dd_start_request()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove()
T Pratham <t-pratham@ti.com>
crypto: aead - Fix reqsize handling
Ian Rogers <irogers@google.com>
perf parse-events: Make X modifier more respectful of groups
Randy Dunlap <rdunlap@infradead.org>
firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
Francesco Lavra <flavra@baylibre.com>
iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K
Sidharth Seela <sidharthseela@gmail.com>
ntfs3: Fix uninit buffer allocated by __getname()
Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
ntfs3: fix uninit memory after failed mi_read in mi_format_new
Herbert Xu <herbert@gondor.apana.org.au>
crypto: authenc - Correctly pass EINPROGRESS back up to the caller
Johan Hovold <johan@kernel.org>
irqchip: Pass platform device to platform drivers
Johan Hovold <johan@kernel.org>
irqchip: Drop leftover brackets
Johan Hovold <johan@kernel.org>
irqchip/qcom-irq-combiner: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/starfive-jh8100: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/renesas-rzg2l: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/imx-mu-msi: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/irq-brcmstb-l2: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/irq-bcm7120-l2: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/irq-bcm7038-l1: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/bcm2712-mip: Fix section mismatch
Johan Hovold <johan@kernel.org>
irqchip/bcm2712-mip: Fix OF node reference imbalance
Fernand Sieber <sieberf@amazon.com>
sched/fair: Forfeit vruntime on yield
Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
wifi: ath12k: fix TX and RX MCS rate configurations in HE mode
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath12k: fix VHT MCS assignment
Sarika Sharma <sarika.sharma@oss.qualcomm.com>
wifi: ath12k: Fix MSDU buffer types handling in RX error path
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath11k: restore register window after global reset
Kang Yang <kang.yang@oss.qualcomm.com>
wifi: ath10k: move recovery check logic into a new work
Danilo Krummrich <dakr@kernel.org>
gpu: nova-core: gsp: do not unwrap() SGEntry
Danilo Krummrich <dakr@kernel.org>
gpu: nova-core: gsp: remove useless conversion
Ian Rogers <irogers@google.com>
perf parse-events: Fix legacy cache events if event is duplicated in a PMU
Wludzik, Jozef <jozef.wludzik@intel.com>
accel/ivpu: Fix race condition when mapping dmabuf
Josh Poimboeuf <jpoimboe@kernel.org>
objtool: Fix weak symbol detection
Dylan Hatch <dylanbhatch@google.com>
objtool: Fix standalone --hacks=jump_label
Peng Fan <peng.fan@nxp.com>
remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path
Mavroudis Chatzilazaridis <mavchatz@protonmail.com>
HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
Cyrille Pitchen <cyrille.pitchen@microchip.com>
drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler()
Marek Vasut <marek.vasut+renesas@mailbox.org>
clk: renesas: cpg-mssr: Read back reset registers to assure values latched
Marek Vasut <marek.vasut+renesas@mailbox.org>
clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
Biju Das <biju.das.jz@bp.renesas.com>
pinctrl: renesas: rzg2l: Fix PMC restore
Roberto Sassu <roberto.sassu@huawei.com>
ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook
Abel Vesa <abel.vesa@linaro.org>
pinctrl: qcom: glymur: Fix the gpio and egpio pin functions
Abel Vesa <abel.vesa@linaro.org>
pinctrl: qcom: glymur: Drop unnecessary platform data from match table
Ian Rogers <irogers@google.com>
perf bpf_counter: Fix opening of "any"(-1) CPU events
Seungjin Bae <eeodqql09@gmail.com>
USB: Fix descriptor count when handling invalid MBIM extended descriptor
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
tools/nolibc: handle NULL wstatus argument to waitpid()
Mykyta Yatsenko <yatsenko@meta.com>
bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq
Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpf: Fix sleepable context for async callbacks
Siddharth Chintamaneni <sidchintamaneni@gmail.com>
bpf: Cleanup unused func args in rqspinlock implementation
Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
drm/vgem-fence: Fix potential deadlock on release
Karol Wachowski <karol.wachowski@linux.intel.com>
accel/ivpu: Fix DCT active percent format
Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
accel/ivpu: Rework bind/unbind of imported buffers
Guido Günther <agx@sigxcpu.org>
drm/panel: visionox-rm69299: Don't clear all mode flags
Guido Günther <agx@sigxcpu.org>
drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq
Karol Wachowski <karol.wachowski@linux.intel.com>
accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object
Lizhi Hou <lizhi.hou@amd.com>
accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array()
Mainak Sen <msen@nvidia.com>
gpu: host1x: Fix race in syncpt alloc/free
Konstantin Andreev <andreev@swemel.ru>
smack: fix bug: setting task label silently ignores input garbage
Konstantin Andreev <andreev@swemel.ru>
smack: fix bug: unprivileged task can create labels
Konstantin Andreev <andreev@swemel.ru>
smack: fix bug: invalid label of unix socket file
Konstantin Andreev <andreev@swemel.ru>
smack: always "instantiate" inode in smack_inode_init_security()
Konstantin Andreev <andreev@swemel.ru>
smack: deduplicate xattr setting in smack_inode_init_security()
Konstantin Andreev <andreev@swemel.ru>
smack: deduplicate "does access rule request transmutation"
Konstantin Andreev <andreev@swemel.ru>
smack: fix bug: SMACK64TRANSMUTE set on non-directory
-------------
Diffstat:
Documentation/admin-guide/LSM/Smack.rst | 16 +-
.../devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +-
Documentation/hwmon/g762.rst | 2 +-
Makefile | 4 +-
arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 -
.../arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 -
arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 +
arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 +
.../boot/dts/samsung/exynos4210-universal_c210.dts | 1 +
arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 +
.../dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 +-
arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi | 2 +-
arch/arm/boot/dts/ti/omap/am335x-boneblue.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-evm.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-evmsk.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-guardian.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-icev2.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts | 2 +-
.../boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 +-
.../arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-pdu001.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 2 +-
arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 +-
arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +-
arch/arm/include/asm/word-at-a-time.h | 10 +-
arch/arm64/boot/dts/amlogic/meson-g12b.dtsi | 4 +-
arch/arm64/boot/dts/exynos/google/gs101.dtsi | 18 +-
.../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 -
.../boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 ---
.../boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 -
arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 +
.../arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 4 +-
arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +-
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 61 ++++
arch/arm64/boot/dts/qcom/ipq5424.dtsi | 2 +-
arch/arm64/boot/dts/qcom/lemans.dtsi | 1 +
arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +
arch/arm64/boot/dts/qcom/qcm2290.dtsi | 10 +-
arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 +
arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 +
arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +-
arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 170 +++++-----
.../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 +-
.../boot/dts/qcom/sdm845-samsung-starqltechn.dts | 16 +-
.../arm64/boot/dts/qcom/sm8250-samsung-common.dtsi | 3 +-
arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +
arch/arm64/boot/dts/qcom/sm8750-mtp.dts | 6 +-
arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 5 +-
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 +-
.../boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 +-
arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 +
.../boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi | 4 +-
.../boot/dts/rockchip/rk3588-rock-5b-plus.dts | 5 +
arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 +
arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts | 4 +
arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 +-
arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 +-
.../boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 4 +-
arch/arm64/mm/mmu.c | 214 +++++++-----
arch/arm64/mm/pageattr.c | 5 +-
arch/powerpc/kernel/entry_32.S | 10 +-
arch/powerpc/kexec/ranges.c | 2 +-
arch/powerpc/mm/book3s64/hash_utils.c | 10 +-
arch/powerpc/mm/ptdump/hashpagetable.c | 6 +
arch/riscv/kvm/vcpu_insn.c | 22 ++
arch/s390/include/asm/fpu-insn.h | 3 +
arch/s390/kernel/smp.c | 1 +
arch/um/Kconfig | 1 +
arch/um/Makefile | 12 +-
arch/um/include/asm/kasan.h | 4 -
arch/x86/boot/compressed/pgtable_64.c | 11 +-
arch/x86/events/core.c | 5 +-
arch/x86/events/intel/core.c | 7 +-
arch/x86/events/intel/cstate.c | 3 +-
arch/x86/kernel/dumpstack.c | 23 +-
block/blk-lib.c | 6 +-
block/blk-mq.c | 35 +-
block/blk-throttle.c | 9 +-
block/mq-deadline.c | 129 ++++---
crypto/aead.c | 1 +
crypto/ahash.c | 18 +-
crypto/asymmetric_keys/asymmetric_type.c | 12 +-
crypto/authenc.c | 75 +++--
drivers/accel/amdxdna/aie2_ctx.c | 22 +-
drivers/accel/amdxdna/aie2_pci.c | 10 +-
drivers/accel/amdxdna/amdxdna_ctx.c | 1 +
drivers/accel/amdxdna/amdxdna_ctx.h | 1 +
drivers/accel/amdxdna/amdxdna_gem.c | 47 ++-
drivers/accel/amdxdna/amdxdna_mailbox.c | 1 +
drivers/accel/ivpu/ivpu_gem.c | 97 ++++--
drivers/accel/ivpu/ivpu_gem.h | 2 +-
drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +-
drivers/accel/ivpu/ivpu_hw_btrs.h | 2 +-
drivers/accel/ivpu/ivpu_job.c | 6 +-
drivers/accel/ivpu/ivpu_pm.c | 9 +-
drivers/acpi/apei/ghes.c | 27 +-
drivers/acpi/processor_core.c | 2 +-
drivers/acpi/property.c | 1 +
drivers/base/firmware_loader/Kconfig | 2 +-
drivers/block/nbd.c | 5 +-
drivers/block/ps3disk.c | 4 +
drivers/block/ublk_drv.c | 4 +-
drivers/char/random.c | 19 +-
drivers/clk/Makefile | 3 +-
drivers/clk/qcom/camcc-sm6350.c | 13 +-
drivers/clk/qcom/camcc-sm7150.c | 6 +-
drivers/clk/qcom/camcc-sm8550.c | 10 +
drivers/clk/qcom/clk-rpmh.c | 1 +
drivers/clk/qcom/gcc-glymur.c | 24 +-
drivers/clk/qcom/gcc-ipq5424.c | 3 +-
drivers/clk/qcom/gcc-qcs615.c | 6 +-
drivers/clk/qcom/gcc-sm8750.c | 1 +
drivers/clk/qcom/tcsrcc-glymur.c | 54 +--
drivers/clk/renesas/r9a06g032-clocks.c | 6 +-
drivers/clk/renesas/r9a09g077-cpg.c | 4 +-
drivers/clk/renesas/renesas-cpg-mssr.c | 57 ++--
drivers/clk/spacemit/ccu-k1.c | 4 +-
drivers/clocksource/arm_arch_timer_mmio.c | 2 +
drivers/clocksource/timer-nxp-pit.c | 3 +-
drivers/clocksource/timer-nxp-stm.c | 23 +-
drivers/clocksource/timer-ralink.c | 11 +-
drivers/cpufreq/amd-pstate.c | 2 +-
drivers/crypto/ccree/cc_buffer_mgr.c | 6 +-
drivers/crypto/hisilicon/qm.c | 14 +-
drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +-
drivers/crypto/starfive/jh7110-hash.c | 6 +-
drivers/devfreq/hisi_uncore_freq.c | 3 +-
drivers/firmware/efi/cper-arm.c | 52 ++-
drivers/firmware/efi/cper.c | 60 ++++
drivers/firmware/efi/libstub/x86-5lvl.c | 4 +-
drivers/firmware/imx/imx-scu-irq.c | 4 +-
drivers/firmware/stratix10-svc.c | 1 +
drivers/firmware/ti_sci.c | 21 +-
drivers/firmware/ti_sci.h | 2 +
drivers/gpio/Kconfig | 1 -
drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 +-
drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 31 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 ++-
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 4 +-
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +-
drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 +-
drivers/gpu/drm/drm_plane.c | 8 +-
drivers/gpu/drm/i915/display/intel_fbdev.c | 43 ++-
drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 42 +--
drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 8 +-
drivers/gpu/drm/imagination/pvr_device.c | 2 +-
drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +-
drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 +-
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 +-
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 -
drivers/gpu/drm/msm/msm_gpu.c | 21 +-
.../gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c | 20 --
.../drm/nouveau/include/dispnv04/i2c/encoder_i2c.h | 19 +-
drivers/gpu/drm/nouveau/nouveau_fence.c | 6 +-
drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 +-
drivers/gpu/drm/nova/Kconfig | 1 +
drivers/gpu/drm/panel/panel-novatek-nt35560.c | 8 +-
drivers/gpu/drm/panel/panel-visionox-rm69299.c | 4 +-
drivers/gpu/drm/panthor/panthor_device.c | 4 +-
drivers/gpu/drm/panthor/panthor_gem.c | 20 +-
drivers/gpu/drm/panthor/panthor_mmu.c | 18 +-
drivers/gpu/drm/panthor/panthor_sched.c | 25 +-
.../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 4 +-
drivers/gpu/drm/tidss/tidss_dispc.c | 93 +++--
drivers/gpu/drm/tidss/tidss_dispc.h | 3 -
drivers/gpu/drm/tidss/tidss_drv.h | 2 +
drivers/gpu/drm/tidss/tidss_oldi.c | 22 ++
drivers/gpu/drm/vgem/vgem_fence.c | 2 +-
drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 32 +-
drivers/gpu/drm/xe/xe_exec_queue.c | 3 +
drivers/gpu/host1x/syncpt.c | 4 +-
drivers/gpu/nova-core/firmware/gsp.rs | 8 +-
drivers/greybus/gb-beagleplay.c | 12 +-
drivers/hid/hid-logitech-hidpp.c | 9 +-
drivers/hv/mshv_root_main.c | 89 +++--
drivers/hwmon/sy7636a-hwmon.c | 7 +-
drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
drivers/hwtracing/coresight/coresight-etm3x-core.c | 59 ++--
drivers/hwtracing/coresight/coresight-etm4x-core.c | 103 ++++--
drivers/hwtracing/coresight/coresight-etm4x.h | 3 -
drivers/hwtracing/coresight/coresight-tmc-etr.c | 10 +-
drivers/i2c/busses/i2c-k1.c | 19 +-
drivers/i3c/master.c | 8 +-
drivers/i3c/master/svc-i3c-master.c | 22 +-
drivers/iio/imu/bmi270/bmi270_spi.c | 2 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +-
drivers/iio/industrialio-core.c | 17 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +-
drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +-
drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 +-
drivers/infiniband/hw/irdma/cm.c | 2 +-
drivers/infiniband/hw/irdma/ctrl.c | 6 +-
drivers/infiniband/hw/irdma/icrdma_if.c | 6 +-
drivers/infiniband/hw/irdma/ig3rdma_if.c | 4 +
drivers/infiniband/hw/irdma/main.h | 2 +-
drivers/infiniband/hw/irdma/pble.c | 6 +-
drivers/infiniband/hw/irdma/puda.c | 1 -
drivers/infiniband/hw/irdma/uk.c | 31 +-
drivers/infiniband/hw/irdma/user.h | 1 -
drivers/infiniband/hw/irdma/verbs.c | 24 +-
drivers/infiniband/hw/irdma/verbs.h | 3 +-
drivers/infiniband/sw/rxe/rxe_srq.c | 7 +-
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +-
drivers/interconnect/debugfs-client.c | 7 +-
drivers/interconnect/qcom/msm8996.c | 1 +
drivers/iommu/amd/debugfs.c | 2 +-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 +-
drivers/iommu/intel/Kconfig | 2 +-
drivers/iommu/intel/iommu.h | 2 +-
drivers/irqchip/irq-bcm2712-mip.c | 11 +-
drivers/irqchip/irq-bcm7038-l1.c | 11 +-
drivers/irqchip/irq-bcm7120-l2.c | 31 +-
drivers/irqchip/irq-brcmstb-l2.c | 25 +-
drivers/irqchip/irq-imx-mu-msi.c | 28 +-
drivers/irqchip/irq-mchp-eic.c | 7 +-
drivers/irqchip/irq-meson-gpio.c | 5 +-
drivers/irqchip/irq-qcom-mpm.c | 6 +-
drivers/irqchip/irq-renesas-rzg2l.c | 37 +-
drivers/irqchip/irq-renesas-rzv2h.c | 32 +-
drivers/irqchip/irq-starfive-jh8100-intc.c | 6 +-
drivers/irqchip/irqchip.c | 10 +-
drivers/irqchip/qcom-irq-combiner.c | 2 +-
drivers/irqchip/qcom-pdc.c | 5 +-
drivers/leds/leds-netxbig.c | 36 +-
drivers/leds/leds-upboard.c | 2 +-
drivers/leds/rgb/leds-qcom-lpg.c | 4 +-
drivers/macintosh/mac_hid.c | 3 +-
drivers/md/dm-log-writes.c | 1 +
drivers/md/dm-raid.c | 2 +
drivers/md/md.c | 92 ++---
drivers/md/md.h | 9 +-
drivers/md/raid5.c | 6 +-
drivers/mfd/da9055-core.c | 1 +
drivers/mfd/mt6358-irq.c | 1 +
drivers/mfd/mt6397-irq.c | 1 +
drivers/misc/rp1/rp1_pci.c | 3 +
drivers/mtd/lpddr/lpddr_cmds.c | 8 +-
drivers/mtd/nand/raw/lpc32xx_slc.c | 2 +
drivers/mtd/nand/raw/marvell_nand.c | 13 +-
drivers/mtd/nand/raw/nand_base.c | 13 +-
drivers/mtd/nand/raw/renesas-nand-controller.c | 5 +-
drivers/net/dsa/b53/b53_common.c | 331 ++++++++++++------
drivers/net/dsa/b53/b53_priv.h | 111 +++++-
drivers/net/dsa/b53/b53_regs.h | 41 ++-
drivers/net/dsa/xrs700x/xrs700x.c | 11 +
drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 +
drivers/net/ethernet/intel/ice/devlink/devlink.c | 21 +-
drivers/net/ethernet/intel/ice/ice.h | 4 +
drivers/net/ethernet/intel/ice/ice_common.c | 3 +
drivers/net/ethernet/intel/ice/ice_main.c | 169 +++++-----
drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 +-
drivers/net/phy/adin1100.c | 2 +-
drivers/net/phy/aquantia/aquantia_firmware.c | 2 +-
drivers/net/phy/mscc/mscc_main.c | 6 +-
drivers/net/phy/phy-core.c | 43 +++
drivers/net/phy/realtek/realtek_main.c | 65 ++--
drivers/net/vxlan/vxlan_core.c | 18 +-
drivers/net/wireless/ath/ath10k/core.c | 20 +-
drivers/net/wireless/ath/ath10k/core.h | 2 +-
drivers/net/wireless/ath/ath10k/mac.c | 2 +-
drivers/net/wireless/ath/ath11k/mac.c | 8 +-
drivers/net/wireless/ath/ath11k/pci.c | 20 +-
drivers/net/wireless/ath/ath11k/wmi.c | 20 +-
drivers/net/wireless/ath/ath11k/wmi.h | 2 +
drivers/net/wireless/ath/ath12k/core.c | 24 +-
drivers/net/wireless/ath/ath12k/core.h | 1 -
drivers/net/wireless/ath/ath12k/dp_rx.c | 70 +++-
drivers/net/wireless/ath/ath12k/hal_rx.c | 10 +-
drivers/net/wireless/ath/ath12k/mac.c | 28 +-
drivers/net/wireless/ath/ath12k/pci.c | 20 +-
drivers/net/wireless/ath/ath12k/qmi.c | 11 +-
drivers/net/wireless/ath/ath12k/qmi.h | 5 +-
drivers/net/wireless/ath/ath12k/wmi.c | 23 +-
drivers/net/wireless/ath/ath12k/wmi.h | 2 +
drivers/net/wireless/ath/ath12k/wow.c | 1 +
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 +
drivers/net/wireless/mediatek/mt76/mac80211.c | 2 -
drivers/net/wireless/mediatek/mt76/mt76.h | 9 +
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 -
drivers/net/wireless/mediatek/mt76/mt7996/dma.c | 15 +-
drivers/net/wireless/mediatek/mt76/mt7996/init.c | 19 +-
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 18 +-
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 115 ++++---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 69 ++--
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 +
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +-
drivers/net/wireless/mediatek/mt76/wed.c | 10 +-
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +-
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 +-
drivers/net/wireless/realtek/rtw89/usb.c | 13 +-
drivers/net/wireless/st/cw1200/bh.c | 6 +-
drivers/nvme/host/auth.c | 2 +-
drivers/of/fdt.c | 85 +++--
drivers/of/of_kunit_helpers.c | 5 +-
drivers/pci/controller/Kconfig | 7 +-
drivers/pci/controller/cadence/pcie-sg2042.c | 3 -
drivers/pci/controller/dwc/pci-keystone.c | 2 +
drivers/pci/controller/dwc/pcie-designware.h | 2 +-
drivers/pci/controller/dwc/pcie-stm32-ep.c | 41 +--
drivers/pci/endpoint/functions/pci-epf-test.c | 5 +-
drivers/pci/setup-bus.c | 5 +
drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 +-
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 +-
drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 15 +
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 27 +-
drivers/pinctrl/pinctrl-single.c | 7 +-
drivers/pinctrl/qcom/pinctrl-glymur.c | 6 +-
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 +-
drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +-
drivers/platform/x86/asus-wmi.c | 8 +-
drivers/platform/x86/intel/pmc/core.h | 2 +-
drivers/power/supply/apm_power.c | 3 +-
drivers/power/supply/cw2015_battery.c | 8 +-
drivers/power/supply/max17040_battery.c | 6 +-
drivers/power/supply/qcom_battmgr.c | 26 +-
drivers/power/supply/rt5033_charger.c | 2 +
drivers/power/supply/rt9467-charger.c | 6 +-
drivers/power/supply/wm831x_power.c | 10 +-
drivers/pwm/core.c | 5 +-
drivers/pwm/pwm-bcm2835.c | 28 +-
drivers/ras/ras.c | 40 ++-
drivers/regulator/core.c | 37 +-
drivers/regulator/fixed.c | 11 +-
drivers/regulator/pca9450-regulator.c | 7 +-
drivers/regulator/spacemit-p1.c | 4 +-
drivers/remoteproc/imx_rproc.c | 9 +-
drivers/remoteproc/qcom_q6v5_wcss.c | 8 +-
drivers/rtc/rtc-amlogic-a4.c | 4 -
drivers/rtc/rtc-gamecube.c | 4 +
drivers/rtc/rtc-max31335.c | 6 +-
drivers/s390/crypto/ap_bus.c | 8 +-
drivers/scsi/imm.c | 1 +
drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
drivers/scsi/qla2xxx/qla_os.c | 20 +-
drivers/scsi/qla2xxx/qla_target.c | 5 +-
drivers/scsi/qla2xxx/qla_target.h | 1 +
drivers/scsi/sim710.c | 2 +
drivers/scsi/smartpqi/smartpqi_init.c | 19 ++
drivers/scsi/stex.c | 1 +
drivers/soc/qcom/qcom_gsbi.c | 8 -
drivers/soc/qcom/smem.c | 3 +-
drivers/soc/renesas/r9a08g045-sysc.c | 69 ++++
drivers/soc/renesas/r9a09g047-sys.c | 79 +++++
drivers/soc/renesas/r9a09g056-sys.c | 69 ++++
drivers/soc/renesas/r9a09g057-sys.c | 101 ++++++
drivers/soc/renesas/rz-sysc.c | 2 +
drivers/soc/renesas/rz-sysc.h | 4 +
drivers/soc/samsung/exynos-pmu.c | 7 +-
drivers/soc/tegra/fuse/speedo-tegra210.c | 58 +++-
drivers/spi/spi-airoha-snfi.c | 25 +-
drivers/spi/spi-ch341.c | 2 +-
drivers/spi/spi-sg2044-nor.c | 4 +-
drivers/spi/spi-tegra210-quad.c | 22 +-
drivers/staging/fbtft/fbtft-core.c | 4 +-
drivers/staging/most/Kconfig | 2 -
drivers/staging/most/Makefile | 1 -
drivers/staging/most/i2c/Kconfig | 13 -
drivers/staging/most/i2c/Makefile | 4 -
drivers/staging/most/i2c/i2c.c | 374 ---------------------
drivers/target/target_core_configfs.c | 1 -
drivers/target/target_core_stat.c | 24 +-
drivers/tty/serial/imx.c | 14 +
drivers/ufs/core/ufshcd-priv.h | 2 +
drivers/ufs/core/ufshcd.c | 27 +-
drivers/ufs/host/ufs-rockchip.c | 19 +-
drivers/uio/uio_fsl_elbc_gpcm.c | 7 +
drivers/usb/core/message.c | 2 +-
drivers/usb/dwc2/platform.c | 17 +-
drivers/usb/dwc3/host.c | 5 +-
drivers/usb/gadget/legacy/raw_gadget.c | 3 +
drivers/usb/gadget/udc/tegra-xudc.c | 6 -
drivers/usb/misc/chaoskey.c | 16 +-
drivers/usb/phy/phy.c | 4 +
drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 2 +
drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +-
drivers/vdpa/pds/vdpa_dev.c | 2 +-
drivers/vfio/pci/vfio_pci_core.c | 68 ++--
drivers/vfio/pci/vfio_pci_intrs.c | 52 +--
drivers/vfio/pci/vfio_pci_priv.h | 4 +
drivers/vhost/net.c | 12 +-
drivers/vhost/vhost.c | 4 +-
drivers/video/backlight/led_bl.c | 13 +
drivers/video/fbdev/ssd1307fb.c | 4 +-
drivers/virtio/virtio.c | 12 +-
drivers/virtio/virtio_debug.c | 10 +-
drivers/virtio/virtio_pci_modern_dev.c | 6 +-
drivers/virtio/virtio_ring.c | 7 +-
drivers/virtio/virtio_vdpa.c | 2 +-
drivers/watchdog/starfive-wdt.c | 4 +-
drivers/watchdog/wdat_wdt.c | 64 ++--
fs/9p/v9fs.c | 4 +-
fs/9p/vfs_file.c | 11 +-
fs/9p/vfs_inode.c | 3 +-
fs/9p/vfs_inode_dotl.c | 2 +-
fs/btrfs/block-group.c | 6 +-
fs/btrfs/ctree.c | 2 +-
fs/btrfs/delayed-ref.c | 43 ++-
fs/btrfs/scrub.c | 2 +-
fs/btrfs/space-info.c | 22 +-
fs/btrfs/space-info.h | 6 +-
fs/erofs/super.c | 38 ++-
fs/exfat/balloc.c | 2 +-
fs/exfat/namei.c | 20 +-
fs/ext4/mballoc.c | 49 ++-
fs/ext4/move_extent.c | 2 +-
fs/f2fs/f2fs.h | 2 +
fs/f2fs/gc.c | 132 +++++---
fs/f2fs/recovery.c | 2 +-
fs/f2fs/segment.c | 38 ++-
fs/f2fs/segment.h | 8 +-
fs/f2fs/super.c | 14 +
fs/f2fs/sysfs.c | 7 +
fs/fuse/control.c | 19 +-
fs/gfs2/glock.c | 5 +-
fs/gfs2/inode.c | 15 +
fs/gfs2/inode.h | 1 +
fs/gfs2/ops_fstype.c | 2 +-
fs/hfs/catalog.c | 2 +-
fs/inode.c | 58 ++--
fs/iomap/direct-io.c | 23 +-
fs/kernfs/dir.c | 5 +-
fs/nfs/client.c | 21 +-
fs/nfs/dir.c | 27 +-
fs/nfs/internal.h | 3 +-
fs/nfs/localio.c | 4 +-
fs/nfs/namespace.c | 11 +-
fs/nfs/nfs4client.c | 18 +-
fs/nfs/nfs4proc.c | 27 +-
fs/nfs/pnfs.c | 1 +
fs/nfs/super.c | 33 +-
fs/nfsd/blocklayout.c | 4 +-
fs/nls/nls_base.c | 27 +-
fs/ntfs3/frecord.c | 8 +-
fs/ntfs3/fsntfs.c | 9 +-
fs/ntfs3/inode.c | 7 +-
fs/ocfs2/alloc.c | 1 -
fs/ocfs2/inode.c | 10 +-
fs/ocfs2/move_extents.c | 8 +-
fs/pidfs.c | 2 +
fs/smb/client/cifssmb.c | 2 +-
fs/smb/client/smb2pdu.c | 2 +-
fs/smb/client/smbdirect.c | 28 +-
fs/smb/common/smbdirect/smbdirect_socket.h | 51 +++
fs/smb/server/transport_rdma.c | 40 ++-
fs/tracefs/event_inode.c | 3 +-
include/asm-generic/mshyperv.h | 17 +-
include/asm-generic/rqspinlock.h | 60 ++--
include/linux/blk_types.h | 5 +-
include/linux/cleanup.h | 15 +-
include/linux/coresight.h | 35 +-
include/linux/cper.h | 12 +-
include/linux/f2fs_fs.h | 5 +-
include/linux/filter.h | 12 +-
include/linux/firmware/qcom/qcom_tzmem.h | 15 +-
include/linux/ieee80211.h | 4 +-
include/linux/if_hsr.h | 9 +
include/linux/irq-entry-common.h | 2 +-
include/linux/irqchip.h | 8 +-
include/linux/netdevice.h | 1 +
include/linux/nfs_fs_sb.h | 5 +
include/linux/ns_common.h | 11 +
include/linux/of_fdt.h | 9 +
include/linux/phy.h | 3 +
include/linux/platform_data/lp855x.h | 4 +-
include/linux/ras.h | 16 +-
include/linux/soc/mediatek/mtk_wed.h | 1 +
include/linux/vfio_pci_core.h | 10 +-
include/linux/virtio.h | 2 +-
include/linux/virtio_config.h | 24 +-
include/linux/virtio_features.h | 29 +-
include/linux/virtio_pci_modern.h | 8 +-
include/net/netfilter/nf_conntrack_count.h | 15 +-
include/ras/ras_event.h | 49 ++-
include/sound/tas2781.h | 2 +-
include/target/target_core_base.h | 12 +-
include/uapi/linux/pidfd.h | 1 +
include/uapi/sound/asound.h | 2 +-
include/ufs/ufshcd.h | 1 -
io_uring/io_uring.c | 10 +-
io_uring/kbuf.c | 10 +-
io_uring/zcrx.c | 16 +-
kernel/bpf/hashtab.c | 10 +-
kernel/bpf/helpers.c | 3 +
kernel/bpf/rqspinlock.c | 36 +-
kernel/bpf/stackmap.c | 62 ++--
kernel/bpf/syscall.c | 6 +-
kernel/bpf/trampoline.c | 4 +-
kernel/bpf/verifier.c | 89 +++--
kernel/cgroup/cpuset.c | 35 +-
kernel/cgroup/namespace.c | 2 +-
kernel/cpu.c | 25 +-
kernel/dma/pool.c | 2 +-
kernel/events/core.c | 22 +-
kernel/locking/locktorture.c | 8 +-
kernel/resource.c | 10 +-
kernel/sched/fair.c | 17 +-
kernel/sched/stats.h | 7 +-
kernel/task_work.c | 8 +-
kernel/time/timer_migration.c | 264 ++++++++-------
lib/vsprintf.c | 6 +-
net/bpf/test_run.c | 5 +
net/core/dev.h | 1 -
net/core/filter.c | 16 +-
net/core/netpoll.c | 2 +-
net/hsr/hsr_device.c | 20 ++
net/hsr/hsr_slave.c | 7 +-
net/ipv6/ip6_fib.c | 4 +
net/mac80211/aes_cmac.c | 63 +++-
net/mac80211/aes_cmac.h | 8 +-
net/mac80211/wpa.c | 20 +-
net/netfilter/nf_conncount.c | 195 +++++++----
net/netfilter/nft_connlimit.c | 34 +-
net/netfilter/nft_flow_offload.c | 9 +-
net/netfilter/xt_connlimit.c | 14 +-
net/openvswitch/conntrack.c | 16 +-
net/sched/sch_cake.c | 60 ++--
net/sctp/socket.c | 5 +-
scripts/cc-can-link.sh | 2 +-
scripts/lib/kdoc/kdoc_parser.py | 16 +-
scripts/package/install-extmod-build | 2 +-
security/integrity/ima/ima_main.c | 40 ++-
security/integrity/ima/ima_policy.c | 2 +-
security/landlock/errata/abi-1.h | 16 +
security/landlock/fs.c | 40 ++-
security/smack/smack.h | 3 +
security/smack/smack_access.c | 93 +++--
security/smack/smack_lsm.c | 277 ++++++++++-----
sound/firewire/dice/dice-extension.c | 4 +-
sound/firewire/motu/motu-hwdep.c | 7 +-
sound/hda/codecs/realtek/alc269.c | 2 +
sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 +
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 +--
sound/isa/wavefront/wavefront_midi.c | 2 +
sound/isa/wavefront/wavefront_synth.c | 4 +-
sound/soc/amd/acp/acp-i2s.c | 2 +
sound/soc/amd/acp/acp-legacy-common.c | 30 +-
sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +-
sound/soc/codecs/Kconfig | 5 +
sound/soc/codecs/Makefile | 2 +
sound/soc/codecs/ak4458.c | 10 +-
sound/soc/codecs/ak5558.c | 10 +-
sound/soc/codecs/nau8325.c | 3 +-
sound/soc/codecs/tas2781-comlib-i2c.c | 2 +-
sound/soc/codecs/tas2781-i2c.c | 2 +-
sound/soc/fsl/fsl_xcvr.c | 2 +-
sound/soc/intel/catpt/pcm.c | 4 +-
sound/soc/sdca/sdca_functions.c | 2 +-
tools/bpf/bpftool/sign.c | 6 +
tools/include/nolibc/arch-x86.h | 6 +-
tools/include/nolibc/dirent.h | 6 +-
tools/include/nolibc/stdio.h | 4 +
tools/include/nolibc/sys/wait.h | 18 +-
tools/lib/bpf/btf.c | 4 +-
tools/objtool/check.c | 3 +-
tools/objtool/elf.c | 8 +-
tools/perf/builtin-kvm.c | 2 +-
tools/perf/builtin-record.c | 2 +-
tools/perf/builtin-stat.c | 15 +-
.../pmu-events/arch/s390/cf_z16/transaction.json | 8 +-
.../pmu-events/arch/s390/cf_z17/transaction.json | 8 +-
tools/perf/util/annotate.c | 2 +-
.../util/arm-spe-decoder/arm-spe-pkt-decoder.c | 25 +-
.../util/arm-spe-decoder/arm-spe-pkt-decoder.h | 15 +-
tools/perf/util/bpf_counter.c | 7 +-
tools/perf/util/bpf_lock_contention.c | 6 +-
tools/perf/util/evsel.c | 2 +-
tools/perf/util/genelf.c | 32 +-
tools/perf/util/hist.c | 6 +-
tools/perf/util/hist.h | 8 +-
tools/perf/util/hwmon_pmu.c | 3 +-
tools/perf/util/parse-events.c | 44 ++-
tools/perf/util/parse-events.h | 3 +-
tools/perf/util/parse-events.y | 2 +-
tools/perf/util/symbol.c | 5 +-
tools/power/x86/turbostat/turbostat.c | 12 +-
tools/testing/selftests/bpf/.gitignore | 1 +
tools/testing/selftests/bpf/Makefile | 6 +-
.../selftests/bpf/prog_tests/kmem_cache_iter.c | 3 +-
.../selftests/bpf/prog_tests/perf_branches.c | 22 +-
.../testing/selftests/bpf/prog_tests/send_signal.c | 5 +
.../selftests/bpf/progs/test_perf_branches.c | 3 +
tools/testing/selftests/bpf/test_tag.c | 2 +-
.../drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 +
tools/testing/selftests/landlock/Makefile | 2 +-
.../tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 +
.../net/packetdrill/tcp_zerocopy_basic.pkt | 2 +
.../net/packetdrill/tcp_zerocopy_batch.pkt | 2 +
.../net/packetdrill/tcp_zerocopy_client.pkt | 2 +
.../net/packetdrill/tcp_zerocopy_closed.pkt | 2 +
.../net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 +
.../packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 +
.../net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 +
.../packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 +
.../packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 +
.../net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 +
.../net/packetdrill/tcp_zerocopy_small.pkt | 2 +
tools/tracing/rtla/Makefile.rtla | 2 +-
tools/tracing/rtla/src/common.c | 24 +-
tools/tracing/rtla/src/osnoise_hist.c | 3 +-
tools/tracing/rtla/src/osnoise_top.c | 3 +-
tools/tracing/rtla/src/timerlat.c | 3 +-
tools/tracing/rtla/src/timerlat_hist.c | 3 +-
tools/tracing/rtla/src/timerlat_top.c | 3 +-
tools/tracing/rtla/tests/osnoise.t | 6 +-
tools/tracing/rtla/tests/timerlat.t | 4 +-
616 files changed, 6319 insertions(+), 3850 deletions(-)
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 001/614] smack: fix bug: SMACK64TRANSMUTE set on non-directory
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 002/614] smack: deduplicate "does access rule request transmutation" Greg Kroah-Hartman
` (626 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 195da3ff244deff119c3f5244b464b2236ea1725 ]
When a new file system object is created
and the conditions for label transmutation are met,
the SMACK64TRANSMUTE extended attribute is set
on the object regardless of its type:
file, pipe, socket, symlink, or directory.
However,
SMACK64TRANSMUTE may only be set on directories.
This bug is a combined effect of the commits [1] and [2]
which both transfer functionality
from smack_d_instantiate() to smack_inode_init_security(),
but only in part.
Commit [1] set blank SMACK64TRANSMUTE on improper object types.
Commit [2] set "TRUE" SMACK64TRANSMUTE on improper object types.
[1] 2023-06-10,
Fixes: baed456a6a2f ("smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20230610075738.3273764-3-roberto.sassu@huaweicloud.com/
[2] 2023-11-16,
Fixes: e63d86b8b764 ("smack: Initialize the in-memory inode in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20231116090125.187209-5-roberto.sassu@huaweicloud.com/
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index af986587841d8..39a4caeb6bc8e 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1015,18 +1015,20 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
if (tsp->smk_task != tsp->smk_transmuted)
isp = issp->smk_inode = dsp;
- issp->smk_flags |= SMK_INODE_TRANSMUTE;
- xattr_transmute = lsm_get_xattr_slot(xattrs,
- xattr_count);
- if (xattr_transmute) {
- xattr_transmute->value = kmemdup(TRANS_TRUE,
- TRANS_TRUE_SIZE,
- GFP_NOFS);
- if (!xattr_transmute->value)
- return -ENOMEM;
-
- xattr_transmute->value_len = TRANS_TRUE_SIZE;
- xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
+ if (S_ISDIR(inode->i_mode)) {
+ issp->smk_flags |= SMK_INODE_TRANSMUTE;
+ xattr_transmute = lsm_get_xattr_slot(xattrs,
+ xattr_count);
+ if (xattr_transmute) {
+ xattr_transmute->value = kmemdup(TRANS_TRUE,
+ TRANS_TRUE_SIZE,
+ GFP_NOFS);
+ if (!xattr_transmute->value)
+ return -ENOMEM;
+
+ xattr_transmute->value_len = TRANS_TRUE_SIZE;
+ xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 002/614] smack: deduplicate "does access rule request transmutation"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 001/614] smack: fix bug: SMACK64TRANSMUTE set on non-directory Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 003/614] smack: deduplicate xattr setting in smack_inode_init_security() Greg Kroah-Hartman
` (625 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 635a01da8385fc00a144ec24684100bd1aa9db11 ]
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Stable-dep-of: 78fc6a94be25 ("smack: fix bug: invalid label of unix socket file")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 57 +++++++++++++++++++++-----------------
1 file changed, 32 insertions(+), 25 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 39a4caeb6bc8e..a005f5afb8e0d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -962,6 +962,24 @@ static int smack_inode_alloc_security(struct inode *inode)
return 0;
}
+/**
+ * smk_rule_transmutes - does access rule for (subject,object) contain 't'?
+ * @subject: a pointer to the subject's Smack label entry
+ * @object: a pointer to the object's Smack label entry
+ */
+static bool
+smk_rule_transmutes(struct smack_known *subject,
+ const struct smack_known *object)
+{
+ int may;
+
+ rcu_read_lock();
+ may = smk_access_entry(subject->smk_known, object->smk_known,
+ &subject->smk_rules);
+ rcu_read_unlock();
+ return (may > 0) && (may & MAY_TRANSMUTE);
+}
+
/**
* smack_inode_init_security - copy out the smack from an inode
* @inode: the newly created inode
@@ -977,23 +995,19 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
struct xattr *xattrs, int *xattr_count)
{
struct task_smack *tsp = smack_cred(current_cred());
- struct inode_smack *issp = smack_inode(inode);
- struct smack_known *skp = smk_of_task(tsp);
- struct smack_known *isp = smk_of_inode(inode);
+ struct inode_smack * const issp = smack_inode(inode);
struct smack_known *dsp = smk_of_inode(dir);
struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
- int may;
+ bool trans_cred;
+ bool trans_rule;
/*
* If equal, transmuting already occurred in
* smack_dentry_create_files_as(). No need to check again.
*/
- if (tsp->smk_task != tsp->smk_transmuted) {
- rcu_read_lock();
- may = smk_access_entry(skp->smk_known, dsp->smk_known,
- &skp->smk_rules);
- rcu_read_unlock();
- }
+ trans_cred = (tsp->smk_task == tsp->smk_transmuted);
+ if (!trans_cred)
+ trans_rule = smk_rule_transmutes(smk_of_task(tsp), dsp);
/*
* In addition to having smk_task equal to smk_transmuted,
@@ -1001,9 +1015,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
* requests transmutation then by all means transmute.
* Mark the inode as changed.
*/
- if ((tsp->smk_task == tsp->smk_transmuted) ||
- (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
- smk_inode_transmutable(dir))) {
+ if (trans_cred || (trans_rule && smk_inode_transmutable(dir))) {
struct xattr *xattr_transmute;
/*
@@ -1012,8 +1024,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
* inode label was already set correctly in
* smack_inode_alloc_security().
*/
- if (tsp->smk_task != tsp->smk_transmuted)
- isp = issp->smk_inode = dsp;
+ if (!trans_cred)
+ issp->smk_inode = dsp;
if (S_ISDIR(inode->i_mode)) {
issp->smk_flags |= SMK_INODE_TRANSMUTE;
@@ -1035,11 +1047,13 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
issp->smk_flags |= SMK_INODE_INSTANT;
if (xattr) {
- xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
+ const char *inode_label = issp->smk_inode->smk_known;
+
+ xattr->value = kstrdup(inode_label, GFP_NOFS);
if (!xattr->value)
return -ENOMEM;
- xattr->value_len = strlen(isp->smk_known);
+ xattr->value_len = strlen(inode_label);
xattr->name = XATTR_SMACK_SUFFIX;
}
@@ -4917,7 +4931,6 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
struct task_smack *otsp = smack_cred(old);
struct task_smack *ntsp = smack_cred(new);
struct inode_smack *isp;
- int may;
/*
* Use the process credential unless all of
@@ -4931,18 +4944,12 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
isp = smack_inode(d_inode(dentry->d_parent));
if (isp->smk_flags & SMK_INODE_TRANSMUTE) {
- rcu_read_lock();
- may = smk_access_entry(otsp->smk_task->smk_known,
- isp->smk_inode->smk_known,
- &otsp->smk_task->smk_rules);
- rcu_read_unlock();
-
/*
* If the directory is transmuting and the rule
* providing access is transmuting use the containing
* directory label instead of the process label.
*/
- if (may > 0 && (may & MAY_TRANSMUTE)) {
+ if (smk_rule_transmutes(otsp->smk_task, isp->smk_inode)) {
ntsp->smk_task = isp->smk_inode;
ntsp->smk_transmuted = ntsp->smk_task;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 003/614] smack: deduplicate xattr setting in smack_inode_init_security()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 001/614] smack: fix bug: SMACK64TRANSMUTE set on non-directory Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 002/614] smack: deduplicate "does access rule request transmutation" Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 004/614] smack: always "instantiate" inode " Greg Kroah-Hartman
` (624 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 8e5d9f916a9678e2dcbed2289b87efd453e4e052 ]
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Stable-dep-of: 78fc6a94be25 ("smack: fix bug: invalid label of unix socket file")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 56 ++++++++++++++++++++------------------
1 file changed, 29 insertions(+), 27 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index a005f5afb8e0d..9eefb5cfccba5 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -980,6 +980,24 @@ smk_rule_transmutes(struct smack_known *subject,
return (may > 0) && (may & MAY_TRANSMUTE);
}
+static int
+xattr_dupval(struct xattr *xattrs, int *xattr_count,
+ const char *name, const void *value, unsigned int vallen)
+{
+ struct xattr * const xattr = lsm_get_xattr_slot(xattrs, xattr_count);
+
+ if (!xattr)
+ return 0;
+
+ xattr->value = kmemdup(value, vallen, GFP_NOFS);
+ if (!xattr->value)
+ return -ENOMEM;
+
+ xattr->value_len = vallen;
+ xattr->name = name;
+ return 0;
+}
+
/**
* smack_inode_init_security - copy out the smack from an inode
* @inode: the newly created inode
@@ -997,7 +1015,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
struct task_smack *tsp = smack_cred(current_cred());
struct inode_smack * const issp = smack_inode(inode);
struct smack_known *dsp = smk_of_inode(dir);
- struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
bool trans_cred;
bool trans_rule;
@@ -1016,8 +1033,6 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
* Mark the inode as changed.
*/
if (trans_cred || (trans_rule && smk_inode_transmutable(dir))) {
- struct xattr *xattr_transmute;
-
/*
* The caller of smack_dentry_create_files_as()
* should have overridden the current cred, so the
@@ -1029,35 +1044,22 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
if (S_ISDIR(inode->i_mode)) {
issp->smk_flags |= SMK_INODE_TRANSMUTE;
- xattr_transmute = lsm_get_xattr_slot(xattrs,
- xattr_count);
- if (xattr_transmute) {
- xattr_transmute->value = kmemdup(TRANS_TRUE,
- TRANS_TRUE_SIZE,
- GFP_NOFS);
- if (!xattr_transmute->value)
- return -ENOMEM;
-
- xattr_transmute->value_len = TRANS_TRUE_SIZE;
- xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
- }
+
+ if (xattr_dupval(xattrs, xattr_count,
+ XATTR_SMACK_TRANSMUTE,
+ TRANS_TRUE,
+ TRANS_TRUE_SIZE
+ ))
+ return -ENOMEM;
}
}
issp->smk_flags |= SMK_INODE_INSTANT;
- if (xattr) {
- const char *inode_label = issp->smk_inode->smk_known;
-
- xattr->value = kstrdup(inode_label, GFP_NOFS);
- if (!xattr->value)
- return -ENOMEM;
-
- xattr->value_len = strlen(inode_label);
- xattr->name = XATTR_SMACK_SUFFIX;
- }
-
- return 0;
+ return xattr_dupval(xattrs, xattr_count,
+ XATTR_SMACK_SUFFIX,
+ issp->smk_inode->smk_known,
+ strlen(issp->smk_inode->smk_known));
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 004/614] smack: always "instantiate" inode in smack_inode_init_security()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 003/614] smack: deduplicate xattr setting in smack_inode_init_security() Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 005/614] smack: fix bug: invalid label of unix socket file Greg Kroah-Hartman
` (623 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 69204f6cdb90f56b7ca27966d1080841108fc5de ]
If memory allocation for the SMACK64TRANSMUTE
xattr value fails in smack_inode_init_security(),
the SMK_INODE_INSTANT flag is not set in
(struct inode_smack *issp)->smk_flags,
leaving the inode as not "instantiated".
It does not matter if fs frees the inode
after failed smack_inode_init_security() call,
but there is no guarantee for this.
To be safe, mark the inode as "instantiated",
even if allocation of xattr values fails.
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Stable-dep-of: 78fc6a94be25 ("smack: fix bug: invalid label of unix socket file")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 9eefb5cfccba5..db2a9aa9f1a05 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1015,6 +1015,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
struct task_smack *tsp = smack_cred(current_cred());
struct inode_smack * const issp = smack_inode(inode);
struct smack_known *dsp = smk_of_inode(dir);
+ int rc = 0;
+ int transflag = 0;
bool trans_cred;
bool trans_rule;
@@ -1043,18 +1045,20 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
issp->smk_inode = dsp;
if (S_ISDIR(inode->i_mode)) {
- issp->smk_flags |= SMK_INODE_TRANSMUTE;
+ transflag = SMK_INODE_TRANSMUTE;
if (xattr_dupval(xattrs, xattr_count,
XATTR_SMACK_TRANSMUTE,
TRANS_TRUE,
TRANS_TRUE_SIZE
))
- return -ENOMEM;
+ rc = -ENOMEM;
}
}
- issp->smk_flags |= SMK_INODE_INSTANT;
+ issp->smk_flags |= (SMK_INODE_INSTANT | transflag);
+ if (rc)
+ return rc;
return xattr_dupval(xattrs, xattr_count,
XATTR_SMACK_SUFFIX,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 005/614] smack: fix bug: invalid label of unix socket file
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 004/614] smack: always "instantiate" inode " Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 006/614] smack: fix bug: unprivileged task can create labels Greg Kroah-Hartman
` (622 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 78fc6a94be252b27bb73e4926eed70b5e302a8e0 ]
According to [1], the label of a UNIX domain socket (UDS)
file (i.e., the filesystem object representing the socket)
is not supposed to participate in Smack security.
To achieve this, [1] labels UDS files with "*"
in smack_d_instantiate().
Before [2], smack_d_instantiate() was responsible
for initializing Smack security for all inodes,
except ones under /proc
[2] imposed the sole responsibility for initializing
inode security for newly created filesystem objects
on smack_inode_init_security().
However, smack_inode_init_security() lacks some logic
present in smack_d_instantiate().
In particular, it does not label UDS files with "*".
This patch adds the missing labeling of UDS files
with "*" to smack_inode_init_security().
Labeling UDS files with "*" in smack_d_instantiate()
still works for stale UDS files that already exist on
disk. Stale UDS files are useless, but I keep labeling
them for consistency and maybe to make easier for user
to delete them.
Compared to [1], this version introduces the following
improvements:
* UDS file label is held inside inode only
and not saved to xattrs.
* relabeling UDS files (setxattr, removexattr, etc.)
is blocked.
[1] 2010-11-24 Casey Schaufler
commit b4e0d5f0791b ("Smack: UDS revision")
[2] 2023-11-16 roberto.sassu
Fixes: e63d86b8b764 ("smack: Initialize the in-memory inode in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20231116090125.187209-5-roberto.sassu@huaweicloud.com/
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/LSM/Smack.rst | 5 +++
security/smack/smack_lsm.c | 58 +++++++++++++++++++------
2 files changed, 49 insertions(+), 14 deletions(-)
diff --git a/Documentation/admin-guide/LSM/Smack.rst b/Documentation/admin-guide/LSM/Smack.rst
index 6d44f4fdbf59f..1b554b5bf98e6 100644
--- a/Documentation/admin-guide/LSM/Smack.rst
+++ b/Documentation/admin-guide/LSM/Smack.rst
@@ -696,6 +696,11 @@ sockets.
A privileged program may set this to match the label of another
task with which it hopes to communicate.
+UNIX domain socket (UDS) with a BSD address functions both as a file in a
+filesystem and as a socket. As a file, it carries the SMACK64 attribute. This
+attribute is not involved in Smack security enforcement and is immutably
+assigned the label "*".
+
Smack Netlabel Exceptions
~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index db2a9aa9f1a05..d16453801a79e 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1020,6 +1020,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
bool trans_cred;
bool trans_rule;
+ /*
+ * UNIX domain sockets use lower level socket data. Let
+ * UDS inode have fixed * label to keep smack_inode_permission() calm
+ * when called from unix_find_bsd()
+ */
+ if (S_ISSOCK(inode->i_mode)) {
+ /* forced label, no need to save to xattrs */
+ issp->smk_inode = &smack_known_star;
+ goto instant_inode;
+ }
/*
* If equal, transmuting already occurred in
* smack_dentry_create_files_as(). No need to check again.
@@ -1056,14 +1066,16 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
}
}
- issp->smk_flags |= (SMK_INODE_INSTANT | transflag);
- if (rc)
- return rc;
-
- return xattr_dupval(xattrs, xattr_count,
+ if (rc == 0)
+ if (xattr_dupval(xattrs, xattr_count,
XATTR_SMACK_SUFFIX,
issp->smk_inode->smk_known,
- strlen(issp->smk_inode->smk_known));
+ strlen(issp->smk_inode->smk_known)
+ ))
+ rc = -ENOMEM;
+instant_inode:
+ issp->smk_flags |= (SMK_INODE_INSTANT | transflag);
+ return rc;
}
/**
@@ -1337,13 +1349,23 @@ static int smack_inode_setxattr(struct mnt_idmap *idmap,
int check_import = 0;
int check_star = 0;
int rc = 0;
+ umode_t const i_mode = d_backing_inode(dentry)->i_mode;
/*
* Check label validity here so import won't fail in post_setxattr
*/
- if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
- strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
- strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
+ if (strcmp(name, XATTR_NAME_SMACK) == 0) {
+ /*
+ * UDS inode has fixed label
+ */
+ if (S_ISSOCK(i_mode)) {
+ rc = -EINVAL;
+ } else {
+ check_priv = 1;
+ check_import = 1;
+ }
+ } else if (strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
+ strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
check_priv = 1;
check_import = 1;
} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
@@ -1353,7 +1375,7 @@ static int smack_inode_setxattr(struct mnt_idmap *idmap,
check_star = 1;
} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
check_priv = 1;
- if (!S_ISDIR(d_backing_inode(dentry)->i_mode) ||
+ if (!S_ISDIR(i_mode) ||
size != TRANS_TRUE_SIZE ||
strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
rc = -EINVAL;
@@ -1484,12 +1506,15 @@ static int smack_inode_removexattr(struct mnt_idmap *idmap,
* Don't do anything special for these.
* XATTR_NAME_SMACKIPIN
* XATTR_NAME_SMACKIPOUT
+ * XATTR_NAME_SMACK if S_ISSOCK (UDS inode has fixed label)
*/
if (strcmp(name, XATTR_NAME_SMACK) == 0) {
- struct super_block *sbp = dentry->d_sb;
- struct superblock_smack *sbsp = smack_superblock(sbp);
+ if (!S_ISSOCK(d_backing_inode(dentry)->i_mode)) {
+ struct super_block *sbp = dentry->d_sb;
+ struct superblock_smack *sbsp = smack_superblock(sbp);
- isp->smk_inode = sbsp->smk_default;
+ isp->smk_inode = sbsp->smk_default;
+ }
} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0)
isp->smk_task = NULL;
else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0)
@@ -3607,7 +3632,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
*/
/*
- * UNIX domain sockets use lower level socket data.
+ * UDS inode has fixed label (*)
*/
if (S_ISSOCK(inode->i_mode)) {
final = &smack_known_star;
@@ -4872,6 +4897,11 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
{
+ /*
+ * UDS inode has fixed label. Ignore nfs label.
+ */
+ if (S_ISSOCK(inode->i_mode))
+ return 0;
return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
ctxlen, 0);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 006/614] smack: fix bug: unprivileged task can create labels
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 005/614] smack: fix bug: invalid label of unix socket file Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 007/614] smack: fix bug: setting task label silently ignores input garbage Greg Kroah-Hartman
` (621 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3 ]
If an unprivileged task is allowed to relabel itself
(/smack/relabel-self is not empty),
it can freely create new labels by writing their
names into own /proc/PID/attr/smack/current
This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.
This change ensures that the "relabel-self" list
is checked before importing the label.
Fixes: 38416e53936e ("Smack: limited capability for changing process label")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smack_lsm.c | 41 +++++++++++++++++++++++++-------------
1 file changed, 27 insertions(+), 14 deletions(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index d16453801a79e..07dbc4cd303a7 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3778,8 +3778,8 @@ static int do_setattr(u64 attr, void *value, size_t size)
struct task_smack *tsp = smack_cred(current_cred());
struct cred *new;
struct smack_known *skp;
- struct smack_known_list_elem *sklep;
- int rc;
+ char *labelstr;
+ int rc = 0;
if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel))
return -EPERM;
@@ -3790,28 +3790,41 @@ static int do_setattr(u64 attr, void *value, size_t size)
if (attr != LSM_ATTR_CURRENT)
return -EOPNOTSUPP;
- skp = smk_import_entry(value, size);
- if (IS_ERR(skp))
- return PTR_ERR(skp);
+ labelstr = smk_parse_smack(value, size);
+ if (IS_ERR(labelstr))
+ return PTR_ERR(labelstr);
/*
* No process is ever allowed the web ("@") label
* and the star ("*") label.
*/
- if (skp == &smack_known_web || skp == &smack_known_star)
- return -EINVAL;
+ if (labelstr[1] == '\0' /* '@', '*' */) {
+ const char c = labelstr[0];
+
+ if (c == *smack_known_web.smk_known ||
+ c == *smack_known_star.smk_known) {
+ rc = -EPERM;
+ goto free_labelstr;
+ }
+ }
if (!smack_privileged(CAP_MAC_ADMIN)) {
- rc = -EPERM;
+ const struct smack_known_list_elem *sklep;
list_for_each_entry(sklep, &tsp->smk_relabel, list)
- if (sklep->smk_label == skp) {
- rc = 0;
- break;
- }
- if (rc)
- return rc;
+ if (strcmp(sklep->smk_label->smk_known, labelstr) == 0)
+ goto free_labelstr;
+ rc = -EPERM;
}
+free_labelstr:
+ kfree(labelstr);
+ if (rc)
+ return -EPERM;
+
+ skp = smk_import_entry(value, size);
+ if (IS_ERR(skp))
+ return PTR_ERR(skp);
+
new = prepare_creds();
if (new == NULL)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 007/614] smack: fix bug: setting task label silently ignores input garbage
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 006/614] smack: fix bug: unprivileged task can create labels Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 008/614] gpu: host1x: Fix race in syncpt alloc/free Greg Kroah-Hartman
` (620 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Andreev, Casey Schaufler,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Andreev <andreev@swemel.ru>
[ Upstream commit 674e2b24791cbe8fd5dc8a0aed4cb4404fcd2028 ]
This command:
# echo foo/bar >/proc/$$/attr/smack/current
gives the task a label 'foo' w/o indication
that label does not match input.
Setting the label with lsm_set_self_attr() syscall
behaves identically.
This occures because:
1) smk_parse_smack() is used to convert input to a label
2) smk_parse_smack() takes only that part from the
beginning of the input that looks like a label.
3) `/' is prohibited in labels, so only "foo" is taken.
(2) is by design, because smk_parse_smack() is used
for parsing strings which are more than just a label.
Silent failure is not a good thing, and there are two
indicators that this was not done intentionally:
(size >= SMK_LONGLABEL) ~> invalid
clause at the beginning of the do_setattr() and the
"Returns the length of the smack label" claim
in the do_setattr() description.
So I fixed this by adding one tiny check:
the taken label length == input length.
Since input length is now strictly controlled,
I changed the two ways of setting label
smack_setselfattr(): lsm_set_self_attr() syscall
smack_setprocattr(): > /proc/.../current
to accommodate the divergence in
what they understand by "input length":
smack_setselfattr counts mandatory \0 into input length,
smack_setprocattr does not.
smack_setprocattr allows various trailers after label
Related changes:
* fixed description for smk_parse_smack
* allow unprivileged tasks validate label syntax.
* extract smk_parse_label_len() from smk_parse_smack()
so parsing may be done w/o string allocation.
* extract smk_import_valid_label() from smk_import_entry()
to avoid repeated parsing.
* smk_parse_smack(): scan null-terminated strings
for no more than SMK_LONGLABEL(256) characters
* smack_setselfattr(): require struct lsm_ctx . flags == 0
to reserve them for future.
Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/LSM/Smack.rst | 11 ++-
security/smack/smack.h | 3 +
security/smack/smack_access.c | 93 ++++++++++++++-----
security/smack/smack_lsm.c | 115 +++++++++++++++---------
4 files changed, 156 insertions(+), 66 deletions(-)
diff --git a/Documentation/admin-guide/LSM/Smack.rst b/Documentation/admin-guide/LSM/Smack.rst
index 1b554b5bf98e6..c5ed775f2d107 100644
--- a/Documentation/admin-guide/LSM/Smack.rst
+++ b/Documentation/admin-guide/LSM/Smack.rst
@@ -601,10 +601,15 @@ specification.
Task Attribute
~~~~~~~~~~~~~~
-The Smack label of a process can be read from /proc/<pid>/attr/current. A
-process can read its own Smack label from /proc/self/attr/current. A
+The Smack label of a process can be read from ``/proc/<pid>/attr/current``. A
+process can read its own Smack label from ``/proc/self/attr/current``. A
privileged process can change its own Smack label by writing to
-/proc/self/attr/current but not the label of another process.
+``/proc/self/attr/current`` but not the label of another process.
+
+Format of writing is : only the label or the label followed by one of the
+3 trailers: ``\n`` (by common agreement for ``/proc/...`` interfaces),
+``\0`` (because some applications incorrectly include it),
+``\n\0`` (because we think some applications may incorrectly include it).
File Attribute
~~~~~~~~~~~~~~
diff --git a/security/smack/smack.h b/security/smack/smack.h
index bf6a6ed3946ce..759343a6bbaeb 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -286,9 +286,12 @@ int smk_tskacc(struct task_smack *, struct smack_known *,
int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
int smack_str_from_perm(char *string, int access);
struct smack_known *smack_from_secid(const u32);
+int smk_parse_label_len(const char *string, int len);
char *smk_parse_smack(const char *string, int len);
int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
struct smack_known *smk_import_entry(const char *, int);
+struct smack_known *smk_import_valid_label(const char *label, int label_len,
+ gfp_t gfp);
void smk_insert_entry(struct smack_known *skp);
struct smack_known *smk_find_entry(const char *);
bool smack_privileged(int cap);
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 2e4a0cb22782b..a289cb6672bd4 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -443,19 +443,19 @@ struct smack_known *smk_find_entry(const char *string)
}
/**
- * smk_parse_smack - parse smack label from a text string
- * @string: a text string that might contain a Smack label
- * @len: the maximum size, or zero if it is NULL terminated.
+ * smk_parse_label_len - calculate the length of the starting segment
+ * in the string that constitutes a valid smack label
+ * @string: a text string that might contain a Smack label at the beginning
+ * @len: the maximum size to look into, may be zero if string is null-terminated
*
- * Returns a pointer to the clean label or an error code.
+ * Returns the length of the segment (0 < L < SMK_LONGLABEL) or an error code.
*/
-char *smk_parse_smack(const char *string, int len)
+int smk_parse_label_len(const char *string, int len)
{
- char *smack;
int i;
- if (len <= 0)
- len = strlen(string) + 1;
+ if (len <= 0 || len > SMK_LONGLABEL)
+ len = SMK_LONGLABEL;
/*
* Reserve a leading '-' as an indicator that
@@ -463,7 +463,7 @@ char *smk_parse_smack(const char *string, int len)
* including /smack/cipso and /smack/cipso2
*/
if (string[0] == '-')
- return ERR_PTR(-EINVAL);
+ return -EINVAL;
for (i = 0; i < len; i++)
if (string[i] > '~' || string[i] <= ' ' || string[i] == '/' ||
@@ -471,6 +471,25 @@ char *smk_parse_smack(const char *string, int len)
break;
if (i == 0 || i >= SMK_LONGLABEL)
+ return -EINVAL;
+
+ return i;
+}
+
+/**
+ * smk_parse_smack - copy the starting segment in the string
+ * that constitutes a valid smack label
+ * @string: a text string that might contain a Smack label at the beginning
+ * @len: the maximum size to look into, may be zero if string is null-terminated
+ *
+ * Returns a pointer to the copy of the label or an error code.
+ */
+char *smk_parse_smack(const char *string, int len)
+{
+ char *smack;
+ int i = smk_parse_label_len(string, len);
+
+ if (i < 0)
return ERR_PTR(-EINVAL);
smack = kstrndup(string, i, GFP_NOFS);
@@ -554,31 +573,25 @@ int smack_populate_secattr(struct smack_known *skp)
}
/**
- * smk_import_entry - import a label, return the list entry
- * @string: a text string that might be a Smack label
- * @len: the maximum size, or zero if it is NULL terminated.
+ * smk_import_valid_allocated_label - import a label, return the list entry
+ * @smack: a text string that is a valid Smack label and may be kfree()ed.
+ * It is consumed: either becomes a part of the entry or kfree'ed.
*
- * Returns a pointer to the entry in the label list that
- * matches the passed string, adding it if necessary,
- * or an error code.
+ * Returns: see description of smk_import_entry()
*/
-struct smack_known *smk_import_entry(const char *string, int len)
+static struct smack_known *
+smk_import_allocated_label(char *smack, gfp_t gfp)
{
struct smack_known *skp;
- char *smack;
int rc;
- smack = smk_parse_smack(string, len);
- if (IS_ERR(smack))
- return ERR_CAST(smack);
-
mutex_lock(&smack_known_lock);
skp = smk_find_entry(smack);
if (skp != NULL)
goto freeout;
- skp = kzalloc(sizeof(*skp), GFP_NOFS);
+ skp = kzalloc(sizeof(*skp), gfp);
if (skp == NULL) {
skp = ERR_PTR(-ENOMEM);
goto freeout;
@@ -608,6 +621,42 @@ struct smack_known *smk_import_entry(const char *string, int len)
return skp;
}
+/**
+ * smk_import_entry - import a label, return the list entry
+ * @string: a text string that might contain a Smack label at the beginning
+ * @len: the maximum size to look into, may be zero if string is null-terminated
+ *
+ * Returns a pointer to the entry in the label list that
+ * matches the passed string, adding it if necessary,
+ * or an error code.
+ */
+struct smack_known *smk_import_entry(const char *string, int len)
+{
+ char *smack = smk_parse_smack(string, len);
+
+ if (IS_ERR(smack))
+ return ERR_CAST(smack);
+
+ return smk_import_allocated_label(smack, GFP_NOFS);
+}
+
+/**
+ * smk_import_valid_label - import a label, return the list entry
+ * @label a text string that is a valid Smack label, not null-terminated
+ *
+ * Returns: see description of smk_import_entry()
+ */
+struct smack_known *
+smk_import_valid_label(const char *label, int label_len, gfp_t gfp)
+{
+ char *smack = kstrndup(label, label_len, gfp);
+
+ if (!smack)
+ return ERR_PTR(-ENOMEM);
+
+ return smk_import_allocated_label(smack, gfp);
+}
+
/**
* smack_from_secid - find the Smack label associated with a secid
* @secid: an integer that might be associated with a Smack label
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 07dbc4cd303a7..7fd8a60b8be90 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3710,7 +3710,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
* @attr: which attribute to fetch
* @ctx: buffer to receive the result
* @size: available size in, actual size out
- * @flags: unused
+ * @flags: reserved, currently zero
*
* Fill the passed user space @ctx with the details of the requested
* attribute.
@@ -3771,57 +3771,52 @@ static int smack_getprocattr(struct task_struct *p, const char *name, char **val
* Sets the Smack value of the task. Only setting self
* is permitted and only with privilege
*
- * Returns the length of the smack label or an error code
+ * Returns zero on success or an error code
*/
-static int do_setattr(u64 attr, void *value, size_t size)
+static int do_setattr(unsigned int attr, void *value, size_t size)
{
struct task_smack *tsp = smack_cred(current_cred());
struct cred *new;
struct smack_known *skp;
- char *labelstr;
- int rc = 0;
-
- if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel))
- return -EPERM;
+ int label_len;
+ /*
+ * let unprivileged user validate input, check permissions later
+ */
if (value == NULL || size == 0 || size >= SMK_LONGLABEL)
return -EINVAL;
- if (attr != LSM_ATTR_CURRENT)
- return -EOPNOTSUPP;
-
- labelstr = smk_parse_smack(value, size);
- if (IS_ERR(labelstr))
- return PTR_ERR(labelstr);
+ label_len = smk_parse_label_len(value, size);
+ if (label_len < 0 || label_len != size)
+ return -EINVAL;
/*
* No process is ever allowed the web ("@") label
* and the star ("*") label.
*/
- if (labelstr[1] == '\0' /* '@', '*' */) {
- const char c = labelstr[0];
+ if (label_len == 1 /* '@', '*' */) {
+ const char c = *(const char *)value;
if (c == *smack_known_web.smk_known ||
- c == *smack_known_star.smk_known) {
- rc = -EPERM;
- goto free_labelstr;
- }
+ c == *smack_known_star.smk_known)
+ return -EPERM;
}
if (!smack_privileged(CAP_MAC_ADMIN)) {
const struct smack_known_list_elem *sklep;
- list_for_each_entry(sklep, &tsp->smk_relabel, list)
- if (strcmp(sklep->smk_label->smk_known, labelstr) == 0)
- goto free_labelstr;
- rc = -EPERM;
- }
+ list_for_each_entry(sklep, &tsp->smk_relabel, list) {
+ const char *cp = sklep->smk_label->smk_known;
-free_labelstr:
- kfree(labelstr);
- if (rc)
+ if (strlen(cp) == label_len &&
+ strncmp(cp, value, label_len) == 0)
+ goto in_relabel;
+ }
return -EPERM;
+in_relabel:
+ ;
+ }
- skp = smk_import_entry(value, size);
+ skp = smk_import_valid_label(value, label_len, GFP_KERNEL);
if (IS_ERR(skp))
return PTR_ERR(skp);
@@ -3837,7 +3832,7 @@ static int do_setattr(u64 attr, void *value, size_t size)
smk_destroy_label_list(&tsp->smk_relabel);
commit_creds(new);
- return size;
+ return 0;
}
/**
@@ -3845,7 +3840,7 @@ static int do_setattr(u64 attr, void *value, size_t size)
* @attr: which attribute to set
* @ctx: buffer containing the data
* @size: size of @ctx
- * @flags: unused
+ * @flags: reserved, must be zero
*
* Fill the passed user space @ctx with the details of the requested
* attribute.
@@ -3855,12 +3850,26 @@ static int do_setattr(u64 attr, void *value, size_t size)
static int smack_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
u32 size, u32 flags)
{
- int rc;
+ if (attr != LSM_ATTR_CURRENT)
+ return -EOPNOTSUPP;
- rc = do_setattr(attr, ctx->ctx, ctx->ctx_len);
- if (rc > 0)
- return 0;
- return rc;
+ if (ctx->flags)
+ return -EINVAL;
+ /*
+ * string must have \0 terminator, included in ctx->ctx
+ * (see description of struct lsm_ctx)
+ */
+ if (ctx->ctx_len == 0)
+ return -EINVAL;
+
+ if (ctx->ctx[ctx->ctx_len - 1] != '\0')
+ return -EINVAL;
+ /*
+ * other do_setattr() caller, smack_setprocattr(),
+ * does not count \0 into size, so
+ * decreasing length by 1 to accommodate the divergence.
+ */
+ return do_setattr(attr, ctx->ctx, ctx->ctx_len - 1);
}
/**
@@ -3872,15 +3881,39 @@ static int smack_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
* Sets the Smack value of the task. Only setting self
* is permitted and only with privilege
*
- * Returns the length of the smack label or an error code
+ * Returns the size of the input value or an error code
*/
static int smack_setprocattr(const char *name, void *value, size_t size)
{
- int attr = lsm_name_to_attr(name);
+ size_t realsize = size;
+ unsigned int attr = lsm_name_to_attr(name);
- if (attr != LSM_ATTR_UNDEF)
- return do_setattr(attr, value, size);
- return -EINVAL;
+ switch (attr) {
+ case LSM_ATTR_UNDEF: return -EINVAL;
+ default: return -EOPNOTSUPP;
+ case LSM_ATTR_CURRENT:
+ ;
+ }
+
+ /*
+ * The value for the "current" attribute is the label
+ * followed by one of the 4 trailers: none, \0, \n, \n\0
+ *
+ * I.e. following inputs are accepted as 3-characters long label "foo":
+ *
+ * "foo" (3 characters)
+ * "foo\0" (4 characters)
+ * "foo\n" (4 characters)
+ * "foo\n\0" (5 characters)
+ */
+
+ if (realsize && (((const char *)value)[realsize - 1] == '\0'))
+ --realsize;
+
+ if (realsize && (((const char *)value)[realsize - 1] == '\n'))
+ --realsize;
+
+ return do_setattr(attr, value, realsize) ? : size;
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 008/614] gpu: host1x: Fix race in syncpt alloc/free
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 007/614] smack: fix bug: setting task label silently ignores input garbage Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 009/614] accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() Greg Kroah-Hartman
` (619 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mainak Sen, Mikko Perttunen,
Thierry Reding, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mainak Sen <msen@nvidia.com>
[ Upstream commit c7d393267c497502fa737607f435f05dfe6e3d9b ]
Fix race condition between host1x_syncpt_alloc()
and host1x_syncpt_put() by using kref_put_mutex()
instead of kref_put() + manual mutex locking.
This ensures no thread can acquire the
syncpt_mutex after the refcount drops to zero
but before syncpt_release acquires it.
This prevents races where syncpoints could
be allocated while still being cleaned up
from a previous release.
Remove explicit mutex locking in syncpt_release
as kref_put_mutex() handles this atomically.
Signed-off-by: Mainak Sen <msen@nvidia.com>
Fixes: f5ba33fb9690 ("gpu: host1x: Reserve VBLANK syncpoints at initialization")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://lore.kernel.org/r/20250707-host1x-syncpt-race-fix-v1-1-28b0776e70bc@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/host1x/syncpt.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/host1x/syncpt.c b/drivers/gpu/host1x/syncpt.c
index f63d14a57a1d9..acc7d82e0585e 100644
--- a/drivers/gpu/host1x/syncpt.c
+++ b/drivers/gpu/host1x/syncpt.c
@@ -345,8 +345,6 @@ static void syncpt_release(struct kref *ref)
sp->locked = false;
- mutex_lock(&sp->host->syncpt_mutex);
-
host1x_syncpt_base_free(sp->base);
kfree(sp->name);
sp->base = NULL;
@@ -369,7 +367,7 @@ void host1x_syncpt_put(struct host1x_syncpt *sp)
if (!sp)
return;
- kref_put(&sp->ref, syncpt_release);
+ kref_put_mutex(&sp->ref, syncpt_release, &sp->host->syncpt_mutex);
}
EXPORT_SYMBOL(host1x_syncpt_put);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 009/614] accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 008/614] gpu: host1x: Fix race in syncpt alloc/free Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 010/614] accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object Greg Kroah-Hartman
` (618 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Maciej Falkowski,
Lizhi Hou, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit 9e16c8bf9aebf629344cfd4cd5e3dc7d8c3f7d82 ]
The unpublished smatch static checker reported a warning.
drivers/accel/amdxdna/aie2_pci.c:904 aie2_query_ctx_status_array()
warn: potential user controlled sizeof overflow
'args->num_element * args->element_size' '1-u32max(user) * 1-u32max(user)'
Even this will not cause a real issue, it is better to put a reasonable
limitation for element_size and num_element. Add condition to make sure
the input element_size <= 4K and num_element <= 1K.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/dri-devel/aL56ZCLyl3tLQM1e@stanley.mountain/
Fixes: 2f509fe6a42c ("accel/amdxdna: Add ioctl DRM_IOCTL_AMDXDNA_GET_ARRAY")
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://lore.kernel.org/r/20250909154531.3469979-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/aie2_pci.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index 87c425e3d2b99..6e39c769bb6d8 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -898,6 +898,12 @@ static int aie2_query_ctx_status_array(struct amdxdna_client *client,
drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+ if (args->element_size > SZ_4K || args->num_element > SZ_1K) {
+ XDNA_DBG(xdna, "Invalid element size %d or number of element %d",
+ args->element_size, args->num_element);
+ return -EINVAL;
+ }
+
array_args.element_size = min(args->element_size,
sizeof(struct amdxdna_drm_hwctx_entry));
array_args.buffer = args->buffer;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 010/614] accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 009/614] accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 011/614] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail Greg Kroah-Hartman
` (617 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Falkowski, Lizhi Hou,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit 457f4393d02fdb612a93912fb09cef70e6e545c9 ]
In amdxdna_gem_obj_vmap(), calling dma_buf_vmap() triggers a kernel
warning if LOCKDEP is enabled. So for imported object, use
dma_buf_vmap_unlocked(). Then, use drm_gem_vmap() for other objects.
The similar change applies to vunmap code.
Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer")
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://lore.kernel.org/r/20250916174842.234709-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/amdxdna_gem.c | 47 ++++++++++++-----------------
1 file changed, 20 insertions(+), 27 deletions(-)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
index d407a36eb4126..7f91863c3f24c 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -392,35 +392,33 @@ static const struct dma_buf_ops amdxdna_dmabuf_ops = {
.vunmap = drm_gem_dmabuf_vunmap,
};
-static int amdxdna_gem_obj_vmap(struct drm_gem_object *obj, struct iosys_map *map)
+static int amdxdna_gem_obj_vmap(struct amdxdna_gem_obj *abo, void **vaddr)
{
- struct amdxdna_gem_obj *abo = to_xdna_obj(obj);
-
- iosys_map_clear(map);
-
- dma_resv_assert_held(obj->resv);
+ struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
+ int ret;
if (is_import_bo(abo))
- dma_buf_vmap(abo->dma_buf, map);
+ ret = dma_buf_vmap_unlocked(abo->dma_buf, &map);
else
- drm_gem_shmem_object_vmap(obj, map);
-
- if (!map->vaddr)
- return -ENOMEM;
+ ret = drm_gem_vmap(to_gobj(abo), &map);
- return 0;
+ *vaddr = map.vaddr;
+ return ret;
}
-static void amdxdna_gem_obj_vunmap(struct drm_gem_object *obj, struct iosys_map *map)
+static void amdxdna_gem_obj_vunmap(struct amdxdna_gem_obj *abo)
{
- struct amdxdna_gem_obj *abo = to_xdna_obj(obj);
+ struct iosys_map map;
+
+ if (!abo->mem.kva)
+ return;
- dma_resv_assert_held(obj->resv);
+ iosys_map_set_vaddr(&map, abo->mem.kva);
if (is_import_bo(abo))
- dma_buf_vunmap(abo->dma_buf, map);
+ dma_buf_vunmap_unlocked(abo->dma_buf, &map);
else
- drm_gem_shmem_object_vunmap(obj, map);
+ drm_gem_vunmap(to_gobj(abo), &map);
}
static struct dma_buf *amdxdna_gem_prime_export(struct drm_gem_object *gobj, int flags)
@@ -455,7 +453,6 @@ static void amdxdna_gem_obj_free(struct drm_gem_object *gobj)
{
struct amdxdna_dev *xdna = to_xdna_dev(gobj->dev);
struct amdxdna_gem_obj *abo = to_xdna_obj(gobj);
- struct iosys_map map = IOSYS_MAP_INIT_VADDR(abo->mem.kva);
XDNA_DBG(xdna, "BO type %d xdna_addr 0x%llx", abo->type, abo->mem.dev_addr);
@@ -468,7 +465,7 @@ static void amdxdna_gem_obj_free(struct drm_gem_object *gobj)
if (abo->type == AMDXDNA_BO_DEV_HEAP)
drm_mm_takedown(&abo->mm);
- drm_gem_vunmap(gobj, &map);
+ amdxdna_gem_obj_vunmap(abo);
mutex_destroy(&abo->lock);
if (is_import_bo(abo)) {
@@ -489,8 +486,8 @@ static const struct drm_gem_object_funcs amdxdna_gem_shmem_funcs = {
.pin = drm_gem_shmem_object_pin,
.unpin = drm_gem_shmem_object_unpin,
.get_sg_table = drm_gem_shmem_object_get_sg_table,
- .vmap = amdxdna_gem_obj_vmap,
- .vunmap = amdxdna_gem_obj_vunmap,
+ .vmap = drm_gem_shmem_object_vmap,
+ .vunmap = drm_gem_shmem_object_vunmap,
.mmap = amdxdna_gem_obj_mmap,
.vm_ops = &drm_gem_shmem_vm_ops,
.export = amdxdna_gem_prime_export,
@@ -663,7 +660,6 @@ amdxdna_drm_create_dev_heap(struct drm_device *dev,
struct drm_file *filp)
{
struct amdxdna_client *client = filp->driver_priv;
- struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
struct amdxdna_dev *xdna = to_xdna_dev(dev);
struct amdxdna_gem_obj *abo;
int ret;
@@ -692,12 +688,11 @@ amdxdna_drm_create_dev_heap(struct drm_device *dev,
abo->mem.dev_addr = client->xdna->dev_info->dev_mem_base;
drm_mm_init(&abo->mm, abo->mem.dev_addr, abo->mem.size);
- ret = drm_gem_vmap(to_gobj(abo), &map);
+ ret = amdxdna_gem_obj_vmap(abo, &abo->mem.kva);
if (ret) {
XDNA_ERR(xdna, "Vmap heap bo failed, ret %d", ret);
goto release_obj;
}
- abo->mem.kva = map.vaddr;
client->dev_heap = abo;
drm_gem_object_get(to_gobj(abo));
@@ -748,7 +743,6 @@ amdxdna_drm_create_cmd_bo(struct drm_device *dev,
struct amdxdna_drm_create_bo *args,
struct drm_file *filp)
{
- struct iosys_map map = IOSYS_MAP_INIT_VADDR(NULL);
struct amdxdna_dev *xdna = to_xdna_dev(dev);
struct amdxdna_gem_obj *abo;
int ret;
@@ -770,12 +764,11 @@ amdxdna_drm_create_cmd_bo(struct drm_device *dev,
abo->type = AMDXDNA_BO_CMD;
abo->client = filp->driver_priv;
- ret = drm_gem_vmap(to_gobj(abo), &map);
+ ret = amdxdna_gem_obj_vmap(abo, &abo->mem.kva);
if (ret) {
XDNA_ERR(xdna, "Vmap cmd bo failed, ret %d", ret);
goto release_obj;
}
- abo->mem.kva = map.vaddr;
return abo;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 011/614] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 010/614] accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 012/614] drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq Greg Kroah-Hartman
` (616 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lizhi Hou, Karol Wachowski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Wachowski <karol.wachowski@linux.intel.com>
[ Upstream commit 9f6c63285737b141ca25a619add80a96111b8b96 ]
Previously, aborting work could return early after engine reset or resume
failure, skipping the necessary runtime_put cleanup leaving the device
with incorrect reference count breaking runtime power management state.
Replace early returns with goto statements to ensure runtime_put is always
executed.
Fixes: a47e36dc5d90 ("accel/ivpu: Trigger device recovery on engine reset/resume failure")
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://lore.kernel.org/r/20250916084809.850073-1-karol.wachowski@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_job.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_job.c b/drivers/accel/ivpu/ivpu_job.c
index 060f1fc031d34..dbefa43c74e28 100644
--- a/drivers/accel/ivpu/ivpu_job.c
+++ b/drivers/accel/ivpu/ivpu_job.c
@@ -1012,7 +1012,7 @@ void ivpu_context_abort_work_fn(struct work_struct *work)
if (vdev->fw->sched_mode == VPU_SCHEDULING_MODE_HW)
if (ivpu_jsm_reset_engine(vdev, 0))
- return;
+ goto runtime_put;
mutex_lock(&vdev->context_list_lock);
xa_for_each(&vdev->context_xa, ctx_id, file_priv) {
@@ -1036,7 +1036,7 @@ void ivpu_context_abort_work_fn(struct work_struct *work)
goto runtime_put;
if (ivpu_jsm_hws_resume_engine(vdev, 0))
- return;
+ goto runtime_put;
/*
* In hardware scheduling mode NPU already has stopped processing jobs
* and won't send us any further notifications, thus we have to free job related resources
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 012/614] drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 011/614] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 013/614] drm/panel: visionox-rm69299: Dont clear all mode flags Greg Kroah-Hartman
` (615 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guido Günther, Neil Armstrong,
Dmitry Baryshkov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guido Günther <agx@sigxcpu.org>
[ Upstream commit d298062312724606855294503acebc7ee55ffbca ]
Make the clock frequency match what the sdm845 downstream kernel
uses. Otherwise the panel stays black.
Fixes: 783334f366b18 ("drm/panel: visionox-rm69299: support the variant found in the SHIFT6mq")
Signed-off-by: Guido Günther <agx@sigxcpu.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20250910-shift6mq-panel-v3-1-a7729911afb9@sigxcpu.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-visionox-rm69299.c b/drivers/gpu/drm/panel/panel-visionox-rm69299.c
index 909c280eab1fb..5491d601681cf 100644
--- a/drivers/gpu/drm/panel/panel-visionox-rm69299.c
+++ b/drivers/gpu/drm/panel/panel-visionox-rm69299.c
@@ -247,7 +247,7 @@ static const struct drm_display_mode visionox_rm69299_1080x2248_60hz = {
};
static const struct drm_display_mode visionox_rm69299_1080x2160_60hz = {
- .clock = 158695,
+ .clock = (2160 + 8 + 4 + 4) * (1080 + 26 + 2 + 36) * 60 / 1000,
.hdisplay = 1080,
.hsync_start = 1080 + 26,
.hsync_end = 1080 + 26 + 2,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 013/614] drm/panel: visionox-rm69299: Dont clear all mode flags
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 012/614] drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 014/614] accel/ivpu: Rework bind/unbind of imported buffers Greg Kroah-Hartman
` (614 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Guido Günther,
Dmitry Baryshkov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guido Günther <agx@sigxcpu.org>
[ Upstream commit 39144b611e9cd4f5814f4098c891b545dd70c536 ]
Don't clear all mode flags. We only want to maek sure we use HS mode
during unprepare.
Fixes: c7f66d32dd431 ("drm/panel: add support for rm69299 visionox panel")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20250910-shift6mq-panel-v3-2-a7729911afb9@sigxcpu.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-visionox-rm69299.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-visionox-rm69299.c b/drivers/gpu/drm/panel/panel-visionox-rm69299.c
index 5491d601681cf..66c30db3b73a7 100644
--- a/drivers/gpu/drm/panel/panel-visionox-rm69299.c
+++ b/drivers/gpu/drm/panel/panel-visionox-rm69299.c
@@ -192,7 +192,7 @@ static int visionox_rm69299_unprepare(struct drm_panel *panel)
struct visionox_rm69299 *ctx = panel_to_ctx(panel);
struct mipi_dsi_multi_context dsi_ctx = { .dsi = ctx->dsi };
- ctx->dsi->mode_flags = 0;
+ ctx->dsi->mode_flags &= ~MIPI_DSI_MODE_LPM;
mipi_dsi_dcs_set_display_off_multi(&dsi_ctx);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 014/614] accel/ivpu: Rework bind/unbind of imported buffers
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 013/614] drm/panel: visionox-rm69299: Dont clear all mode flags Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 015/614] accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Greg Kroah-Hartman
` (613 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacek Lawrynowicz, Maciej Falkowski,
Karol Wachowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
[ Upstream commit e0c0891cd63bf8338c25c423e28a5a93aed3d74c ]
Ensure that imported buffers are properly mapped and unmapped in
the same way as regular buffers to properly handle buffers during
device's bind and unbind operations to prevent resource leaks and
inconsistent buffer states.
Imported buffers are now dma_mapped before submission and
dma_unmapped in ivpu_bo_unbind(), guaranteeing they are unmapped
when the device is unbound.
Add also imported buffers to vdev->bo_list for consistent unmapping
on device unbind. The bo->ctx_id is set in open() so imported
buffers have a valid context ID.
Debug logs have been updated to match the new code structure.
The function ivpu_bo_pin() has been renamed to ivpu_bo_bind()
to better reflect its purpose, and unbind tests have been refactored
for improved coverage and clarity.
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Signed-off-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://lore.kernel.org/r/20250925145059.1446243-1-maciej.falkowski@linux.intel.com
Stable-dep-of: 8b694b405a84 ("accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_gem.c | 90 ++++++++++++++++++++++-------------
drivers/accel/ivpu/ivpu_gem.h | 2 +-
drivers/accel/ivpu/ivpu_job.c | 2 +-
3 files changed, 60 insertions(+), 34 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c
index 59cfcf3eaded9..dc6d0d15cda9c 100644
--- a/drivers/accel/ivpu/ivpu_gem.c
+++ b/drivers/accel/ivpu/ivpu_gem.c
@@ -27,8 +27,8 @@ static const struct drm_gem_object_funcs ivpu_gem_funcs;
static inline void ivpu_dbg_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, const char *action)
{
ivpu_dbg(vdev, BO,
- "%6s: bo %8p vpu_addr %9llx size %8zu ctx %d has_pages %d dma_mapped %d mmu_mapped %d wc %d imported %d\n",
- action, bo, bo->vpu_addr, ivpu_bo_size(bo), bo->ctx_id,
+ "%6s: bo %8p size %9zu ctx %d vpu_addr %9llx pages %d sgt %d mmu_mapped %d wc %d imported %d\n",
+ action, bo, ivpu_bo_size(bo), bo->ctx_id, bo->vpu_addr,
(bool)bo->base.pages, (bool)bo->base.sgt, bo->mmu_mapped, bo->base.map_wc,
(bool)drm_gem_is_imported(&bo->base.base));
}
@@ -43,22 +43,46 @@ static inline void ivpu_bo_unlock(struct ivpu_bo *bo)
dma_resv_unlock(bo->base.base.resv);
}
+static struct sg_table *ivpu_bo_map_attachment(struct ivpu_device *vdev, struct ivpu_bo *bo)
+{
+ struct sg_table *sgt = bo->base.sgt;
+
+ drm_WARN_ON(&vdev->drm, !bo->base.base.import_attach);
+
+ ivpu_bo_lock(bo);
+
+ if (!sgt) {
+ sgt = dma_buf_map_attachment(bo->base.base.import_attach, DMA_BIDIRECTIONAL);
+ if (IS_ERR(sgt))
+ ivpu_err(vdev, "Failed to map BO in IOMMU: %ld\n", PTR_ERR(sgt));
+ else
+ bo->base.sgt = sgt;
+ }
+
+ ivpu_bo_unlock(bo);
+
+ return sgt;
+}
+
/*
- * ivpu_bo_pin() - pin the backing physical pages and map them to VPU.
+ * ivpu_bo_bind() - pin the backing physical pages and map them to VPU.
*
* This function pins physical memory pages, then maps the physical pages
* to IOMMU address space and finally updates the VPU MMU page tables
* to allow the VPU to translate VPU address to IOMMU address.
*/
-int __must_check ivpu_bo_pin(struct ivpu_bo *bo)
+int __must_check ivpu_bo_bind(struct ivpu_bo *bo)
{
struct ivpu_device *vdev = ivpu_bo_to_vdev(bo);
struct sg_table *sgt;
int ret = 0;
- ivpu_dbg_bo(vdev, bo, "pin");
+ ivpu_dbg_bo(vdev, bo, "bind");
- sgt = drm_gem_shmem_get_pages_sgt(&bo->base);
+ if (bo->base.base.import_attach)
+ sgt = ivpu_bo_map_attachment(vdev, bo);
+ else
+ sgt = drm_gem_shmem_get_pages_sgt(&bo->base);
if (IS_ERR(sgt)) {
ret = PTR_ERR(sgt);
ivpu_err(vdev, "Failed to map BO in IOMMU: %d\n", ret);
@@ -99,7 +123,9 @@ ivpu_bo_alloc_vpu_addr(struct ivpu_bo *bo, struct ivpu_mmu_context *ctx,
ret = ivpu_mmu_context_insert_node(ctx, range, ivpu_bo_size(bo), &bo->mm_node);
if (!ret) {
bo->ctx = ctx;
+ bo->ctx_id = ctx->id;
bo->vpu_addr = bo->mm_node.start;
+ ivpu_dbg_bo(vdev, bo, "vaddr");
} else {
ivpu_err(vdev, "Failed to add BO to context %u: %d\n", ctx->id, ret);
}
@@ -115,7 +141,7 @@ static void ivpu_bo_unbind_locked(struct ivpu_bo *bo)
{
struct ivpu_device *vdev = ivpu_bo_to_vdev(bo);
- lockdep_assert(dma_resv_held(bo->base.base.resv) || !kref_read(&bo->base.base.refcount));
+ dma_resv_assert_held(bo->base.base.resv);
if (bo->mmu_mapped) {
drm_WARN_ON(&vdev->drm, !bo->ctx);
@@ -134,9 +160,14 @@ static void ivpu_bo_unbind_locked(struct ivpu_bo *bo)
return;
if (bo->base.sgt) {
- dma_unmap_sgtable(vdev->drm.dev, bo->base.sgt, DMA_BIDIRECTIONAL, 0);
- sg_free_table(bo->base.sgt);
- kfree(bo->base.sgt);
+ if (bo->base.base.import_attach) {
+ dma_buf_unmap_attachment(bo->base.base.import_attach,
+ bo->base.sgt, DMA_BIDIRECTIONAL);
+ } else {
+ dma_unmap_sgtable(vdev->drm.dev, bo->base.sgt, DMA_BIDIRECTIONAL, 0);
+ sg_free_table(bo->base.sgt);
+ kfree(bo->base.sgt);
+ }
bo->base.sgt = NULL;
}
}
@@ -162,6 +193,7 @@ void ivpu_bo_unbind_all_bos_from_context(struct ivpu_device *vdev, struct ivpu_m
struct drm_gem_object *ivpu_gem_create_object(struct drm_device *dev, size_t size)
{
+ struct ivpu_device *vdev = to_ivpu_device(dev);
struct ivpu_bo *bo;
if (size == 0 || !PAGE_ALIGNED(size))
@@ -176,6 +208,11 @@ struct drm_gem_object *ivpu_gem_create_object(struct drm_device *dev, size_t siz
INIT_LIST_HEAD(&bo->bo_list_node);
+ mutex_lock(&vdev->bo_list_lock);
+ list_add_tail(&bo->bo_list_node, &vdev->bo_list);
+ mutex_unlock(&vdev->bo_list_lock);
+
+ ivpu_dbg(vdev, BO, " alloc: bo %8p size %9zu\n", bo, size);
return &bo->base.base;
}
@@ -184,7 +221,6 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev,
{
struct device *attach_dev = dev->dev;
struct dma_buf_attachment *attach;
- struct sg_table *sgt;
struct drm_gem_object *obj;
int ret;
@@ -194,16 +230,10 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev,
get_dma_buf(dma_buf);
- sgt = dma_buf_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL);
- if (IS_ERR(sgt)) {
- ret = PTR_ERR(sgt);
- goto fail_detach;
- }
-
- obj = drm_gem_shmem_prime_import_sg_table(dev, attach, sgt);
+ obj = drm_gem_shmem_prime_import_sg_table(dev, attach, NULL);
if (IS_ERR(obj)) {
ret = PTR_ERR(obj);
- goto fail_unmap;
+ goto fail_detach;
}
obj->import_attach = attach;
@@ -211,8 +241,6 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev,
return obj;
-fail_unmap:
- dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_BIDIRECTIONAL);
fail_detach:
dma_buf_detach(dma_buf, attach);
dma_buf_put(dma_buf);
@@ -220,7 +248,7 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev,
return ERR_PTR(ret);
}
-static struct ivpu_bo *ivpu_bo_alloc(struct ivpu_device *vdev, u64 size, u32 flags, u32 ctx_id)
+static struct ivpu_bo *ivpu_bo_alloc(struct ivpu_device *vdev, u64 size, u32 flags)
{
struct drm_gem_shmem_object *shmem;
struct ivpu_bo *bo;
@@ -238,16 +266,9 @@ static struct ivpu_bo *ivpu_bo_alloc(struct ivpu_device *vdev, u64 size, u32 fla
return ERR_CAST(shmem);
bo = to_ivpu_bo(&shmem->base);
- bo->ctx_id = ctx_id;
bo->base.map_wc = flags & DRM_IVPU_BO_WC;
bo->flags = flags;
- mutex_lock(&vdev->bo_list_lock);
- list_add_tail(&bo->bo_list_node, &vdev->bo_list);
- mutex_unlock(&vdev->bo_list_lock);
-
- ivpu_dbg_bo(vdev, bo, "alloc");
-
return bo;
}
@@ -281,6 +302,8 @@ static void ivpu_gem_bo_free(struct drm_gem_object *obj)
ivpu_dbg_bo(vdev, bo, "free");
+ drm_WARN_ON(&vdev->drm, list_empty(&bo->bo_list_node));
+
mutex_lock(&vdev->bo_list_lock);
list_del(&bo->bo_list_node);
mutex_unlock(&vdev->bo_list_lock);
@@ -290,7 +313,10 @@ static void ivpu_gem_bo_free(struct drm_gem_object *obj)
drm_WARN_ON(&vdev->drm, ivpu_bo_size(bo) == 0);
drm_WARN_ON(&vdev->drm, bo->base.vaddr);
+ ivpu_bo_lock(bo);
ivpu_bo_unbind_locked(bo);
+ ivpu_bo_unlock(bo);
+
drm_WARN_ON(&vdev->drm, bo->mmu_mapped);
drm_WARN_ON(&vdev->drm, bo->ctx);
@@ -326,7 +352,7 @@ int ivpu_bo_create_ioctl(struct drm_device *dev, void *data, struct drm_file *fi
if (size == 0)
return -EINVAL;
- bo = ivpu_bo_alloc(vdev, size, args->flags, file_priv->ctx.id);
+ bo = ivpu_bo_alloc(vdev, size, args->flags);
if (IS_ERR(bo)) {
ivpu_err(vdev, "Failed to allocate BO: %pe (ctx %u size %llu flags 0x%x)",
bo, file_priv->ctx.id, args->size, args->flags);
@@ -360,7 +386,7 @@ ivpu_bo_create(struct ivpu_device *vdev, struct ivpu_mmu_context *ctx,
drm_WARN_ON(&vdev->drm, !PAGE_ALIGNED(range->end));
drm_WARN_ON(&vdev->drm, !PAGE_ALIGNED(size));
- bo = ivpu_bo_alloc(vdev, size, flags, IVPU_GLOBAL_CONTEXT_MMU_SSID);
+ bo = ivpu_bo_alloc(vdev, size, flags);
if (IS_ERR(bo)) {
ivpu_err(vdev, "Failed to allocate BO: %pe (vpu_addr 0x%llx size %llu flags 0x%x)",
bo, range->start, size, flags);
@@ -371,7 +397,7 @@ ivpu_bo_create(struct ivpu_device *vdev, struct ivpu_mmu_context *ctx,
if (ret)
goto err_put;
- ret = ivpu_bo_pin(bo);
+ ret = ivpu_bo_bind(bo);
if (ret)
goto err_put;
diff --git a/drivers/accel/ivpu/ivpu_gem.h b/drivers/accel/ivpu/ivpu_gem.h
index aa8ff14f7aae1..ade0d127453ff 100644
--- a/drivers/accel/ivpu/ivpu_gem.h
+++ b/drivers/accel/ivpu/ivpu_gem.h
@@ -24,7 +24,7 @@ struct ivpu_bo {
bool mmu_mapped;
};
-int ivpu_bo_pin(struct ivpu_bo *bo);
+int ivpu_bo_bind(struct ivpu_bo *bo);
void ivpu_bo_unbind_all_bos_from_context(struct ivpu_device *vdev, struct ivpu_mmu_context *ctx);
struct drm_gem_object *ivpu_gem_create_object(struct drm_device *dev, size_t size);
diff --git a/drivers/accel/ivpu/ivpu_job.c b/drivers/accel/ivpu/ivpu_job.c
index dbefa43c74e28..1e4caf5726474 100644
--- a/drivers/accel/ivpu/ivpu_job.c
+++ b/drivers/accel/ivpu/ivpu_job.c
@@ -732,7 +732,7 @@ ivpu_job_prepare_bos_for_submit(struct drm_file *file, struct ivpu_job *job, u32
job->bos[i] = to_ivpu_bo(obj);
- ret = ivpu_bo_pin(job->bos[i]);
+ ret = ivpu_bo_bind(job->bos[i]);
if (ret)
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 015/614] accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 014/614] accel/ivpu: Rework bind/unbind of imported buffers Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 016/614] accel/ivpu: Fix DCT active percent format Greg Kroah-Hartman
` (612 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacek Lawrynowicz, Maciej Falkowski,
Karol Wachowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
[ Upstream commit 8b694b405a84696f1d964f6da7cf9721e68c4714 ]
Don't add BO to the vdev->bo_list in ivpu_gem_create_object().
When failure happens inside drm_gem_shmem_create(), the BO is not
fully created and ivpu_gem_bo_free() callback will not be called
causing a deleted BO to be left on the list.
Fixes: 8d88e4cdce4f ("accel/ivpu: Use GEM shmem helper for all buffers")
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Signed-off-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://lore.kernel.org/r/20250925145114.1446283-1-maciej.falkowski@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_gem.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c
index dc6d0d15cda9c..171e809575ad6 100644
--- a/drivers/accel/ivpu/ivpu_gem.c
+++ b/drivers/accel/ivpu/ivpu_gem.c
@@ -193,7 +193,6 @@ void ivpu_bo_unbind_all_bos_from_context(struct ivpu_device *vdev, struct ivpu_m
struct drm_gem_object *ivpu_gem_create_object(struct drm_device *dev, size_t size)
{
- struct ivpu_device *vdev = to_ivpu_device(dev);
struct ivpu_bo *bo;
if (size == 0 || !PAGE_ALIGNED(size))
@@ -208,20 +207,17 @@ struct drm_gem_object *ivpu_gem_create_object(struct drm_device *dev, size_t siz
INIT_LIST_HEAD(&bo->bo_list_node);
- mutex_lock(&vdev->bo_list_lock);
- list_add_tail(&bo->bo_list_node, &vdev->bo_list);
- mutex_unlock(&vdev->bo_list_lock);
-
- ivpu_dbg(vdev, BO, " alloc: bo %8p size %9zu\n", bo, size);
return &bo->base.base;
}
struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev,
struct dma_buf *dma_buf)
{
+ struct ivpu_device *vdev = to_ivpu_device(dev);
struct device *attach_dev = dev->dev;
struct dma_buf_attachment *attach;
struct drm_gem_object *obj;
+ struct ivpu_bo *bo;
int ret;
attach = dma_buf_attach(dma_buf, attach_dev);
@@ -239,6 +235,14 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev,
obj->import_attach = attach;
obj->resv = dma_buf->resv;
+ bo = to_ivpu_bo(obj);
+
+ mutex_lock(&vdev->bo_list_lock);
+ list_add_tail(&bo->bo_list_node, &vdev->bo_list);
+ mutex_unlock(&vdev->bo_list_lock);
+
+ ivpu_dbg(vdev, BO, "import: bo %8p size %9zu\n", bo, ivpu_bo_size(bo));
+
return obj;
fail_detach:
@@ -269,6 +273,12 @@ static struct ivpu_bo *ivpu_bo_alloc(struct ivpu_device *vdev, u64 size, u32 fla
bo->base.map_wc = flags & DRM_IVPU_BO_WC;
bo->flags = flags;
+ mutex_lock(&vdev->bo_list_lock);
+ list_add_tail(&bo->bo_list_node, &vdev->bo_list);
+ mutex_unlock(&vdev->bo_list_lock);
+
+ ivpu_dbg(vdev, BO, " alloc: bo %8p size %9llu\n", bo, size);
+
return bo;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 016/614] accel/ivpu: Fix DCT active percent format
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 015/614] accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 017/614] drm/vgem-fence: Fix potential deadlock on release Greg Kroah-Hartman
` (611 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lizhi Hou, Karol Wachowski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Wachowski <karol.wachowski@linux.intel.com>
[ Upstream commit aa1c2b073ad23847dd2e7bdc7d30009f34ed7f59 ]
The pcode MAILBOX STATUS register PARAM2 field expects DCT active
percent in U1.7 value format. Convert percentage value to this
format before writing to the register.
Fixes: a19bffb10c46 ("accel/ivpu: Implement DCT handling")
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://lore.kernel.org/r/20251001104322.1249896-1-karol.wachowski@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +-
drivers/accel/ivpu/ivpu_hw_btrs.h | 2 +-
drivers/accel/ivpu/ivpu_pm.c | 9 +++++++--
3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_hw_btrs.c b/drivers/accel/ivpu/ivpu_hw_btrs.c
index afdb3b2aa72a7..aa33f562d29c1 100644
--- a/drivers/accel/ivpu/ivpu_hw_btrs.c
+++ b/drivers/accel/ivpu/ivpu_hw_btrs.c
@@ -752,7 +752,7 @@ int ivpu_hw_btrs_dct_get_request(struct ivpu_device *vdev, bool *enable)
}
}
-void ivpu_hw_btrs_dct_set_status(struct ivpu_device *vdev, bool enable, u32 active_percent)
+void ivpu_hw_btrs_dct_set_status(struct ivpu_device *vdev, bool enable, u8 active_percent)
{
u32 val = 0;
u32 cmd = enable ? DCT_ENABLE : DCT_DISABLE;
diff --git a/drivers/accel/ivpu/ivpu_hw_btrs.h b/drivers/accel/ivpu/ivpu_hw_btrs.h
index 032c384ac3d4d..c4c10e22f30f3 100644
--- a/drivers/accel/ivpu/ivpu_hw_btrs.h
+++ b/drivers/accel/ivpu/ivpu_hw_btrs.h
@@ -36,7 +36,7 @@ u32 ivpu_hw_btrs_dpu_freq_get(struct ivpu_device *vdev);
bool ivpu_hw_btrs_irq_handler_mtl(struct ivpu_device *vdev, int irq);
bool ivpu_hw_btrs_irq_handler_lnl(struct ivpu_device *vdev, int irq);
int ivpu_hw_btrs_dct_get_request(struct ivpu_device *vdev, bool *enable);
-void ivpu_hw_btrs_dct_set_status(struct ivpu_device *vdev, bool enable, u32 active_percent);
+void ivpu_hw_btrs_dct_set_status(struct ivpu_device *vdev, bool enable, u8 active_percent);
u32 ivpu_hw_btrs_telemetry_offset_get(struct ivpu_device *vdev);
u32 ivpu_hw_btrs_telemetry_size_get(struct ivpu_device *vdev);
u32 ivpu_hw_btrs_telemetry_enable_get(struct ivpu_device *vdev);
diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
index 475ddc94f1cfe..457ccf09df545 100644
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -502,6 +502,11 @@ void ivpu_pm_irq_dct_work_fn(struct work_struct *work)
else
ret = ivpu_pm_dct_disable(vdev);
- if (!ret)
- ivpu_hw_btrs_dct_set_status(vdev, enable, vdev->pm->dct_active_percent);
+ if (!ret) {
+ /* Convert percent to U1.7 format */
+ u8 val = DIV_ROUND_CLOSEST(vdev->pm->dct_active_percent * 128, 100);
+
+ ivpu_hw_btrs_dct_set_status(vdev, enable, val);
+ }
+
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 017/614] drm/vgem-fence: Fix potential deadlock on release
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 016/614] accel/ivpu: Fix DCT active percent format Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 018/614] bpf: Cleanup unused func args in rqspinlock implementation Greg Kroah-Hartman
` (610 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Janusz Krzysztofik,
Christian König, Maarten Lankhorst, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
[ Upstream commit 78b4d6463e9e69e5103f98b367f8984ad12cdc6f ]
A timer that expires a vgem fence automatically in 10 seconds is now
released with timer_delete_sync() from fence->ops.release() called on last
dma_fence_put(). In some scenarios, it can run in IRQ context, which is
not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was
demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while
working on new IGT subtests syncobj_timeline@stress-* as user space
replacements of some problematic test cases of a dma-fence-chain selftest
[1].
[117.004338] ================================
[117.004340] WARNING: inconsistent lock state
[117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S U
[117.004346] --------------------------------
[117.004347] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
[117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes:
[117.004352] ffff888138f86aa8 ((&fence->timer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190
[117.004361] {HARDIRQ-ON-W} state was registered at:
[117.004363] lock_acquire+0xc4/0x2e0
[117.004366] call_timer_fn+0x80/0x2a0
[117.004368] __run_timers+0x231/0x310
[117.004370] run_timer_softirq+0x76/0xe0
[117.004372] handle_softirqs+0xd4/0x4d0
[117.004375] __irq_exit_rcu+0x13f/0x160
[117.004377] irq_exit_rcu+0xe/0x20
[117.004379] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004382] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004385] cpuidle_enter_state+0x12b/0x8a0
[117.004388] cpuidle_enter+0x2e/0x50
[117.004393] call_cpuidle+0x22/0x60
[117.004395] do_idle+0x1fd/0x260
[117.004398] cpu_startup_entry+0x29/0x30
[117.004401] start_secondary+0x12d/0x160
[117.004404] common_startup_64+0x13e/0x141
[117.004407] irq event stamp: 2282669
[117.004409] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.004414] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.004419] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.004423] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.004426]
other info that might help us debug this:
[117.004429] Possible unsafe locking scenario:
[117.004432] CPU0
[117.004433] ----
[117.004434] lock((&fence->timer));
[117.004436] <Interrupt>
[117.004438] lock((&fence->timer));
[117.004440]
*** DEADLOCK ***
[117.004443] 1 lock held by swapper/0/0:
[117.004445] #0: ffffc90000003d50 ((&fence->timer)){?.-.}-{0:0}, at: call_timer_fn+0x7a/0x2a0
[117.004450]
stack backtrace:
[117.004453] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004455] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004455] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004456] Call Trace:
[117.004456] <IRQ>
[117.004457] dump_stack_lvl+0x91/0xf0
[117.004460] dump_stack+0x10/0x20
[117.004461] print_usage_bug.part.0+0x260/0x360
[117.004463] mark_lock+0x76e/0x9c0
[117.004465] ? register_lock_class+0x48/0x4a0
[117.004467] __lock_acquire+0xbc3/0x2860
[117.004469] lock_acquire+0xc4/0x2e0
[117.004470] ? __timer_delete_sync+0x4b/0x190
[117.004472] ? __timer_delete_sync+0x4b/0x190
[117.004473] __timer_delete_sync+0x68/0x190
[117.004474] ? __timer_delete_sync+0x4b/0x190
[117.004475] timer_delete_sync+0x10/0x20
[117.004476] vgem_fence_release+0x19/0x30 [vgem]
[117.004478] dma_fence_release+0xc1/0x3b0
[117.004480] ? dma_fence_release+0xa1/0x3b0
[117.004481] dma_fence_chain_release+0xe7/0x130
[117.004483] dma_fence_release+0xc1/0x3b0
[117.004484] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004485] dma_fence_chain_irq_work+0x59/0x80
[117.004487] irq_work_single+0x75/0xa0
[117.004490] irq_work_run_list+0x33/0x60
[117.004491] irq_work_run+0x18/0x40
[117.004493] __sysvec_irq_work+0x35/0x170
[117.004494] sysvec_irq_work+0x47/0xc0
[117.004496] asm_sysvec_irq_work+0x1b/0x20
[117.004497] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004499] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004499] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004500] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004501] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004502] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004502] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004502] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004506] dma_fence_signal+0x49/0xb0
[117.004507] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004508] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004509] call_timer_fn+0xa1/0x2a0
[117.004512] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004513] __run_timers+0x231/0x310
[117.004514] ? tmigr_handle_remote+0x2ac/0x560
[117.004517] timer_expire_remote+0x46/0x70
[117.004518] tmigr_handle_remote+0x433/0x560
[117.004520] ? __run_timers+0x239/0x310
[117.004521] ? run_timer_softirq+0x21/0xe0
[117.004522] ? lock_release+0xce/0x2a0
[117.004524] run_timer_softirq+0xcf/0xe0
[117.004525] handle_softirqs+0xd4/0x4d0
[117.004526] __irq_exit_rcu+0x13f/0x160
[117.004527] irq_exit_rcu+0xe/0x20
[117.004528] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004529] </IRQ>
[117.004529] <TASK>
[117.004529] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004530] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004532] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004532] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004533] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004533] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004534] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004534] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004534] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004537] ? cpuidle_enter_state+0x125/0x8a0
[117.004538] ? sched_clock_noinstr+0x9/0x10
[117.004540] cpuidle_enter+0x2e/0x50
[117.004542] call_cpuidle+0x22/0x60
[117.004542] do_idle+0x1fd/0x260
[117.004544] cpu_startup_entry+0x29/0x30
[117.004546] rest_init+0x104/0x200
[117.004548] start_kernel+0x93d/0xbd0
[117.004550] ? load_ucode_intel_bsp+0x2a/0x90
[117.004551] ? sme_unmap_bootdata+0x14/0x80
[117.004554] x86_64_start_reservations+0x18/0x30
[117.004555] x86_64_start_kernel+0xfd/0x150
[117.004556] ? soft_restart_cpu+0x14/0x14
[117.004558] common_startup_64+0x13e/0x141
[117.004560] </TASK>
[117.004565] ------------[ cut here ]------------
[117.004692] WARNING: CPU: 0 PID: 0 at kernel/time/timer.c:1610 __timer_delete_sync+0x126/0x190
[117.004697] Modules linked in: vgem snd_hda_codec_intelhdmi snd_hda_codec_hdmi i915 prime_numbers ttm drm_buddy drm_display_helper cec rc_core i2c_algo_bit hid_sensor_custom hid_sensor_hub hid_generic intel_ishtp_hid hid intel_uncore_frequency intel_uncore_frequency_common x86_pkg_temp_thermal intel_powerclamp cmdlinepart ee1004 r8153_ecm spi_nor coretemp cdc_ether mei_pxp mei_hdcp usbnet mtd intel_rapl_msr wmi_bmof kvm_intel snd_hda_intel snd_intel_dspcfg processor_thermal_device_pci kvm snd_hda_codec processor_thermal_device irqbypass processor_thermal_wt_hint polyval_clmulni platform_temperature_control snd_hda_core ghash_clmulni_intel processor_thermal_rfim spi_pxa2xx_platform snd_hwdep aesni_intel processor_thermal_rapl dw_dmac snd_pcm dw_dmac_core intel_rapl_common r8152 rapl mii intel_cstate spi_pxa2xx_core i2c_i801 processor_thermal_wt_req snd_timer i2c_mux mei_me intel_ish_ipc processor_thermal_power_floor e1000e snd i2c_smbus spi_intel_pci processor_thermal_mbox mei soundcore intel_ishtp thunderbolt idma64
[117.004733] spi_intel int340x_thermal_zone igen6_edac binfmt_misc intel_skl_int3472_tps68470 intel_pmc_core tps68470_regulator video clk_tps68470 pmt_telemetry pmt_discovery nls_iso8859_1 pmt_class intel_pmc_ssram_telemetry intel_skl_int3472_discrete int3400_thermal intel_hid intel_skl_int3472_common acpi_thermal_rel intel_vsec wmi pinctrl_tigerlake acpi_tad sparse_keymap acpi_pad dm_multipath msr nvme_fabrics fuse efi_pstore nfnetlink autofs4
[117.004782] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G S U 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 PREEMPT(voluntary)
[117.004787] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
[117.004789] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
[117.004793] RIP: 0010:__timer_delete_sync+0x126/0x190
[117.004795] Code: 31 c0 45 31 c9 c3 cc cc cc cc 48 8b 75 d0 45 84 f6 74 63 49 c7 45 18 00 00 00 00 48 89 c7 e8 51 46 39 01 f3 90 e9 66 ff ff ff <0f> 0b e9 5f ff ff ff e8 ee e4 0c 00 49 8d 5d 28 45 31 c9 31 c9 4c
[117.004801] RSP: 0018:ffffc90000003a40 EFLAGS: 00010046
[117.004804] RAX: ffffffff815093fb RBX: ffff888138f86aa8 RCX: 0000000000000000
[117.004807] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004809] RBP: ffffc90000003a70 R08: 0000000000000000 R09: 0000000000000000
[117.004812] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff815093fb
[117.004814] R13: ffff888138f86a80 R14: 0000000000000000 R15: 0000000000000000
[117.004817] FS: 0000000000000000(0000) GS:ffff88890b0f7000(0000) knlGS:0000000000000000
[117.004820] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[117.004823] CR2: 00005db8131eb7f0 CR3: 0000000003448000 CR4: 0000000000f52ef0
[117.004826] PKRU: 55555554
[117.004827] Call Trace:
[117.004829] <IRQ>
[117.004831] timer_delete_sync+0x10/0x20
[117.004833] vgem_fence_release+0x19/0x30 [vgem]
[117.004836] dma_fence_release+0xc1/0x3b0
[117.004838] ? dma_fence_release+0xa1/0x3b0
[117.004841] dma_fence_chain_release+0xe7/0x130
[117.004844] dma_fence_release+0xc1/0x3b0
[117.004847] ? _raw_spin_unlock_irqrestore+0x27/0x80
[117.004850] dma_fence_chain_irq_work+0x59/0x80
[117.004853] irq_work_single+0x75/0xa0
[117.004857] irq_work_run_list+0x33/0x60
[117.004860] irq_work_run+0x18/0x40
[117.004863] __sysvec_irq_work+0x35/0x170
[117.004865] sysvec_irq_work+0x47/0xc0
[117.004868] asm_sysvec_irq_work+0x1b/0x20
[117.004871] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80
[117.004874] Code: 00 75 1c 65 ff 0d d9 34 68 01 74 20 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3 cc cc cc cc e8 7f 9d d3 fe fb 0f 1f 44 00 00 <eb> d7 0f 1f 44 00 00 5b 41 5c 5d 31 c0 31 d2 31 c9 31 f6 31 ff c3
[117.004879] RSP: 0018:ffffc90000003cf0 EFLAGS: 00000246
[117.004882] RAX: 0000000000000000 RBX: ffff888155e94c40 RCX: 0000000000000000
[117.004884] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004887] RBP: ffffc90000003d00 R08: 0000000000000000 R09: 0000000000000000
[117.004890] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000246
[117.004892] R13: 0000000000000001 R14: 0000000000000246 R15: ffff888155e94c80
[117.004897] dma_fence_signal+0x49/0xb0
[117.004899] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004902] vgem_fence_timeout+0x12/0x20 [vgem]
[117.004904] call_timer_fn+0xa1/0x2a0
[117.004908] ? __pfx_vgem_fence_timeout+0x10/0x10 [vgem]
[117.004910] __run_timers+0x231/0x310
[117.004913] ? tmigr_handle_remote+0x2ac/0x560
[117.004917] timer_expire_remote+0x46/0x70
[117.004919] tmigr_handle_remote+0x433/0x560
[117.004923] ? __run_timers+0x239/0x310
[117.004925] ? run_timer_softirq+0x21/0xe0
[117.004928] ? lock_release+0xce/0x2a0
[117.004931] run_timer_softirq+0xcf/0xe0
[117.004933] handle_softirqs+0xd4/0x4d0
[117.004936] __irq_exit_rcu+0x13f/0x160
[117.004938] irq_exit_rcu+0xe/0x20
[117.004940] sysvec_apic_timer_interrupt+0xa0/0xc0
[117.004943] </IRQ>
[117.004944] <TASK>
[117.004946] asm_sysvec_apic_timer_interrupt+0x1b/0x20
[117.004949] RIP: 0010:cpuidle_enter_state+0x12b/0x8a0
[117.004953] Code: 48 0f a3 05 97 ce 0e 01 0f 82 2e 03 00 00 31 ff e8 8a 41 bd fe 80 7d d0 00 0f 85 11 03 00 00 e8 8b 06 d5 fe fb 0f 1f 44 00 00 <45> 85 f6 0f 88 67 02 00 00 4d 63 ee 49 83 fd 0a 0f 83 34 06 00 00
[117.004961] RSP: 0018:ffffffff83403d88 EFLAGS: 00000246
[117.004963] RAX: 0000000000000000 RBX: ffff88888f046440 RCX: 0000000000000000
[117.004966] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[117.004968] RBP: ffffffff83403dd8 R08: 0000000000000000 R09: 0000000000000000
[117.004971] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff837cbe80
[117.004974] R13: 0000000000000004 R14: 0000000000000004 R15: 0000001ad1df466b
[117.004978] ? cpuidle_enter_state+0x125/0x8a0
[117.004981] ? sched_clock_noinstr+0x9/0x10
[117.004985] cpuidle_enter+0x2e/0x50
[117.004989] call_cpuidle+0x22/0x60
[117.004991] do_idle+0x1fd/0x260
[117.005001] cpu_startup_entry+0x29/0x30
[117.005004] rest_init+0x104/0x200
[117.005008] start_kernel+0x93d/0xbd0
[117.005011] ? load_ucode_intel_bsp+0x2a/0x90
[117.005014] ? sme_unmap_bootdata+0x14/0x80
[117.005017] x86_64_start_reservations+0x18/0x30
[117.005020] x86_64_start_kernel+0xfd/0x150
[117.005023] ? soft_restart_cpu+0x14/0x14
[117.005026] common_startup_64+0x13e/0x141
[117.005030] </TASK>
[117.005032] irq event stamp: 2282669
[117.005034] hardirqs last enabled at (2282668): [<ffffffff8289db71>] _raw_spin_unlock_irqrestore+0x51/0x80
[117.005038] hardirqs last disabled at (2282669): [<ffffffff82882021>] sysvec_irq_work+0x11/0xc0
[117.005043] softirqs last enabled at (2254702): [<ffffffff8289fd00>] __do_softirq+0x10/0x18
[117.005047] softirqs last disabled at (2254725): [<ffffffff813d4ddf>] __irq_exit_rcu+0x13f/0x160
[117.005051] ---[ end trace 0000000000000000 ]---
Make the timer IRQ safe.
[1] https://patchwork.freedesktop.org/series/154987/#rev2
Fixes: 4077798484459 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)")
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20250926152628.2165080-2-janusz.krzysztofik@linux.intel.com
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vgem/vgem_fence.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
index fd76730fd38c0..07db319c3d7f9 100644
--- a/drivers/gpu/drm/vgem/vgem_fence.c
+++ b/drivers/gpu/drm/vgem/vgem_fence.c
@@ -79,7 +79,7 @@ static struct dma_fence *vgem_fence_create(struct vgem_file *vfile,
dma_fence_init(&fence->base, &vgem_fence_ops, &fence->lock,
dma_fence_context_alloc(1), 1);
- timer_setup(&fence->timer, vgem_fence_timeout, 0);
+ timer_setup(&fence->timer, vgem_fence_timeout, TIMER_IRQSAFE);
/* We force the fence to expire within 10s to prevent driver hangs */
mod_timer(&fence->timer, jiffies + VGEM_FENCE_TIMEOUT);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 018/614] bpf: Cleanup unused func args in rqspinlock implementation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 017/614] drm/vgem-fence: Fix potential deadlock on release Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 019/614] bpf: Fix sleepable context for async callbacks Greg Kroah-Hartman
` (609 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Chintamaneni,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Alexei Starovoitov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
[ Upstream commit 56b4d162392dda2365fbc1f482184a24b489d07d ]
cleanup unused function args in check_deadlock* functions.
Fixes: 31158ad02ddb ("rqspinlock: Add deadlock detection and recovery")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20251001172702.122838-1-sidchintamaneni@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/rqspinlock.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c
index a00561b1d3e51..21be48108e962 100644
--- a/kernel/bpf/rqspinlock.c
+++ b/kernel/bpf/rqspinlock.c
@@ -89,15 +89,14 @@ struct rqspinlock_timeout {
DEFINE_PER_CPU_ALIGNED(struct rqspinlock_held, rqspinlock_held_locks);
EXPORT_SYMBOL_GPL(rqspinlock_held_locks);
-static bool is_lock_released(rqspinlock_t *lock, u32 mask, struct rqspinlock_timeout *ts)
+static bool is_lock_released(rqspinlock_t *lock, u32 mask)
{
if (!(atomic_read_acquire(&lock->val) & (mask)))
return true;
return false;
}
-static noinline int check_deadlock_AA(rqspinlock_t *lock, u32 mask,
- struct rqspinlock_timeout *ts)
+static noinline int check_deadlock_AA(rqspinlock_t *lock)
{
struct rqspinlock_held *rqh = this_cpu_ptr(&rqspinlock_held_locks);
int cnt = min(RES_NR_HELD, rqh->cnt);
@@ -118,8 +117,7 @@ static noinline int check_deadlock_AA(rqspinlock_t *lock, u32 mask,
* more locks, which reduce to ABBA). This is not exhaustive, and we rely on
* timeouts as the final line of defense.
*/
-static noinline int check_deadlock_ABBA(rqspinlock_t *lock, u32 mask,
- struct rqspinlock_timeout *ts)
+static noinline int check_deadlock_ABBA(rqspinlock_t *lock, u32 mask)
{
struct rqspinlock_held *rqh = this_cpu_ptr(&rqspinlock_held_locks);
int rqh_cnt = min(RES_NR_HELD, rqh->cnt);
@@ -142,7 +140,7 @@ static noinline int check_deadlock_ABBA(rqspinlock_t *lock, u32 mask,
* Let's ensure to break out of this loop if the lock is available for
* us to potentially acquire.
*/
- if (is_lock_released(lock, mask, ts))
+ if (is_lock_released(lock, mask))
return 0;
/*
@@ -198,15 +196,14 @@ static noinline int check_deadlock_ABBA(rqspinlock_t *lock, u32 mask,
return 0;
}
-static noinline int check_deadlock(rqspinlock_t *lock, u32 mask,
- struct rqspinlock_timeout *ts)
+static noinline int check_deadlock(rqspinlock_t *lock, u32 mask)
{
int ret;
- ret = check_deadlock_AA(lock, mask, ts);
+ ret = check_deadlock_AA(lock);
if (ret)
return ret;
- ret = check_deadlock_ABBA(lock, mask, ts);
+ ret = check_deadlock_ABBA(lock, mask);
if (ret)
return ret;
@@ -234,7 +231,7 @@ static noinline int check_timeout(rqspinlock_t *lock, u32 mask,
*/
if (prev + NSEC_PER_MSEC < time) {
ts->cur = time;
- return check_deadlock(lock, mask, ts);
+ return check_deadlock(lock, mask);
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 019/614] bpf: Fix sleepable context for async callbacks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 018/614] bpf: Cleanup unused func args in rqspinlock implementation Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 020/614] bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq Greg Kroah-Hartman
` (608 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
[ Upstream commit 469d638d1520a9332cd0d034690e75e845610a51 ]
Fix the BPF verifier to correctly determine the sleepable context of
async callbacks based on the async primitive type rather than the arming
program's context.
The bug is in in_sleepable() which uses OR logic to check if the current
execution context is sleepable. When a sleepable program arms a timer
callback, the callback's state correctly has in_sleepable=false, but
in_sleepable() would still return true due to env->prog->sleepable being
true. This incorrectly allows sleepable helpers like
bpf_copy_from_user() inside timer callbacks when armed from sleepable
programs, even though timer callbacks always execute in non-sleepable
context.
Fix in_sleepable() to rely solely on env->cur_state->in_sleepable, and
initialize state->in_sleepable to env->prog->sleepable in
do_check_common() for the main program entry. This ensures the sleepable
context is properly tracked per verification state rather than being
overridden by the program's sleepability.
The env->cur_state NULL check in in_sleepable() was only needed for
do_misc_fixups() which runs after verification when env->cur_state is
set to NULL. Update do_misc_fixups() to use env->prog->sleepable
directly for the storage_get_function check, and remove the redundant
NULL check from in_sleepable().
Introduce is_async_cb_sleepable() helper to explicitly determine async
callback sleepability based on the primitive type:
- bpf_timer callbacks are never sleepable
- bpf_wq and bpf_task_work callbacks are always sleepable
Add verifier_bug() check to catch unhandled async callback types,
ensuring future additions cannot be silently mishandled. Move the
is_task_work_add_kfunc() forward declaration to the top alongside other
callback-related helpers. We update push_async_cb() to adjust to the new
changes.
At the same time, while simplifying in_sleepable(), we notice a problem
in do_misc_fixups. Fix storage_get helpers to use GFP_ATOMIC when called
from non-sleepable contexts within sleepable programs, such as bpf_timer
callbacks.
Currently, the check in do_misc_fixups assumes that env->prog->sleepable,
previously in_sleepable(env) which only resolved to this check before
last commit, holds across the program's execution, but that is not true.
Instead, the func_atomic bit must be set whenever we see the function
being called in an atomic context. Previously, this is being done when
the helper is invoked in atomic contexts in sleepable programs, we can
simply just set the value to true without doing an in_sleepable() check.
We must also do a standalone in_sleepable() check to handle cases where
the async callback itself is armed from a sleepable program, but is
itself non-sleepable (e.g., timer callback) and invokes such a helper,
thus needing the func_atomic bit to be true for the said call.
Adjust do_misc_fixups() to drop any checks regarding sleepable nature of
the program, and just depend on the func_atomic bit to decide which GFP
flag to pass.
Fixes: 81f1d7a583fa ("bpf: wq: add bpf_wq_set_callback_impl")
Fixes: b00fa38a9c1c ("bpf: Enable non-atomic allocations in local storage")
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20251007220349.3852807-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 41 ++++++++++++++++++++++++++++++-----------
1 file changed, 30 insertions(+), 11 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fbe4bb91c564a..460107b0449fe 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -515,6 +515,7 @@ static bool is_callback_calling_kfunc(u32 btf_id);
static bool is_bpf_throw_kfunc(struct bpf_insn *insn);
static bool is_bpf_wq_set_callback_impl_kfunc(u32 btf_id);
+static bool is_task_work_add_kfunc(u32 func_id);
static bool is_sync_callback_calling_function(enum bpf_func_id func_id)
{
@@ -547,6 +548,21 @@ static bool is_async_callback_calling_insn(struct bpf_insn *insn)
(bpf_pseudo_kfunc_call(insn) && is_async_callback_calling_kfunc(insn->imm));
}
+static bool is_async_cb_sleepable(struct bpf_verifier_env *env, struct bpf_insn *insn)
+{
+ /* bpf_timer callbacks are never sleepable. */
+ if (bpf_helper_call(insn) && insn->imm == BPF_FUNC_timer_set_callback)
+ return false;
+
+ /* bpf_wq and bpf_task_work callbacks are always sleepable. */
+ if (bpf_pseudo_kfunc_call(insn) && insn->off == 0 &&
+ (is_bpf_wq_set_callback_impl_kfunc(insn->imm) || is_task_work_add_kfunc(insn->imm)))
+ return true;
+
+ verifier_bug(env, "unhandled async callback in is_async_cb_sleepable");
+ return false;
+}
+
static bool is_may_goto_insn(struct bpf_insn *insn)
{
return insn->code == (BPF_JMP | BPF_JCOND) && insn->src_reg == BPF_MAY_GOTO;
@@ -5826,8 +5842,7 @@ static int map_kptr_match_type(struct bpf_verifier_env *env,
static bool in_sleepable(struct bpf_verifier_env *env)
{
- return env->prog->sleepable ||
- (env->cur_state && env->cur_state->in_sleepable);
+ return env->cur_state->in_sleepable;
}
/* The non-sleepable programs and sleepable programs with explicit bpf_rcu_read_lock()
@@ -10368,8 +10383,6 @@ typedef int (*set_callee_state_fn)(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx);
-static bool is_task_work_add_kfunc(u32 func_id);
-
static int set_callee_state(struct bpf_verifier_env *env,
struct bpf_func_state *caller,
struct bpf_func_state *callee, int insn_idx);
@@ -10588,8 +10601,7 @@ static int push_callback_call(struct bpf_verifier_env *env, struct bpf_insn *ins
env->subprog_info[subprog].is_async_cb = true;
async_cb = push_async_cb(env, env->subprog_info[subprog].start,
insn_idx, subprog,
- is_bpf_wq_set_callback_impl_kfunc(insn->imm) ||
- is_task_work_add_kfunc(insn->imm));
+ is_async_cb_sleepable(env, insn));
if (!async_cb)
return -EFAULT;
callee = async_cb->frame[0];
@@ -11428,7 +11440,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
return -EINVAL;
}
- if (in_sleepable(env) && is_storage_get_function(func_id))
+ if (is_storage_get_function(func_id))
env->insn_aux_data[insn_idx].storage_get_func_atomic = true;
}
@@ -11439,7 +11451,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
return -EINVAL;
}
- if (in_sleepable(env) && is_storage_get_function(func_id))
+ if (is_storage_get_function(func_id))
env->insn_aux_data[insn_idx].storage_get_func_atomic = true;
}
@@ -11450,10 +11462,17 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
return -EINVAL;
}
- if (in_sleepable(env) && is_storage_get_function(func_id))
+ if (is_storage_get_function(func_id))
env->insn_aux_data[insn_idx].storage_get_func_atomic = true;
}
+ /*
+ * Non-sleepable contexts in sleepable programs (e.g., timer callbacks)
+ * are atomic and must use GFP_ATOMIC for storage_get helpers.
+ */
+ if (!in_sleepable(env) && is_storage_get_function(func_id))
+ env->insn_aux_data[insn_idx].storage_get_func_atomic = true;
+
meta.func_id = func_id;
/* check args */
for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) {
@@ -22485,8 +22504,7 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
}
if (is_storage_get_function(insn->imm)) {
- if (!in_sleepable(env) ||
- env->insn_aux_data[i + delta].storage_get_func_atomic)
+ if (env->insn_aux_data[i + delta].storage_get_func_atomic)
insn_buf[0] = BPF_MOV64_IMM(BPF_REG_5, (__force __s32)GFP_ATOMIC);
else
insn_buf[0] = BPF_MOV64_IMM(BPF_REG_5, (__force __s32)GFP_KERNEL);
@@ -23156,6 +23174,7 @@ static int do_check_common(struct bpf_verifier_env *env, int subprog)
state->curframe = 0;
state->speculative = false;
state->branches = 1;
+ state->in_sleepable = env->prog->sleepable;
state->frame[0] = kzalloc(sizeof(struct bpf_func_state), GFP_KERNEL_ACCOUNT);
if (!state->frame[0]) {
kfree(state);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 020/614] bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 019/614] bpf: Fix sleepable context for async callbacks Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 021/614] tools/nolibc: handle NULL wstatus argument to waitpid() Greg Kroah-Hartman
` (607 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mykyta Yatsenko, Andrii Nakryiko,
Eduard Zingerman, Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mykyta Yatsenko <yatsenko@meta.com>
[ Upstream commit 5f8d41172931a92339c5cce81a3142065fa56e45 ]
Fix handling maps with no BTF and non-constant offsets for the bpf_wq.
This de-duplicates logic with other internal structs (task_work, timer),
keeps error reporting consistent, and makes future changes to the layout
handling centralized.
Fixes: d940c9b94d7e ("bpf: add support for KF_ARG_PTR_TO_WORKQUEUE")
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251010164606.147298-1-mykyta.yatsenko5@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 460107b0449fe..52c01c011c6fb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8479,6 +8479,9 @@ static int check_map_field_pointer(struct bpf_verifier_env *env, u32 regno,
case BPF_TASK_WORK:
field_off = map->record->task_work_off;
break;
+ case BPF_WORKQUEUE:
+ field_off = map->record->wq_off;
+ break;
default:
verifier_bug(env, "unsupported BTF field type: %s\n", struct_name);
return -EINVAL;
@@ -8520,13 +8523,17 @@ static int process_wq_func(struct bpf_verifier_env *env, int regno,
{
struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno];
struct bpf_map *map = reg->map_ptr;
- u64 val = reg->var_off.value;
+ int err;
- if (map->record->wq_off != val + reg->off) {
- verbose(env, "off %lld doesn't point to 'struct bpf_wq' that is at %d\n",
- val + reg->off, map->record->wq_off);
- return -EINVAL;
+ err = check_map_field_pointer(env, regno, BPF_WORKQUEUE);
+ if (err)
+ return err;
+
+ if (meta->map.ptr) {
+ verifier_bug(env, "Two map pointers in a bpf_wq helper");
+ return -EFAULT;
}
+
meta->map.uid = reg->map_uid;
meta->map.ptr = map;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 021/614] tools/nolibc: handle NULL wstatus argument to waitpid()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 020/614] bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 022/614] USB: Fix descriptor count when handling invalid MBIM extended descriptor Greg Kroah-Hartman
` (606 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Willy Tarreau,
Thomas Weißschuh, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 812f223fe9be03dc22abb85240b6f075135d2386 ]
wstatus is allowed to be NULL. Avoid a segmentation fault in this case.
Fixes: 0c89abf5ab3f ("tools/nolibc: implement waitpid() in terms of waitid()")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/sys/wait.h | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/tools/include/nolibc/sys/wait.h b/tools/include/nolibc/sys/wait.h
index 4e66e1f7a03e4..9d9319ba92cbd 100644
--- a/tools/include/nolibc/sys/wait.h
+++ b/tools/include/nolibc/sys/wait.h
@@ -65,23 +65,29 @@ pid_t waitpid(pid_t pid, int *status, int options)
switch (info.si_code) {
case 0:
- *status = 0;
+ if (status)
+ *status = 0;
break;
case CLD_EXITED:
- *status = (info.si_status & 0xff) << 8;
+ if (status)
+ *status = (info.si_status & 0xff) << 8;
break;
case CLD_KILLED:
- *status = info.si_status & 0x7f;
+ if (status)
+ *status = info.si_status & 0x7f;
break;
case CLD_DUMPED:
- *status = (info.si_status & 0x7f) | 0x80;
+ if (status)
+ *status = (info.si_status & 0x7f) | 0x80;
break;
case CLD_STOPPED:
case CLD_TRAPPED:
- *status = (info.si_status << 8) + 0x7f;
+ if (status)
+ *status = (info.si_status << 8) + 0x7f;
break;
case CLD_CONTINUED:
- *status = 0xffff;
+ if (status)
+ *status = 0xffff;
break;
default:
return -1;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 022/614] USB: Fix descriptor count when handling invalid MBIM extended descriptor
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 021/614] tools/nolibc: handle NULL wstatus argument to waitpid() Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 023/614] perf bpf_counter: Fix opening of "any"(-1) CPU events Greg Kroah-Hartman
` (605 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 5570ad1423ee60f6e972dadb63fb2e5f90a54cbe ]
In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE
descriptor was using 'break' upon detecting an invalid length.
This was incorrect because 'break' only exits the switch statement,
causing the code to fall through to cnt++, thus incorrectly
incrementing the count of parsed descriptors for a descriptor that was
actually invalid and being discarded.
This patch changes 'break' to 'goto next_desc;' to ensure that the
logic skips the counter increment and correctly proceeds to the next
descriptor in the buffer. This maintains an accurate count of only
the successfully parsed descriptors.
Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20250928185611.764589-1-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/message.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index d2b2787be4092..6138468c67c47 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2431,7 +2431,7 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
break;
case USB_CDC_MBIM_EXTENDED_TYPE:
if (elength < sizeof(struct usb_cdc_mbim_extended_desc))
- break;
+ goto next_desc;
hdr->usb_cdc_mbim_extended_desc =
(struct usb_cdc_mbim_extended_desc *)buffer;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 023/614] perf bpf_counter: Fix opening of "any"(-1) CPU events
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 022/614] USB: Fix descriptor count when handling invalid MBIM extended descriptor Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 024/614] pinctrl: qcom: glymur: Drop unnecessary platform data from match table Greg Kroah-Hartman
` (604 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 2a67955de13624ec17d1c2504d2c9eeb37933b77 ]
The bperf BPF counter code doesn't handle "any"(-1) CPU events, always
wanting to aggregate a count against a CPU, which avoids the need for
atomics so let's not change that. Force evsels used for BPF counters
to require a CPU when not in system-wide mode so that the "any"(-1)
value isn't used during map propagation and evsel's CPU map matches
that of the PMU.
Fixes: b91917c0c6fa ("perf bpf_counter: Fix handling of cpumap fixing hybrid")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-stat.c | 13 +++++++++++++
tools/perf/util/bpf_counter.c | 7 ++++++-
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 7006f848f87a6..f1c9d6c94fc50 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -2540,6 +2540,7 @@ int cmd_stat(int argc, const char **argv)
unsigned int interval, timeout;
const char * const stat_subcommands[] = { "record", "report" };
char errbuf[BUFSIZ];
+ struct evsel *counter;
setlocale(LC_ALL, "");
@@ -2797,6 +2798,18 @@ int cmd_stat(int argc, const char **argv)
evlist__warn_user_requested_cpus(evsel_list, target.cpu_list);
+ evlist__for_each_entry(evsel_list, counter) {
+ /*
+ * Setup BPF counters to require CPUs as any(-1) isn't
+ * supported. evlist__create_maps below will propagate this
+ * information to the evsels. Note, evsel__is_bperf isn't yet
+ * set up, and this change must happen early, so directly use
+ * the bpf_counter variable and target information.
+ */
+ if ((counter->bpf_counter || target.use_bpf) && !target__has_cpu(&target))
+ counter->core.requires_cpu = true;
+ }
+
if (evlist__create_maps(evsel_list, &target) < 0) {
if (target__has_task(&target)) {
pr_err("Problems finding threads of monitor\n");
diff --git a/tools/perf/util/bpf_counter.c b/tools/perf/util/bpf_counter.c
index ca5d01b9017db..a5882b5822057 100644
--- a/tools/perf/util/bpf_counter.c
+++ b/tools/perf/util/bpf_counter.c
@@ -460,6 +460,7 @@ static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd,
struct bperf_leader_bpf *skel = bperf_leader_bpf__open();
int link_fd, diff_map_fd, err;
struct bpf_link *link = NULL;
+ struct perf_thread_map *threads;
if (!skel) {
pr_err("Failed to open leader skeleton\n");
@@ -495,7 +496,11 @@ static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd,
* following evsel__open_per_cpu call
*/
evsel->leader_skel = skel;
- evsel__open(evsel, evsel->core.cpus, evsel->core.threads);
+ assert(!perf_cpu_map__has_any_cpu_or_is_empty(evsel->core.cpus));
+ /* Always open system wide. */
+ threads = thread_map__new_by_tid(-1);
+ evsel__open(evsel, evsel->core.cpus, threads);
+ perf_thread_map__put(threads);
out:
bperf_leader_bpf__destroy(skel);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 024/614] pinctrl: qcom: glymur: Drop unnecessary platform data from match table
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 023/614] perf bpf_counter: Fix opening of "any"(-1) CPU events Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 025/614] pinctrl: qcom: glymur: Fix the gpio and egpio pin functions Greg Kroah-Hartman
` (603 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Dmitry Baryshkov,
Linus Walleij, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <abel.vesa@linaro.org>
[ Upstream commit 37e7b536061a33c8f27030e3ffc5a717a6c319e3 ]
The platform specific configuration is already passed on to the generic
msm probe. So it's useless to exist in the match table next to the
compatible. So drop it from match table.
Fixes: 87ebcd8baebf ("pinctrl: qcom: Add glymur pinctrl driver")
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/qcom/pinctrl-glymur.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/qcom/pinctrl-glymur.c b/drivers/pinctrl/qcom/pinctrl-glymur.c
index 9913f98e95311..9781e7fcb3a11 100644
--- a/drivers/pinctrl/qcom/pinctrl-glymur.c
+++ b/drivers/pinctrl/qcom/pinctrl-glymur.c
@@ -1743,7 +1743,7 @@ static const struct msm_pinctrl_soc_data glymur_tlmm = {
};
static const struct of_device_id glymur_tlmm_of_match[] = {
- { .compatible = "qcom,glymur-tlmm", .data = &glymur_tlmm },
+ { .compatible = "qcom,glymur-tlmm", },
{ }
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 025/614] pinctrl: qcom: glymur: Fix the gpio and egpio pin functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 024/614] pinctrl: qcom: glymur: Drop unnecessary platform data from match table Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 026/614] ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Greg Kroah-Hartman
` (602 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Bartosz Golaszewski,
Dmitry Baryshkov, Linus Walleij, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <abel.vesa@linaro.org>
[ Upstream commit e73fda2dcb0bad6650e654556c5242b773707257 ]
Mark the gpio/egpio as GPIO specific pin functions, othewise
the pin muxing generic framework will complain about the gpio
being already requested by a different owner.
Fixes: 87ebcd8baebf ("pinctrl: qcom: Add glymur pinctrl driver")
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/qcom/pinctrl-glymur.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/pinctrl/qcom/pinctrl-glymur.c b/drivers/pinctrl/qcom/pinctrl-glymur.c
index 9781e7fcb3a11..335005084b6bc 100644
--- a/drivers/pinctrl/qcom/pinctrl-glymur.c
+++ b/drivers/pinctrl/qcom/pinctrl-glymur.c
@@ -1316,7 +1316,7 @@ static const char *const wcn_sw_ctrl_groups[] = {
};
static const struct pinfunction glymur_functions[] = {
- MSM_PIN_FUNCTION(gpio),
+ MSM_GPIO_PIN_FUNCTION(gpio),
MSM_PIN_FUNCTION(resout_gpio_n),
MSM_PIN_FUNCTION(aoss_cti),
MSM_PIN_FUNCTION(asc_cci),
@@ -1342,7 +1342,7 @@ static const struct pinfunction glymur_functions[] = {
MSM_PIN_FUNCTION(edp0_hot),
MSM_PIN_FUNCTION(edp0_lcd),
MSM_PIN_FUNCTION(edp1_lcd),
- MSM_PIN_FUNCTION(egpio),
+ MSM_GPIO_PIN_FUNCTION(egpio),
MSM_PIN_FUNCTION(eusb_ac_en),
MSM_PIN_FUNCTION(gcc_gp1),
MSM_PIN_FUNCTION(gcc_gp2),
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 026/614] ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 025/614] pinctrl: qcom: glymur: Fix the gpio and egpio pin functions Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 027/614] pinctrl: renesas: rzg2l: Fix PMC restore Greg Kroah-Hartman
` (601 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge E. Hallyn, Matthew Garrett,
Eric W. Biederman, Jann Horn, Christian Brauner, Kees Cook,
Roberto Sassu, Mimi Zohar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Sassu <roberto.sassu@huawei.com>
[ Upstream commit 8f3fc4f3f8aa6e99266c69cc78bdaa58379e65fc ]
Since commit 56305aa9b6fa ("exec: Compute file based creds only once"), the
credentials to be applied to the process after execution are not calculated
anymore for each step of finding intermediate interpreters (including the
final binary), but only after the final binary to be executed without
interpreter has been found.
In particular, that means that the bprm_check_security LSM hook will not
see the updated cred->e[ug]id for the intermediate and for the final binary
to be executed, since the function doing this task has been moved from
prepare_binprm(), which calls the bprm_check_security hook, to
bprm_creds_from_file().
This breaks the IMA expectation for the CREDS_CHECK hook, introduced with
commit d906c10d8a31 ("IMA: Support using new creds in appraisal policy"),
which expects to evaluate "the credentials that will be committed when the
new process is started". This is clearly not the case for the CREDS_CHECK
IMA hook, which is attached to bprm_check_security.
This issue does not affect systems which load a policy with the BPRM_CHECK
hook with no other criteria, as is the case with the built-in "tcb" and/or
"appraise_tcb" IMA policies. The "tcb" built-in policy measures all
executions regardless of the new credentials, and the "appraise_tcb" policy
is written in terms of the file owner, rather than IMA hooks.
However, it does affect systems without a BPRM_CHECK policy rule or with a
BPRM_CHECK policy rule that does not include what CREDS_CHECK evaluates. As
an extreme example, taking a standalone rule like:
measure func=CREDS_CHECK euid=0
This will not measure for example sudo (because CREDS_CHECK still sees the
bprm->cred->euid set to the regular user UID), but only the subsequent
commands after the euid was applied to the children.
Make set[ug]id programs measured/appraised again by splitting
ima_bprm_check() in two separate hook implementations (CREDS_CHECK now
being implemented by ima_creds_check()), and by attaching CREDS_CHECK to
the bprm_creds_from_file LSM hook.
The limitation of this approach is that CREDS_CHECK will not be invoked
anymore for the intermediate interpreters, like it was before, but only for
the final binary. This limitation can be removed only by reverting commit
56305aa9b6fa ("exec: Compute file based creds only once").
Link: https://github.com/linux-integrity/linux/issues/3
Fixes: 56305aa9b6fa ("exec: Compute file based creds only once")
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Jann Horn <jannh@google.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/ima/ima_main.c | 42 ++++++++++++++++++++++++-------
1 file changed, 33 insertions(+), 9 deletions(-)
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index cdd225f65a629..ebaebccfbe9ab 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -573,18 +573,41 @@ static int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
*/
static int ima_bprm_check(struct linux_binprm *bprm)
{
- int ret;
struct lsm_prop prop;
security_current_getlsmprop_subj(&prop);
- ret = process_measurement(bprm->file, current_cred(),
- &prop, NULL, 0, MAY_EXEC, BPRM_CHECK);
- if (ret)
- return ret;
-
- security_cred_getlsmprop(bprm->cred, &prop);
- return process_measurement(bprm->file, bprm->cred, &prop, NULL, 0,
- MAY_EXEC, CREDS_CHECK);
+ return process_measurement(bprm->file, current_cred(),
+ &prop, NULL, 0, MAY_EXEC, BPRM_CHECK);
+}
+
+/**
+ * ima_creds_check - based on policy, collect/store measurement.
+ * @bprm: contains the linux_binprm structure
+ * @file: contains the file descriptor of the binary being executed
+ *
+ * The OS protects against an executable file, already open for write,
+ * from being executed in deny_write_access() and an executable file,
+ * already open for execute, from being modified in get_write_access().
+ * So we can be certain that what we verify and measure here is actually
+ * what is being executed.
+ *
+ * The difference from ima_bprm_check() is that ima_creds_check() is invoked
+ * only after determining the final binary to be executed without interpreter,
+ * and not when searching for intermediate binaries. The reason is that since
+ * commit 56305aa9b6fab ("exec: Compute file based creds only once"), the
+ * credentials to be applied to the process are calculated only at that stage
+ * (bprm_creds_from_file security hook instead of bprm_check_security).
+ *
+ * On success return 0. On integrity appraisal error, assuming the file
+ * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
+ */
+static int ima_creds_check(struct linux_binprm *bprm, const struct file *file)
+{
+ struct lsm_prop prop;
+
+ security_current_getlsmprop_subj(&prop);
+ return process_measurement((struct file *)file, bprm->cred, &prop, NULL,
+ 0, MAY_EXEC, CREDS_CHECK);
}
/**
@@ -1242,6 +1265,7 @@ static int __init init_ima(void)
static struct security_hook_list ima_hooks[] __ro_after_init = {
LSM_HOOK_INIT(bprm_check_security, ima_bprm_check),
LSM_HOOK_INIT(bprm_creds_for_exec, ima_bprm_creds_for_exec),
+ LSM_HOOK_INIT(bprm_creds_from_file, ima_creds_check),
LSM_HOOK_INIT(file_post_open, ima_file_check),
LSM_HOOK_INIT(inode_post_create_tmpfile, ima_post_create_tmpfile),
LSM_HOOK_INIT(file_release, ima_file_free),
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 027/614] pinctrl: renesas: rzg2l: Fix PMC restore
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 026/614] ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 028/614] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback Greg Kroah-Hartman
` (600 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Biju Das, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit cea950101108b7bfffe26ec4007b8e263a4b56a8 ]
PMC restore needs unlocking the register using the PWPR register.
Fixes: ede014cd1ea6422d ("pinctrl: renesas: rzg2l: Add function pointer for PMC register write")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250921111557.103069-2-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
index f524af6f586f4..94cb77949f595 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
@@ -2993,7 +2993,11 @@ static void rzg2l_pinctrl_pm_setup_regs(struct rzg2l_pinctrl *pctrl, bool suspen
* Now cache the registers or set them in the order suggested by
* HW manual (section "Operation for GPIO Function").
*/
- RZG2L_PCTRL_REG_ACCESS8(suspend, pctrl->base + PMC(off), cache->pmc[port]);
+ if (suspend)
+ RZG2L_PCTRL_REG_ACCESS8(suspend, pctrl->base + PMC(off), cache->pmc[port]);
+ else
+ pctrl->data->pmc_writeb(pctrl, cache->pmc[port], PMC(off));
+
if (has_iolh) {
RZG2L_PCTRL_REG_ACCESS32(suspend, pctrl->base + IOLH(off),
cache->iolh[0][port]);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 028/614] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 027/614] pinctrl: renesas: rzg2l: Fix PMC restore Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 029/614] clk: renesas: cpg-mssr: Read back reset registers to assure values latched Greg Kroah-Hartman
` (599 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 62abfd7bedc2b3d86d4209a4146f9d2b5ae21fab ]
R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page
583 Figure 9.3.1(a) Software Reset flow (A) as well as flow (B) / (C)
indicate after reset has been asserted by writing a matching reset bit
into register SRCR, it is mandatory to wait 1ms.
This 1ms delay is documented on R-Car V4H and V4M, it is currently
unclear whether S4 is affected as well. This patch does apply the extra
delay on R-Car S4 as well.
Fix the reset driver to respect the additional delay when toggling
resets. Drivers which use separate reset_control_(de)assert() must
assure matching delay in their driver code.
Fixes: 0ab55cf18341 ("clk: renesas: cpg-mssr: Add support for R-Car V4H")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250918030552.331389-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/renesas-cpg-mssr.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index de1cf7ba45b78..7063d896249ea 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -689,8 +689,15 @@ static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
/* Reset module */
writel(bitmask, priv->pub.base0 + priv->reset_regs[reg]);
- /* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
- udelay(35);
+ /*
+ * On R-Car Gen4, delay after SRCR has been written is 1ms.
+ * On older SoCs, delay after SRCR has been written is 35us
+ * (one cycle of the RCLK clock @ ca. 32 kHz).
+ */
+ if (priv->reg_layout == CLK_REG_LAYOUT_RCAR_GEN4)
+ usleep_range(1000, 2000);
+ else
+ usleep_range(35, 1000);
/* Release module from reset state */
writel(bitmask, priv->pub.base0 + priv->reset_clear_regs[reg]);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 029/614] clk: renesas: cpg-mssr: Read back reset registers to assure values latched
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 028/614] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 030/614] drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Greg Kroah-Hartman
` (598 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Geert Uytterhoeven,
Marek Vasut, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit b91401af6c00ffab003698bfabd4c166df30748b ]
On R-Car V4H, the PCIEC controller DBI read would generate an SError in
case the controller reset is released by writing SRSTCLR register first,
and immediately afterward reading some PCIEC controller DBI register.
The issue triggers in rcar_gen4_pcie_additional_common_init() on
dw_pcie_readl_dbi(dw, PCIE_PORT_LANE_SKEW), which on V4H is the first
read after reset_control_deassert(dw->core_rsts[DW_PCIE_PWR_RST].rstc).
The reset controller which contains the SRSTCLR register and the PCIEC
controller which contains the DBI register share the same root access
bus, but the bus then splits into separate segments before reaching each
IP. Even if the SRSTCLR write access was posted on the bus before the
DBI read access, it seems the DBI read access may reach the PCIEC
controller before the SRSTCLR write completed, and trigger the SError.
Mitigate the issue by adding a dummy SRSTCLR read, which assures the
SRSTCLR write completes fully and is latched into the reset controller,
before the PCIEC DBI read access can occur.
Fixes: 0ab55cf18341 ("clk: renesas: cpg-mssr: Add support for R-Car V4H")
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250922162113.113223-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/renesas-cpg-mssr.c | 46 ++++++++++++--------------
1 file changed, 21 insertions(+), 25 deletions(-)
diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
index 7063d896249ea..a0a68ec0490f7 100644
--- a/drivers/clk/renesas/renesas-cpg-mssr.c
+++ b/drivers/clk/renesas/renesas-cpg-mssr.c
@@ -676,18 +676,32 @@ static int __init cpg_mssr_add_clk_domain(struct device *dev,
#define rcdev_to_priv(x) container_of(x, struct cpg_mssr_priv, rcdev)
-static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
- unsigned long id)
+static int cpg_mssr_reset_operate(struct reset_controller_dev *rcdev,
+ const char *func, bool set, unsigned long id)
{
struct cpg_mssr_priv *priv = rcdev_to_priv(rcdev);
unsigned int reg = id / 32;
unsigned int bit = id % 32;
+ const u16 off = set ? priv->reset_regs[reg] : priv->reset_clear_regs[reg];
u32 bitmask = BIT(bit);
- dev_dbg(priv->dev, "reset %u%02u\n", reg, bit);
+ if (func)
+ dev_dbg(priv->dev, "%s %u%02u\n", func, reg, bit);
+
+ writel(bitmask, priv->pub.base0 + off);
+ readl(priv->pub.base0 + off);
+ barrier_data(priv->pub.base0 + off);
+
+ return 0;
+}
+
+static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
+ unsigned long id)
+{
+ struct cpg_mssr_priv *priv = rcdev_to_priv(rcdev);
/* Reset module */
- writel(bitmask, priv->pub.base0 + priv->reset_regs[reg]);
+ cpg_mssr_reset_operate(rcdev, "reset", true, id);
/*
* On R-Car Gen4, delay after SRCR has been written is 1ms.
@@ -700,36 +714,18 @@ static int cpg_mssr_reset(struct reset_controller_dev *rcdev,
usleep_range(35, 1000);
/* Release module from reset state */
- writel(bitmask, priv->pub.base0 + priv->reset_clear_regs[reg]);
-
- return 0;
+ return cpg_mssr_reset_operate(rcdev, NULL, false, id);
}
static int cpg_mssr_assert(struct reset_controller_dev *rcdev, unsigned long id)
{
- struct cpg_mssr_priv *priv = rcdev_to_priv(rcdev);
- unsigned int reg = id / 32;
- unsigned int bit = id % 32;
- u32 bitmask = BIT(bit);
-
- dev_dbg(priv->dev, "assert %u%02u\n", reg, bit);
-
- writel(bitmask, priv->pub.base0 + priv->reset_regs[reg]);
- return 0;
+ return cpg_mssr_reset_operate(rcdev, "assert", true, id);
}
static int cpg_mssr_deassert(struct reset_controller_dev *rcdev,
unsigned long id)
{
- struct cpg_mssr_priv *priv = rcdev_to_priv(rcdev);
- unsigned int reg = id / 32;
- unsigned int bit = id % 32;
- u32 bitmask = BIT(bit);
-
- dev_dbg(priv->dev, "deassert %u%02u\n", reg, bit);
-
- writel(bitmask, priv->pub.base0 + priv->reset_clear_regs[reg]);
- return 0;
+ return cpg_mssr_reset_operate(rcdev, "deassert", false, id);
}
static int cpg_mssr_status(struct reset_controller_dev *rcdev,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 030/614] drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 029/614] clk: renesas: cpg-mssr: Read back reset registers to assure values latched Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 031/614] HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Greg Kroah-Hartman
` (597 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cyrille Pitchen, Dmitry Baryshkov,
Nicolas Ferre, Manikandan Muralidharan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyrille Pitchen <cyrille.pitchen@microchip.com>
[ Upstream commit a312acdcec57b3955fbf1f3057c13a6d38e4aa2a ]
On SoCs, like the SAM9X75, which embed the XLCDC ip, the registers that
configure the unified scaling engine were not filled with proper values.
Indeed, for YCbCr formats, the VXSCFACT bitfield of the HEOCFG25
register and the HXSCFACT bitfield of the HEOCFG27 register were
incorrect.
For 4:2:0 formats, both vertical and horizontal factors for
chroma chanels should be divided by 2 from the factors for the luma
channel. Hence:
HEOCFG24.VXSYFACT = VFACTOR
HEOCFG25.VSXCFACT = VFACTOR / 2
HEOCFG26.HXSYFACT = HFACTOR
HEOCFG27.HXSCFACT = HFACTOR / 2
However, for 4:2:2 formats, only the horizontal factor for chroma
chanels should be divided by 2 from the factor for the luma channel;
the vertical factor is the same for all the luma and chroma channels.
Hence:
HEOCFG24.VXSYFACT = VFACTOR
HEOCFG25.VXSCFACT = VFACTOR
HEOCFG26.HXSYFACT = HFACTOR
HEOCFG27.HXSCFACT = HFACTOR / 2
Fixes: d498771b0b83 ("drm: atmel_hlcdc: Add support for XLCDC using IP specific driver ops")
Signed-off-by: Cyrille Pitchen <cyrille.pitchen@microchip.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20241014094942.325211-1-manikandan.m@microchip.com
Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 ++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 4a7ba0918eca1..3787db014501e 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -365,13 +365,34 @@ void atmel_xlcdc_plane_setup_scaler(struct atmel_hlcdc_plane *plane,
xfactor);
/*
- * With YCbCr 4:2:2 and YCbYcr 4:2:0 window resampling, configuration
- * register LCDC_HEOCFG25.VXSCFACT and LCDC_HEOCFG27.HXSCFACT is half
+ * With YCbCr 4:2:0 window resampling, configuration register
+ * LCDC_HEOCFG25.VXSCFACT and LCDC_HEOCFG27.HXSCFACT values are half
* the value of yfactor and xfactor.
+ *
+ * On the other hand, with YCbCr 4:2:2 window resampling, only the
+ * configuration register LCDC_HEOCFG27.HXSCFACT value is half the value
+ * of the xfactor; the value of LCDC_HEOCFG25.VXSCFACT is yfactor (no
+ * division by 2).
*/
- if (state->base.fb->format->format == DRM_FORMAT_YUV420) {
+ switch (state->base.fb->format->format) {
+ /* YCbCr 4:2:2 */
+ case DRM_FORMAT_YUYV:
+ case DRM_FORMAT_UYVY:
+ case DRM_FORMAT_YVYU:
+ case DRM_FORMAT_VYUY:
+ case DRM_FORMAT_YUV422:
+ case DRM_FORMAT_NV61:
+ xfactor /= 2;
+ break;
+
+ /* YCbCr 4:2:0 */
+ case DRM_FORMAT_YUV420:
+ case DRM_FORMAT_NV21:
yfactor /= 2;
xfactor /= 2;
+ break;
+ default:
+ break;
}
atmel_hlcdc_layer_write_cfg(&plane->layer, desc->layout.scaler_config + 2,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 031/614] HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 030/614] drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 032/614] remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path Greg Kroah-Hartman
` (596 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mavroudis Chatzilazaridis,
Stuart Hayhurst, Jiri Kosina, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mavroudis Chatzilazaridis <mavchatz@protonmail.com>
[ Upstream commit aba7963544d47d82cdf36602a6678a093af0299d ]
Currently, hidpp_send_message_sync() retries sending the message when the
device returns a busy error code, specifically HIDPP20_ERROR_BUSY, which
has a different meaning under RAP. This ends up being a problem because
this function is used for both FAP and RAP messages.
This issue is not noticeable on older receivers with unreachable devices
since they return HIDPP_ERROR_RESOURCE_ERROR (0x09), which is not equal to
HIDPP20_ERROR_BUSY (0x08).
However, newer receivers return HIDPP_ERROR_UNKNOWN_DEVICE (0x08) which
happens to equal to HIDPP20_ERROR_BUSY, causing unnecessary retries when
the device is not actually busy.
This is resolved by checking if the error response is FAP or RAP and
picking the respective ERROR_BUSY code.
Fixes: 60165ab774cb ("HID: logitech-hidpp: rework one more time the retries attempts")
Signed-off-by: Mavroudis Chatzilazaridis <mavchatz@protonmail.com>
Tested-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 5e763de4b94fd..a88f2e5f791c6 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -352,10 +352,15 @@ static int hidpp_send_message_sync(struct hidpp_device *hidpp,
do {
ret = __do_hidpp_send_message_sync(hidpp, message, response);
- if (ret != HIDPP20_ERROR_BUSY)
+ if (response->report_id == REPORT_ID_HIDPP_SHORT &&
+ ret != HIDPP_ERROR_BUSY)
+ break;
+ if ((response->report_id == REPORT_ID_HIDPP_LONG ||
+ response->report_id == REPORT_ID_HIDPP_VERY_LONG) &&
+ ret != HIDPP20_ERROR_BUSY)
break;
- dbg_hid("%s:got busy hidpp 2.0 error %02X, retrying\n", __func__, ret);
+ dbg_hid("%s:got busy hidpp error %02X, retrying\n", __func__, ret);
} while (--max_retries);
mutex_unlock(&hidpp->send_mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 032/614] remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 031/614] HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 033/614] objtool: Fix standalone --hacks=jump_label Greg Kroah-Hartman
` (595 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ulf Hansson, Hiago De Franco,
Peng Fan, Mathieu Poirier, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 80405a34e1f8975cdb2d7d8679bca7f768861035 ]
Proper cleanup should be done when rproc_add() fails by invoking both
pm_runtime_disable() and pm_runtime_put_noidle() to avoid leaving the
device in an inconsistent power state.
Fix it by adding pm_runtime_put_noidle() and pm_runtime_disable()
in the error path.
Also Update the remove() callback to use pm_runtime_put_noidle() instead of
pm_runtime_put(), to clearly indicate that only need to restore the usage
count.
Fixes: a876a3aacc43 ("remoteproc: imx_rproc: detect and attach to pre-booted remote cores")
Cc: Ulf Hansson <ulf.hansson@linaro.org>
Cc: Hiago De Franco <hiago.franco@toradex.com>
Suggested-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20250926-imx_rproc_v3-v3-1-4c0ec279cc5f@nxp.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/imx_rproc.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index bb25221a4a898..8424e6ea5569b 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -1136,11 +1136,16 @@ static int imx_rproc_probe(struct platform_device *pdev)
ret = rproc_add(rproc);
if (ret) {
dev_err(dev, "rproc_add failed\n");
- goto err_put_clk;
+ goto err_put_pm;
}
return 0;
+err_put_pm:
+ if (dcfg->method == IMX_RPROC_SCU_API) {
+ pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
+ }
err_put_clk:
clk_disable_unprepare(priv->clk);
err_put_scu:
@@ -1160,7 +1165,7 @@ static void imx_rproc_remove(struct platform_device *pdev)
if (priv->dcfg->method == IMX_RPROC_SCU_API) {
pm_runtime_disable(priv->dev);
- pm_runtime_put(priv->dev);
+ pm_runtime_put_noidle(priv->dev);
}
clk_disable_unprepare(priv->clk);
rproc_del(rproc);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 033/614] objtool: Fix standalone --hacks=jump_label
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 032/614] remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 034/614] objtool: Fix weak symbol detection Greg Kroah-Hartman
` (594 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dylan Hatch, Josh Poimboeuf,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dylan Hatch <dylanbhatch@google.com>
[ Upstream commit be8374a5ba7cbab6b97df94b4ffe0b92f5c8a6d2 ]
The objtool command line 'objtool --hacks=jump_label foo.o' on its own
should be expected to rewrite jump labels to NOPs. This means the
add_special_section_alts() code path needs to run when only this option
is provided.
This is mainly relevant in certain debugging situations, but could
potentially also fix kernel builds in which objtool is run with
--hacks=jump_label but without --orc, --stackval, --uaccess, or
--hacks=noinstr.
Fixes: de6fbcedf5ab ("objtool: Read special sections with alts only when specific options are selected")
Signed-off-by: Dylan Hatch <dylanbhatch@google.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/objtool/check.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 9004fbc067693..6059a546fb759 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -2564,7 +2564,8 @@ static int decode_sections(struct objtool_file *file)
* Must be before add_jump_destinations(), which depends on 'func'
* being set for alternatives, to enable proper sibling call detection.
*/
- if (opts.stackval || opts.orc || opts.uaccess || opts.noinstr) {
+ if (opts.stackval || opts.orc || opts.uaccess || opts.noinstr ||
+ opts.hack_jump_label) {
ret = add_special_section_alts(file);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 034/614] objtool: Fix weak symbol detection
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 033/614] objtool: Fix standalone --hacks=jump_label Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 035/614] accel/ivpu: Fix race condition when mapping dmabuf Greg Kroah-Hartman
` (593 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Mladek, Joe Lawrence,
Josh Poimboeuf, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@kernel.org>
[ Upstream commit 72567c630d32bc31f671977f78228c80937ed80e ]
find_symbol_hole_containing() fails to find a symbol hole (aka stripped
weak symbol) if its section has no symbols before the hole. This breaks
weak symbol detection if -ffunction-sections is enabled.
Fix that by allowing the interval tree to contain section symbols, which
are always at offset zero for a given section.
Fixes a bunch of (-ffunction-sections) warnings like:
vmlinux.o: warning: objtool: .text.__x64_sys_io_setup+0x10: unreachable instruction
Fixes: 4adb23686795 ("objtool: Ignore extra-symbol code")
Acked-by: Petr Mladek <pmladek@suse.com>
Tested-by: Joe Lawrence <joe.lawrence@redhat.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/objtool/elf.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index ca5d77db692a2..9cb51fcde7986 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -108,7 +108,7 @@ struct symbol_hole {
};
/*
- * Find !section symbol where @offset is after it.
+ * Find the last symbol before @offset.
*/
static int symbol_hole_by_offset(const void *key, const struct rb_node *node)
{
@@ -119,8 +119,7 @@ static int symbol_hole_by_offset(const void *key, const struct rb_node *node)
return -1;
if (sh->key >= s->offset + s->len) {
- if (s->type != STT_SECTION)
- sh->sym = s;
+ sh->sym = s;
return 1;
}
@@ -412,7 +411,8 @@ static void elf_add_symbol(struct elf *elf, struct symbol *sym)
sym->len = sym->sym.st_size;
__sym_for_each(iter, &sym->sec->symbol_tree, sym->offset, sym->offset) {
- if (iter->offset == sym->offset && iter->type == sym->type)
+ if (iter->offset == sym->offset && iter->type == sym->type &&
+ iter->len == sym->len)
iter->alias = sym;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 035/614] accel/ivpu: Fix race condition when mapping dmabuf
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 034/614] objtool: Fix weak symbol detection Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 036/614] perf parse-events: Fix legacy cache events if event is duplicated in a PMU Greg Kroah-Hartman
` (592 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wludzik, Jozef, Jeff Hugo,
Karol Wachowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wludzik, Jozef <jozef.wludzik@intel.com>
[ Upstream commit 63c7870fab67b2ab2bfe75e8b46f3c37b88c47a8 ]
Fix a race that can occur when multiple jobs submit the same dmabuf.
This could cause the sg_table to be mapped twice, leading to undefined
behavior.
Fixes: e0c0891cd63b ("accel/ivpu: Rework bind/unbind of imported buffers")
Signed-off-by: Wludzik, Jozef <jozef.wludzik@intel.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://lore.kernel.org/r/20251014071725.3047287-1-karol.wachowski@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_gem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c
index 171e809575ad6..1fca969df19dc 100644
--- a/drivers/accel/ivpu/ivpu_gem.c
+++ b/drivers/accel/ivpu/ivpu_gem.c
@@ -45,12 +45,13 @@ static inline void ivpu_bo_unlock(struct ivpu_bo *bo)
static struct sg_table *ivpu_bo_map_attachment(struct ivpu_device *vdev, struct ivpu_bo *bo)
{
- struct sg_table *sgt = bo->base.sgt;
+ struct sg_table *sgt;
drm_WARN_ON(&vdev->drm, !bo->base.base.import_attach);
ivpu_bo_lock(bo);
+ sgt = bo->base.sgt;
if (!sgt) {
sgt = dma_buf_map_attachment(bo->base.base.import_attach, DMA_BIDIRECTIONAL);
if (IS_ERR(sgt))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 036/614] perf parse-events: Fix legacy cache events if event is duplicated in a PMU
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 035/614] accel/ivpu: Fix race condition when mapping dmabuf Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 037/614] gpu: nova-core: gsp: remove useless conversion Greg Kroah-Hartman
` (591 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Richter, Ian Rogers,
James Clark, Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit b7b76f607a15f16031001687e733046b5f6f5d86 ]
The term list when adding an event to a PMU is expected to have the
event name for the alias lookup. Also, set found_supported so that
-EINVAL isn't returned.
Fixes: 62593394f66a ("perf parse-events: Legacy cache names on all
PMUs and lower priority")
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/parse-events.c | 28 +++++++++++++++++++++++++++-
tools/perf/util/parse-events.h | 3 ++-
tools/perf/util/parse-events.y | 2 +-
3 files changed, 30 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index da73d686f6b93..90a765016f64f 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -475,8 +475,10 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,
int parse_events_add_cache(struct list_head *list, int *idx, const char *name,
struct parse_events_state *parse_state,
- struct parse_events_terms *parsed_terms)
+ struct parse_events_terms *parsed_terms,
+ void *loc_)
{
+ YYLTYPE *loc = loc_;
struct perf_pmu *pmu = NULL;
bool found_supported = false;
const char *config_name = get_config_name(parsed_terms);
@@ -497,12 +499,36 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name,
* The PMU has the event so add as not a legacy cache
* event.
*/
+ struct parse_events_terms temp_terms;
+ struct parse_events_term *term;
+ char *config = strdup(name);
+
+ if (!config)
+ goto out_err;
+
+ parse_events_terms__init(&temp_terms);
+ if (!parsed_terms)
+ parsed_terms = &temp_terms;
+
+ if (parse_events_term__num(&term,
+ PARSE_EVENTS__TERM_TYPE_USER,
+ config, /*num=*/1, /*novalue=*/true,
+ loc, /*loc_val=*/NULL) < 0) {
+ zfree(&config);
+ goto out_err;
+ }
+ list_add(&term->list, &parsed_terms->terms);
+
ret = parse_events_add_pmu(parse_state, list, pmu,
parsed_terms,
first_wildcard_match,
/*alternate_hw_config=*/PERF_COUNT_HW_MAX);
+ list_del_init(&term->list);
+ parse_events_term__delete(term);
+ parse_events_terms__exit(&temp_terms);
if (ret)
goto out_err;
+ found_supported = true;
if (first_wildcard_match == NULL)
first_wildcard_match =
container_of(list->prev, struct evsel, core.node);
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index 8f8c8e7fbcf18..8af19dec6a17d 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -237,7 +237,8 @@ int parse_events_add_numeric(struct parse_events_state *parse_state,
bool wildcard);
int parse_events_add_cache(struct list_head *list, int *idx, const char *name,
struct parse_events_state *parse_state,
- struct parse_events_terms *parsed_terms);
+ struct parse_events_terms *parsed_terms,
+ void *loc);
int parse_events__decode_legacy_cache(const char *name, int pmu_type, __u64 *config);
int parse_events_add_breakpoint(struct parse_events_state *parse_state,
struct list_head *list,
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index a2361c0040d75..ced26c549c33a 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -353,7 +353,7 @@ PE_LEGACY_CACHE opt_event_config
if (!list)
YYNOMEM;
- err = parse_events_add_cache(list, &parse_state->idx, $1, parse_state, $2);
+ err = parse_events_add_cache(list, &parse_state->idx, $1, parse_state, $2, &@1);
parse_events_terms__delete($2);
free($1);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 037/614] gpu: nova-core: gsp: remove useless conversion
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 036/614] perf parse-events: Fix legacy cache events if event is duplicated in a PMU Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 038/614] gpu: nova-core: gsp: do not unwrap() SGEntry Greg Kroah-Hartman
` (590 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danilo Krummrich, John Hubbard,
Alexandre Courbot, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit 87990025b87283f1b8c50d4d75379ca6d86d2211 ]
Because nova-core depends on CONFIG_64BIT and a raw DmaAddress is
always a u64, we can remove the now actually useless conversion.
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
[acourbot@nvidia.com: reword commit as suggested by John.]
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Message-ID: <20250926130623.61316-1-dakr@kernel.org>
Stable-dep-of: f7a33a67c50c ("gpu: nova-core: gsp: do not unwrap() SGEntry")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/nova-core/firmware/gsp.rs | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/nova-core/firmware/gsp.rs b/drivers/gpu/nova-core/firmware/gsp.rs
index 9b70095434c61..ca785860e1c82 100644
--- a/drivers/gpu/nova-core/firmware/gsp.rs
+++ b/drivers/gpu/nova-core/firmware/gsp.rs
@@ -202,8 +202,7 @@ pub(crate) fn new<'a, 'b>(
let mut level0_data = kvec![0u8; GSP_PAGE_SIZE]?;
// Fill level 1 page entry.
- #[allow(clippy::useless_conversion)]
- let level1_entry = u64::from(level1.iter().next().unwrap().dma_address());
+ let level1_entry = level1.iter().next().unwrap().dma_address();
let dst = &mut level0_data[..size_of_val(&level1_entry)];
dst.copy_from_slice(&level1_entry.to_le_bytes());
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 038/614] gpu: nova-core: gsp: do not unwrap() SGEntry
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 037/614] gpu: nova-core: gsp: remove useless conversion Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 039/614] wifi: ath10k: move recovery check logic into a new work Greg Kroah-Hartman
` (589 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danilo Krummrich, John Hubbard,
Alexandre Courbot, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit f7a33a67c50c92589b046e69b9075b7d28d31f87 ]
Don't use unwrap() to extract an Option<SGEntry>, instead handle the
error condition gracefully.
Fixes: a841614e607c ("gpu: nova-core: firmware: process and prepare the GSP firmware")
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Message-ID: <20250926130623.61316-2-dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/nova-core/firmware/gsp.rs | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/nova-core/firmware/gsp.rs b/drivers/gpu/nova-core/firmware/gsp.rs
index ca785860e1c82..6b0761460a57d 100644
--- a/drivers/gpu/nova-core/firmware/gsp.rs
+++ b/drivers/gpu/nova-core/firmware/gsp.rs
@@ -202,9 +202,10 @@ pub(crate) fn new<'a, 'b>(
let mut level0_data = kvec![0u8; GSP_PAGE_SIZE]?;
// Fill level 1 page entry.
- let level1_entry = level1.iter().next().unwrap().dma_address();
- let dst = &mut level0_data[..size_of_val(&level1_entry)];
- dst.copy_from_slice(&level1_entry.to_le_bytes());
+ let level1_entry = level1.iter().next().ok_or(EINVAL)?;
+ let level1_entry_addr = level1_entry.dma_address();
+ let dst = &mut level0_data[..size_of_val(&level1_entry_addr)];
+ dst.copy_from_slice(&level1_entry_addr.to_le_bytes());
// Turn the level0 page table into a [`DmaObject`].
DmaObject::from_data(dev, &level0_data)?
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 039/614] wifi: ath10k: move recovery check logic into a new work
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 038/614] gpu: nova-core: gsp: do not unwrap() SGEntry Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 040/614] wifi: ath11k: restore register window after global reset Greg Kroah-Hartman
` (588 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kang Yang, Baochen Qiang,
Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <kang.yang@oss.qualcomm.com>
[ Upstream commit f35a07a4842a88801d9182b1a76d178bfa616978 ]
Currently, ath10k has a recovery check logic. It will wait for the
last recovery to finish by wait_for_completion_timeout();
But in SDIO scenarios, the recovery function may be invoked from
interrupt context, where long blocking waits are undesirable and can
lead to system instability.
Additionally, Linux’s ordered workqueue processes one task at a time.
If a previous recovery is still queued or executing, new triggers are
ignored. This prevents accurate tracking of consecutive failures and
delays transition to the WEDGED state.
To address this, move the recovery check logic into a different
workqueue.
Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1
Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189
Fixes: c256a94d1b1b ("wifi: ath10k: shutdown driver when hardware is unreliable")
Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251014110757.155-1-kang.yang@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/core.c | 20 +++++++++-----------
drivers/net/wireless/ath/ath10k/core.h | 2 +-
drivers/net/wireless/ath/ath10k/mac.c | 2 +-
3 files changed, 11 insertions(+), 13 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 6f78f1752cd6f..9ae3595fb6986 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -3,7 +3,6 @@
* Copyright (c) 2005-2011 Atheros Communications Inc.
* Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
@@ -2493,8 +2492,9 @@ static int ath10k_init_hw_params(struct ath10k *ar)
return 0;
}
-static bool ath10k_core_needs_recovery(struct ath10k *ar)
+static void ath10k_core_recovery_check_work(struct work_struct *work)
{
+ struct ath10k *ar = container_of(work, struct ath10k, recovery_check_work);
long time_left;
/* Sometimes the recovery will fail and then the next all recovery fail,
@@ -2504,7 +2504,7 @@ static bool ath10k_core_needs_recovery(struct ath10k *ar)
ath10k_err(ar, "consecutive fail %d times, will shutdown driver!",
atomic_read(&ar->fail_cont_count));
ar->state = ATH10K_STATE_WEDGED;
- return false;
+ return;
}
ath10k_dbg(ar, ATH10K_DBG_BOOT, "total recovery count: %d", ++ar->recovery_count);
@@ -2518,27 +2518,24 @@ static bool ath10k_core_needs_recovery(struct ath10k *ar)
ATH10K_RECOVERY_TIMEOUT_HZ);
if (time_left) {
ath10k_warn(ar, "previous recovery succeeded, skip this!\n");
- return false;
+ return;
}
/* Record the continuous recovery fail count when recovery failed. */
atomic_inc(&ar->fail_cont_count);
/* Avoid having multiple recoveries at the same time. */
- return false;
+ return;
}
atomic_inc(&ar->pending_recovery);
-
- return true;
+ queue_work(ar->workqueue, &ar->restart_work);
}
void ath10k_core_start_recovery(struct ath10k *ar)
{
- if (!ath10k_core_needs_recovery(ar))
- return;
-
- queue_work(ar->workqueue, &ar->restart_work);
+ /* Use workqueue_aux to avoid blocking recovery tracking */
+ queue_work(ar->workqueue_aux, &ar->recovery_check_work);
}
EXPORT_SYMBOL(ath10k_core_start_recovery);
@@ -3734,6 +3731,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
INIT_WORK(&ar->register_work, ath10k_core_register_work);
INIT_WORK(&ar->restart_work, ath10k_core_restart);
+ INIT_WORK(&ar->recovery_check_work, ath10k_core_recovery_check_work);
INIT_WORK(&ar->set_coverage_class_work,
ath10k_core_set_coverage_class_work);
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 8c72ed386edb7..859176fcb5a29 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -3,7 +3,6 @@
* Copyright (c) 2005-2011 Atheros Communications Inc.
* Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
@@ -1208,6 +1207,7 @@ struct ath10k {
struct work_struct register_work;
struct work_struct restart_work;
+ struct work_struct recovery_check_work;
struct work_struct bundle_tx_work;
struct work_struct tx_complete_work;
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 154ac7a709824..da6f7957a0ae7 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3,7 +3,6 @@
* Copyright (c) 2005-2011 Atheros Communications Inc.
* Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
@@ -5428,6 +5427,7 @@ static void ath10k_stop(struct ieee80211_hw *hw, bool suspend)
cancel_work_sync(&ar->set_coverage_class_work);
cancel_delayed_work_sync(&ar->scan.timeout);
cancel_work_sync(&ar->restart_work);
+ cancel_work_sync(&ar->recovery_check_work);
}
static int ath10k_config_ps(struct ath10k *ar)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 040/614] wifi: ath11k: restore register window after global reset
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 039/614] wifi: ath10k: move recovery check logic into a new work Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 041/614] wifi: ath12k: Fix MSDU buffer types handling in RX error path Greg Kroah-Hartman
` (587 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 596b911644cc19ecba0dbc9c92849fb59390e29a ]
Hardware target implements an address space larger than that PCI BAR can
map. In order to be able to access the whole target address space, the BAR
space is split into 4 segments, of which the last 3, called windows, can
be dynamically mapped to the desired area. This is achieved by updating
window register with appropriate window value. Currently each time when
accessing a register that beyond ATH11K_PCI_WINDOW_START, host calculates
the window value and caches it after window update, this way next time
when accessing a register falling in the same window, host knows that the
window is already good hence no additional update needed.
However this mechanism breaks after global reset is triggered in
ath11k_pci_soc_global_reset(), because with global reset hardware resets
window register hence the window is not properly mapped any more. Current
host does nothing about this, as a result a subsequent register access may
not work as expected if it falls in a window same as before.
Although there is no obvious issue seen now, better to fix it to avoid
future problem. The fix is done by restoring the window register after
global reset.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251014-ath11k-reset-window-cache-v1-1-b85271b111dd@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/pci.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c
index d8655badd96d0..7114eca8810db 100644
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/module.h>
@@ -177,6 +177,19 @@ static inline void ath11k_pci_select_static_window(struct ath11k_pci *ab_pci)
ab_pci->ab->mem + ATH11K_PCI_WINDOW_REG_ADDRESS);
}
+static void ath11k_pci_restore_window(struct ath11k_base *ab)
+{
+ struct ath11k_pci *ab_pci = ath11k_pci_priv(ab);
+
+ spin_lock_bh(&ab_pci->window_lock);
+
+ iowrite32(ATH11K_PCI_WINDOW_ENABLE_BIT | ab_pci->register_window,
+ ab->mem + ATH11K_PCI_WINDOW_REG_ADDRESS);
+ ioread32(ab->mem + ATH11K_PCI_WINDOW_REG_ADDRESS);
+
+ spin_unlock_bh(&ab_pci->window_lock);
+}
+
static void ath11k_pci_soc_global_reset(struct ath11k_base *ab)
{
u32 val, delay;
@@ -201,6 +214,11 @@ static void ath11k_pci_soc_global_reset(struct ath11k_base *ab)
val = ath11k_pcic_read32(ab, PCIE_SOC_GLOBAL_RESET);
if (val == 0xffffffff)
ath11k_warn(ab, "link down error during global reset\n");
+
+ /* Restore window register as its content is cleared during
+ * hardware global reset, such that it aligns with host cache.
+ */
+ ath11k_pci_restore_window(ab);
}
static void ath11k_pci_clear_dbg_registers(struct ath11k_base *ab)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 041/614] wifi: ath12k: Fix MSDU buffer types handling in RX error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 040/614] wifi: ath11k: restore register window after global reset Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 042/614] wifi: ath12k: fix VHT MCS assignment Greg Kroah-Hartman
` (586 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sarika Sharma, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarika Sharma <sarika.sharma@oss.qualcomm.com>
[ Upstream commit 36f9edbb9d0fc36c865c74f3c1ad8e1261ad3981 ]
Currently, packets received on the REO exception ring from
unassociated peers are of MSDU buffer type, while the driver expects
link descriptor type packets. These packets are not parsed further due
to a return check on packet type in ath12k_hal_desc_reo_parse_err(),
but the associated skb is not freed. This may lead to kernel
crashes and buffer leaks.
Hence to fix, update the RX error handler to explicitly drop
MSDU buffer type packets received on the REO exception ring.
This prevents further processing of invalid packets and ensures
stability in the RX error handling path.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Sarika Sharma <sarika.sharma@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20250930091551.3305312-2-sarika.sharma@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/dp_rx.c | 70 ++++++++++++++++++++++--
drivers/net/wireless/ath/ath12k/hal_rx.c | 10 +---
2 files changed, 66 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index 5e5c14a70316d..99d29eda26cf1 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/ieee80211.h>
@@ -3781,6 +3781,48 @@ ath12k_dp_process_rx_err_buf(struct ath12k *ar, struct hal_reo_dest_ring *desc,
return 0;
}
+static int ath12k_dp_h_msdu_buffer_type(struct ath12k_base *ab,
+ struct list_head *list,
+ struct hal_reo_dest_ring *desc)
+{
+ struct ath12k_rx_desc_info *desc_info;
+ struct ath12k_skb_rxcb *rxcb;
+ struct sk_buff *msdu;
+ u64 desc_va;
+
+ desc_va = (u64)le32_to_cpu(desc->buf_va_hi) << 32 |
+ le32_to_cpu(desc->buf_va_lo);
+ desc_info = (struct ath12k_rx_desc_info *)(uintptr_t)desc_va;
+ if (!desc_info) {
+ u32 cookie;
+
+ cookie = le32_get_bits(desc->buf_addr_info.info1,
+ BUFFER_ADDR_INFO1_SW_COOKIE);
+ desc_info = ath12k_dp_get_rx_desc(ab, cookie);
+ if (!desc_info) {
+ ath12k_warn(ab, "Invalid cookie in manual descriptor retrieval: 0x%x\n",
+ cookie);
+ return -EINVAL;
+ }
+ }
+
+ if (desc_info->magic != ATH12K_DP_RX_DESC_MAGIC) {
+ ath12k_warn(ab, "rx exception, magic check failed with value: %u\n",
+ desc_info->magic);
+ return -EINVAL;
+ }
+
+ msdu = desc_info->skb;
+ desc_info->skb = NULL;
+ list_add_tail(&desc_info->list, list);
+ rxcb = ATH12K_SKB_RXCB(msdu);
+ dma_unmap_single(ab->dev, rxcb->paddr, msdu->len + skb_tailroom(msdu),
+ DMA_FROM_DEVICE);
+ dev_kfree_skb_any(msdu);
+
+ return 0;
+}
+
int ath12k_dp_rx_process_err(struct ath12k_base *ab, struct napi_struct *napi,
int budget)
{
@@ -3825,6 +3867,26 @@ int ath12k_dp_rx_process_err(struct ath12k_base *ab, struct napi_struct *napi,
drop = false;
ab->device_stats.err_ring_pkts++;
+ hw_link_id = le32_get_bits(reo_desc->info0,
+ HAL_REO_DEST_RING_INFO0_SRC_LINK_ID);
+ device_id = hw_links[hw_link_id].device_id;
+ partner_ab = ath12k_ag_to_ab(ag, device_id);
+
+ /* Below case is added to handle data packet from un-associated clients.
+ * As it is expected that AST lookup will fail for
+ * un-associated station's data packets.
+ */
+ if (le32_get_bits(reo_desc->info0, HAL_REO_DEST_RING_INFO0_BUFFER_TYPE) ==
+ HAL_REO_DEST_RING_BUFFER_TYPE_MSDU) {
+ if (!ath12k_dp_h_msdu_buffer_type(partner_ab,
+ &rx_desc_used_list[device_id],
+ reo_desc)) {
+ num_buffs_reaped[device_id]++;
+ tot_n_bufs_reaped++;
+ }
+ goto next_desc;
+ }
+
ret = ath12k_hal_desc_reo_parse_err(ab, reo_desc, &paddr,
&desc_bank);
if (ret) {
@@ -3833,11 +3895,6 @@ int ath12k_dp_rx_process_err(struct ath12k_base *ab, struct napi_struct *napi,
continue;
}
- hw_link_id = le32_get_bits(reo_desc->info0,
- HAL_REO_DEST_RING_INFO0_SRC_LINK_ID);
- device_id = hw_links[hw_link_id].device_id;
- partner_ab = ath12k_ag_to_ab(ag, device_id);
-
pdev_id = ath12k_hw_mac_id_to_pdev_id(partner_ab->hw_params,
hw_links[hw_link_id].pdev_idx);
ar = partner_ab->pdevs[pdev_id].ar;
@@ -3886,6 +3943,7 @@ int ath12k_dp_rx_process_err(struct ath12k_base *ab, struct napi_struct *napi,
}
}
+next_desc:
if (tot_n_bufs_reaped >= quota) {
tot_n_bufs_reaped = quota;
goto exit;
diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.c b/drivers/net/wireless/ath/ath12k/hal_rx.c
index 669096278fdd4..c4443ca05cd65 100644
--- a/drivers/net/wireless/ath/ath12k/hal_rx.c
+++ b/drivers/net/wireless/ath/ath12k/hal_rx.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include "debug.h"
@@ -323,7 +323,7 @@ int ath12k_hal_desc_reo_parse_err(struct ath12k_base *ab,
{
enum hal_reo_dest_ring_push_reason push_reason;
enum hal_reo_dest_ring_error_code err_code;
- u32 cookie, val;
+ u32 cookie;
push_reason = le32_get_bits(desc->info0,
HAL_REO_DEST_RING_INFO0_PUSH_REASON);
@@ -338,12 +338,6 @@ int ath12k_hal_desc_reo_parse_err(struct ath12k_base *ab,
return -EINVAL;
}
- val = le32_get_bits(desc->info0, HAL_REO_DEST_RING_INFO0_BUFFER_TYPE);
- if (val != HAL_REO_DEST_RING_BUFFER_TYPE_LINK_DESC) {
- ath12k_warn(ab, "expected buffer type link_desc");
- return -EINVAL;
- }
-
ath12k_hal_rx_reo_ent_paddr_get(ab, &desc->buf_addr_info, paddr, &cookie);
*desc_bank = u32_get_bits(cookie, DP_LINK_DESC_BANK_MASK);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 042/614] wifi: ath12k: fix VHT MCS assignment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 041/614] wifi: ath12k: Fix MSDU buffer types handling in RX error path Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 043/614] wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Greg Kroah-Hartman
` (585 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Pradeep Kumar Chitrapu, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 8c21b32c2cc82224c7fc1a9f67318f3b1199744b ]
While associating, firmware needs the peer's receive capability
to calculate its own VHT transmit MCS. Currently, the host
sends this information via mcs->rx_mcs_set field, but firmware
actually reads it from mcs->tx_mcs_set field. This mismatch is
incorrect.
This issue has not caused failures so far because most peers
advertise identical TX and RX capabilities. Fix this by
assigning the value to tx_mcs_set as expected.
Additionally, the rate control mask is intended to limit our
transmit MCS, so it should also apply to the peer's receive
capability. Update the logic accordingly.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251009211656.2386085-2-quic_pradeepc@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 7 +++----
drivers/net/wireless/ath/ath12k/wmi.c | 13 ++++++++-----
drivers/net/wireless/ath/ath12k/wmi.h | 2 ++
3 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index db351c9220181..4e6d136433202 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -2249,7 +2249,6 @@ static void ath12k_peer_assoc_h_vht(struct ath12k *ar,
struct cfg80211_chan_def def;
enum nl80211_band band;
u16 *vht_mcs_mask;
- u16 tx_mcs_map;
u8 ampdu_factor;
u8 max_nss, vht_mcs;
int i, vht_nss, nss_idx;
@@ -2340,10 +2339,10 @@ static void ath12k_peer_assoc_h_vht(struct ath12k *ar,
arg->peer_nss = min(link_sta->rx_nss, max_nss);
arg->rx_max_rate = __le16_to_cpu(vht_cap->vht_mcs.rx_highest);
arg->rx_mcs_set = __le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map);
- arg->tx_max_rate = __le16_to_cpu(vht_cap->vht_mcs.tx_highest);
+ arg->rx_mcs_set = ath12k_peer_assoc_h_vht_limit(arg->rx_mcs_set, vht_mcs_mask);
- tx_mcs_map = __le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
- arg->tx_mcs_set = ath12k_peer_assoc_h_vht_limit(tx_mcs_map, vht_mcs_mask);
+ arg->tx_max_rate = __le16_to_cpu(vht_cap->vht_mcs.tx_highest);
+ arg->tx_mcs_set = __le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
/* In QCN9274 platform, VHT MCS rate 10 and 11 is enabled by default.
* VHT MCS rate 10 and 11 is not supported in 11ac standard.
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index ff6b3d4ea8208..e76275bd6916f 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/skbuff.h>
#include <linux/ctype.h>
@@ -2367,10 +2367,13 @@ int ath12k_wmi_send_peer_assoc_cmd(struct ath12k *ar,
cmd->peer_bw_rxnss_override |= cpu_to_le32(arg->peer_bw_rxnss_override);
if (arg->vht_capable) {
- mcs->rx_max_rate = cpu_to_le32(arg->rx_max_rate);
- mcs->rx_mcs_set = cpu_to_le32(arg->rx_mcs_set);
- mcs->tx_max_rate = cpu_to_le32(arg->tx_max_rate);
- mcs->tx_mcs_set = cpu_to_le32(arg->tx_mcs_set);
+ /* Firmware interprets mcs->tx_mcs_set field as peer's
+ * RX capability
+ */
+ mcs->rx_max_rate = cpu_to_le32(arg->tx_max_rate);
+ mcs->rx_mcs_set = cpu_to_le32(arg->tx_mcs_set);
+ mcs->tx_max_rate = cpu_to_le32(arg->rx_max_rate);
+ mcs->tx_mcs_set = cpu_to_le32(arg->rx_mcs_set);
}
/* HE Rates */
diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h
index a8c3190e8ad95..6d9c645e3d5d0 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.h
+++ b/drivers/net/wireless/ath/ath12k/wmi.h
@@ -4218,8 +4218,10 @@ struct wmi_unit_test_cmd {
struct ath12k_wmi_vht_rate_set_params {
__le32 tlv_header;
__le32 rx_max_rate;
+ /* MCS at which the peer can transmit */
__le32 rx_mcs_set;
__le32 tx_max_rate;
+ /* MCS at which the peer can receive */
__le32 tx_mcs_set;
__le32 tx_max_mcs_nss;
} __packed;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 043/614] wifi: ath12k: fix TX and RX MCS rate configurations in HE mode
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 042/614] wifi: ath12k: fix VHT MCS assignment Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 044/614] sched/fair: Forfeit vruntime on yield Greg Kroah-Hartman
` (584 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pradeep Kumar Chitrapu,
Vasanthakumar Thiagarajan, Baochen Qiang, Jeff Johnson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
[ Upstream commit 9c5f229b1312a31aff762b2111f6751e4e3722fe ]
Currently, the TX and RX MCS rate configurations per peer are
reversed when sent to the firmware. As a result, RX MCS rates
are configured for TX, and vice versa. This commit rectifies
the configuration to match what the firmware expects.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251009211656.2386085-3-quic_pradeepc@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 4e6d136433202..0cec6c47fca29 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -2624,9 +2624,10 @@ static void ath12k_peer_assoc_h_he(struct ath12k *ar,
switch (link_sta->bandwidth) {
case IEEE80211_STA_RX_BW_160:
v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_160);
+ v = ath12k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
- v = ath12k_peer_assoc_h_he_limit(v, he_mcs_mask);
+ v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_160);
arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
arg->peer_he_mcs_count++;
@@ -2636,10 +2637,10 @@ static void ath12k_peer_assoc_h_he(struct ath12k *ar,
default:
v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80);
+ v = ath12k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
- v = ath12k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
arg->peer_he_mcs_count++;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 044/614] sched/fair: Forfeit vruntime on yield
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 043/614] wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 045/614] irqchip/bcm2712-mip: Fix OF node reference imbalance Greg Kroah-Hartman
` (583 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernand Sieber,
Peter Zijlstra (Intel), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernand Sieber <sieberf@amazon.com>
[ Upstream commit 79104becf42baeeb4a3f2b106f954b9fc7c10a3c ]
If a task yields, the scheduler may decide to pick it again. The task in
turn may decide to yield immediately or shortly after, leading to a tight
loop of yields.
If there's another runnable task as this point, the deadline will be
increased by the slice at each loop. This can cause the deadline to runaway
pretty quickly, and subsequent elevated run delays later on as the task
doesn't get picked again. The reason the scheduler can pick the same task
again and again despite its deadline increasing is because it may be the
only eligible task at that point.
Fix this by making the task forfeiting its remaining vruntime and pushing
the deadline one slice ahead. This implements yield behavior more
authentically.
We limit the forfeiting to eligible tasks. This is because core scheduling
prefers running ineligible tasks rather than force idling. As such, without
the condition, we can end up on a yield loop which makes the vruntime
increase rapidly, leading to anomalous run delays later down the line.
Fixes: 147f3efaa24182 ("sched/fair: Implement an EEVDF-like scheduling policy")
Signed-off-by: Fernand Sieber <sieberf@amazon.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250401123622.584018-1-sieberf@amazon.com
Link: https://lore.kernel.org/r/20250911095113.203439-1-sieberf@amazon.com
Link: https://lore.kernel.org/r/20250916140228.452231-1-sieberf@amazon.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 5b752324270b0..2a4a1c6e25da0 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -9014,7 +9014,19 @@ static void yield_task_fair(struct rq *rq)
*/
rq_clock_skip_update(rq);
- se->deadline += calc_delta_fair(se->slice, se);
+ /*
+ * Forfeit the remaining vruntime, only if the entity is eligible. This
+ * condition is necessary because in core scheduling we prefer to run
+ * ineligible tasks rather than force idling. If this happens we may
+ * end up in a loop where the core scheduler picks the yielding task,
+ * which yields immediately again; without the condition the vruntime
+ * ends up quickly running away.
+ */
+ if (entity_eligible(cfs_rq, se)) {
+ se->vruntime = se->deadline;
+ se->deadline += calc_delta_fair(se->slice, se);
+ update_min_vruntime(cfs_rq);
+ }
}
static bool yield_to_task_fair(struct rq *rq, struct task_struct *p)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 045/614] irqchip/bcm2712-mip: Fix OF node reference imbalance
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 044/614] sched/fair: Forfeit vruntime on yield Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 046/614] irqchip/bcm2712-mip: Fix section mismatch Greg Kroah-Hartman
` (582 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Florian Fainelli, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 0435bcc4e5858c632c1b6d5afa637580d9779890 ]
The init callback must not decrement the reference count of the provided
irqchip OF node.
This should not cause any trouble currently, but if the driver ever
starts probe deferring it could lead to warnings about reference
underflow and saturation.
Fixes: 32c6c054661a ("irqchip: Add Broadcom BCM2712 MSI-X interrupt controller")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm2712-mip.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/irqchip/irq-bcm2712-mip.c b/drivers/irqchip/irq-bcm2712-mip.c
index 9bd7bc0bf6d59..256c2d59f717d 100644
--- a/drivers/irqchip/irq-bcm2712-mip.c
+++ b/drivers/irqchip/irq-bcm2712-mip.c
@@ -239,7 +239,6 @@ static int __init mip_of_msi_init(struct device_node *node, struct device_node *
int ret;
pdev = of_find_device_by_node(node);
- of_node_put(node);
if (!pdev)
return -EPROBE_DEFER;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 046/614] irqchip/bcm2712-mip: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 045/614] irqchip/bcm2712-mip: Fix OF node reference imbalance Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 047/614] irqchip/irq-bcm7038-l1: " Greg Kroah-Hartman
` (581 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Florian Fainelli, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit a8452d1d59d46066051e676d5daa472cd08cb304 ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callback must not live in init.
Fixes: 32c6c054661a ("irqchip: Add Broadcom BCM2712 MSI-X interrupt controller")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm2712-mip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-bcm2712-mip.c b/drivers/irqchip/irq-bcm2712-mip.c
index 256c2d59f717d..8466646e5a2da 100644
--- a/drivers/irqchip/irq-bcm2712-mip.c
+++ b/drivers/irqchip/irq-bcm2712-mip.c
@@ -232,7 +232,7 @@ static int mip_parse_dt(struct mip_priv *mip, struct device_node *np)
return ret;
}
-static int __init mip_of_msi_init(struct device_node *node, struct device_node *parent)
+static int mip_of_msi_init(struct device_node *node, struct device_node *parent)
{
struct platform_device *pdev;
struct mip_priv *mip;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 047/614] irqchip/irq-bcm7038-l1: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 046/614] irqchip/bcm2712-mip: Fix section mismatch Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 048/614] irqchip/irq-bcm7120-l2: " Greg Kroah-Hartman
` (580 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Florian Fainelli, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e9db5332caaf4789ae3bafe72f61ad8e6e0c2d81 ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callback must not live in init.
Fixes: c057c799e379 ("irqchip/irq-bcm7038-l1: Switch to IRQCHIP_PLATFORM_DRIVER")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm7038-l1.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 04fac0cc857fd..eda33bd5d080c 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -219,9 +219,8 @@ static int bcm7038_l1_set_affinity(struct irq_data *d,
}
#endif
-static int __init bcm7038_l1_init_one(struct device_node *dn,
- unsigned int idx,
- struct bcm7038_l1_chip *intc)
+static int bcm7038_l1_init_one(struct device_node *dn, unsigned int idx,
+ struct bcm7038_l1_chip *intc)
{
struct resource res;
resource_size_t sz;
@@ -395,8 +394,7 @@ static const struct irq_domain_ops bcm7038_l1_domain_ops = {
.map = bcm7038_l1_map,
};
-static int __init bcm7038_l1_of_init(struct device_node *dn,
- struct device_node *parent)
+static int bcm7038_l1_of_init(struct device_node *dn, struct device_node *parent)
{
struct bcm7038_l1_chip *intc;
int idx, ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 048/614] irqchip/irq-bcm7120-l2: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 047/614] irqchip/irq-bcm7038-l1: " Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 049/614] irqchip/irq-brcmstb-l2: " Greg Kroah-Hartman
` (579 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Florian Fainelli, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit bfc0c5beab1fde843677923cf008f41d583c980a ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callbacks must not live in init.
Fixes: 3ac268d5ed22 ("irqchip/irq-bcm7120-l2: Switch to IRQCHIP_PLATFORM_DRIVER")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm7120-l2.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index ff22c31044018..b6c85560c42ea 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -143,8 +143,7 @@ static int bcm7120_l2_intc_init_one(struct device_node *dn,
return 0;
}
-static int __init bcm7120_l2_intc_iomap_7120(struct device_node *dn,
- struct bcm7120_l2_intc_data *data)
+static int bcm7120_l2_intc_iomap_7120(struct device_node *dn, struct bcm7120_l2_intc_data *data)
{
int ret;
@@ -177,8 +176,7 @@ static int __init bcm7120_l2_intc_iomap_7120(struct device_node *dn,
return 0;
}
-static int __init bcm7120_l2_intc_iomap_3380(struct device_node *dn,
- struct bcm7120_l2_intc_data *data)
+static int bcm7120_l2_intc_iomap_3380(struct device_node *dn, struct bcm7120_l2_intc_data *data)
{
unsigned int gc_idx;
@@ -208,10 +206,9 @@ static int __init bcm7120_l2_intc_iomap_3380(struct device_node *dn,
return 0;
}
-static int __init bcm7120_l2_intc_probe(struct device_node *dn,
- struct device_node *parent,
+static int bcm7120_l2_intc_probe(struct device_node *dn, struct device_node *parent,
int (*iomap_regs_fn)(struct device_node *,
- struct bcm7120_l2_intc_data *),
+ struct bcm7120_l2_intc_data *),
const char *intc_name)
{
unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
@@ -339,15 +336,13 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
return ret;
}
-static int __init bcm7120_l2_intc_probe_7120(struct device_node *dn,
- struct device_node *parent)
+static int bcm7120_l2_intc_probe_7120(struct device_node *dn, struct device_node *parent)
{
return bcm7120_l2_intc_probe(dn, parent, bcm7120_l2_intc_iomap_7120,
"BCM7120 L2");
}
-static int __init bcm7120_l2_intc_probe_3380(struct device_node *dn,
- struct device_node *parent)
+static int bcm7120_l2_intc_probe_3380(struct device_node *dn, struct device_node *parent)
{
return bcm7120_l2_intc_probe(dn, parent, bcm7120_l2_intc_iomap_3380,
"BCM3380 L2");
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 049/614] irqchip/irq-brcmstb-l2: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 048/614] irqchip/irq-bcm7120-l2: " Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 050/614] irqchip/imx-mu-msi: " Greg Kroah-Hartman
` (578 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Florian Fainelli, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit bbe1775924478e95372c2f896064ab6446000713 ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callbacks must not live in init.
Fixes: 51d9db5c8fbb ("irqchip/irq-brcmstb-l2: Switch to IRQCHIP_PLATFORM_DRIVER")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-brcmstb-l2.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 1bec5b2cd3f0e..53e67c6c01f7a 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -138,10 +138,8 @@ static void brcmstb_l2_intc_resume(struct irq_data *d)
irq_reg_writel(gc, ~b->saved_mask, ct->regs.enable);
}
-static int __init brcmstb_l2_intc_of_init(struct device_node *np,
- struct device_node *parent,
- const struct brcmstb_intc_init_params
- *init_params)
+static int brcmstb_l2_intc_of_init(struct device_node *np, struct device_node *parent,
+ const struct brcmstb_intc_init_params *init_params)
{
unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
unsigned int set = 0;
@@ -257,14 +255,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
return ret;
}
-static int __init brcmstb_l2_edge_intc_of_init(struct device_node *np,
- struct device_node *parent)
+static int brcmstb_l2_edge_intc_of_init(struct device_node *np, struct device_node *parent)
{
return brcmstb_l2_intc_of_init(np, parent, &l2_edge_intc_init);
}
-static int __init brcmstb_l2_lvl_intc_of_init(struct device_node *np,
- struct device_node *parent)
+static int brcmstb_l2_lvl_intc_of_init(struct device_node *np, struct device_node *parent)
{
return brcmstb_l2_intc_of_init(np, parent, &l2_lvl_intc_init);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 050/614] irqchip/imx-mu-msi: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 049/614] irqchip/irq-brcmstb-l2: " Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 051/614] irqchip/renesas-rzg2l: " Greg Kroah-Hartman
` (577 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 64acfd8e680ff8992c101fe19aadb112ce551072 ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callbacks must not live in init.
Fixes: 70afdab904d2 ("irqchip: Add IMX MU MSI controller driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-imx-mu-msi.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/irqchip/irq-imx-mu-msi.c b/drivers/irqchip/irq-imx-mu-msi.c
index d2a4e8a61a42b..41df168aa7da2 100644
--- a/drivers/irqchip/irq-imx-mu-msi.c
+++ b/drivers/irqchip/irq-imx-mu-msi.c
@@ -296,9 +296,8 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
},
};
-static int __init imx_mu_of_init(struct device_node *dn,
- struct device_node *parent,
- const struct imx_mu_dcfg *cfg)
+static int imx_mu_of_init(struct device_node *dn, struct device_node *parent,
+ const struct imx_mu_dcfg *cfg)
{
struct platform_device *pdev = of_find_device_by_node(dn);
struct device_link *pd_link_a;
@@ -416,20 +415,17 @@ static const struct dev_pm_ops imx_mu_pm_ops = {
imx_mu_runtime_resume, NULL)
};
-static int __init imx_mu_imx7ulp_of_init(struct device_node *dn,
- struct device_node *parent)
+static int imx_mu_imx7ulp_of_init(struct device_node *dn, struct device_node *parent)
{
return imx_mu_of_init(dn, parent, &imx_mu_cfg_imx7ulp);
}
-static int __init imx_mu_imx6sx_of_init(struct device_node *dn,
- struct device_node *parent)
+static int imx_mu_imx6sx_of_init(struct device_node *dn, struct device_node *parent)
{
return imx_mu_of_init(dn, parent, &imx_mu_cfg_imx6sx);
}
-static int __init imx_mu_imx8ulp_of_init(struct device_node *dn,
- struct device_node *parent)
+static int imx_mu_imx8ulp_of_init(struct device_node *dn, struct device_node *parent)
{
return imx_mu_of_init(dn, parent, &imx_mu_cfg_imx8ulp);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 051/614] irqchip/renesas-rzg2l: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 050/614] irqchip/imx-mu-msi: " Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 052/614] irqchip/starfive-jh8100: " Greg Kroah-Hartman
` (576 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Geert Uytterhoeven, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 5b338fbb2b5b21d61a9eaba14dcf43108de30258 ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callbacks must not live in init.
Fixes: d011c022efe27579 ("irqchip/renesas-rzg2l: Add support for RZ/Five SoC")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-renesas-rzg2l.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/irqchip/irq-renesas-rzg2l.c b/drivers/irqchip/irq-renesas-rzg2l.c
index 2a54adeb4cc71..12b6eb1503016 100644
--- a/drivers/irqchip/irq-renesas-rzg2l.c
+++ b/drivers/irqchip/irq-renesas-rzg2l.c
@@ -597,14 +597,12 @@ static int rzg2l_irqc_common_init(struct device_node *node, struct device_node *
return 0;
}
-static int __init rzg2l_irqc_init(struct device_node *node,
- struct device_node *parent)
+static int rzg2l_irqc_init(struct device_node *node, struct device_node *parent)
{
return rzg2l_irqc_common_init(node, parent, &rzg2l_irqc_chip);
}
-static int __init rzfive_irqc_init(struct device_node *node,
- struct device_node *parent)
+static int rzfive_irqc_init(struct device_node *node, struct device_node *parent)
{
return rzg2l_irqc_common_init(node, parent, &rzfive_irqc_chip);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 052/614] irqchip/starfive-jh8100: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 051/614] irqchip/renesas-rzg2l: " Greg Kroah-Hartman
@ 2025-12-16 11:06 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 053/614] irqchip/qcom-irq-combiner: " Greg Kroah-Hartman
` (575 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:06 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Changhuang Liang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit f798bdb9aa81c425184f92e3d0b44d3b53d10da7 ]
Platform drivers can be probed after their init sections have been
discarded so the irqchip init callback must not live in init.
Fixes: e4e535036173 ("irqchip: Add StarFive external interrupt controller")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Changhuang Liang <changhuang.liang@starfivetech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-starfive-jh8100-intc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/irqchip/irq-starfive-jh8100-intc.c b/drivers/irqchip/irq-starfive-jh8100-intc.c
index 2460798ec158b..117f2c651ebd0 100644
--- a/drivers/irqchip/irq-starfive-jh8100-intc.c
+++ b/drivers/irqchip/irq-starfive-jh8100-intc.c
@@ -114,8 +114,7 @@ static void starfive_intc_irq_handler(struct irq_desc *desc)
chained_irq_exit(chip, desc);
}
-static int __init starfive_intc_init(struct device_node *intc,
- struct device_node *parent)
+static int starfive_intc_init(struct device_node *intc, struct device_node *parent)
{
struct starfive_irq_chip *irqc;
struct reset_control *rst;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 053/614] irqchip/qcom-irq-combiner: Fix section mismatch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2025-12-16 11:06 ` [PATCH 6.18 052/614] irqchip/starfive-jh8100: " Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 054/614] irqchip: Drop leftover brackets Greg Kroah-Hartman
` (574 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 9b685058ca936752285c5520d351b828312ac965 ]
Platform drivers can be probed after their init sections have been
discarded so the probe callback must not live in init.
Fixes: f20cc9b00c7b ("irqchip/qcom: Add IRQ combiner driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/qcom-irq-combiner.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
index 18e696dc7f4d6..9308088773be7 100644
--- a/drivers/irqchip/qcom-irq-combiner.c
+++ b/drivers/irqchip/qcom-irq-combiner.c
@@ -222,7 +222,7 @@ static int get_registers(struct platform_device *pdev, struct combiner *comb)
return 0;
}
-static int __init combiner_probe(struct platform_device *pdev)
+static int combiner_probe(struct platform_device *pdev)
{
struct combiner *combiner;
int nregs;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 054/614] irqchip: Drop leftover brackets
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 053/614] irqchip/qcom-irq-combiner: " Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 055/614] irqchip: Pass platform device to platform drivers Greg Kroah-Hartman
` (573 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Geert Uytterhoeven, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 3540d99c03a88d4ebf65026f1f1926d3af658fb1 ]
Drop some unnecessary brackets in platform_irqchip_probe() mistakenly
left by commit 9322d1915f9d ("irqchip: Plug a OF node reference leak in
platform_irqchip_probe()").
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Stable-dep-of: 1e3e330c0707 ("irqchip: Pass platform device to platform drivers")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irqchip.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c
index 0ee7b6b71f5fa..652d20d2b07f1 100644
--- a/drivers/irqchip/irqchip.c
+++ b/drivers/irqchip/irqchip.c
@@ -38,9 +38,8 @@ int platform_irqchip_probe(struct platform_device *pdev)
struct device_node *par_np __free(device_node) = of_irq_find_parent(np);
of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev);
- if (!irq_init_cb) {
+ if (!irq_init_cb)
return -EINVAL;
- }
if (par_np == np)
par_np = NULL;
@@ -53,9 +52,8 @@ int platform_irqchip_probe(struct platform_device *pdev)
* interrupt controller. The actual initialization callback of this
* interrupt controller can check for specific domains as necessary.
*/
- if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) {
+ if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY))
return -EPROBE_DEFER;
- }
return irq_init_cb(np, par_np);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 055/614] irqchip: Pass platform device to platform drivers
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 054/614] irqchip: Drop leftover brackets Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 056/614] crypto: authenc - Correctly pass EINPROGRESS back up to the caller Greg Kroah-Hartman
` (572 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Thomas Gleixner,
Florian Fainelli, Changhuang Liang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 1e3e330c07076a0582385bbea029c9cc918fa30d ]
The IRQCHIP_PLATFORM_DRIVER macros can be used to convert OF irqchip
drivers to platform drivers but currently reuse the OF init callback
prototype that only takes OF nodes as arguments. This forces drivers to
do reverse lookups of their struct devices during probe if they need
them for things like dev_printk() and device managed resources.
Half of the drivers doing reverse lookups also currently fail to release
the additional reference taken during the lookup, while other drivers
have had the reference leak plugged in various ways (e.g. using
non-intuitive cleanup constructs which still confuse static checkers).
Switch to using a probe callback that takes a platform device as its
first argument to simplify drivers and plug the remaining (mostly
benign) reference leaks.
Fixes: 32c6c054661a ("irqchip: Add Broadcom BCM2712 MSI-X interrupt controller")
Fixes: 70afdab904d2 ("irqchip: Add IMX MU MSI controller driver")
Fixes: a6199bb514d8 ("irqchip: Add Qualcomm MPM controller driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Changhuang Liang <changhuang.liang@starfivetech.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-bcm2712-mip.c | 10 ++-----
drivers/irqchip/irq-bcm7038-l1.c | 5 ++--
drivers/irqchip/irq-bcm7120-l2.c | 20 ++++---------
drivers/irqchip/irq-brcmstb-l2.c | 21 ++++++-------
drivers/irqchip/irq-imx-mu-msi.c | 24 +++++++--------
drivers/irqchip/irq-mchp-eic.c | 5 ++--
drivers/irqchip/irq-meson-gpio.c | 5 ++--
drivers/irqchip/irq-qcom-mpm.c | 6 ++--
drivers/irqchip/irq-renesas-rzg2l.c | 35 +++++++---------------
drivers/irqchip/irq-renesas-rzv2h.c | 32 ++++++--------------
drivers/irqchip/irq-starfive-jh8100-intc.c | 5 ++--
drivers/irqchip/irqchip.c | 6 ++--
drivers/irqchip/qcom-pdc.c | 5 ++--
include/linux/irqchip.h | 8 ++++-
14 files changed, 78 insertions(+), 109 deletions(-)
diff --git a/drivers/irqchip/irq-bcm2712-mip.c b/drivers/irqchip/irq-bcm2712-mip.c
index 8466646e5a2da..4761974ad650a 100644
--- a/drivers/irqchip/irq-bcm2712-mip.c
+++ b/drivers/irqchip/irq-bcm2712-mip.c
@@ -232,16 +232,12 @@ static int mip_parse_dt(struct mip_priv *mip, struct device_node *np)
return ret;
}
-static int mip_of_msi_init(struct device_node *node, struct device_node *parent)
+static int mip_msi_probe(struct platform_device *pdev, struct device_node *parent)
{
- struct platform_device *pdev;
+ struct device_node *node = pdev->dev.of_node;
struct mip_priv *mip;
int ret;
- pdev = of_find_device_by_node(node);
- if (!pdev)
- return -EPROBE_DEFER;
-
mip = kzalloc(sizeof(*mip), GFP_KERNEL);
if (!mip)
return -ENOMEM;
@@ -284,7 +280,7 @@ static int mip_of_msi_init(struct device_node *node, struct device_node *parent)
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(mip_msi)
-IRQCHIP_MATCH("brcm,bcm2712-mip", mip_of_msi_init)
+IRQCHIP_MATCH("brcm,bcm2712-mip", mip_msi_probe)
IRQCHIP_PLATFORM_DRIVER_END(mip_msi)
MODULE_DESCRIPTION("Broadcom BCM2712 MSI-X interrupt controller");
MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index eda33bd5d080c..821b288587cab 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -394,8 +394,9 @@ static const struct irq_domain_ops bcm7038_l1_domain_ops = {
.map = bcm7038_l1_map,
};
-static int bcm7038_l1_of_init(struct device_node *dn, struct device_node *parent)
+static int bcm7038_l1_probe(struct platform_device *pdev, struct device_node *parent)
{
+ struct device_node *dn = pdev->dev.of_node;
struct bcm7038_l1_chip *intc;
int idx, ret;
@@ -453,7 +454,7 @@ static int bcm7038_l1_of_init(struct device_node *dn, struct device_node *parent
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(bcm7038_l1)
-IRQCHIP_MATCH("brcm,bcm7038-l1-intc", bcm7038_l1_of_init)
+IRQCHIP_MATCH("brcm,bcm7038-l1-intc", bcm7038_l1_probe)
IRQCHIP_PLATFORM_DRIVER_END(bcm7038_l1)
MODULE_DESCRIPTION("Broadcom STB 7038-style L1/L2 interrupt controller");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index b6c85560c42ea..518c9d4366a55 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -206,14 +206,14 @@ static int bcm7120_l2_intc_iomap_3380(struct device_node *dn, struct bcm7120_l2_
return 0;
}
-static int bcm7120_l2_intc_probe(struct device_node *dn, struct device_node *parent,
+static int bcm7120_l2_intc_probe(struct platform_device *pdev, struct device_node *parent,
int (*iomap_regs_fn)(struct device_node *,
struct bcm7120_l2_intc_data *),
const char *intc_name)
{
unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
+ struct device_node *dn = pdev->dev.of_node;
struct bcm7120_l2_intc_data *data;
- struct platform_device *pdev;
struct irq_chip_generic *gc;
struct irq_chip_type *ct;
int ret = 0;
@@ -224,14 +224,7 @@ static int bcm7120_l2_intc_probe(struct device_node *dn, struct device_node *par
if (!data)
return -ENOMEM;
- pdev = of_find_device_by_node(dn);
- if (!pdev) {
- ret = -ENODEV;
- goto out_free_data;
- }
-
data->num_parent_irqs = platform_irq_count(pdev);
- put_device(&pdev->dev);
if (data->num_parent_irqs <= 0) {
pr_err("invalid number of parent interrupts\n");
ret = -ENOMEM;
@@ -331,20 +324,19 @@ static int bcm7120_l2_intc_probe(struct device_node *dn, struct device_node *par
if (data->map_base[idx])
iounmap(data->map_base[idx]);
}
-out_free_data:
kfree(data);
return ret;
}
-static int bcm7120_l2_intc_probe_7120(struct device_node *dn, struct device_node *parent)
+static int bcm7120_l2_intc_probe_7120(struct platform_device *pdev, struct device_node *parent)
{
- return bcm7120_l2_intc_probe(dn, parent, bcm7120_l2_intc_iomap_7120,
+ return bcm7120_l2_intc_probe(pdev, parent, bcm7120_l2_intc_iomap_7120,
"BCM7120 L2");
}
-static int bcm7120_l2_intc_probe_3380(struct device_node *dn, struct device_node *parent)
+static int bcm7120_l2_intc_probe_3380(struct platform_device *pdev, struct device_node *parent)
{
- return bcm7120_l2_intc_probe(dn, parent, bcm7120_l2_intc_iomap_3380,
+ return bcm7120_l2_intc_probe(pdev, parent, bcm7120_l2_intc_iomap_3380,
"BCM3380 L2");
}
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 53e67c6c01f7a..bb7078d6524f9 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -138,11 +138,12 @@ static void brcmstb_l2_intc_resume(struct irq_data *d)
irq_reg_writel(gc, ~b->saved_mask, ct->regs.enable);
}
-static int brcmstb_l2_intc_of_init(struct device_node *np, struct device_node *parent,
- const struct brcmstb_intc_init_params *init_params)
+static int brcmstb_l2_intc_probe(struct platform_device *pdev, struct device_node *parent,
+ const struct brcmstb_intc_init_params *init_params)
{
unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
unsigned int set = 0;
+ struct device_node *np = pdev->dev.of_node;
struct brcmstb_l2_intc_data *data;
struct irq_chip_type *ct;
int ret;
@@ -255,21 +256,21 @@ static int brcmstb_l2_intc_of_init(struct device_node *np, struct device_node *p
return ret;
}
-static int brcmstb_l2_edge_intc_of_init(struct device_node *np, struct device_node *parent)
+static int brcmstb_l2_edge_intc_probe(struct platform_device *pdev, struct device_node *parent)
{
- return brcmstb_l2_intc_of_init(np, parent, &l2_edge_intc_init);
+ return brcmstb_l2_intc_probe(pdev, parent, &l2_edge_intc_init);
}
-static int brcmstb_l2_lvl_intc_of_init(struct device_node *np, struct device_node *parent)
+static int brcmstb_l2_lvl_intc_probe(struct platform_device *pdev, struct device_node *parent)
{
- return brcmstb_l2_intc_of_init(np, parent, &l2_lvl_intc_init);
+ return brcmstb_l2_intc_probe(pdev, parent, &l2_lvl_intc_init);
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(brcmstb_l2)
-IRQCHIP_MATCH("brcm,l2-intc", brcmstb_l2_edge_intc_of_init)
-IRQCHIP_MATCH("brcm,hif-spi-l2-intc", brcmstb_l2_edge_intc_of_init)
-IRQCHIP_MATCH("brcm,upg-aux-aon-l2-intc", brcmstb_l2_edge_intc_of_init)
-IRQCHIP_MATCH("brcm,bcm7271-l2-intc", brcmstb_l2_lvl_intc_of_init)
+IRQCHIP_MATCH("brcm,l2-intc", brcmstb_l2_edge_intc_probe)
+IRQCHIP_MATCH("brcm,hif-spi-l2-intc", brcmstb_l2_edge_intc_probe)
+IRQCHIP_MATCH("brcm,upg-aux-aon-l2-intc", brcmstb_l2_edge_intc_probe)
+IRQCHIP_MATCH("brcm,bcm7271-l2-intc", brcmstb_l2_lvl_intc_probe)
IRQCHIP_PLATFORM_DRIVER_END(brcmstb_l2)
MODULE_DESCRIPTION("Broadcom STB generic L2 interrupt controller");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/irq-imx-mu-msi.c b/drivers/irqchip/irq-imx-mu-msi.c
index 41df168aa7da2..c598f2f52fc6f 100644
--- a/drivers/irqchip/irq-imx-mu-msi.c
+++ b/drivers/irqchip/irq-imx-mu-msi.c
@@ -296,10 +296,9 @@ static const struct imx_mu_dcfg imx_mu_cfg_imx8ulp = {
},
};
-static int imx_mu_of_init(struct device_node *dn, struct device_node *parent,
- const struct imx_mu_dcfg *cfg)
+static int imx_mu_probe(struct platform_device *pdev, struct device_node *parent,
+ const struct imx_mu_dcfg *cfg)
{
- struct platform_device *pdev = of_find_device_by_node(dn);
struct device_link *pd_link_a;
struct device_link *pd_link_b;
struct imx_mu_msi *msi_data;
@@ -415,28 +414,27 @@ static const struct dev_pm_ops imx_mu_pm_ops = {
imx_mu_runtime_resume, NULL)
};
-static int imx_mu_imx7ulp_of_init(struct device_node *dn, struct device_node *parent)
+static int imx_mu_imx7ulp_probe(struct platform_device *pdev, struct device_node *parent)
{
- return imx_mu_of_init(dn, parent, &imx_mu_cfg_imx7ulp);
+ return imx_mu_probe(pdev, parent, &imx_mu_cfg_imx7ulp);
}
-static int imx_mu_imx6sx_of_init(struct device_node *dn, struct device_node *parent)
+static int imx_mu_imx6sx_probe(struct platform_device *pdev, struct device_node *parent)
{
- return imx_mu_of_init(dn, parent, &imx_mu_cfg_imx6sx);
+ return imx_mu_probe(pdev, parent, &imx_mu_cfg_imx6sx);
}
-static int imx_mu_imx8ulp_of_init(struct device_node *dn, struct device_node *parent)
+static int imx_mu_imx8ulp_probe(struct platform_device *pdev, struct device_node *parent)
{
- return imx_mu_of_init(dn, parent, &imx_mu_cfg_imx8ulp);
+ return imx_mu_probe(pdev, parent, &imx_mu_cfg_imx8ulp);
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(imx_mu_msi)
-IRQCHIP_MATCH("fsl,imx7ulp-mu-msi", imx_mu_imx7ulp_of_init)
-IRQCHIP_MATCH("fsl,imx6sx-mu-msi", imx_mu_imx6sx_of_init)
-IRQCHIP_MATCH("fsl,imx8ulp-mu-msi", imx_mu_imx8ulp_of_init)
+IRQCHIP_MATCH("fsl,imx7ulp-mu-msi", imx_mu_imx7ulp_probe)
+IRQCHIP_MATCH("fsl,imx6sx-mu-msi", imx_mu_imx6sx_probe)
+IRQCHIP_MATCH("fsl,imx8ulp-mu-msi", imx_mu_imx8ulp_probe)
IRQCHIP_PLATFORM_DRIVER_END(imx_mu_msi, .pm = &imx_mu_pm_ops)
-
MODULE_AUTHOR("Frank Li <Frank.Li@nxp.com>");
MODULE_DESCRIPTION("Freescale MU MSI controller driver");
MODULE_LICENSE("GPL");
diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index 516a3a0e359cc..b513a899c0853 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -199,8 +199,9 @@ static const struct irq_domain_ops mchp_eic_domain_ops = {
.free = irq_domain_free_irqs_common,
};
-static int mchp_eic_init(struct device_node *node, struct device_node *parent)
+static int mchp_eic_probe(struct platform_device *pdev, struct device_node *parent)
{
+ struct device_node *node = pdev->dev.of_node;
struct irq_domain *parent_domain = NULL;
int ret, i;
@@ -273,7 +274,7 @@ static int mchp_eic_init(struct device_node *node, struct device_node *parent)
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(mchp_eic)
-IRQCHIP_MATCH("microchip,sama7g5-eic", mchp_eic_init)
+IRQCHIP_MATCH("microchip,sama7g5-eic", mchp_eic_probe)
IRQCHIP_PLATFORM_DRIVER_END(mchp_eic)
MODULE_DESCRIPTION("Microchip External Interrupt Controller");
diff --git a/drivers/irqchip/irq-meson-gpio.c b/drivers/irqchip/irq-meson-gpio.c
index 7d177626d64ba..09ebf1d9c21b0 100644
--- a/drivers/irqchip/irq-meson-gpio.c
+++ b/drivers/irqchip/irq-meson-gpio.c
@@ -572,8 +572,9 @@ static int meson_gpio_irq_parse_dt(struct device_node *node, struct meson_gpio_i
return 0;
}
-static int meson_gpio_irq_of_init(struct device_node *node, struct device_node *parent)
+static int meson_gpio_irq_probe(struct platform_device *pdev, struct device_node *parent)
{
+ struct device_node *node = pdev->dev.of_node;
struct irq_domain *domain, *parent_domain;
struct meson_gpio_irq_controller *ctl;
int ret;
@@ -630,7 +631,7 @@ static int meson_gpio_irq_of_init(struct device_node *node, struct device_node *
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(meson_gpio_intc)
-IRQCHIP_MATCH("amlogic,meson-gpio-intc", meson_gpio_irq_of_init)
+IRQCHIP_MATCH("amlogic,meson-gpio-intc", meson_gpio_irq_probe)
IRQCHIP_PLATFORM_DRIVER_END(meson_gpio_intc)
MODULE_AUTHOR("Jerome Brunet <jbrunet@baylibre.com>");
diff --git a/drivers/irqchip/irq-qcom-mpm.c b/drivers/irqchip/irq-qcom-mpm.c
index 8d569f7c5a7aa..83f31ea657b74 100644
--- a/drivers/irqchip/irq-qcom-mpm.c
+++ b/drivers/irqchip/irq-qcom-mpm.c
@@ -320,9 +320,9 @@ static bool gic_hwirq_is_mapped(struct mpm_gic_map *maps, int cnt, u32 hwirq)
return false;
}
-static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
+static int qcom_mpm_probe(struct platform_device *pdev, struct device_node *parent)
{
- struct platform_device *pdev = of_find_device_by_node(np);
+ struct device_node *np = pdev->dev.of_node;
struct device *dev = &pdev->dev;
struct irq_domain *parent_domain;
struct generic_pm_domain *genpd;
@@ -478,7 +478,7 @@ static int qcom_mpm_init(struct device_node *np, struct device_node *parent)
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(qcom_mpm)
-IRQCHIP_MATCH("qcom,mpm", qcom_mpm_init)
+IRQCHIP_MATCH("qcom,mpm", qcom_mpm_probe)
IRQCHIP_PLATFORM_DRIVER_END(qcom_mpm)
MODULE_DESCRIPTION("Qualcomm Technologies, Inc. MSM Power Manager");
MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/irq-renesas-rzg2l.c b/drivers/irqchip/irq-renesas-rzg2l.c
index 12b6eb1503016..1bf19deb02c4e 100644
--- a/drivers/irqchip/irq-renesas-rzg2l.c
+++ b/drivers/irqchip/irq-renesas-rzg2l.c
@@ -8,7 +8,6 @@
*/
#include <linux/bitfield.h>
-#include <linux/cleanup.h>
#include <linux/clk.h>
#include <linux/err.h>
#include <linux/io.h>
@@ -528,18 +527,15 @@ static int rzg2l_irqc_parse_interrupts(struct rzg2l_irqc_priv *priv,
return 0;
}
-static int rzg2l_irqc_common_init(struct device_node *node, struct device_node *parent,
- const struct irq_chip *irq_chip)
+static int rzg2l_irqc_common_probe(struct platform_device *pdev, struct device_node *parent,
+ const struct irq_chip *irq_chip)
{
- struct platform_device *pdev = of_find_device_by_node(node);
- struct device *dev __free(put_device) = pdev ? &pdev->dev : NULL;
struct irq_domain *irq_domain, *parent_domain;
+ struct device_node *node = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
struct reset_control *resetn;
int ret;
- if (!pdev)
- return -ENODEV;
-
parent_domain = irq_find_host(parent);
if (!parent_domain)
return dev_err_probe(dev, -ENODEV, "cannot find parent domain\n");
@@ -583,33 +579,22 @@ static int rzg2l_irqc_common_init(struct device_node *node, struct device_node *
register_syscore_ops(&rzg2l_irqc_syscore_ops);
- /*
- * Prevent the cleanup function from invoking put_device by assigning
- * NULL to dev.
- *
- * make coccicheck will complain about missing put_device calls, but
- * those are false positives, as dev will be automatically "put" via
- * __free_put_device on the failing path.
- * On the successful path we don't actually want to "put" dev.
- */
- dev = NULL;
-
return 0;
}
-static int rzg2l_irqc_init(struct device_node *node, struct device_node *parent)
+static int rzg2l_irqc_probe(struct platform_device *pdev, struct device_node *parent)
{
- return rzg2l_irqc_common_init(node, parent, &rzg2l_irqc_chip);
+ return rzg2l_irqc_common_probe(pdev, parent, &rzg2l_irqc_chip);
}
-static int rzfive_irqc_init(struct device_node *node, struct device_node *parent)
+static int rzfive_irqc_probe(struct platform_device *pdev, struct device_node *parent)
{
- return rzg2l_irqc_common_init(node, parent, &rzfive_irqc_chip);
+ return rzg2l_irqc_common_probe(pdev, parent, &rzfive_irqc_chip);
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(rzg2l_irqc)
-IRQCHIP_MATCH("renesas,rzg2l-irqc", rzg2l_irqc_init)
-IRQCHIP_MATCH("renesas,r9a07g043f-irqc", rzfive_irqc_init)
+IRQCHIP_MATCH("renesas,rzg2l-irqc", rzg2l_irqc_probe)
+IRQCHIP_MATCH("renesas,r9a07g043f-irqc", rzfive_irqc_probe)
IRQCHIP_PLATFORM_DRIVER_END(rzg2l_irqc)
MODULE_AUTHOR("Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>");
MODULE_DESCRIPTION("Renesas RZ/G2L IRQC Driver");
diff --git a/drivers/irqchip/irq-renesas-rzv2h.c b/drivers/irqchip/irq-renesas-rzv2h.c
index 9018d9c3911e3..899a423b5da8f 100644
--- a/drivers/irqchip/irq-renesas-rzv2h.c
+++ b/drivers/irqchip/irq-renesas-rzv2h.c
@@ -490,29 +490,15 @@ static int rzv2h_icu_parse_interrupts(struct rzv2h_icu_priv *priv, struct device
return 0;
}
-static void rzv2h_icu_put_device(void *data)
-{
- put_device(data);
-}
-
-static int rzv2h_icu_init_common(struct device_node *node, struct device_node *parent,
- const struct rzv2h_hw_info *hw_info)
+static int rzv2h_icu_probe_common(struct platform_device *pdev, struct device_node *parent,
+ const struct rzv2h_hw_info *hw_info)
{
struct irq_domain *irq_domain, *parent_domain;
+ struct device_node *node = pdev->dev.of_node;
struct rzv2h_icu_priv *rzv2h_icu_data;
- struct platform_device *pdev;
struct reset_control *resetn;
int ret;
- pdev = of_find_device_by_node(node);
- if (!pdev)
- return -ENODEV;
-
- ret = devm_add_action_or_reset(&pdev->dev, rzv2h_icu_put_device,
- &pdev->dev);
- if (ret < 0)
- return ret;
-
parent_domain = irq_find_host(parent);
if (!parent_domain) {
dev_err(&pdev->dev, "cannot find parent domain\n");
@@ -618,19 +604,19 @@ static const struct rzv2h_hw_info rzv2h_hw_params = {
.field_width = 8,
};
-static int rzg3e_icu_init(struct device_node *node, struct device_node *parent)
+static int rzg3e_icu_probe(struct platform_device *pdev, struct device_node *parent)
{
- return rzv2h_icu_init_common(node, parent, &rzg3e_hw_params);
+ return rzv2h_icu_probe_common(pdev, parent, &rzg3e_hw_params);
}
-static int rzv2h_icu_init(struct device_node *node, struct device_node *parent)
+static int rzv2h_icu_probe(struct platform_device *pdev, struct device_node *parent)
{
- return rzv2h_icu_init_common(node, parent, &rzv2h_hw_params);
+ return rzv2h_icu_probe_common(pdev, parent, &rzv2h_hw_params);
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(rzv2h_icu)
-IRQCHIP_MATCH("renesas,r9a09g047-icu", rzg3e_icu_init)
-IRQCHIP_MATCH("renesas,r9a09g057-icu", rzv2h_icu_init)
+IRQCHIP_MATCH("renesas,r9a09g047-icu", rzg3e_icu_probe)
+IRQCHIP_MATCH("renesas,r9a09g057-icu", rzv2h_icu_probe)
IRQCHIP_PLATFORM_DRIVER_END(rzv2h_icu)
MODULE_AUTHOR("Fabrizio Castro <fabrizio.castro.jz@renesas.com>");
MODULE_DESCRIPTION("Renesas RZ/V2H(P) ICU Driver");
diff --git a/drivers/irqchip/irq-starfive-jh8100-intc.c b/drivers/irqchip/irq-starfive-jh8100-intc.c
index 117f2c651ebd0..705361b4ebe07 100644
--- a/drivers/irqchip/irq-starfive-jh8100-intc.c
+++ b/drivers/irqchip/irq-starfive-jh8100-intc.c
@@ -114,8 +114,9 @@ static void starfive_intc_irq_handler(struct irq_desc *desc)
chained_irq_exit(chip, desc);
}
-static int starfive_intc_init(struct device_node *intc, struct device_node *parent)
+static int starfive_intc_probe(struct platform_device *pdev, struct device_node *parent)
{
+ struct device_node *intc = pdev->dev.of_node;
struct starfive_irq_chip *irqc;
struct reset_control *rst;
struct clk *clk;
@@ -198,7 +199,7 @@ static int starfive_intc_init(struct device_node *intc, struct device_node *pare
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(starfive_intc)
-IRQCHIP_MATCH("starfive,jh8100-intc", starfive_intc_init)
+IRQCHIP_MATCH("starfive,jh8100-intc", starfive_intc_probe)
IRQCHIP_PLATFORM_DRIVER_END(starfive_intc)
MODULE_DESCRIPTION("StarFive JH8100 External Interrupt Controller");
diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c
index 652d20d2b07f1..689c8e4489019 100644
--- a/drivers/irqchip/irqchip.c
+++ b/drivers/irqchip/irqchip.c
@@ -36,9 +36,9 @@ int platform_irqchip_probe(struct platform_device *pdev)
{
struct device_node *np = pdev->dev.of_node;
struct device_node *par_np __free(device_node) = of_irq_find_parent(np);
- of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev);
+ platform_irq_probe_t irq_probe = of_device_get_match_data(&pdev->dev);
- if (!irq_init_cb)
+ if (!irq_probe)
return -EINVAL;
if (par_np == np)
@@ -55,6 +55,6 @@ int platform_irqchip_probe(struct platform_device *pdev)
if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY))
return -EPROBE_DEFER;
- return irq_init_cb(np, par_np);
+ return irq_probe(pdev, par_np);
}
EXPORT_SYMBOL_GPL(platform_irqchip_probe);
diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
index 52d77546aacb9..518f7f0f3dab5 100644
--- a/drivers/irqchip/qcom-pdc.c
+++ b/drivers/irqchip/qcom-pdc.c
@@ -350,9 +350,10 @@ static int pdc_setup_pin_mapping(struct device_node *np)
#define QCOM_PDC_SIZE 0x30000
-static int qcom_pdc_init(struct device_node *node, struct device_node *parent)
+static int qcom_pdc_probe(struct platform_device *pdev, struct device_node *parent)
{
struct irq_domain *parent_domain, *pdc_domain;
+ struct device_node *node = pdev->dev.of_node;
resource_size_t res_size;
struct resource res;
int ret;
@@ -428,7 +429,7 @@ static int qcom_pdc_init(struct device_node *node, struct device_node *parent)
}
IRQCHIP_PLATFORM_DRIVER_BEGIN(qcom_pdc)
-IRQCHIP_MATCH("qcom,pdc", qcom_pdc_init)
+IRQCHIP_MATCH("qcom,pdc", qcom_pdc_probe)
IRQCHIP_PLATFORM_DRIVER_END(qcom_pdc)
MODULE_DESCRIPTION("Qualcomm Technologies, Inc. Power Domain Controller");
MODULE_LICENSE("GPL v2");
diff --git a/include/linux/irqchip.h b/include/linux/irqchip.h
index d5e6024cb2a8c..bc4ddacd6ddc1 100644
--- a/include/linux/irqchip.h
+++ b/include/linux/irqchip.h
@@ -17,12 +17,18 @@
#include <linux/of_irq.h>
#include <linux/platform_device.h>
+typedef int (*platform_irq_probe_t)(struct platform_device *, struct device_node *);
+
/* Undefined on purpose */
extern of_irq_init_cb_t typecheck_irq_init_cb;
+extern platform_irq_probe_t typecheck_irq_probe;
#define typecheck_irq_init_cb(fn) \
(__typecheck(typecheck_irq_init_cb, &fn) ? fn : fn)
+#define typecheck_irq_probe(fn) \
+ (__typecheck(typecheck_irq_probe, &fn) ? fn : fn)
+
/*
* This macro must be used by the different irqchip drivers to declare
* the association between their DT compatible string and their
@@ -42,7 +48,7 @@ extern int platform_irqchip_probe(struct platform_device *pdev);
static const struct of_device_id drv_name##_irqchip_match_table[] = {
#define IRQCHIP_MATCH(compat, fn) { .compatible = compat, \
- .data = typecheck_irq_init_cb(fn), },
+ .data = typecheck_irq_probe(fn), },
#define IRQCHIP_PLATFORM_DRIVER_END(drv_name, ...) \
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 056/614] crypto: authenc - Correctly pass EINPROGRESS back up to the caller
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 055/614] irqchip: Pass platform device to platform drivers Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 057/614] ntfs3: fix uninit memory after failed mi_read in mi_format_new Greg Kroah-Hartman
` (571 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ingo Franzki, Mikulas Patocka,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 96feb73def02d175850daa0e7c2c90c876681b5c ]
When authenc is invoked with MAY_BACKLOG, it needs to pass EINPROGRESS
notifications back up to the caller when the underlying algorithm
returns EBUSY synchronously.
However, if the EBUSY comes from the second part of an authenc call,
i.e., it is asynchronous, both the EBUSY and the subsequent EINPROGRESS
notification must not be passed to the caller.
Implement this by passing a mask to the function that starts the
second half of authenc and using it to determine whether EBUSY
and EINPROGRESS should be passed to the caller.
This was a deficiency in the original implementation of authenc
because it was not expected to be used with MAY_BACKLOG.
Reported-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 180ce7e81030 ("crypto: authenc - Add EINPROGRESS check")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/authenc.c | 75 ++++++++++++++++++++++++++++++++----------------
1 file changed, 50 insertions(+), 25 deletions(-)
diff --git a/crypto/authenc.c b/crypto/authenc.c
index a723769c87779..ac679ce2cb953 100644
--- a/crypto/authenc.c
+++ b/crypto/authenc.c
@@ -37,7 +37,7 @@ struct authenc_request_ctx {
static void authenc_request_complete(struct aead_request *req, int err)
{
- if (err != -EINPROGRESS)
+ if (err != -EINPROGRESS && err != -EBUSY)
aead_request_complete(req, err);
}
@@ -107,27 +107,42 @@ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key,
return err;
}
-static void authenc_geniv_ahash_done(void *data, int err)
+static void authenc_geniv_ahash_finish(struct aead_request *req)
{
- struct aead_request *req = data;
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
struct aead_instance *inst = aead_alg_instance(authenc);
struct authenc_instance_ctx *ictx = aead_instance_ctx(inst);
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
- if (err)
- goto out;
-
scatterwalk_map_and_copy(ahreq->result, req->dst,
req->assoclen + req->cryptlen,
crypto_aead_authsize(authenc), 1);
+}
-out:
+static void authenc_geniv_ahash_done(void *data, int err)
+{
+ struct aead_request *req = data;
+
+ if (!err)
+ authenc_geniv_ahash_finish(req);
aead_request_complete(req, err);
}
-static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags)
+/*
+ * Used when the ahash request was invoked in the async callback context
+ * of the previous skcipher request. Eat any EINPROGRESS notifications.
+ */
+static void authenc_geniv_ahash_done2(void *data, int err)
+{
+ struct aead_request *req = data;
+
+ if (!err)
+ authenc_geniv_ahash_finish(req);
+ authenc_request_complete(req, err);
+}
+
+static int crypto_authenc_genicv(struct aead_request *req, unsigned int mask)
{
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
struct aead_instance *inst = aead_alg_instance(authenc);
@@ -136,6 +151,7 @@ static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags)
struct crypto_ahash *auth = ctx->auth;
struct authenc_request_ctx *areq_ctx = aead_request_ctx(req);
struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff);
+ unsigned int flags = aead_request_flags(req) & ~mask;
u8 *hash = areq_ctx->tail;
int err;
@@ -143,7 +159,8 @@ static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags)
ahash_request_set_crypt(ahreq, req->dst, hash,
req->assoclen + req->cryptlen);
ahash_request_set_callback(ahreq, flags,
- authenc_geniv_ahash_done, req);
+ mask ? authenc_geniv_ahash_done2 :
+ authenc_geniv_ahash_done, req);
err = crypto_ahash_digest(ahreq);
if (err)
@@ -159,12 +176,11 @@ static void crypto_authenc_encrypt_done(void *data, int err)
{
struct aead_request *areq = data;
- if (err)
- goto out;
-
- err = crypto_authenc_genicv(areq, 0);
-
-out:
+ if (err) {
+ aead_request_complete(areq, err);
+ return;
+ }
+ err = crypto_authenc_genicv(areq, CRYPTO_TFM_REQ_MAY_SLEEP);
authenc_request_complete(areq, err);
}
@@ -199,11 +215,18 @@ static int crypto_authenc_encrypt(struct aead_request *req)
if (err)
return err;
- return crypto_authenc_genicv(req, aead_request_flags(req));
+ return crypto_authenc_genicv(req, 0);
+}
+
+static void authenc_decrypt_tail_done(void *data, int err)
+{
+ struct aead_request *req = data;
+
+ authenc_request_complete(req, err);
}
static int crypto_authenc_decrypt_tail(struct aead_request *req,
- unsigned int flags)
+ unsigned int mask)
{
struct crypto_aead *authenc = crypto_aead_reqtfm(req);
struct aead_instance *inst = aead_alg_instance(authenc);
@@ -214,6 +237,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req,
struct skcipher_request *skreq = (void *)(areq_ctx->tail +
ictx->reqoff);
unsigned int authsize = crypto_aead_authsize(authenc);
+ unsigned int flags = aead_request_flags(req) & ~mask;
u8 *ihash = ahreq->result + authsize;
struct scatterlist *src, *dst;
@@ -230,7 +254,9 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req,
skcipher_request_set_tfm(skreq, ctx->enc);
skcipher_request_set_callback(skreq, flags,
- req->base.complete, req->base.data);
+ mask ? authenc_decrypt_tail_done :
+ req->base.complete,
+ mask ? req : req->base.data);
skcipher_request_set_crypt(skreq, src, dst,
req->cryptlen - authsize, req->iv);
@@ -241,12 +267,11 @@ static void authenc_verify_ahash_done(void *data, int err)
{
struct aead_request *req = data;
- if (err)
- goto out;
-
- err = crypto_authenc_decrypt_tail(req, 0);
-
-out:
+ if (err) {
+ aead_request_complete(req, err);
+ return;
+ }
+ err = crypto_authenc_decrypt_tail(req, CRYPTO_TFM_REQ_MAY_SLEEP);
authenc_request_complete(req, err);
}
@@ -273,7 +298,7 @@ static int crypto_authenc_decrypt(struct aead_request *req)
if (err)
return err;
- return crypto_authenc_decrypt_tail(req, aead_request_flags(req));
+ return crypto_authenc_decrypt_tail(req, 0);
}
static int crypto_authenc_init_tfm(struct crypto_aead *tfm)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 057/614] ntfs3: fix uninit memory after failed mi_read in mi_format_new
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 056/614] crypto: authenc - Correctly pass EINPROGRESS back up to the caller Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 058/614] ntfs3: Fix uninit buffer allocated by __getname() Greg Kroah-Hartman
` (570 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7a2ba6b7b66340cff225,
Raphael Pinsonneault-Thibeault, Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
[ Upstream commit 73e6b9dacf72a1e7a4265eacca46f8f33e0997d6 ]
Fix a KMSAN un-init bug found by syzkaller.
ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be
uptodate. We do not bring the buffer uptodate before setting it as
uptodate. If the buffer were to not be uptodate, it could mean adding a
buffer with un-init data to the mi record. Attempting to load that record
will trigger KMSAN.
Avoid this by setting the buffer as uptodate, if it’s not already, by
overwriting it.
Reported-by: syzbot+7a2ba6b7b66340cff225@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7a2ba6b7b66340cff225
Tested-by: syzbot+7a2ba6b7b66340cff225@syzkaller.appspotmail.com
Fixes: 4342306f0f0d5 ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/fsntfs.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index c7a2f191254da..5ae910e9ecbda 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -1349,7 +1349,14 @@ int ntfs_get_bh(struct ntfs_sb_info *sbi, const struct runs_tree *run, u64 vbo,
}
if (buffer_locked(bh))
__wait_on_buffer(bh);
- set_buffer_uptodate(bh);
+
+ lock_buffer(bh);
+ if (!buffer_uptodate(bh))
+ {
+ memset(bh->b_data, 0, blocksize);
+ set_buffer_uptodate(bh);
+ }
+ unlock_buffer(bh);
} else {
bh = ntfs_bread(sb, block);
if (!bh) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 058/614] ntfs3: Fix uninit buffer allocated by __getname()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 057/614] ntfs3: fix uninit memory after failed mi_read in mi_format_new Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 059/614] arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K Greg Kroah-Hartman
` (569 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+332bd4e9d148f11a87dc,
Sidharth Seela, Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidharth Seela <sidharthseela@gmail.com>
[ Upstream commit 9948dcb2f7b5a1bf8e8710eafaf6016e00be3ad6 ]
Fix uninit errors caused after buffer allocation given to 'de'; by
initializing the buffer with zeroes. The fix was found by using KMSAN.
Reported-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com
Fixes: 78ab59fee07f2 ("fs/ntfs3: Rework file operations")
Signed-off-by: Sidharth Seela <sidharthseela@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 3959f23c487a2..3a0676871bade 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -1722,6 +1722,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
de = __getname();
if (!de)
return -ENOMEM;
+ memset(de, 0, PATH_MAX);
/* Mark rw ntfs as dirty. It will be cleared at umount. */
ntfs_set_state(sbi, NTFS_DIRTY_DIRTY);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 059/614] arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 058/614] ntfs3: Fix uninit buffer allocated by __getname() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 060/614] iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Greg Kroah-Hartman
` (568 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathiravan Thirumoorthy,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
[ Upstream commit 28803705b552a0a711fa849490f14dca2bc5296e ]
Correct the reserved memory size for TF-A to 512K, as it was mistakenly
marked as 500K. Update the reserved memory node accordingly.
Fixes: 8517204c982b ("arm64: dts: qcom: ipq5424: Add reserved memory for TF-A")
Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251014-tfa-reserved-mem-v1-1-48c82033c8a7@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/ipq5424.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq5424.dtsi b/arch/arm64/boot/dts/qcom/ipq5424.dtsi
index ef2b52f3597d9..227d5ce297515 100644
--- a/arch/arm64/boot/dts/qcom/ipq5424.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq5424.dtsi
@@ -213,7 +213,7 @@ smem@8a800000 {
};
tfa@8a832000 {
- reg = <0x0 0x8a832000 0x0 0x7d000>;
+ reg = <0x0 0x8a832000 0x0 0x80000>;
no-map;
status = "disabled";
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 060/614] iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 059/614] arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 061/614] firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc Greg Kroah-Hartman
` (567 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Lavra, Lorenzo Bianconi,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
[ Upstream commit c6d702f2b77194b62fb2098c63bb7f2a87da142d ]
The `odr` field in struct st_lsm6dsx_sensor contains a data rate
value expressed in mHz, not in Hz.
Fixes: f8710f0357bc3 ("iio: imu: st_lsm6dsx: express odr in mHZ")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
index 381b016fa5243..56244d49ab2fc 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
@@ -383,7 +383,7 @@ enum st_lsm6dsx_fifo_mode {
* @id: Sensor identifier.
* @hw: Pointer to instance of struct st_lsm6dsx_hw.
* @gain: Configured sensor sensitivity.
- * @odr: Output data rate of the sensor [Hz].
+ * @odr: Output data rate of the sensor [mHz].
* @samples_to_discard: Number of samples to discard for filters settling time.
* @watermark: Sensor watermark level.
* @decimator: Sensor decimation factor.
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 061/614] firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 060/614] iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 062/614] perf parse-events: Make X modifier more respectful of groups Greg Kroah-Hartman
` (566 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Bjorn Andersson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit edd548dc64a699d71ea4f537f815044e763d01e1 ]
Fix kernel-doc warnings by using correct kernel-doc syntax and
formatting to prevent warnings:
Warning: include/linux/firmware/qcom/qcom_tzmem.h:25 Enum value
'QCOM_TZMEM_POLICY_STATIC' not described in enum 'qcom_tzmem_policy'
Warning: ../include/linux/firmware/qcom/qcom_tzmem.h:25 Enum value
'QCOM_TZMEM_POLICY_MULTIPLIER' not described in enum 'qcom_tzmem_policy'
Warning: ../include/linux/firmware/qcom/qcom_tzmem.h:25 Enum value
'QCOM_TZMEM_POLICY_ON_DEMAND' not described in enum 'qcom_tzmem_policy'
Fixes: 84f5a7b67b61 ("firmware: qcom: add a dedicated TrustZone buffer allocator")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20251017191323.1820167-1-rdunlap@infradead.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/firmware/qcom/qcom_tzmem.h | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/include/linux/firmware/qcom/qcom_tzmem.h b/include/linux/firmware/qcom/qcom_tzmem.h
index 48ac0e5454c7f..23173e0c3dddd 100644
--- a/include/linux/firmware/qcom/qcom_tzmem.h
+++ b/include/linux/firmware/qcom/qcom_tzmem.h
@@ -17,11 +17,20 @@ struct qcom_tzmem_pool;
* enum qcom_tzmem_policy - Policy for pool growth.
*/
enum qcom_tzmem_policy {
- /**< Static pool, never grow above initial size. */
+ /**
+ * @QCOM_TZMEM_POLICY_STATIC: Static pool,
+ * never grow above initial size.
+ */
QCOM_TZMEM_POLICY_STATIC = 1,
- /**< When out of memory, add increment * current size of memory. */
+ /**
+ * @QCOM_TZMEM_POLICY_MULTIPLIER: When out of memory,
+ * add increment * current size of memory.
+ */
QCOM_TZMEM_POLICY_MULTIPLIER,
- /**< When out of memory add as much as is needed until max_size. */
+ /**
+ * @QCOM_TZMEM_POLICY_ON_DEMAND: When out of memory
+ * add as much as is needed until max_size.
+ */
QCOM_TZMEM_POLICY_ON_DEMAND,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 062/614] perf parse-events: Make X modifier more respectful of groups
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 061/614] firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 063/614] crypto: aead - Fix reqsize handling Greg Kroah-Hartman
` (565 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 800201997a509c298e74696da3586d82b1a2b6f4 ]
Events with an X modifier were reordered within a group, for example
slots was made the leader in:
```
$ perf record -e '{cpu/mem-stores/ppu,cpu/slots/uX}' -- sleep 1
```
Fix by making `dont_regroup` evsels always use their index for
sorting. Make the cur_leader, when fixing the groups, be that of
`dont_regroup` evsel so that the `dont_regroup` evsel doesn't become a
leader.
On a tigerlake this patch corrects this and meets expectations in:
```
$ perf stat -e '{cpu/mem-stores/,cpu/slots/uX}' -a -- sleep 0.1
Performance counter stats for 'system wide':
83,458,652 cpu/mem-stores/
2,720,854,880 cpu/slots/uX
0.103780587 seconds time elapsed
$ perf stat -e 'slots,slots:X' -a -- sleep 0.1
Performance counter stats for 'system wide':
732,042,247 slots (48.96%)
643,288,155 slots:X (51.04%)
0.102731018 seconds time elapsed
```
Closes: https://lore.kernel.org/lkml/18f20d38-070c-4e17-bc90-cf7102e1e53d@linux.intel.com/
Fixes: 035c17893082 ("perf parse-events: Add 'X' modifier to exclude an event from being regrouped")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/parse-events.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 90a765016f64f..cd9315d3ca117 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -2121,14 +2121,18 @@ static int evlist__cmp(void *_fg_idx, const struct list_head *l, const struct li
* event's index is used. An index may be forced for events that
* must be in the same group, namely Intel topdown events.
*/
- if (*force_grouped_idx != -1 && arch_evsel__must_be_in_group(lhs)) {
+ if (lhs->dont_regroup) {
+ lhs_sort_idx = lhs_core->idx;
+ } else if (*force_grouped_idx != -1 && arch_evsel__must_be_in_group(lhs)) {
lhs_sort_idx = *force_grouped_idx;
} else {
bool lhs_has_group = lhs_core->leader != lhs_core || lhs_core->nr_members > 1;
lhs_sort_idx = lhs_has_group ? lhs_core->leader->idx : lhs_core->idx;
}
- if (*force_grouped_idx != -1 && arch_evsel__must_be_in_group(rhs)) {
+ if (rhs->dont_regroup) {
+ rhs_sort_idx = rhs_core->idx;
+ } else if (*force_grouped_idx != -1 && arch_evsel__must_be_in_group(rhs)) {
rhs_sort_idx = *force_grouped_idx;
} else {
bool rhs_has_group = rhs_core->leader != rhs_core || rhs_core->nr_members > 1;
@@ -2226,10 +2230,10 @@ static int parse_events__sort_events_and_fix_groups(struct list_head *list)
*/
idx = 0;
list_for_each_entry(pos, list, core.node) {
- const struct evsel *pos_leader = evsel__leader(pos);
+ struct evsel *pos_leader = evsel__leader(pos);
const char *pos_pmu_name = pos->group_pmu_name;
const char *cur_leader_pmu_name;
- bool pos_force_grouped = force_grouped_idx != -1 &&
+ bool pos_force_grouped = force_grouped_idx != -1 && !pos->dont_regroup &&
arch_evsel__must_be_in_group(pos);
/* Reset index and nr_members. */
@@ -2243,8 +2247,8 @@ static int parse_events__sort_events_and_fix_groups(struct list_head *list)
* groups can't span PMUs.
*/
if (!cur_leader || pos->dont_regroup) {
- cur_leader = pos;
- cur_leaders_grp = &pos->core;
+ cur_leader = pos->dont_regroup ? pos_leader : pos;
+ cur_leaders_grp = &cur_leader->core;
if (pos_force_grouped)
force_grouped_leader = pos;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 063/614] crypto: aead - Fix reqsize handling
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 062/614] perf parse-events: Make X modifier more respectful of groups Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 064/614] PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove() Greg Kroah-Hartman
` (564 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, T Pratham, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: T Pratham <t-pratham@ti.com>
[ Upstream commit 9b04d8f00569573796dd05397f5779135593eb24 ]
Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg")
introduced cra_reqsize field in crypto_alg struct to replace type
specific reqsize fields. It looks like this was introduced specifically
for ahash and acomp from the commit description as subsequent commits
add necessary changes in these alg frameworks.
However, this is being recommended for use in all crypto algs
instead of setting reqsize using crypto_*_set_reqsize(). Using
cra_reqsize in aead algorithms, hence, causes memory corruptions and
crashes as the underlying functions in the algorithm framework have not
been updated to set the reqsize properly from cra_reqsize. [1]
Add proper set_reqsize calls in the aead init function to properly
initialize reqsize for these algorithms in the framework.
[1]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b
Fixes: afddce13ce81d ("crypto: api - Add reqsize to crypto_alg")
Signed-off-by: T Pratham <t-pratham@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/aead.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/crypto/aead.c b/crypto/aead.c
index 5d14b775036ee..51ab3af691af2 100644
--- a/crypto/aead.c
+++ b/crypto/aead.c
@@ -120,6 +120,7 @@ static int crypto_aead_init_tfm(struct crypto_tfm *tfm)
struct aead_alg *alg = crypto_aead_alg(aead);
crypto_aead_set_flags(aead, CRYPTO_TFM_NEED_KEY);
+ crypto_aead_set_reqsize(aead, crypto_tfm_alg_reqsize(tfm));
aead->authsize = alg->maxauthsize;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 064/614] PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 063/614] crypto: aead - Fix reqsize handling Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 065/614] block/mq-deadline: Introduce dd_start_request() Greg Kroah-Hartman
` (563 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Manivannan Sadhasivam, Chen Wang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 932ec9dff6da40382ee63049a11a6ff047bdc259 ]
devm_pm_runtime_enable() is used in the probe, so pm_runtime_disable()
should not be called explicitly in the remove function.
Fixes: 1c72774df028 ("PCI: sg2042: Add Sophgo SG2042 PCIe driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Chen Wang <unicorn_wang@outlook.com> # on Pioneerbox.
Acked-by: Chen Wang <unicorn_wang@outlook.com>
Link: https://patch.msgid.link/242eca0ff6601de7966a53706e9950fbcb10aac8.1759169586.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/cadence/pcie-sg2042.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/pci/controller/cadence/pcie-sg2042.c b/drivers/pci/controller/cadence/pcie-sg2042.c
index a077b28d48949..0c50c74d03eeb 100644
--- a/drivers/pci/controller/cadence/pcie-sg2042.c
+++ b/drivers/pci/controller/cadence/pcie-sg2042.c
@@ -74,15 +74,12 @@ static int sg2042_pcie_probe(struct platform_device *pdev)
static void sg2042_pcie_remove(struct platform_device *pdev)
{
struct cdns_pcie *pcie = platform_get_drvdata(pdev);
- struct device *dev = &pdev->dev;
struct cdns_pcie_rc *rc;
rc = container_of(pcie, struct cdns_pcie_rc, pcie);
cdns_pcie_host_disable(rc);
cdns_pcie_disable_phy(pcie);
-
- pm_runtime_disable(dev);
}
static int sg2042_pcie_suspend_noirq(struct device *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 065/614] block/mq-deadline: Introduce dd_start_request()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 064/614] PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 066/614] block/mq-deadline: Switch back to a single dispatch list Greg Kroah-Hartman
` (562 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Yu Kuai, chengkaitao,
Bart Van Assche, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 93a358af59c6e8ab00b57cfdb1c437516a4948ca ]
Prepare for adding a second caller of this function. No functionality
has been changed.
Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Yu Kuai <yukuai@kernel.org>
Cc: chengkaitao <chengkaitao@kylinos.cn>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: d60055cf5270 ("block/mq-deadline: Switch back to a single dispatch list")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/mq-deadline.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 3e741d33142d3..647a45f6d9352 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -306,6 +306,19 @@ static bool started_after(struct deadline_data *dd, struct request *rq,
return time_after(start_time, latest_start);
}
+static struct request *dd_start_request(struct deadline_data *dd,
+ enum dd_data_dir data_dir,
+ struct request *rq)
+{
+ u8 ioprio_class = dd_rq_ioclass(rq);
+ enum dd_prio prio = ioprio_class_to_prio[ioprio_class];
+
+ dd->per_prio[prio].latest_pos[data_dir] = blk_rq_pos(rq);
+ dd->per_prio[prio].stats.dispatched++;
+ rq->rq_flags |= RQF_STARTED;
+ return rq;
+}
+
/*
* deadline_dispatch_requests selects the best request according to
* read/write expire, fifo_batch, etc and with a start time <= @latest_start.
@@ -316,8 +329,6 @@ static struct request *__dd_dispatch_request(struct deadline_data *dd,
{
struct request *rq, *next_rq;
enum dd_data_dir data_dir;
- enum dd_prio prio;
- u8 ioprio_class;
lockdep_assert_held(&dd->lock);
@@ -411,12 +422,7 @@ static struct request *__dd_dispatch_request(struct deadline_data *dd,
dd->batching++;
deadline_move_request(dd, per_prio, rq);
done:
- ioprio_class = dd_rq_ioclass(rq);
- prio = ioprio_class_to_prio[ioprio_class];
- dd->per_prio[prio].latest_pos[data_dir] = blk_rq_pos(rq);
- dd->per_prio[prio].stats.dispatched++;
- rq->rq_flags |= RQF_STARTED;
- return rq;
+ return dd_start_request(dd, data_dir, rq);
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 066/614] block/mq-deadline: Switch back to a single dispatch list
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 065/614] block/mq-deadline: Introduce dd_start_request() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 067/614] bpf: Do not let BPF test infra emit invalid GSO types to stack Greg Kroah-Hartman
` (561 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Yu Kuai, chengkaitao,
Bart Van Assche, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit d60055cf52703a705b86fb25b9b7931ec7ee399c ]
Commit c807ab520fc3 ("block/mq-deadline: Add I/O priority support")
modified the behavior of request flag BLK_MQ_INSERT_AT_HEAD from
dispatching a request before other requests into dispatching a request
before other requests with the same I/O priority. This is not correct since
BLK_MQ_INSERT_AT_HEAD is used when requeuing requests and also when a flush
request is inserted. Both types of requests should be dispatched as soon
as possible. Hence, make the mq-deadline I/O scheduler again ignore the I/O
priority for BLK_MQ_INSERT_AT_HEAD requests.
Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Yu Kuai <yukuai@kernel.org>
Reported-by: chengkaitao <chengkaitao@kylinos.cn>
Closes: https://lore.kernel.org/linux-block/20251009155253.14611-1-pilgrimtao@gmail.com/
Fixes: c807ab520fc3 ("block/mq-deadline: Add I/O priority support")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Damien Le Moalv <dlemoal@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/mq-deadline.c | 107 +++++++++++++++++++-------------------------
1 file changed, 47 insertions(+), 60 deletions(-)
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 647a45f6d9352..3e3719093aec7 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -71,7 +71,6 @@ struct io_stats_per_prio {
* present on both sort_list[] and fifo_list[].
*/
struct dd_per_prio {
- struct list_head dispatch;
struct rb_root sort_list[DD_DIR_COUNT];
struct list_head fifo_list[DD_DIR_COUNT];
/* Position of the most recently dispatched request. */
@@ -84,6 +83,7 @@ struct deadline_data {
* run time data
*/
+ struct list_head dispatch;
struct dd_per_prio per_prio[DD_PRIO_COUNT];
/* Data direction of latest dispatched request. */
@@ -332,16 +332,6 @@ static struct request *__dd_dispatch_request(struct deadline_data *dd,
lockdep_assert_held(&dd->lock);
- if (!list_empty(&per_prio->dispatch)) {
- rq = list_first_entry(&per_prio->dispatch, struct request,
- queuelist);
- if (started_after(dd, rq, latest_start))
- return NULL;
- list_del_init(&rq->queuelist);
- data_dir = rq_data_dir(rq);
- goto done;
- }
-
/*
* batches are currently reads XOR writes
*/
@@ -421,7 +411,6 @@ static struct request *__dd_dispatch_request(struct deadline_data *dd,
*/
dd->batching++;
deadline_move_request(dd, per_prio, rq);
-done:
return dd_start_request(dd, data_dir, rq);
}
@@ -469,6 +458,14 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx)
enum dd_prio prio;
spin_lock(&dd->lock);
+
+ if (!list_empty(&dd->dispatch)) {
+ rq = list_first_entry(&dd->dispatch, struct request, queuelist);
+ list_del_init(&rq->queuelist);
+ dd_start_request(dd, rq_data_dir(rq), rq);
+ goto unlock;
+ }
+
rq = dd_dispatch_prio_aged_requests(dd, now);
if (rq)
goto unlock;
@@ -557,10 +554,10 @@ static int dd_init_sched(struct request_queue *q, struct elevator_queue *eq)
eq->elevator_data = dd;
+ INIT_LIST_HEAD(&dd->dispatch);
for (prio = 0; prio <= DD_PRIO_MAX; prio++) {
struct dd_per_prio *per_prio = &dd->per_prio[prio];
- INIT_LIST_HEAD(&per_prio->dispatch);
INIT_LIST_HEAD(&per_prio->fifo_list[DD_READ]);
INIT_LIST_HEAD(&per_prio->fifo_list[DD_WRITE]);
per_prio->sort_list[DD_READ] = RB_ROOT;
@@ -664,7 +661,7 @@ static void dd_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
trace_block_rq_insert(rq);
if (flags & BLK_MQ_INSERT_AT_HEAD) {
- list_add(&rq->queuelist, &per_prio->dispatch);
+ list_add(&rq->queuelist, &dd->dispatch);
rq->fifo_time = jiffies;
} else {
deadline_add_rq_rb(per_prio, rq);
@@ -731,8 +728,7 @@ static void dd_finish_request(struct request *rq)
static bool dd_has_work_for_prio(struct dd_per_prio *per_prio)
{
- return !list_empty_careful(&per_prio->dispatch) ||
- !list_empty_careful(&per_prio->fifo_list[DD_READ]) ||
+ return !list_empty_careful(&per_prio->fifo_list[DD_READ]) ||
!list_empty_careful(&per_prio->fifo_list[DD_WRITE]);
}
@@ -741,6 +737,9 @@ static bool dd_has_work(struct blk_mq_hw_ctx *hctx)
struct deadline_data *dd = hctx->queue->elevator->elevator_data;
enum dd_prio prio;
+ if (!list_empty_careful(&dd->dispatch))
+ return true;
+
for (prio = 0; prio <= DD_PRIO_MAX; prio++)
if (dd_has_work_for_prio(&dd->per_prio[prio]))
return true;
@@ -949,49 +948,39 @@ static int dd_owned_by_driver_show(void *data, struct seq_file *m)
return 0;
}
-#define DEADLINE_DISPATCH_ATTR(prio) \
-static void *deadline_dispatch##prio##_start(struct seq_file *m, \
- loff_t *pos) \
- __acquires(&dd->lock) \
-{ \
- struct request_queue *q = m->private; \
- struct deadline_data *dd = q->elevator->elevator_data; \
- struct dd_per_prio *per_prio = &dd->per_prio[prio]; \
- \
- spin_lock(&dd->lock); \
- return seq_list_start(&per_prio->dispatch, *pos); \
-} \
- \
-static void *deadline_dispatch##prio##_next(struct seq_file *m, \
- void *v, loff_t *pos) \
-{ \
- struct request_queue *q = m->private; \
- struct deadline_data *dd = q->elevator->elevator_data; \
- struct dd_per_prio *per_prio = &dd->per_prio[prio]; \
- \
- return seq_list_next(v, &per_prio->dispatch, pos); \
-} \
- \
-static void deadline_dispatch##prio##_stop(struct seq_file *m, void *v) \
- __releases(&dd->lock) \
-{ \
- struct request_queue *q = m->private; \
- struct deadline_data *dd = q->elevator->elevator_data; \
- \
- spin_unlock(&dd->lock); \
-} \
- \
-static const struct seq_operations deadline_dispatch##prio##_seq_ops = { \
- .start = deadline_dispatch##prio##_start, \
- .next = deadline_dispatch##prio##_next, \
- .stop = deadline_dispatch##prio##_stop, \
- .show = blk_mq_debugfs_rq_show, \
+static void *deadline_dispatch_start(struct seq_file *m, loff_t *pos)
+ __acquires(&dd->lock)
+{
+ struct request_queue *q = m->private;
+ struct deadline_data *dd = q->elevator->elevator_data;
+
+ spin_lock(&dd->lock);
+ return seq_list_start(&dd->dispatch, *pos);
}
-DEADLINE_DISPATCH_ATTR(0);
-DEADLINE_DISPATCH_ATTR(1);
-DEADLINE_DISPATCH_ATTR(2);
-#undef DEADLINE_DISPATCH_ATTR
+static void *deadline_dispatch_next(struct seq_file *m, void *v, loff_t *pos)
+{
+ struct request_queue *q = m->private;
+ struct deadline_data *dd = q->elevator->elevator_data;
+
+ return seq_list_next(v, &dd->dispatch, pos);
+}
+
+static void deadline_dispatch_stop(struct seq_file *m, void *v)
+ __releases(&dd->lock)
+{
+ struct request_queue *q = m->private;
+ struct deadline_data *dd = q->elevator->elevator_data;
+
+ spin_unlock(&dd->lock);
+}
+
+static const struct seq_operations deadline_dispatch_seq_ops = {
+ .start = deadline_dispatch_start,
+ .next = deadline_dispatch_next,
+ .stop = deadline_dispatch_stop,
+ .show = blk_mq_debugfs_rq_show,
+};
#define DEADLINE_QUEUE_DDIR_ATTRS(name) \
{#name "_fifo_list", 0400, \
@@ -1014,9 +1003,7 @@ static const struct blk_mq_debugfs_attr deadline_queue_debugfs_attrs[] = {
{"batching", 0400, deadline_batching_show},
{"starved", 0400, deadline_starved_show},
{"async_depth", 0400, dd_async_depth_show},
- {"dispatch0", 0400, .seq_ops = &deadline_dispatch0_seq_ops},
- {"dispatch1", 0400, .seq_ops = &deadline_dispatch1_seq_ops},
- {"dispatch2", 0400, .seq_ops = &deadline_dispatch2_seq_ops},
+ {"dispatch", 0400, .seq_ops = &deadline_dispatch_seq_ops},
{"owned_by_driver", 0400, dd_owned_by_driver_show},
{"queued", 0400, dd_queued_show},
{},
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 067/614] bpf: Do not let BPF test infra emit invalid GSO types to stack
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 066/614] block/mq-deadline: Switch back to a single dispatch list Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 068/614] arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props Greg Kroah-Hartman
` (560 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yinhao Hu, Kaiyan Mei, Dongliang Mu,
Daniel Borkmann, Martin KaFai Lau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 04a899573fb87273a656f178b5f920c505f68875 ]
Yinhao et al. reported that their fuzzer tool was able to trigger a
skb_warn_bad_offload() from netif_skb_features() -> gso_features_check().
When a BPF program - triggered via BPF test infra - pushes the packet
to the loopback device via bpf_clone_redirect() then mentioned offload
warning can be seen. GSO-related features are then rightfully disabled.
We get into this situation due to convert___skb_to_skb() setting
gso_segs and gso_size but not gso_type. Technically, it makes sense
that this warning triggers since the GSO properties are malformed due
to the gso_type. Potentially, the gso_type could be marked non-trustworthy
through setting it at least to SKB_GSO_DODGY without any other specific
assumptions, but that also feels wrong given we should not go further
into the GSO engine in the first place.
The checks were added in 121d57af308d ("gso: validate gso_type in GSO
handlers") because there were malicious (syzbot) senders that combine
a protocol with a non-matching gso_type. If we would want to drop such
packets, gso_features_check() currently only returns feature flags via
netif_skb_features(), so one location for potentially dropping such skbs
could be validate_xmit_unreadable_skb(), but then otoh it would be
an additional check in the fast-path for a very corner case. Given
bpf_clone_redirect() is the only place where BPF test infra could emit
such packets, lets reject them right there.
Fixes: 850a88cc4096 ("bpf: Expose __sk_buff wire_len/gso_segs to BPF_PROG_TEST_RUN")
Fixes: cf62089b0edd ("bpf: Add gso_size to __sk_buff")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20251020075441.127980-1-daniel@iogearbox.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bpf/test_run.c | 5 +++++
net/core/filter.c | 7 +++++++
2 files changed, 12 insertions(+)
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 8b7d0b90fea76..55a79337ac51f 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -939,6 +939,11 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb)
if (__skb->gso_segs > GSO_MAX_SEGS)
return -EINVAL;
+
+ /* Currently GSO type is zero/unset. If this gets extended with
+ * a small list of accepted GSO types in future, the filter for
+ * an unset GSO type in bpf_clone_redirect() can be lifted.
+ */
skb_shinfo(skb)->gso_segs = __skb->gso_segs;
skb_shinfo(skb)->gso_size = __skb->gso_size;
skb_shinfo(skb)->hwtstamps.hwtstamp = __skb->hwtstamp;
diff --git a/net/core/filter.c b/net/core/filter.c
index fa06c5a08e22f..1efec0d70d783 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2458,6 +2458,13 @@ BPF_CALL_3(bpf_clone_redirect, struct sk_buff *, skb, u32, ifindex, u64, flags)
if (unlikely(flags & (~(BPF_F_INGRESS) | BPF_F_REDIRECT_INTERNAL)))
return -EINVAL;
+ /* BPF test infra's convert___skb_to_skb() can create type-less
+ * GSO packets. gso_features_check() will detect this as a bad
+ * offload. However, lets not leak them out in the first place.
+ */
+ if (unlikely(skb_is_gso(skb) && !skb_shinfo(skb)->gso_type))
+ return -EBADMSG;
+
dev = dev_get_by_index_rcu(dev_net(skb->dev), ifindex);
if (unlikely(!dev))
return -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 068/614] arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 067/614] bpf: Do not let BPF test infra emit invalid GSO types to stack Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 069/614] arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl Greg Kroah-Hartman
` (559 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Harvey, Peng Fan, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <tharvey@gateworks.com>
[ Upstream commit 8b7e58ab4a02601a0e86e9f9701d4612038d8b29 ]
Remove the un-intended duplicate properties from usdhc1.
Fixes: 0d5b288c2110e ("arm64: dts: freescale: Add imx8mp-venice-gw7905-2x")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 3 ---
1 file changed, 3 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
index cbf0c9a740faa..303995a8adce8 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
@@ -423,9 +423,6 @@ &usdhc1 {
bus-width = <4>;
non-removable;
status = "okay";
- bus-width = <4>;
- non-removable;
- status = "okay";
};
/* eMMC */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 069/614] arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 068/614] arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 070/614] arm64: dts: imx8mp-venice-gw702x: remove off-board uart Greg Kroah-Hartman
` (558 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Harvey, Peng Fan, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <tharvey@gateworks.com>
[ Upstream commit d949b8d12d6e8fa119bca10d3157cd42e810f6f7 ]
The SDHC1 interface is not used on the imx8mm-venice-gw72xx. Remove the
unused pinctrl_usdhc1 iomux node.
Fixes: 6f30b27c5ef5 ("arm64: dts: imx8mm: Add Gateworks i.MX 8M Mini Development Kits")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi
index 752caa38eb03b..266038fbbef97 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx.dtsi
@@ -351,17 +351,6 @@ MX8MM_IOMUXC_UART4_TXD_UART4_DCE_TX 0x140
>;
};
- pinctrl_usdhc1: usdhc1grp {
- fsl,pins = <
- MX8MM_IOMUXC_SD1_CLK_USDHC1_CLK 0x190
- MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD 0x1d0
- MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x1d0
- MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x1d0
- MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x1d0
- MX8MM_IOMUXC_SD1_DATA3_USDHC1_DATA3 0x1d0
- >;
- };
-
pinctrl_usdhc2: usdhc2grp {
fsl,pins = <
MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK 0x190
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 070/614] arm64: dts: imx8mp-venice-gw702x: remove off-board uart
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 069/614] arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 071/614] arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Greg Kroah-Hartman
` (557 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Harvey, Peng Fan, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <tharvey@gateworks.com>
[ Upstream commit effe98060f70eb96e142f656e750d6af275ceac3 ]
UART1 and UART3 go to a connector for use on a baseboard and as such are
defined in the baseboard device-trees. Remove them from the gw702x SOM
device-tree.
Fixes: 0d5b288c2110 ("arm64: dts: freescale: Add imx8mp-venice-gw7905-2x")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/freescale/imx8mp-venice-gw702x.dtsi | 28 -------------------
1 file changed, 28 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
index 303995a8adce8..086ee4510cd83 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
@@ -395,13 +395,6 @@ &i2c3 {
status = "okay";
};
-/* off-board header */
-&uart1 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_uart1>;
- status = "okay";
-};
-
/* console */
&uart2 {
pinctrl-names = "default";
@@ -409,13 +402,6 @@ &uart2 {
status = "okay";
};
-/* off-board header */
-&uart3 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_uart3>;
- status = "okay";
-};
-
/* off-board */
&usdhc1 {
pinctrl-names = "default";
@@ -520,13 +506,6 @@ MX8MP_IOMUXC_I2C3_SDA__GPIO5_IO19 0x400001c2
>;
};
- pinctrl_uart1: uart1grp {
- fsl,pins = <
- MX8MP_IOMUXC_UART1_RXD__UART1_DCE_RX 0x140
- MX8MP_IOMUXC_UART1_TXD__UART1_DCE_TX 0x140
- >;
- };
-
pinctrl_uart2: uart2grp {
fsl,pins = <
MX8MP_IOMUXC_UART2_RXD__UART2_DCE_RX 0x140
@@ -534,13 +513,6 @@ MX8MP_IOMUXC_UART2_TXD__UART2_DCE_TX 0x140
>;
};
- pinctrl_uart3: uart3grp {
- fsl,pins = <
- MX8MP_IOMUXC_UART3_RXD__UART3_DCE_RX 0x140
- MX8MP_IOMUXC_UART3_TXD__UART3_DCE_TX 0x140
- >;
- };
-
pinctrl_usdhc1: usdhc1grp {
fsl,pins = <
MX8MP_IOMUXC_SD1_CLK__USDHC1_CLK 0x190
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 071/614] arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 070/614] arm64: dts: imx8mp-venice-gw702x: remove off-board uart Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 072/614] arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Greg Kroah-Hartman
` (556 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tim Harvey, Peng Fan, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Harvey <tharvey@gateworks.com>
[ Upstream commit 9db04b310ef99b546e4240c55842e81b06b78579 ]
SDHC1 on the GW702x SOM routes to a connector for use on a baseboard
and as such are defined in the baseboard device-trees.
Remove it from the gw702x SOM device-tree.
Fixes: 0d5b288c2110 ("arm64: dts: freescale: Add imx8mp-venice-gw7905-2x")
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../dts/freescale/imx8mp-venice-gw702x.dtsi | 20 -------------------
.../dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 ----------
2 files changed, 31 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
index 086ee4510cd83..fb159199b39de 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
@@ -402,15 +402,6 @@ &uart2 {
status = "okay";
};
-/* off-board */
-&usdhc1 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_usdhc1>;
- bus-width = <4>;
- non-removable;
- status = "okay";
-};
-
/* eMMC */
&usdhc3 {
pinctrl-names = "default", "state_100mhz", "state_200mhz";
@@ -513,17 +504,6 @@ MX8MP_IOMUXC_UART2_TXD__UART2_DCE_TX 0x140
>;
};
- pinctrl_usdhc1: usdhc1grp {
- fsl,pins = <
- MX8MP_IOMUXC_SD1_CLK__USDHC1_CLK 0x190
- MX8MP_IOMUXC_SD1_CMD__USDHC1_CMD 0x1d0
- MX8MP_IOMUXC_SD1_DATA0__USDHC1_DATA0 0x1d0
- MX8MP_IOMUXC_SD1_DATA1__USDHC1_DATA1 0x1d0
- MX8MP_IOMUXC_SD1_DATA2__USDHC1_DATA2 0x1d0
- MX8MP_IOMUXC_SD1_DATA3__USDHC1_DATA3 0x1d0
- >;
- };
-
pinctrl_usdhc3: usdhc3grp {
fsl,pins = <
MX8MP_IOMUXC_NAND_WE_B__USDHC3_CLK 0x190
diff --git a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi
index cf747ec6fa16e..76020ef89bf3e 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw72xx.dtsi
@@ -365,17 +365,6 @@ MX8MP_IOMUXC_UART4_TXD__UART4_DCE_TX 0x140
>;
};
- pinctrl_usdhc1: usdhc1grp {
- fsl,pins = <
- MX8MP_IOMUXC_SD1_CLK__USDHC1_CLK 0x190
- MX8MP_IOMUXC_SD1_CMD__USDHC1_CMD 0x1d0
- MX8MP_IOMUXC_SD1_DATA0__USDHC1_DATA0 0x1d0
- MX8MP_IOMUXC_SD1_DATA1__USDHC1_DATA1 0x1d0
- MX8MP_IOMUXC_SD1_DATA2__USDHC1_DATA2 0x1d0
- MX8MP_IOMUXC_SD1_DATA3__USDHC1_DATA3 0x1d0
- >;
- };
-
pinctrl_usdhc2: usdhc2grp {
fsl,pins = <
MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK 0x190
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 072/614] arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 071/614] arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 073/614] perf annotate: Check return value of evsel__get_arch() properly Greg Kroah-Hartman
` (555 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joy Zou, Frank Li, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Zou <joy.zou@nxp.com>
[ Upstream commit 93b2fac5cdaf0d501d04c9a4b0e5024632a6af7c ]
Add fan-supply regulator to pwm-fan node to specify power source.
Fixes: e3e8b199aff8 ("arm64: dts: imx95: Add imx95-15x15-evk support")
Signed-off-by: Joy Zou <joy.zou@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts b/arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts
index 148243470dd4a..0953c25ef5576 100644
--- a/arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts
+++ b/arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts
@@ -61,6 +61,7 @@ chosen {
fan0: pwm-fan {
compatible = "pwm-fan";
+ fan-supply = <®_vcc_12v>;
#cooling-cells = <2>;
cooling-levels = <64 128 192 255>;
pwms = <&tpm6 0 4000000 PWM_POLARITY_INVERTED>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 073/614] perf annotate: Check return value of evsel__get_arch() properly
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 072/614] arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 074/614] arm64: dts: exynos: gs101: fix clock module unit reg sizes Greg Kroah-Hartman
` (554 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Namhyung Kim,
Tianyou Li, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianyou Li <tianyou.li@intel.com>
[ Upstream commit f1204e5846d22fb2fffbd1164eeb19535f306797 ]
Check the error code of evsel__get_arch() in the symbol__annotate().
Previously it checked non-zero value but after the refactoring it does
only for negative values.
Fixes: 0669729eb0afb0cf ("perf annotate: Factor out evsel__get_arch()")
Suggested-by: James Clark <james.clark@linaro.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tianyou Li <tianyou.li@intel.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/annotate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index a2e34f149a074..1d6900033b3a0 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1021,7 +1021,7 @@ int symbol__annotate(struct map_symbol *ms, struct evsel *evsel,
int err, nr;
err = evsel__get_arch(evsel, &arch);
- if (err < 0)
+ if (err)
return err;
if (parch)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 074/614] arm64: dts: exynos: gs101: fix clock module unit reg sizes
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 073/614] perf annotate: Check return value of evsel__get_arch() properly Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 075/614] arm64: dts: exynos: gs101: fix sysreg_apm reg property Greg Kroah-Hartman
` (553 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Griffin, André Draszik,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <peter.griffin@linaro.org>
[ Upstream commit ddb2a16804d005a96e8b5ffc0925e2f5bff65767 ]
The memory map lists each clock module unit as having a size of
0x10000. Additionally there are some undocumented registers in this region
that need to be used for automatic clock gating mode. Some of those
registers also need to be saved/restored on suspend & resume.
Fixes: 86124c76683e ("arm64: dts: exynos: gs101: enable cmu-hsi2 clock controller")
Fixes: 4982a4a2092e ("arm64: dts: exynos: gs101: enable cmu-hsi0 clock controller")
Fixes: 7d66d98b5bf3 ("arm64: dts: exynos: gs101: enable cmu-peric1 clock controller")
Fixes: e62c706f3aa0 ("arm64: dts: exynos: gs101: enable cmu-peric0 clock controller")
Fixes: ea89fdf24fd9 ("arm64: dts: exynos: google: Add initial Google gs101 SoC support")
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Reviewed-by: André Draszik <andre.draszik@linaro.org>
Link: https://patch.msgid.link/20251013-automatic-clocks-v1-4-72851ee00300@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/exynos/google/gs101.dtsi | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/exynos/google/gs101.dtsi b/arch/arm64/boot/dts/exynos/google/gs101.dtsi
index 31c99526470d0..6335e0a8136be 100644
--- a/arch/arm64/boot/dts/exynos/google/gs101.dtsi
+++ b/arch/arm64/boot/dts/exynos/google/gs101.dtsi
@@ -288,7 +288,7 @@ soc: soc@0 {
cmu_misc: clock-controller@10010000 {
compatible = "google,gs101-cmu-misc";
- reg = <0x10010000 0x8000>;
+ reg = <0x10010000 0x10000>;
#clock-cells = <1>;
clocks = <&cmu_top CLK_DOUT_CMU_MISC_BUS>,
<&cmu_top CLK_DOUT_CMU_MISC_SSS>;
@@ -365,7 +365,7 @@ ppi_cluster2: interrupt-partition-2 {
cmu_peric0: clock-controller@10800000 {
compatible = "google,gs101-cmu-peric0";
- reg = <0x10800000 0x4000>;
+ reg = <0x10800000 0x10000>;
#clock-cells = <1>;
clocks = <&ext_24_5m>,
<&cmu_top CLK_DOUT_CMU_PERIC0_BUS>,
@@ -911,7 +911,7 @@ spi_14: spi@10a20000 {
cmu_peric1: clock-controller@10c00000 {
compatible = "google,gs101-cmu-peric1";
- reg = <0x10c00000 0x4000>;
+ reg = <0x10c00000 0x10000>;
#clock-cells = <1>;
clocks = <&ext_24_5m>,
<&cmu_top CLK_DOUT_CMU_PERIC1_BUS>,
@@ -1265,7 +1265,7 @@ spi_13: spi@10d60000 {
cmu_hsi0: clock-controller@11000000 {
compatible = "google,gs101-cmu-hsi0";
- reg = <0x11000000 0x4000>;
+ reg = <0x11000000 0x10000>;
#clock-cells = <1>;
clocks = <&ext_24_5m>,
@@ -1332,7 +1332,7 @@ pinctrl_hsi1: pinctrl@11840000 {
cmu_hsi2: clock-controller@14400000 {
compatible = "google,gs101-cmu-hsi2";
- reg = <0x14400000 0x4000>;
+ reg = <0x14400000 0x10000>;
#clock-cells = <1>;
clocks = <&ext_24_5m>,
<&cmu_top CLK_DOUT_CMU_HSI2_BUS>,
@@ -1395,7 +1395,7 @@ ufs_0_phy: phy@14704000 {
cmu_apm: clock-controller@17400000 {
compatible = "google,gs101-cmu-apm";
- reg = <0x17400000 0x8000>;
+ reg = <0x17400000 0x10000>;
#clock-cells = <1>;
clocks = <&ext_24_5m>;
@@ -1497,7 +1497,7 @@ pinctrl_gsacore: pinctrl@17a80000 {
cmu_top: clock-controller@1e080000 {
compatible = "google,gs101-cmu-top";
- reg = <0x1e080000 0x8000>;
+ reg = <0x1e080000 0x10000>;
#clock-cells = <1>;
clocks = <&ext_24_5m>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 075/614] arm64: dts: exynos: gs101: fix sysreg_apm reg property
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 074/614] arm64: dts: exynos: gs101: fix clock module unit reg sizes Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 076/614] PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 Greg Kroah-Hartman
` (552 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Griffin, André Draszik,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <peter.griffin@linaro.org>
[ Upstream commit 4348c22a4f15dbef1314f1a353d7f053b24e9ace ]
Both the start address and size are incorrect for the apm_sysreg DT
node. Update to match the TRM (rather than how it was defined
downstream).
Fixes: ea89fdf24fd9 ("arm64: dts: exynos: google: Add initial Google gs101 SoC support")
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Reviewed-by: André Draszik <andre.draszik@linaro.org>
Link: https://patch.msgid.link/20251013-automatic-clocks-v1-5-72851ee00300@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/exynos/google/gs101.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/exynos/google/gs101.dtsi b/arch/arm64/boot/dts/exynos/google/gs101.dtsi
index 6335e0a8136be..c01ff4e1b0d5d 100644
--- a/arch/arm64/boot/dts/exynos/google/gs101.dtsi
+++ b/arch/arm64/boot/dts/exynos/google/gs101.dtsi
@@ -1402,9 +1402,9 @@ cmu_apm: clock-controller@17400000 {
clock-names = "oscclk";
};
- sysreg_apm: syscon@174204e0 {
+ sysreg_apm: syscon@17420000 {
compatible = "google,gs101-apm-sysreg", "syscon";
- reg = <0x174204e0 0x1000>;
+ reg = <0x17420000 0x10000>;
};
pmu_system_controller: system-controller@17460000 {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 076/614] PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 075/614] arm64: dts: exynos: gs101: fix sysreg_apm reg property Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 077/614] uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe Greg Kroah-Hartman
` (551 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Jarvinen, Geert Uytterhoeven,
Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit d312742f686582e6457070bcfd24bee8acfdf213 ]
Since the reliance on ARM-specific struct pci_sys_data was removed, this
driver can be compile-tested on other architectures.
While at it, make the help text a bit more generic, as some members of
the R-Car Gen2 family have a different number of internal PCI
controllers.
Fixes: 4a957563fe0231e0 ("PCI: rcar-gen2: Convert to use modern host bridge probe functions")
Suggested-by: Ilpo Jarvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: add rcar-gen2 to subject]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://patch.msgid.link/00f75d6732eacce93f04ffaeedc415d2db714cd6.1759480426.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/Kconfig | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/pci/controller/Kconfig b/drivers/pci/controller/Kconfig
index 41748d083b933..0452151a7bccc 100644
--- a/drivers/pci/controller/Kconfig
+++ b/drivers/pci/controller/Kconfig
@@ -259,12 +259,11 @@ config PCIE_RCAR_EP
config PCI_RCAR_GEN2
bool "Renesas R-Car Gen2 Internal PCI controller"
- depends on ARCH_RENESAS || COMPILE_TEST
- depends on ARM
+ depends on (ARCH_RENESAS && ARM) || COMPILE_TEST
help
Say Y here if you want internal PCI support on R-Car Gen2 SoC.
- There are 3 internal PCI controllers available with a single
- built-in EHCI/OHCI host controller present on each one.
+ Each internal PCI controller contains a single built-in EHCI/OHCI
+ host controller.
config PCIE_ROCKCHIP
bool
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 077/614] uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 076/614] PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 078/614] tty: serial: imx: Only configure the wake register when device is set as wakeup source Greg Kroah-Hartman
` (550 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Qiang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <liqiang01@kylinos.cn>
[ Upstream commit d48fb15e6ad142e0577428a8c5028136e10c7b3d ]
devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Fixes: d57801c45f53e ("uio: uio_fsl_elbc_gpcm: use device-managed allocators")
Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Link: https://patch.msgid.link/20251015064020.56589-1-liqiang01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/uio/uio_fsl_elbc_gpcm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/uio/uio_fsl_elbc_gpcm.c b/drivers/uio/uio_fsl_elbc_gpcm.c
index 81454c3e2484c..338dd2aaabc87 100644
--- a/drivers/uio/uio_fsl_elbc_gpcm.c
+++ b/drivers/uio/uio_fsl_elbc_gpcm.c
@@ -384,6 +384,11 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev)
/* set all UIO data */
info->mem[0].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%pOFn", node);
+ if (!info->mem[0].name) {
+ ret = -ENODEV;
+ goto out_err3;
+ }
+
info->mem[0].addr = res.start;
info->mem[0].size = resource_size(&res);
info->mem[0].memtype = UIO_MEM_PHYS;
@@ -423,6 +428,8 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev)
out_err2:
if (priv->shutdown)
priv->shutdown(info, true);
+
+out_err3:
iounmap(info->mem[0].internal_addr);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 078/614] tty: serial: imx: Only configure the wake register when device is set as wakeup source
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 077/614] uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 079/614] clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other Greg Kroah-Hartman
` (549 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sherry Sun, Frank Li, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <sherry.sun@nxp.com>
[ Upstream commit d55f3d2375ceeb08330d30f1e08196993c0b6583 ]
Currently, the i.MX UART driver enables wake-related registers for all
UART devices by default. However, this is unnecessary for devices that
are not configured as wakeup sources. To address this, add a
device_may_wakeup() check before configuring the UART wake-related
registers.
Fixes: db1a9b55004c ("tty: serial: imx: Allow UART to be a source for wakeup")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251002045259.2725461-2-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/imx.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 500dfc009d03e..90e2ea1e8afe5 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2697,8 +2697,22 @@ static void imx_uart_save_context(struct imx_port *sport)
/* called with irq off */
static void imx_uart_enable_wakeup(struct imx_port *sport, bool on)
{
+ struct tty_port *port = &sport->port.state->port;
+ struct device *tty_dev;
+ bool may_wake = false;
u32 ucr3;
+ scoped_guard(tty_port_tty, port) {
+ struct tty_struct *tty = scoped_tty();
+
+ tty_dev = tty->dev;
+ may_wake = tty_dev && device_may_wakeup(tty_dev);
+ }
+
+ /* only configure the wake register when device set as wakeup source */
+ if (!may_wake)
+ return;
+
uart_port_lock_irq(&sport->port);
ucr3 = imx_uart_readl(sport, UCR3);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 079/614] clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 078/614] tty: serial: imx: Only configure the wake register when device is set as wakeup source Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 080/614] clk: qcom: camcc-sm6350: " Greg Kroah-Hartman
` (548 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Imran Shaik,
Bryan ODonoghue, Vladimir Zapolskiy, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit d8f1121ebf4036884fc9ab1968f606523dd1c1fe ]
When a consumer turns on/off a power domain dependent on another power
domain in hardware, the parent power domain shall be turned on/off by
the power domain provider as well, and to get it the power domain hardware
hierarchy shall be described in the CAMCC driver.
Establish the power domain hierarchy with a Titan GDSC set as a parent of
all other GDSC power domains provided by the SM8550 camera clock controller
to enforce a correct sequence of enabling and disabling power domains by
the consumers, this fixes the CAMCC as a supplier of power domains to CAMSS
IP and its driver.
Fixes: ccc4e6a061a2 ("clk: qcom: camcc-sm8550: Add camera clock controller driver for SM8550")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Link: https://lore.kernel.org/r/20251021234450.2271279-2-vladimir.zapolskiy@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/camcc-sm8550.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/clk/qcom/camcc-sm8550.c b/drivers/clk/qcom/camcc-sm8550.c
index 63aed9e4c362d..b8ece8a57a8a9 100644
--- a/drivers/clk/qcom/camcc-sm8550.c
+++ b/drivers/clk/qcom/camcc-sm8550.c
@@ -3204,6 +3204,8 @@ static struct clk_branch cam_cc_sfe_1_fast_ahb_clk = {
},
};
+static struct gdsc cam_cc_titan_top_gdsc;
+
static struct gdsc cam_cc_bps_gdsc = {
.gdscr = 0x10004,
.en_rest_wait_val = 0x2,
@@ -3213,6 +3215,7 @@ static struct gdsc cam_cc_bps_gdsc = {
.name = "cam_cc_bps_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3225,6 +3228,7 @@ static struct gdsc cam_cc_ife_0_gdsc = {
.name = "cam_cc_ife_0_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3237,6 +3241,7 @@ static struct gdsc cam_cc_ife_1_gdsc = {
.name = "cam_cc_ife_1_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3249,6 +3254,7 @@ static struct gdsc cam_cc_ife_2_gdsc = {
.name = "cam_cc_ife_2_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3261,6 +3267,7 @@ static struct gdsc cam_cc_ipe_0_gdsc = {
.name = "cam_cc_ipe_0_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3273,6 +3280,7 @@ static struct gdsc cam_cc_sbi_gdsc = {
.name = "cam_cc_sbi_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3285,6 +3293,7 @@ static struct gdsc cam_cc_sfe_0_gdsc = {
.name = "cam_cc_sfe_0_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3297,6 +3306,7 @@ static struct gdsc cam_cc_sfe_1_gdsc = {
.name = "cam_cc_sfe_1_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &cam_cc_titan_top_gdsc.pd,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 080/614] clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 079/614] clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 081/614] clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615 Greg Kroah-Hartman
` (547 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Imran Shaik,
Bryan ODonoghue, Vladimir Zapolskiy, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
[ Upstream commit a76ce61d7225934b0a52c8172a8cd944002a8c6f ]
When a consumer turns on/off a power domain dependent on another power
domain in hardware, the parent power domain shall be turned on/off by
the power domain provider as well, and to get it the power domain hardware
hierarchy shall be described in the CAMCC driver.
Establish the power domain hierarchy with a Titan GDSC set as a parent of
all other GDSC power domains provided by the SM6350 camera clock controller
to enforce a correct sequence of enabling and disabling power domains by
the consumers, this fixes the CAMCC as a supplier of power domains to CAMSS
IP and its driver.
Fixes: 80f5451d9a7c ("clk: qcom: Add camera clock controller driver for SM6350")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Link: https://lore.kernel.org/r/20251021234450.2271279-3-vladimir.zapolskiy@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/camcc-sm6350.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/clk/qcom/camcc-sm6350.c b/drivers/clk/qcom/camcc-sm6350.c
index 8aac97d29ce3f..6c272f7b07219 100644
--- a/drivers/clk/qcom/camcc-sm6350.c
+++ b/drivers/clk/qcom/camcc-sm6350.c
@@ -1693,6 +1693,8 @@ static struct clk_branch camcc_sys_tmr_clk = {
},
};
+static struct gdsc titan_top_gdsc;
+
static struct gdsc bps_gdsc = {
.gdscr = 0x6004,
.en_rest_wait_val = 0x2,
@@ -1702,6 +1704,7 @@ static struct gdsc bps_gdsc = {
.name = "bps_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
.flags = VOTABLE,
};
@@ -1714,6 +1717,7 @@ static struct gdsc ipe_0_gdsc = {
.name = "ipe_0_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
.flags = VOTABLE,
};
@@ -1726,6 +1730,7 @@ static struct gdsc ife_0_gdsc = {
.name = "ife_0_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
};
static struct gdsc ife_1_gdsc = {
@@ -1737,6 +1742,7 @@ static struct gdsc ife_1_gdsc = {
.name = "ife_1_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
};
static struct gdsc ife_2_gdsc = {
@@ -1748,6 +1754,7 @@ static struct gdsc ife_2_gdsc = {
.name = "ife_2_gdsc",
},
.pwrsts = PWRSTS_OFF_ON,
+ .parent = &titan_top_gdsc.pd,
};
static struct gdsc titan_top_gdsc = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 081/614] clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 080/614] clk: qcom: camcc-sm6350: " Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 082/614] clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock Greg Kroah-Hartman
` (546 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 17e4db05930e455770b15b77708a07681ed24efc ]
This was previously (mis)represented in the interconnect driver, move
the resource under the clk-rpmh driver control, just like we did for
all platforms in the past, see e.g. Commit aa055bf158cd ("clk: qcom:
rpmh: define IPA clocks where required")
Fixes: 42a1905a10d6 ("clk: qcom: rpmhcc: Add support for QCS615 Clocks")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250627-topic-qcs615_icc_ipa-v1-4-dc47596cde69@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/clk-rpmh.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/clk-rpmh.c b/drivers/clk/qcom/clk-rpmh.c
index 63c38cb47bc45..1a98b3a0c528c 100644
--- a/drivers/clk/qcom/clk-rpmh.c
+++ b/drivers/clk/qcom/clk-rpmh.c
@@ -855,6 +855,7 @@ static struct clk_hw *qcs615_rpmh_clocks[] = {
[RPMH_RF_CLK1_A] = &clk_rpmh_rf_clk1_a_ao.hw,
[RPMH_RF_CLK2] = &clk_rpmh_rf_clk2_a.hw,
[RPMH_RF_CLK2_A] = &clk_rpmh_rf_clk2_a_ao.hw,
+ [RPMH_IPA_CLK] = &clk_rpmh_ipa.hw,
};
static const struct clk_rpmh_desc clk_rpmh_qcs615 = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 082/614] clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 081/614] clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615 Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 083/614] clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks Greg Kroah-Hartman
` (545 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taniya Das, Imran Shaik,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <taniya.das@oss.qualcomm.com>
[ Upstream commit 393f7834cd2b1eaf4a9eff2701e706e73e660dd7 ]
The SD card support requires a 37.5MHz clock; add it to the frequency
list for the storage SW driver to be able to request for the frequency.
Fixes: 3267c774f3ff ("clk: qcom: Add support for GCC on SM8750")
Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250924-sm8750_gcc_sdcc2_frequency-v1-1-541fd321125f@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-sm8750.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-sm8750.c b/drivers/clk/qcom/gcc-sm8750.c
index 8092dd6b37b56..def86b71a3da5 100644
--- a/drivers/clk/qcom/gcc-sm8750.c
+++ b/drivers/clk/qcom/gcc-sm8750.c
@@ -1012,6 +1012,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s7_clk_src = {
static const struct freq_tbl ftbl_gcc_sdcc2_apps_clk_src[] = {
F(400000, P_BI_TCXO, 12, 1, 4),
F(25000000, P_GCC_GPLL0_OUT_EVEN, 12, 0, 0),
+ F(37500000, P_GCC_GPLL0_OUT_EVEN, 8, 0, 0),
F(50000000, P_GCC_GPLL0_OUT_EVEN, 6, 0, 0),
F(100000000, P_GCC_GPLL0_OUT_EVEN, 3, 0, 0),
F(202000000, P_GCC_GPLL9_OUT_MAIN, 4, 0, 0),
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 083/614] clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 082/614] clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 084/614] clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Greg Kroah-Hartman
` (544 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Taniya Das,
Imran Shaik, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <taniya.das@oss.qualcomm.com>
[ Upstream commit 18da820eb632fbd99167f3fc6650a30db714ddfd ]
The pipe clocks for PCIE and USB are externally sourced and they should
not be polled by the clock driver. Update the halt_check flags to 'SKIP'
to disable polling for these clocks.
This helps avoid the clock status stuck at 'off' warnings, which are
benign, since all consumers of the PHYs must initialize a given instance
before performing any operations.
Fixes: efe504300a17 ("clk: qcom: gcc: Add support for Global Clock Controller")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250925-glymur_gcc_usb_fixes-v2-1-ee4619571efe@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-glymur.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/clk/qcom/gcc-glymur.c b/drivers/clk/qcom/gcc-glymur.c
index 62059120f9720..d938e7dc5b66e 100644
--- a/drivers/clk/qcom/gcc-glymur.c
+++ b/drivers/clk/qcom/gcc-glymur.c
@@ -6760,7 +6760,7 @@ static struct clk_branch gcc_usb3_prim_phy_com_aux_clk = {
static struct clk_branch gcc_usb3_prim_phy_pipe_clk = {
.halt_reg = 0x3f088,
- .halt_check = BRANCH_HALT_DELAY,
+ .halt_check = BRANCH_HALT_SKIP,
.hwcg_reg = 0x3f088,
.hwcg_bit = 1,
.clkr = {
@@ -6816,7 +6816,7 @@ static struct clk_branch gcc_usb3_sec_phy_com_aux_clk = {
static struct clk_branch gcc_usb3_sec_phy_pipe_clk = {
.halt_reg = 0xe2078,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.hwcg_reg = 0xe2078,
.hwcg_bit = 1,
.clkr = {
@@ -6872,7 +6872,7 @@ static struct clk_branch gcc_usb3_tert_phy_com_aux_clk = {
static struct clk_branch gcc_usb3_tert_phy_pipe_clk = {
.halt_reg = 0xe1078,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.hwcg_reg = 0xe1078,
.hwcg_bit = 1,
.clkr = {
@@ -6961,7 +6961,7 @@ static struct clk_branch gcc_usb4_0_master_clk = {
static struct clk_branch gcc_usb4_0_phy_p2rr2p_pipe_clk = {
.halt_reg = 0x2b0f4,
- .halt_check = BRANCH_HALT,
+ .halt_check = BRANCH_HALT_SKIP,
.clkr = {
.enable_reg = 0x2b0f4,
.enable_mask = BIT(0),
@@ -6979,7 +6979,7 @@ static struct clk_branch gcc_usb4_0_phy_p2rr2p_pipe_clk = {
static struct clk_branch gcc_usb4_0_phy_pcie_pipe_clk = {
.halt_reg = 0x2b04c,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.clkr = {
.enable_reg = 0x62010,
.enable_mask = BIT(11),
@@ -7033,7 +7033,7 @@ static struct clk_branch gcc_usb4_0_phy_rx1_clk = {
static struct clk_branch gcc_usb4_0_phy_usb_pipe_clk = {
.halt_reg = 0x2b0bc,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.hwcg_reg = 0x2b0bc,
.hwcg_bit = 1,
.clkr = {
@@ -7196,7 +7196,7 @@ static struct clk_branch gcc_usb4_1_master_clk = {
static struct clk_branch gcc_usb4_1_phy_p2rr2p_pipe_clk = {
.halt_reg = 0x2d118,
- .halt_check = BRANCH_HALT,
+ .halt_check = BRANCH_HALT_SKIP,
.clkr = {
.enable_reg = 0x2d118,
.enable_mask = BIT(0),
@@ -7214,7 +7214,7 @@ static struct clk_branch gcc_usb4_1_phy_p2rr2p_pipe_clk = {
static struct clk_branch gcc_usb4_1_phy_pcie_pipe_clk = {
.halt_reg = 0x2d04c,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.clkr = {
.enable_reg = 0x62010,
.enable_mask = BIT(12),
@@ -7268,7 +7268,7 @@ static struct clk_branch gcc_usb4_1_phy_rx1_clk = {
static struct clk_branch gcc_usb4_1_phy_usb_pipe_clk = {
.halt_reg = 0x2d0e0,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.hwcg_reg = 0x2d0e0,
.hwcg_bit = 1,
.clkr = {
@@ -7431,7 +7431,7 @@ static struct clk_branch gcc_usb4_2_master_clk = {
static struct clk_branch gcc_usb4_2_phy_p2rr2p_pipe_clk = {
.halt_reg = 0xe00f8,
- .halt_check = BRANCH_HALT,
+ .halt_check = BRANCH_HALT_SKIP,
.clkr = {
.enable_reg = 0xe00f8,
.enable_mask = BIT(0),
@@ -7449,7 +7449,7 @@ static struct clk_branch gcc_usb4_2_phy_p2rr2p_pipe_clk = {
static struct clk_branch gcc_usb4_2_phy_pcie_pipe_clk = {
.halt_reg = 0xe004c,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.clkr = {
.enable_reg = 0x62010,
.enable_mask = BIT(13),
@@ -7503,7 +7503,7 @@ static struct clk_branch gcc_usb4_2_phy_rx1_clk = {
static struct clk_branch gcc_usb4_2_phy_usb_pipe_clk = {
.halt_reg = 0xe00c0,
- .halt_check = BRANCH_HALT_VOTED,
+ .halt_check = BRANCH_HALT_SKIP,
.hwcg_reg = 0xe00c0,
.hwcg_bit = 1,
.clkr = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 084/614] clk: qcom: gcc-ipq5424: Correct the icc_first_node_id
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 083/614] clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 085/614] clk: qcom: camcc-sm6350: Fix PLL config of PLL2 Greg Kroah-Hartman
` (543 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Luo Jie,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Jie <quic_luoj@quicinc.com>
[ Upstream commit 464ce94531f5a62ce29081a9d3c70eb4d525f443 ]
Update to use the expected icc_first_node_id for registering the icc
clocks, ensuring correct association of clocks with interconnect nodes.
Fixes: 170f3d2c065e ("clk: qcom: ipq5424: Use icc-clk for enabling NoC related clocks")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Luo Jie <quic_luoj@quicinc.com>
Link: https://lore.kernel.org/r/20251014-qcom_ipq5424_nsscc-v7-1-081f4956be02@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-ipq5424.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/gcc-ipq5424.c b/drivers/clk/qcom/gcc-ipq5424.c
index 3d42f3d85c7a9..71afa1b86b723 100644
--- a/drivers/clk/qcom/gcc-ipq5424.c
+++ b/drivers/clk/qcom/gcc-ipq5424.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (c) 2018,2020 The Linux Foundation. All rights reserved.
- * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/clk-provider.h>
@@ -3284,6 +3284,7 @@ static const struct qcom_cc_desc gcc_ipq5424_desc = {
.num_clk_hws = ARRAY_SIZE(gcc_ipq5424_hws),
.icc_hws = icc_ipq5424_hws,
.num_icc_hws = ARRAY_SIZE(icc_ipq5424_hws),
+ .icc_first_node_id = IPQ_APPS_ID,
};
static int gcc_ipq5424_probe(struct platform_device *pdev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 085/614] clk: qcom: camcc-sm6350: Fix PLL config of PLL2
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 084/614] clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 086/614] clk: qcom: camcc-sm7150: " Greg Kroah-Hartman
` (542 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taniya Das, Luca Weiss, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
[ Upstream commit ab0e13141d679fdffdd3463a272c5c1b10be1794 ]
The 'Agera' PLLs (with clk_agera_pll_configure) do not take some of the
parameters that are provided in the vendor driver. Instead the upstream
configuration should provide the final user_ctl value that is written to
the USER_CTL register.
Fix the config so that the PLL is configured correctly, and fixes
CAMCC_MCLK* being stuck off.
Fixes: 80f5451d9a7c ("clk: qcom: Add camera clock controller driver for SM6350")
Suggested-by: Taniya Das <taniya.das@oss.qualcomm.com>
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251021-agera-pll-fixups-v1-1-8c1d8aff4afc@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/camcc-sm6350.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/clk/qcom/camcc-sm6350.c b/drivers/clk/qcom/camcc-sm6350.c
index 6c272f7b07219..7df12c1311c68 100644
--- a/drivers/clk/qcom/camcc-sm6350.c
+++ b/drivers/clk/qcom/camcc-sm6350.c
@@ -145,15 +145,11 @@ static struct clk_alpha_pll_postdiv camcc_pll1_out_even = {
static const struct alpha_pll_config camcc_pll2_config = {
.l = 0x64,
.alpha = 0x0,
- .post_div_val = 0x3 << 8,
- .post_div_mask = 0x3 << 8,
- .aux_output_mask = BIT(1),
- .main_output_mask = BIT(0),
- .early_output_mask = BIT(3),
.config_ctl_val = 0x20000800,
.config_ctl_hi_val = 0x400003d2,
.test_ctl_val = 0x04000400,
.test_ctl_hi_val = 0x00004000,
+ .user_ctl_val = 0x0000030b,
};
static struct clk_alpha_pll camcc_pll2 = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 086/614] clk: qcom: camcc-sm7150: Fix PLL config of PLL2
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 085/614] clk: qcom: camcc-sm6350: Fix PLL config of PLL2 Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 087/614] soc: qcom: gsbi: fix double disable caused by devm Greg Kroah-Hartman
` (541 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taniya Das, Luca Weiss, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
[ Upstream commit 415aad75c7e5cdb72e0672dc1159be1a99535ecd ]
The 'Agera' PLLs (with clk_agera_pll_configure) do not take some of the
parameters that are provided in the vendor driver. Instead the upstream
configuration should provide the final user_ctl value that is written to
the USER_CTL register.
Fix the config so that the PLL is configured correctly.
Fixes: 9f0532da4226 ("clk: qcom: Add Camera Clock Controller driver for SM7150")
Suggested-by: Taniya Das <taniya.das@oss.qualcomm.com>
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251021-agera-pll-fixups-v1-2-8c1d8aff4afc@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/camcc-sm7150.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/clk/qcom/camcc-sm7150.c b/drivers/clk/qcom/camcc-sm7150.c
index 4a3baf5d8e858..590548cac45bf 100644
--- a/drivers/clk/qcom/camcc-sm7150.c
+++ b/drivers/clk/qcom/camcc-sm7150.c
@@ -139,13 +139,9 @@ static struct clk_fixed_factor camcc_pll1_out_even = {
/* 1920MHz configuration */
static const struct alpha_pll_config camcc_pll2_config = {
.l = 0x64,
- .post_div_val = 0x3 << 8,
- .post_div_mask = 0x3 << 8,
- .early_output_mask = BIT(3),
- .aux_output_mask = BIT(1),
- .main_output_mask = BIT(0),
.config_ctl_hi_val = 0x400003d6,
.config_ctl_val = 0x20000954,
+ .user_ctl_val = 0x0000030b,
};
static struct clk_alpha_pll camcc_pll2 = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 087/614] soc: qcom: gsbi: fix double disable caused by devm
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 086/614] clk: qcom: camcc-sm7150: " Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 088/614] crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Greg Kroah-Hartman
` (540 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 2286e18e3937c69cc103308a8c1d4898d8a7b04f ]
In the commit referenced by the Fixes tag, devm_clk_get_enabled() was
introduced to replace devm_clk_get() and clk_prepare_enable(). While
the clk_disable_unprepare() call in the error path was correctly
removed, the one in the remove function was overlooked, leading to a
double disable issue.
Remove the redundant clk_disable_unprepare() call from gsbi_remove()
to fix this issue. Since all resources are now managed by devres
and will be automatically released, the remove function serves no purpose
and can be deleted entirely.
Fixes: 489d7a8cc286 ("soc: qcom: use devm_clk_get_enabled() in gsbi_probe()")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/stable/20251020160215.523-1-vulab%40iscas.ac.cn
Link: https://lore.kernel.org/r/20251020160215.523-1-vulab@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/qcom_gsbi.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c
index 8f1158e0c6313..a25d1de592f06 100644
--- a/drivers/soc/qcom/qcom_gsbi.c
+++ b/drivers/soc/qcom/qcom_gsbi.c
@@ -212,13 +212,6 @@ static int gsbi_probe(struct platform_device *pdev)
return of_platform_populate(node, NULL, NULL, &pdev->dev);
}
-static void gsbi_remove(struct platform_device *pdev)
-{
- struct gsbi_info *gsbi = platform_get_drvdata(pdev);
-
- clk_disable_unprepare(gsbi->hclk);
-}
-
static const struct of_device_id gsbi_dt_match[] = {
{ .compatible = "qcom,gsbi-v1.0.0", },
{ },
@@ -232,7 +225,6 @@ static struct platform_driver gsbi_driver = {
.of_match_table = gsbi_dt_match,
},
.probe = gsbi_probe,
- .remove = gsbi_remove,
};
module_platform_driver(gsbi_driver);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 088/614] crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 087/614] soc: qcom: gsbi: fix double disable caused by devm Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 089/614] crypto: hisilicon/qm - restore original qos values Greg Kroah-Hartman
` (539 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Lukas Wunner,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit df0845cf447ae1556c3440b8b155de0926cbaa56 ]
Use check_add_overflow() to guard against potential integer overflows
when adding the binary blob lengths and the size of an asymmetric_key_id
structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a
possible buffer overflow when copying data from potentially malicious
X.509 certificate fields that can be arbitrarily large, such as ASN.1
INTEGER serial numbers, issuer names, etc.
Fixes: 7901c1a8effb ("KEYS: Implement binary asymmetric key ID handling")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/asymmetric_keys/asymmetric_type.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
index ba2d9d1ea235a..348966ea2175c 100644
--- a/crypto/asymmetric_keys/asymmetric_type.c
+++ b/crypto/asymmetric_keys/asymmetric_type.c
@@ -11,6 +11,7 @@
#include <crypto/public_key.h>
#include <linux/seq_file.h>
#include <linux/module.h>
+#include <linux/overflow.h>
#include <linux/slab.h>
#include <linux/ctype.h>
#include <keys/system_keyring.h>
@@ -141,12 +142,17 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1,
size_t len_2)
{
struct asymmetric_key_id *kid;
-
- kid = kmalloc(sizeof(struct asymmetric_key_id) + len_1 + len_2,
- GFP_KERNEL);
+ size_t kid_sz;
+ size_t len;
+
+ if (check_add_overflow(len_1, len_2, &len))
+ return ERR_PTR(-EOVERFLOW);
+ if (check_add_overflow(sizeof(struct asymmetric_key_id), len, &kid_sz))
+ return ERR_PTR(-EOVERFLOW);
+ kid = kmalloc(kid_sz, GFP_KERNEL);
if (!kid)
return ERR_PTR(-ENOMEM);
- kid->len = len_1 + len_2;
+ kid->len = len;
memcpy(kid->data, val_1, len_1);
memcpy(kid->data + len_1, val_2, len_2);
return kid;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 089/614] crypto: hisilicon/qm - restore original qos values
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 088/614] crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 090/614] wifi: ath11k: fix VHT MCS assignment Greg Kroah-Hartman
` (538 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, nieweiqiang, Chenghai Huang,
Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: nieweiqiang <nieweiqiang@huawei.com>
[ Upstream commit e7066160f5b4187ad9869b712fa7a35d3d5be6b9 ]
When the new qos valus setting fails, restore to
the original qos values.
Fixes: 72b010dc33b9 ("crypto: hisilicon/qm - supports writing QoS int the host")
Signed-off-by: nieweiqiang <nieweiqiang@huawei.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/hisilicon/qm.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index 3b391a1466353..0968304c0cb51 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -3678,6 +3678,7 @@ static void qm_clear_vft_config(struct hisi_qm *qm)
static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)
{
struct device *dev = &qm->pdev->dev;
+ struct qm_shaper_factor t_factor;
u32 ir = qos * QM_QOS_RATE;
int ret, total_vfs, i;
@@ -3685,6 +3686,7 @@ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)
if (fun_index > total_vfs)
return -EINVAL;
+ memcpy(&t_factor, &qm->factor[fun_index], sizeof(t_factor));
qm->factor[fun_index].func_qos = qos;
ret = qm_get_shaper_para(ir, &qm->factor[fun_index]);
@@ -3698,11 +3700,21 @@ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)
ret = qm_set_vft_common(qm, SHAPER_VFT, fun_index, i, 1);
if (ret) {
dev_err(dev, "type: %d, failed to set shaper vft!\n", i);
- return -EINVAL;
+ goto back_func_qos;
}
}
return 0;
+
+back_func_qos:
+ memcpy(&qm->factor[fun_index], &t_factor, sizeof(t_factor));
+ for (i--; i >= ALG_TYPE_0; i--) {
+ ret = qm_set_vft_common(qm, SHAPER_VFT, fun_index, i, 1);
+ if (ret)
+ dev_err(dev, "failed to restore shaper vft during rollback!\n");
+ }
+
+ return -EINVAL;
}
static u32 qm_get_shaper_vft_qos(struct hisi_qm *qm, u32 fun_index)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 090/614] wifi: ath11k: fix VHT MCS assignment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 089/614] crypto: hisilicon/qm - restore original qos values Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 091/614] wifi: ath11k: fix peer HE " Greg Kroah-Hartman
` (537 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 47d0cd6bccb4604192633cc8d29511e85d811fc0 ]
While associating, firmware needs to know peer's receive capability to
calculate its own VHT transmit MCS, currently host sends this information
to firmware via mcs->rx_mcs_set field, this is wrong as firmware actually
takes it from mcs->tx_mcs_set field. Till now there is no failure seen
due to this, most likely because almost all peers are advertising the
same capability for both transmit and receive. Swap the assignment to
fix it.
Besides, rate control mask is meant to limit our own transmit MCS, hence
need to go via mcs->tx_mcs_set field. With the aforementioned swapping
done, change is needed as well to apply it to the peer's receive
capability rather than transmit capability.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-ath11k-mcs-assignment-v1-1-da40825c1783@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 ++--
drivers/net/wireless/ath/ath11k/wmi.c | 13 ++++++++-----
drivers/net/wireless/ath/ath11k/wmi.h | 2 ++
3 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 0e41b5a91d66d..49c639d73d58d 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -2235,9 +2235,9 @@ static void ath11k_peer_assoc_h_vht(struct ath11k *ar,
arg->peer_nss = min(sta->deflink.rx_nss, max_nss);
arg->rx_max_rate = __le16_to_cpu(vht_cap->vht_mcs.rx_highest);
arg->rx_mcs_set = __le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map);
+ arg->rx_mcs_set = ath11k_peer_assoc_h_vht_limit(arg->rx_mcs_set, vht_mcs_mask);
arg->tx_max_rate = __le16_to_cpu(vht_cap->vht_mcs.tx_highest);
- arg->tx_mcs_set = ath11k_peer_assoc_h_vht_limit(
- __le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map), vht_mcs_mask);
+ arg->tx_mcs_set = __le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
/* In IPQ8074 platform, VHT mcs rate 10 and 11 is enabled by default.
* VHT mcs rate 10 and 11 is not supported in 11ac standard.
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index e3b444333deed..649839d243293 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/skbuff.h>
#include <linux/ctype.h>
@@ -2061,10 +2061,13 @@ int ath11k_wmi_send_peer_assoc_cmd(struct ath11k *ar,
cmd->peer_bw_rxnss_override |= param->peer_bw_rxnss_override;
if (param->vht_capable) {
- mcs->rx_max_rate = param->rx_max_rate;
- mcs->rx_mcs_set = param->rx_mcs_set;
- mcs->tx_max_rate = param->tx_max_rate;
- mcs->tx_mcs_set = param->tx_mcs_set;
+ /* firmware interprets mcs->tx_mcs_set field as peer's
+ * RX capability
+ */
+ mcs->tx_max_rate = param->rx_max_rate;
+ mcs->tx_mcs_set = param->rx_mcs_set;
+ mcs->rx_max_rate = param->tx_max_rate;
+ mcs->rx_mcs_set = param->tx_mcs_set;
}
/* HE Rates */
diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
index 9fcffaa2f383c..6e9354297e71d 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.h
+++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -4133,8 +4133,10 @@ struct wmi_rate_set {
struct wmi_vht_rate_set {
u32 tlv_header;
u32 rx_max_rate;
+ /* MCS at which the peer can transmit */
u32 rx_mcs_set;
u32 tx_max_rate;
+ /* MCS at which the peer can receive */
u32 tx_mcs_set;
u32 tx_max_mcs_nss;
} __packed;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 091/614] wifi: ath11k: fix peer HE MCS assignment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 090/614] wifi: ath11k: fix VHT MCS assignment Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 092/614] s390/smp: Fix fallback CPU detection Greg Kroah-Hartman
` (536 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 4a013ca2d490c73c40588d62712ffaa432046a04 ]
In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to
firmware as receive MCS while peer's receive MCS sent as transmit MCS,
which goes against firmwire's definition.
While connecting to a misbehaved AP that advertises 0xffff (meaning not
supported) for 160 MHz transmit MCS map, firmware crashes due to 0xffff
is assigned to he_mcs->rx_mcs_set field.
Ext Tag: HE Capabilities
[...]
Supported HE-MCS and NSS Set
[...]
Rx and Tx MCS Maps 160 MHz
[...]
Tx HE-MCS Map 160 MHz: 0xffff
Swap the assignment to fix this issue.
As the HE rate control mask is meant to limit our own transmit MCS, it
needs to go via he_mcs->rx_mcs_set field. With the aforementioned swapping
done, change is needed as well to apply it to the peer's receive MCS.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: 61fe43e7216d ("ath11k: add support for setting fixed HE rate/gi/ltf")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-ath11k-mcs-assignment-v1-2-da40825c1783@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 ++--
drivers/net/wireless/ath/ath11k/wmi.c | 7 +++++--
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 49c639d73d58d..f142c17aa9aa7 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -2522,10 +2522,10 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar,
he_tx_mcs = v;
}
v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_160);
+ v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_160);
- v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
arg->peer_he_mcs_count++;
@@ -2535,10 +2535,10 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar,
default:
v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80);
+ v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
- v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
arg->peer_he_mcs_count++;
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 649839d243293..110035dae8a61 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -2091,8 +2091,11 @@ int ath11k_wmi_send_peer_assoc_cmd(struct ath11k *ar,
FIELD_PREP(WMI_TLV_LEN,
sizeof(*he_mcs) - TLV_HDR_SIZE);
- he_mcs->rx_mcs_set = param->peer_he_tx_mcs_set[i];
- he_mcs->tx_mcs_set = param->peer_he_rx_mcs_set[i];
+ /* firmware interprets mcs->rx_mcs_set field as peer's
+ * RX capability
+ */
+ he_mcs->rx_mcs_set = param->peer_he_rx_mcs_set[i];
+ he_mcs->tx_mcs_set = param->peer_he_tx_mcs_set[i];
ptr += sizeof(*he_mcs);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 092/614] s390/smp: Fix fallback CPU detection
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 091/614] wifi: ath11k: fix peer HE " Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 093/614] scsi: ufs: core: Move the ufshcd_enable_intr() declaration Greg Kroah-Hartman
` (535 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Egorenkov, Mete Durlu,
Heiko Carstens, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit 07a75d08cfa1b883a6e1256666e5f0617ee99231 ]
In case SCLP CPU detection does not work a fallback mechanism using SIGP is
in place. Since a cleanup this does not work correctly anymore: new CPUs
are only considered if their type matches the boot CPU.
Before the cleanup the information if a CPU type should be considered was
also part of a structure generated by the fallback mechanism and indicated
that a CPU type should not be considered when adding CPUs.
Since the rework a global SCLP state is used instead. If the global SCLP
state indicates that the CPU type should be considered and the fallback
mechanism is used, there may be a mismatch with CPU types if CPUs are
added. This can lead to a system with only a single CPU even tough there
are many more CPUs.
Address this by simply copying the boot cpu type into the generated data
structure from the fallback mechanism.
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Fixes: d08d94306e90 ("s390/smp: cleanup core vs. cpu in the SCLP interface")
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/smp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index da84c0dc6b7e0..70df4ca5d4436 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -697,6 +697,7 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early)
continue;
info->core[info->configured].core_id =
address >> smp_cpu_mt_shift;
+ info->core[info->configured].type = boot_core_type;
info->configured++;
}
info->combined = info->configured;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 093/614] scsi: ufs: core: Move the ufshcd_enable_intr() declaration
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 092/614] s390/smp: Fix fallback CPU detection Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 094/614] s390/ap: Dont leak debug feature files if AP instructions are not available Greg Kroah-Hartman
` (534 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Peter Wang,
Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit b30006b5bec1dcba207bc42e7f7cd96a568acc27 ]
ufshcd_enable_intr() is not exported and hence should not be declared in
include/ufs/ufshcd.h.
Fixes: 253757797973 ("scsi: ufs: core: Change MCQ interrupt enable flow")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Link: https://patch.msgid.link/20251014200118.3390839-7-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd-priv.h | 2 ++
include/ufs/ufshcd.h | 1 -
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h
index d0a2c963a27d3..1f0d38aa37f92 100644
--- a/drivers/ufs/core/ufshcd-priv.h
+++ b/drivers/ufs/core/ufshcd-priv.h
@@ -6,6 +6,8 @@
#include <linux/pm_runtime.h>
#include <ufs/ufshcd.h>
+void ufshcd_enable_intr(struct ufs_hba *hba, u32 intrs);
+
static inline bool ufshcd_is_user_access_allowed(struct ufs_hba *hba)
{
return !hba->shutting_down;
diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
index 0f95576bf1f6c..d949db3a46759 100644
--- a/include/ufs/ufshcd.h
+++ b/include/ufs/ufshcd.h
@@ -1302,7 +1302,6 @@ static inline void ufshcd_rmwl(struct ufs_hba *hba, u32 mask, u32 val, u32 reg)
void ufshcd_enable_irq(struct ufs_hba *hba);
void ufshcd_disable_irq(struct ufs_hba *hba);
-void ufshcd_enable_intr(struct ufs_hba *hba, u32 intrs);
int ufshcd_alloc_host(struct device *, struct ufs_hba **);
int ufshcd_hba_enable(struct ufs_hba *hba);
int ufshcd_init(struct ufs_hba *, void __iomem *, unsigned int);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 094/614] s390/ap: Dont leak debug feature files if AP instructions are not available
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 093/614] scsi: ufs: core: Move the ufshcd_enable_intr() declaration Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 095/614] tools/power turbostat: Regression fix Uncore MHz printed in hex Greg Kroah-Hartman
` (533 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harald Freudenberger, Heiko Carstens,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit 020d5dc57874e58d3ebae398f3fe258f029e3d06 ]
If no AP instructions are available the AP bus module leaks registered
debug feature files. Change function call order to fix this.
Fixes: cccd85bfb7bf ("s390/zcrypt: Rework debug feature invocations.")
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/ap_bus.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 65f1a127cc3f6..dfd5d0f61a70d 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -2484,15 +2484,15 @@ static int __init ap_module_init(void)
{
int rc;
- rc = ap_debug_init();
- if (rc)
- return rc;
-
if (!ap_instructions_available()) {
pr_warn("The hardware system does not support AP instructions\n");
return -ENODEV;
}
+ rc = ap_debug_init();
+ if (rc)
+ return rc;
+
/* init ap_queue hashtable */
hash_init(ap_queues);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 095/614] tools/power turbostat: Regression fix Uncore MHz printed in hex
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 094/614] s390/ap: Dont leak debug feature files if AP instructions are not available Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 096/614] wifi: ath12k: restore register window after global reset Greg Kroah-Hartman
` (532 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrej Tkalcec, Len Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <len.brown@intel.com>
[ Upstream commit 92664f2e6ab2228a3330734fc72dabeaf8a49ee1 ]
A patch to allow specifying FORMAT_AVERAGE to added counters...
broke the internally added counter for Cluster Uncore MHz -- printing it in HEX.
Fixes: dcd1c379b0f1 ("tools/power turbostat: add format "average" for external attributes")
Reported-by: Andrej Tkalcec <andrej.tkalcec@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/x86/turbostat/turbostat.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index f2512d78bcbd8..1b5ca2f4e92ff 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -3285,13 +3285,13 @@ int format_counters(PER_THREAD_PARAMS)
/* Added counters */
for (i = 0, mp = sys.tp; mp; i++, mp = mp->next) {
- if (mp->format == FORMAT_RAW || mp->format == FORMAT_AVERAGE) {
+ if (mp->format == FORMAT_RAW) {
if (mp->width == 32)
outp +=
sprintf(outp, "%s0x%08x", (printed++ ? delim : ""), (unsigned int)t->counter[i]);
else
outp += sprintf(outp, "%s0x%016llx", (printed++ ? delim : ""), t->counter[i]);
- } else if (mp->format == FORMAT_DELTA) {
+ } else if (mp->format == FORMAT_DELTA || mp->format == FORMAT_AVERAGE) {
if ((mp->type == COUNTER_ITEMS) && sums_need_wide_columns)
outp += sprintf(outp, "%s%8lld", (printed++ ? delim : ""), t->counter[i]);
else
@@ -3382,13 +3382,13 @@ int format_counters(PER_THREAD_PARAMS)
outp += sprintf(outp, "%s%lld", (printed++ ? delim : ""), c->core_throt_cnt);
for (i = 0, mp = sys.cp; mp; i++, mp = mp->next) {
- if (mp->format == FORMAT_RAW || mp->format == FORMAT_AVERAGE) {
+ if (mp->format == FORMAT_RAW) {
if (mp->width == 32)
outp +=
sprintf(outp, "%s0x%08x", (printed++ ? delim : ""), (unsigned int)c->counter[i]);
else
outp += sprintf(outp, "%s0x%016llx", (printed++ ? delim : ""), c->counter[i]);
- } else if (mp->format == FORMAT_DELTA) {
+ } else if (mp->format == FORMAT_DELTA || mp->format == FORMAT_AVERAGE) {
if ((mp->type == COUNTER_ITEMS) && sums_need_wide_columns)
outp += sprintf(outp, "%s%8lld", (printed++ ? delim : ""), c->counter[i]);
else
@@ -3581,7 +3581,7 @@ int format_counters(PER_THREAD_PARAMS)
outp += sprintf(outp, "%s%d", (printed++ ? delim : ""), p->uncore_mhz);
for (i = 0, mp = sys.pp; mp; i++, mp = mp->next) {
- if (mp->format == FORMAT_RAW || mp->format == FORMAT_AVERAGE) {
+ if (mp->format == FORMAT_RAW) {
if (mp->width == 32)
outp +=
sprintf(outp, "%s0x%08x", (printed++ ? delim : ""), (unsigned int)p->counter[i]);
@@ -3758,7 +3758,7 @@ int delta_package(struct pkg_data *new, struct pkg_data *old)
new->rapl_dram_perf_status.raw_value - old->rapl_dram_perf_status.raw_value;
for (i = 0, mp = sys.pp; mp; i++, mp = mp->next) {
- if (mp->format == FORMAT_RAW || mp->format == FORMAT_AVERAGE)
+ if (mp->format == FORMAT_RAW)
old->counter[i] = new->counter[i];
else if (mp->format == FORMAT_AVERAGE)
old->counter[i] = new->counter[i];
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 096/614] wifi: ath12k: restore register window after global reset
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 095/614] tools/power turbostat: Regression fix Uncore MHz printed in hex Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 097/614] accel/amdxdna: Fix uninitialized return value Greg Kroah-Hartman
` (531 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit a41281f6518e485220d180a6031d302a736fc463 ]
Hardware target implements an address space larger than that PCI BAR can
map. In order to be able to access the whole target address space, the
BAR space is split into 4 segments, of which the last 3, called windows,
can be dynamically mapped to the desired area. This is achieved by
updating WINDOW_REG_ADDRESS register with appropriate window value.
Currently each time when accessing a register that beyond WINDOW_START,
host calculates the window value and caches it after window update,
this way next time when accessing a register falling in the same window,
host knows that the window is already good hence no additional update
needed.
However this mechanism breaks after global reset is triggered in
ath12k_pci_soc_global_reset(), because with global reset hardware resets
WINDOW_REG_ADDRESS register hence the window is not properly mapped any
more. Current host does nothing about this, as a result a subsequent
register access may not work as expected if it falls in a window same as
before.
Although there is no obvious issue seen now, better to fix it to avoid
future problem. The fix is done by restoring the window register after
global reset.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-ath12k-reset-window-cache-v1-1-29e0e751deed@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/pci.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c
index c729d5526c753..60b8f7361b7f6 100644
--- a/drivers/net/wireless/ath/ath12k/pci.c
+++ b/drivers/net/wireless/ath/ath12k/pci.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2019-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/module.h>
@@ -218,6 +218,19 @@ static inline bool ath12k_pci_is_offset_within_mhi_region(u32 offset)
return (offset >= PCI_MHIREGLEN_REG && offset <= PCI_MHI_REGION_END);
}
+static void ath12k_pci_restore_window(struct ath12k_base *ab)
+{
+ struct ath12k_pci *ab_pci = ath12k_pci_priv(ab);
+
+ spin_lock_bh(&ab_pci->window_lock);
+
+ iowrite32(WINDOW_ENABLE_BIT | ab_pci->register_window,
+ ab->mem + WINDOW_REG_ADDRESS);
+ ioread32(ab->mem + WINDOW_REG_ADDRESS);
+
+ spin_unlock_bh(&ab_pci->window_lock);
+}
+
static void ath12k_pci_soc_global_reset(struct ath12k_base *ab)
{
u32 val, delay;
@@ -242,6 +255,11 @@ static void ath12k_pci_soc_global_reset(struct ath12k_base *ab)
val = ath12k_pci_read32(ab, PCIE_SOC_GLOBAL_RESET);
if (val == 0xffffffff)
ath12k_warn(ab, "link down error during global reset\n");
+
+ /* Restore window register as its content is cleared during
+ * hardware global reset, such that it aligns with host cache.
+ */
+ ath12k_pci_restore_window(ab);
}
static void ath12k_pci_clear_dbg_registers(struct ath12k_base *ab)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 097/614] accel/amdxdna: Fix uninitialized return value
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 096/614] wifi: ath12k: restore register window after global reset Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 098/614] ice: move service task start out of ice_init_pf() Greg Kroah-Hartman
` (530 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD), Lizhi Hou,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit 81233d5419cf20e4f5ef505882951616888a2ef9 ]
In aie2_get_hwctx_status() and aie2_query_ctx_status_array(), the
functions could return an uninitialized value in some cases. Update them
to always return 0. The amount of valid results is indicated by the
returned buffer_size, element_size, and num_element fields.
Fixes: 2f509fe6a42c ("accel/amdxdna: Add ioctl DRM_IOCTL_AMDXDNA_GET_ARRAY")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251024165503.1548131-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/aie2_pci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
index 6e39c769bb6d8..43f725e1a2d76 100644
--- a/drivers/accel/amdxdna/aie2_pci.c
+++ b/drivers/accel/amdxdna/aie2_pci.c
@@ -845,7 +845,7 @@ static int aie2_get_hwctx_status(struct amdxdna_client *client,
}
args->buffer_size -= (u32)(array_args.buffer - args->buffer);
- return ret;
+ return 0;
}
static int aie2_get_info(struct amdxdna_client *client, struct amdxdna_drm_get_info *args)
@@ -920,7 +920,7 @@ static int aie2_query_ctx_status_array(struct amdxdna_client *client,
args->num_element = (u32)((array_args.buffer - args->buffer) /
args->element_size);
- return ret;
+ return 0;
}
static int aie2_get_array(struct amdxdna_client *client,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 098/614] ice: move service task start out of ice_init_pf()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 097/614] accel/amdxdna: Fix uninitialized return value Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 099/614] ice: move ice_init_interrupt_scheme() prior ice_init_pf() Greg Kroah-Hartman
` (529 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Tony Nguyen,
Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit 806c4f32a80627f8977fda53520afc41491d162f ]
Move service task start out of ice_init_pf(). Do analogous with deinit.
Service task is needed up to the very end of driver removal, later commit
of the series will move it later on execution timeline.
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice.h | 1 +
drivers/net/ethernet/intel/ice/ice_main.c | 18 +++++++++++-------
2 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 22b8323ff0d0e..0e58a58c23eb3 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -1029,6 +1029,7 @@ int ice_open(struct net_device *netdev);
int ice_open_internal(struct net_device *netdev);
int ice_stop(struct net_device *netdev);
void ice_service_task_schedule(struct ice_pf *pf);
+void ice_start_service_task(struct ice_pf *pf);
int ice_load(struct ice_pf *pf);
void ice_unload(struct ice_pf *pf);
void ice_adv_lnk_speed_maps_init(void);
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 86f5859e88ef5..41c2f0d52ce0d 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3951,7 +3951,6 @@ u16 ice_get_avail_rxq_count(struct ice_pf *pf)
*/
static void ice_deinit_pf(struct ice_pf *pf)
{
- ice_service_task_stop(pf);
mutex_destroy(&pf->lag_mutex);
mutex_destroy(&pf->adev_mutex);
mutex_destroy(&pf->sw_mutex);
@@ -4030,6 +4029,14 @@ static void ice_set_pf_caps(struct ice_pf *pf)
pf->max_pf_rxqs = func_caps->common_cap.num_rxq;
}
+void ice_start_service_task(struct ice_pf *pf)
+{
+ timer_setup(&pf->serv_tmr, ice_service_timer, 0);
+ pf->serv_tmr_period = HZ;
+ INIT_WORK(&pf->serv_task, ice_service_task);
+ clear_bit(ICE_SERVICE_SCHED, pf->state);
+}
+
/**
* ice_init_pf - Initialize general software structures (struct ice_pf)
* @pf: board private structure to initialize
@@ -4049,12 +4056,6 @@ static int ice_init_pf(struct ice_pf *pf)
init_waitqueue_head(&pf->reset_wait_queue);
- /* setup service timer and periodic service task */
- timer_setup(&pf->serv_tmr, ice_service_timer, 0);
- pf->serv_tmr_period = HZ;
- INIT_WORK(&pf->serv_task, ice_service_task);
- clear_bit(ICE_SERVICE_SCHED, pf->state);
-
mutex_init(&pf->avail_q_mutex);
pf->avail_txqs = bitmap_zalloc(pf->max_pf_txqs, GFP_KERNEL);
if (!pf->avail_txqs)
@@ -4745,6 +4746,7 @@ int ice_init_dev(struct ice_pf *pf)
ice_set_safe_mode_caps(hw);
}
+ ice_start_service_task(pf);
err = ice_init_pf(pf);
if (err) {
dev_err(dev, "ice_init_pf failed: %d\n", err);
@@ -4791,6 +4793,7 @@ int ice_init_dev(struct ice_pf *pf)
ice_clear_interrupt_scheme(pf);
unroll_pf_init:
ice_deinit_pf(pf);
+ ice_service_task_stop(pf);
return err;
}
@@ -4799,6 +4802,7 @@ void ice_deinit_dev(struct ice_pf *pf)
ice_free_irq_msix_misc(pf);
ice_deinit_pf(pf);
ice_deinit_hw(&pf->hw);
+ ice_service_task_stop(pf);
/* Service task is already stopped, so call reset directly. */
ice_reset(&pf->hw, ICE_RESET_PFR);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 099/614] ice: move ice_init_interrupt_scheme() prior ice_init_pf()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 098/614] ice: move service task start out of ice_init_pf() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 100/614] ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure Greg Kroah-Hartman
` (528 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Aleksandr Loktionov,
Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit 2fe18288fce6b421f1dc585bcb9dd3afa32d3ad9 ]
Move ice_init_interrupt_scheme() prior ice_init_pf().
To enable the move ice_set_pf_caps() was moved out from ice_init_pf()
to the caller (ice_init_dev()), and placed prior to the irq scheme init.
The move makes deinit order of ice_deinit_dev() and failure-path of
ice_init_pf() match (at least in terms of not calling
ice_clear_interrupt_scheme() and ice_deinit_pf() in opposite ways).
The new order aligns with findings made by Jakub Buchocki in
the commit 24b454bc354a ("ice: Fix ice module unload").
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 25 ++++++++++-------------
1 file changed, 11 insertions(+), 14 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 41c2f0d52ce0d..13db83fb383e6 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -4043,8 +4043,6 @@ void ice_start_service_task(struct ice_pf *pf)
*/
static int ice_init_pf(struct ice_pf *pf)
{
- ice_set_pf_caps(pf);
-
mutex_init(&pf->sw_mutex);
mutex_init(&pf->tc_mutex);
mutex_init(&pf->adev_mutex);
@@ -4746,11 +4744,18 @@ int ice_init_dev(struct ice_pf *pf)
ice_set_safe_mode_caps(hw);
}
+ ice_set_pf_caps(pf);
+ err = ice_init_interrupt_scheme(pf);
+ if (err) {
+ dev_err(dev, "ice_init_interrupt_scheme failed: %d\n", err);
+ return -EIO;
+ }
+
ice_start_service_task(pf);
err = ice_init_pf(pf);
if (err) {
dev_err(dev, "ice_init_pf failed: %d\n", err);
- return err;
+ goto unroll_irq_scheme_init;
}
pf->hw.udp_tunnel_nic.set_port = ice_udp_tunnel_set_port;
@@ -4768,14 +4773,6 @@ int ice_init_dev(struct ice_pf *pf)
pf->hw.udp_tunnel_nic.tables[1].tunnel_types =
UDP_TUNNEL_TYPE_GENEVE;
}
-
- err = ice_init_interrupt_scheme(pf);
- if (err) {
- dev_err(dev, "ice_init_interrupt_scheme failed: %d\n", err);
- err = -EIO;
- goto unroll_pf_init;
- }
-
/* In case of MSIX we are going to setup the misc vector right here
* to handle admin queue events etc. In case of legacy and MSI
* the misc functionality and queue processing is combined in
@@ -4784,16 +4781,16 @@ int ice_init_dev(struct ice_pf *pf)
err = ice_req_irq_msix_misc(pf);
if (err) {
dev_err(dev, "setup of misc vector failed: %d\n", err);
- goto unroll_irq_scheme_init;
+ goto unroll_pf_init;
}
return 0;
-unroll_irq_scheme_init:
- ice_clear_interrupt_scheme(pf);
unroll_pf_init:
ice_deinit_pf(pf);
+unroll_irq_scheme_init:
ice_service_task_stop(pf);
+ ice_clear_interrupt_scheme(pf);
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 100/614] ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 099/614] ice: move ice_init_interrupt_scheme() prior ice_init_pf() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 101/614] ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf() Greg Kroah-Hartman
` (527 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Aleksandr Loktionov,
Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit 71430451f81bd6550e46d89b69103a111fc42982 ]
Unroll actions of ice_init_pf() when it fails.
ice_deinit_pf() happens to be perfect to call here.
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 31 +++++++++--------------
1 file changed, 12 insertions(+), 19 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 13db83fb383e6..80349aed1f9d6 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3951,6 +3951,8 @@ u16 ice_get_avail_rxq_count(struct ice_pf *pf)
*/
static void ice_deinit_pf(struct ice_pf *pf)
{
+ /* note that we unroll also on ice_init_pf() failure here */
+
mutex_destroy(&pf->lag_mutex);
mutex_destroy(&pf->adev_mutex);
mutex_destroy(&pf->sw_mutex);
@@ -4055,25 +4057,6 @@ static int ice_init_pf(struct ice_pf *pf)
init_waitqueue_head(&pf->reset_wait_queue);
mutex_init(&pf->avail_q_mutex);
- pf->avail_txqs = bitmap_zalloc(pf->max_pf_txqs, GFP_KERNEL);
- if (!pf->avail_txqs)
- return -ENOMEM;
-
- pf->avail_rxqs = bitmap_zalloc(pf->max_pf_rxqs, GFP_KERNEL);
- if (!pf->avail_rxqs) {
- bitmap_free(pf->avail_txqs);
- pf->avail_txqs = NULL;
- return -ENOMEM;
- }
-
- pf->txtime_txqs = bitmap_zalloc(pf->max_pf_txqs, GFP_KERNEL);
- if (!pf->txtime_txqs) {
- bitmap_free(pf->avail_txqs);
- pf->avail_txqs = NULL;
- bitmap_free(pf->avail_rxqs);
- pf->avail_rxqs = NULL;
- return -ENOMEM;
- }
mutex_init(&pf->vfs.table_lock);
hash_init(pf->vfs.table);
@@ -4086,7 +4069,17 @@ static int ice_init_pf(struct ice_pf *pf)
xa_init(&pf->dyn_ports);
xa_init(&pf->sf_nums);
+ pf->avail_txqs = bitmap_zalloc(pf->max_pf_txqs, GFP_KERNEL);
+ pf->avail_rxqs = bitmap_zalloc(pf->max_pf_rxqs, GFP_KERNEL);
+ pf->txtime_txqs = bitmap_zalloc(pf->max_pf_txqs, GFP_KERNEL);
+ if (!pf->avail_txqs || !pf->avail_rxqs || !pf->txtime_txqs)
+ goto undo_init;
+
return 0;
+undo_init:
+ /* deinit handles half-initialized pf just fine */
+ ice_deinit_pf(pf);
+ return -ENOMEM;
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 101/614] ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 100/614] ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 102/614] ice: move ice_init_pf() out of ice_init_dev() Greg Kroah-Hartman
` (526 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Aleksandr Loktionov,
Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit e3bf1cdde7471bab7fc20dd1a37c2cdb82d3f76b ]
Move udp_tunnel_nic setup and ice_req_irq_msix_misc() call into
ice_init_pf(), remove some redundancy in the former while moving.
Move ice_free_irq_msix_misc() call into ice_deinit_pf(), to mimic
the above in terms of needed cleanup. Guard it via emptiness check,
to keep the allowance of half-initialized pf being cleaned up.
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 58 +++++++++++------------
1 file changed, 28 insertions(+), 30 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 80349aed1f9d6..6773b918daffc 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3978,6 +3978,9 @@ static void ice_deinit_pf(struct ice_pf *pf)
if (pf->ptp.clock)
ptp_clock_unregister(pf->ptp.clock);
+ if (!xa_empty(&pf->irq_tracker.entries))
+ ice_free_irq_msix_misc(pf);
+
xa_destroy(&pf->dyn_ports);
xa_destroy(&pf->sf_nums);
}
@@ -4045,6 +4048,11 @@ void ice_start_service_task(struct ice_pf *pf)
*/
static int ice_init_pf(struct ice_pf *pf)
{
+ struct udp_tunnel_nic_info *udp_tunnel_nic = &pf->hw.udp_tunnel_nic;
+ struct device *dev = ice_pf_to_dev(pf);
+ struct ice_hw *hw = &pf->hw;
+ int err = -ENOMEM;
+
mutex_init(&pf->sw_mutex);
mutex_init(&pf->tc_mutex);
mutex_init(&pf->adev_mutex);
@@ -4075,11 +4083,30 @@ static int ice_init_pf(struct ice_pf *pf)
if (!pf->avail_txqs || !pf->avail_rxqs || !pf->txtime_txqs)
goto undo_init;
+ udp_tunnel_nic->set_port = ice_udp_tunnel_set_port;
+ udp_tunnel_nic->unset_port = ice_udp_tunnel_unset_port;
+ udp_tunnel_nic->shared = &hw->udp_tunnel_shared;
+ udp_tunnel_nic->tables[0].n_entries = hw->tnl.valid_count[TNL_VXLAN];
+ udp_tunnel_nic->tables[0].tunnel_types = UDP_TUNNEL_TYPE_VXLAN;
+ udp_tunnel_nic->tables[1].n_entries = hw->tnl.valid_count[TNL_GENEVE];
+ udp_tunnel_nic->tables[1].tunnel_types = UDP_TUNNEL_TYPE_GENEVE;
+
+ /* In case of MSIX we are going to setup the misc vector right here
+ * to handle admin queue events etc. In case of legacy and MSI
+ * the misc functionality and queue processing is combined in
+ * the same vector and that gets setup at open.
+ */
+ err = ice_req_irq_msix_misc(pf);
+ if (err) {
+ dev_err(dev, "setup of misc vector failed: %d\n", err);
+ goto undo_init;
+ }
+
return 0;
undo_init:
/* deinit handles half-initialized pf just fine */
ice_deinit_pf(pf);
- return -ENOMEM;
+ return err;
}
/**
@@ -4751,36 +4778,8 @@ int ice_init_dev(struct ice_pf *pf)
goto unroll_irq_scheme_init;
}
- pf->hw.udp_tunnel_nic.set_port = ice_udp_tunnel_set_port;
- pf->hw.udp_tunnel_nic.unset_port = ice_udp_tunnel_unset_port;
- pf->hw.udp_tunnel_nic.shared = &pf->hw.udp_tunnel_shared;
- if (pf->hw.tnl.valid_count[TNL_VXLAN]) {
- pf->hw.udp_tunnel_nic.tables[0].n_entries =
- pf->hw.tnl.valid_count[TNL_VXLAN];
- pf->hw.udp_tunnel_nic.tables[0].tunnel_types =
- UDP_TUNNEL_TYPE_VXLAN;
- }
- if (pf->hw.tnl.valid_count[TNL_GENEVE]) {
- pf->hw.udp_tunnel_nic.tables[1].n_entries =
- pf->hw.tnl.valid_count[TNL_GENEVE];
- pf->hw.udp_tunnel_nic.tables[1].tunnel_types =
- UDP_TUNNEL_TYPE_GENEVE;
- }
- /* In case of MSIX we are going to setup the misc vector right here
- * to handle admin queue events etc. In case of legacy and MSI
- * the misc functionality and queue processing is combined in
- * the same vector and that gets setup at open.
- */
- err = ice_req_irq_msix_misc(pf);
- if (err) {
- dev_err(dev, "setup of misc vector failed: %d\n", err);
- goto unroll_pf_init;
- }
-
return 0;
-unroll_pf_init:
- ice_deinit_pf(pf);
unroll_irq_scheme_init:
ice_service_task_stop(pf);
ice_clear_interrupt_scheme(pf);
@@ -4789,7 +4788,6 @@ int ice_init_dev(struct ice_pf *pf)
void ice_deinit_dev(struct ice_pf *pf)
{
- ice_free_irq_msix_misc(pf);
ice_deinit_pf(pf);
ice_deinit_hw(&pf->hw);
ice_service_task_stop(pf);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 102/614] ice: move ice_init_pf() out of ice_init_dev()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 101/614] ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 103/614] ice: extract ice_init_dev() from ice_init() Greg Kroah-Hartman
` (525 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Aleksandr Loktionov,
Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit ef825bdb4605742c4efc03f67d930e80c42f33cb ]
Move ice_init_pf() out of ice_init_dev().
Do the same for deinit counterpart.
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/intel/ice/devlink/devlink.c | 16 ++++++++--
drivers/net/ethernet/intel/ice/ice.h | 2 ++
drivers/net/ethernet/intel/ice/ice_main.c | 32 +++++++++----------
3 files changed, 31 insertions(+), 19 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/devlink/devlink.c b/drivers/net/ethernet/intel/ice/devlink/devlink.c
index fb2de521731ae..c354a03c950cd 100644
--- a/drivers/net/ethernet/intel/ice/devlink/devlink.c
+++ b/drivers/net/ethernet/intel/ice/devlink/devlink.c
@@ -459,6 +459,7 @@ static void ice_devlink_reinit_down(struct ice_pf *pf)
rtnl_lock();
ice_vsi_decfg(ice_get_main_vsi(pf));
rtnl_unlock();
+ ice_deinit_pf(pf);
ice_deinit_dev(pf);
}
@@ -1231,11 +1232,12 @@ static void ice_set_min_max_msix(struct ice_pf *pf)
static int ice_devlink_reinit_up(struct ice_pf *pf)
{
struct ice_vsi *vsi = ice_get_main_vsi(pf);
+ struct device *dev = ice_pf_to_dev(pf);
int err;
err = ice_init_hw(&pf->hw);
if (err) {
- dev_err(ice_pf_to_dev(pf), "ice_init_hw failed: %d\n", err);
+ dev_err(dev, "ice_init_hw failed: %d\n", err);
return err;
}
@@ -1246,13 +1248,19 @@ static int ice_devlink_reinit_up(struct ice_pf *pf)
if (err)
goto unroll_hw_init;
+ err = ice_init_pf(pf);
+ if (err) {
+ dev_err(dev, "ice_init_pf failed: %d\n", err);
+ goto unroll_dev_init;
+ }
+
vsi->flags = ICE_VSI_FLAG_INIT;
rtnl_lock();
err = ice_vsi_cfg(vsi);
rtnl_unlock();
if (err)
- goto err_vsi_cfg;
+ goto unroll_pf_init;
/* No need to take devl_lock, it's already taken by devlink API */
err = ice_load(pf);
@@ -1265,7 +1273,9 @@ static int ice_devlink_reinit_up(struct ice_pf *pf)
rtnl_lock();
ice_vsi_decfg(vsi);
rtnl_unlock();
-err_vsi_cfg:
+unroll_pf_init:
+ ice_deinit_pf(pf);
+unroll_dev_init:
ice_deinit_dev(pf);
unroll_hw_init:
ice_deinit_hw(&pf->hw);
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 0e58a58c23eb3..9a1abd4573372 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -1035,6 +1035,8 @@ void ice_unload(struct ice_pf *pf);
void ice_adv_lnk_speed_maps_init(void);
int ice_init_dev(struct ice_pf *pf);
void ice_deinit_dev(struct ice_pf *pf);
+int ice_init_pf(struct ice_pf *pf);
+void ice_deinit_pf(struct ice_pf *pf);
int ice_change_mtu(struct net_device *netdev, int new_mtu);
void ice_tx_timeout(struct net_device *netdev, unsigned int txqueue);
int ice_xdp(struct net_device *dev, struct netdev_bpf *xdp);
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 6773b918daffc..6b3d941f419b3 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -3949,7 +3949,7 @@ u16 ice_get_avail_rxq_count(struct ice_pf *pf)
* ice_deinit_pf - Unrolls initialziations done by ice_init_pf
* @pf: board private structure to initialize
*/
-static void ice_deinit_pf(struct ice_pf *pf)
+void ice_deinit_pf(struct ice_pf *pf)
{
/* note that we unroll also on ice_init_pf() failure here */
@@ -4045,8 +4045,9 @@ void ice_start_service_task(struct ice_pf *pf)
/**
* ice_init_pf - Initialize general software structures (struct ice_pf)
* @pf: board private structure to initialize
+ * Return: 0 on success, negative errno otherwise.
*/
-static int ice_init_pf(struct ice_pf *pf)
+int ice_init_pf(struct ice_pf *pf)
{
struct udp_tunnel_nic_info *udp_tunnel_nic = &pf->hw.udp_tunnel_nic;
struct device *dev = ice_pf_to_dev(pf);
@@ -4772,23 +4773,12 @@ int ice_init_dev(struct ice_pf *pf)
}
ice_start_service_task(pf);
- err = ice_init_pf(pf);
- if (err) {
- dev_err(dev, "ice_init_pf failed: %d\n", err);
- goto unroll_irq_scheme_init;
- }
return 0;
-
-unroll_irq_scheme_init:
- ice_service_task_stop(pf);
- ice_clear_interrupt_scheme(pf);
- return err;
}
void ice_deinit_dev(struct ice_pf *pf)
{
- ice_deinit_pf(pf);
ice_deinit_hw(&pf->hw);
ice_service_task_stop(pf);
@@ -5030,21 +5020,28 @@ static void ice_deinit_devlink(struct ice_pf *pf)
static int ice_init(struct ice_pf *pf)
{
+ struct device *dev = ice_pf_to_dev(pf);
int err;
err = ice_init_dev(pf);
if (err)
return err;
+ err = ice_init_pf(pf);
+ if (err) {
+ dev_err(dev, "ice_init_pf failed: %d\n", err);
+ goto unroll_dev_init;
+ }
+
if (pf->hw.mac_type == ICE_MAC_E830) {
err = pci_enable_ptm(pf->pdev, NULL);
if (err)
- dev_dbg(ice_pf_to_dev(pf), "PCIe PTM not supported by PCIe bus/controller\n");
+ dev_dbg(dev, "PCIe PTM not supported by PCIe bus/controller\n");
}
err = ice_alloc_vsis(pf);
if (err)
- goto err_alloc_vsis;
+ goto unroll_pf_init;
err = ice_init_pf_sw(pf);
if (err)
@@ -5081,7 +5078,9 @@ static int ice_init(struct ice_pf *pf)
ice_deinit_pf_sw(pf);
err_init_pf_sw:
ice_dealloc_vsis(pf);
-err_alloc_vsis:
+unroll_pf_init:
+ ice_deinit_pf(pf);
+unroll_dev_init:
ice_deinit_dev(pf);
return err;
}
@@ -5093,6 +5092,7 @@ static void ice_deinit(struct ice_pf *pf)
ice_deinit_pf_sw(pf);
ice_dealloc_vsis(pf);
+ ice_deinit_pf(pf);
ice_deinit_dev(pf);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 103/614] ice: extract ice_init_dev() from ice_init()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 102/614] ice: move ice_init_pf() out of ice_init_dev() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 104/614] ice: move ice_deinit_dev() to the end of deinit paths Greg Kroah-Hartman
` (524 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Aleksandr Loktionov,
Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit c2fb9398f73d41cb2b5da74ff505578525ee3fd8 ]
Extract ice_init_dev() from ice_init(), to allow service task and IRQ
scheme teardown to be put after clearing SW constructs in the subsequent
commit.
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 6b3d941f419b3..a12dcc733e041 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -5023,14 +5023,10 @@ static int ice_init(struct ice_pf *pf)
struct device *dev = ice_pf_to_dev(pf);
int err;
- err = ice_init_dev(pf);
- if (err)
- return err;
-
err = ice_init_pf(pf);
if (err) {
dev_err(dev, "ice_init_pf failed: %d\n", err);
- goto unroll_dev_init;
+ return err;
}
if (pf->hw.mac_type == ICE_MAC_E830) {
@@ -5080,8 +5076,6 @@ static int ice_init(struct ice_pf *pf)
ice_dealloc_vsis(pf);
unroll_pf_init:
ice_deinit_pf(pf);
-unroll_dev_init:
- ice_deinit_dev(pf);
return err;
}
@@ -5093,7 +5087,6 @@ static void ice_deinit(struct ice_pf *pf)
ice_deinit_pf_sw(pf);
ice_dealloc_vsis(pf);
ice_deinit_pf(pf);
- ice_deinit_dev(pf);
}
/**
@@ -5323,10 +5316,14 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
}
pf->adapter = adapter;
- err = ice_init(pf);
+ err = ice_init_dev(pf);
if (err)
goto unroll_adapter;
+ err = ice_init(pf);
+ if (err)
+ goto unroll_dev_init;
+
devl_lock(priv_to_devlink(pf));
err = ice_load(pf);
if (err)
@@ -5344,6 +5341,8 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
unroll_init:
devl_unlock(priv_to_devlink(pf));
ice_deinit(pf);
+unroll_dev_init:
+ ice_deinit_dev(pf);
unroll_adapter:
ice_adapter_put(pdev);
unroll_hw_init:
@@ -5457,6 +5456,7 @@ static void ice_remove(struct pci_dev *pdev)
devl_unlock(priv_to_devlink(pf));
ice_deinit(pf);
+ ice_deinit_dev(pf);
ice_vsi_release_all(pf);
ice_setup_mc_magic_wake(pf);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 104/614] ice: move ice_deinit_dev() to the end of deinit paths
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 103/614] ice: extract ice_init_dev() from ice_init() Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 105/614] ice: remove duplicate call to ice_deinit_hw() on error paths Greg Kroah-Hartman
` (523 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Aleksandr Loktionov,
Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit 8a37f9e2ff40f4a4fa8def22febefe4daf58e573 ]
ice_deinit_dev() takes care of turning off adminq processing, which is
much needed during driver teardown (remove, reset, error path). Move it
to the very end where applicable.
For example, ice_deinit_hw() called after adminq deinit slows rmmod on
my two-card setup by about 60 seconds.
ice_init_dev() and ice_deinit_dev() scopes were reduced by previous
commits of the series, with a final touch of extracting ice_init_dev_hw()
out now (there is no deinit counterpart).
Note that removed ice_service_task_stop() call from ice_remove() is placed
in the ice_deinit_dev() (and stopping twice makes no sense).
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 1390b8b3d2be ("ice: remove duplicate call to ice_deinit_hw() on error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/intel/ice/devlink/devlink.c | 5 +++-
drivers/net/ethernet/intel/ice/ice.h | 1 +
drivers/net/ethernet/intel/ice/ice_common.c | 3 +++
drivers/net/ethernet/intel/ice/ice_main.c | 23 ++++++++++++-------
4 files changed, 23 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/devlink/devlink.c b/drivers/net/ethernet/intel/ice/devlink/devlink.c
index c354a03c950cd..938914abbe066 100644
--- a/drivers/net/ethernet/intel/ice/devlink/devlink.c
+++ b/drivers/net/ethernet/intel/ice/devlink/devlink.c
@@ -1233,6 +1233,7 @@ static int ice_devlink_reinit_up(struct ice_pf *pf)
{
struct ice_vsi *vsi = ice_get_main_vsi(pf);
struct device *dev = ice_pf_to_dev(pf);
+ bool need_dev_deinit = false;
int err;
err = ice_init_hw(&pf->hw);
@@ -1276,9 +1277,11 @@ static int ice_devlink_reinit_up(struct ice_pf *pf)
unroll_pf_init:
ice_deinit_pf(pf);
unroll_dev_init:
- ice_deinit_dev(pf);
+ need_dev_deinit = true;
unroll_hw_init:
ice_deinit_hw(&pf->hw);
+ if (need_dev_deinit)
+ ice_deinit_dev(pf);
return err;
}
diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 9a1abd4573372..9ee596773f34e 100644
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -1033,6 +1033,7 @@ void ice_start_service_task(struct ice_pf *pf);
int ice_load(struct ice_pf *pf);
void ice_unload(struct ice_pf *pf);
void ice_adv_lnk_speed_maps_init(void);
+void ice_init_dev_hw(struct ice_pf *pf);
int ice_init_dev(struct ice_pf *pf);
void ice_deinit_dev(struct ice_pf *pf);
int ice_init_pf(struct ice_pf *pf);
diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 2532b6f82e971..6edeb06b4dce2 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -1161,6 +1161,9 @@ int ice_init_hw(struct ice_hw *hw)
status = ice_init_hw_tbls(hw);
if (status)
goto err_unroll_fltr_mgmt_struct;
+
+ ice_init_dev_hw(hw->back);
+
mutex_init(&hw->tnl_lock);
ice_init_chk_recipe_reuse_support(hw);
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index a12dcc733e041..f1ebdb7dbdc73 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -4742,9 +4742,8 @@ static void ice_decfg_netdev(struct ice_vsi *vsi)
vsi->netdev = NULL;
}
-int ice_init_dev(struct ice_pf *pf)
+void ice_init_dev_hw(struct ice_pf *pf)
{
- struct device *dev = ice_pf_to_dev(pf);
struct ice_hw *hw = &pf->hw;
int err;
@@ -4764,6 +4763,12 @@ int ice_init_dev(struct ice_pf *pf)
*/
ice_set_safe_mode_caps(hw);
}
+}
+
+int ice_init_dev(struct ice_pf *pf)
+{
+ struct device *dev = ice_pf_to_dev(pf);
+ int err;
ice_set_pf_caps(pf);
err = ice_init_interrupt_scheme(pf);
@@ -5220,6 +5225,7 @@ static int
ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
{
struct device *dev = &pdev->dev;
+ bool need_dev_deinit = false;
struct ice_adapter *adapter;
struct ice_pf *pf;
struct ice_hw *hw;
@@ -5342,11 +5348,13 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent)
devl_unlock(priv_to_devlink(pf));
ice_deinit(pf);
unroll_dev_init:
- ice_deinit_dev(pf);
+ need_dev_deinit = true;
unroll_adapter:
ice_adapter_put(pdev);
unroll_hw_init:
ice_deinit_hw(hw);
+ if (need_dev_deinit)
+ ice_deinit_dev(pf);
return err;
}
@@ -5441,10 +5449,6 @@ static void ice_remove(struct pci_dev *pdev)
ice_hwmon_exit(pf);
- ice_service_task_stop(pf);
- ice_aq_cancel_waiting_tasks(pf);
- set_bit(ICE_DOWN, pf->state);
-
if (!ice_is_safe_mode(pf))
ice_remove_arfs(pf);
@@ -5456,13 +5460,16 @@ static void ice_remove(struct pci_dev *pdev)
devl_unlock(priv_to_devlink(pf));
ice_deinit(pf);
- ice_deinit_dev(pf);
ice_vsi_release_all(pf);
ice_setup_mc_magic_wake(pf);
ice_set_wake(pf);
ice_adapter_put(pdev);
+
+ ice_deinit_dev(pf);
+ ice_aq_cancel_waiting_tasks(pf);
+ set_bit(ICE_DOWN, pf->state);
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 105/614] ice: remove duplicate call to ice_deinit_hw() on error paths
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 104/614] ice: move ice_deinit_dev() to the end of deinit paths Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 106/614] leds: upboard: Fix module alias Greg Kroah-Hartman
` (522 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Keller, Przemek Kitszel,
Aleksandr Loktionov, Tony Nguyen, Sasha Levin, Rinitha S
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit 1390b8b3d2bef9bfbb852fc735430798bfca36e7 ]
Current unwinding code on error paths of ice_devlink_reinit_up() and
ice_probe() have manual call to ice_deinit_hw() (which is good, as there
is also manual call to ice_hw_init() there), which is then duplicated
(and was prior current series) in ice_deinit_dev().
Fix the above by removing ice_deinit_hw() from ice_deinit_dev().
Add a (now missing) call in ice_remove().
Reported-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/intel-wired-lan/20250717-jk-ddp-safe-mode-issue-v1-1-e113b2baed79@intel.com/
Fixes: 4d3f59bfa2cd ("ice: split ice_init_hw() out from ice_init_dev()")
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index f1ebdb7dbdc73..b0f8a96c13b47 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -4784,7 +4784,6 @@ int ice_init_dev(struct ice_pf *pf)
void ice_deinit_dev(struct ice_pf *pf)
{
- ice_deinit_hw(&pf->hw);
ice_service_task_stop(pf);
/* Service task is already stopped, so call reset directly. */
@@ -5466,6 +5465,7 @@ static void ice_remove(struct pci_dev *pdev)
ice_set_wake(pf);
ice_adapter_put(pdev);
+ ice_deinit_hw(&pf->hw);
ice_deinit_dev(pf);
ice_aq_cancel_waiting_tasks(pf);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 106/614] leds: upboard: Fix module alias
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 105/614] ice: remove duplicate call to ice_deinit_hw() on error paths Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 107/614] PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Greg Kroah-Hartman
` (521 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Richard, Krzysztof Kozlowski,
Lee Jones, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richard <thomas.richard@bootlin.com>
[ Upstream commit c06a017439110debd335b6864bc2d69835624235 ]
The module alias does not match the cell name defined in the MFD driver,
preventing automatic loading when the driver is built as a module. So fix
the module alias to ensure proper module auto-loading.
Fixes: 0ef2929a0181 ("leds: Add AAEON UP board LED driver")
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20251020-leds-upboard-fix-module-alias-v2-1-84ac5c3a1a81@bootlin.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-upboard.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/leds/leds-upboard.c b/drivers/leds/leds-upboard.c
index b350eb294280f..12989b2f19530 100644
--- a/drivers/leds/leds-upboard.c
+++ b/drivers/leds/leds-upboard.c
@@ -123,4 +123,4 @@ MODULE_AUTHOR("Gary Wang <garywang@aaeon.com.tw>");
MODULE_AUTHOR("Thomas Richard <thomas.richard@bootlin.com>");
MODULE_DESCRIPTION("UP Board LED driver");
MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:upboard-led");
+MODULE_ALIAS("platform:upboard-leds");
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 107/614] PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 106/614] leds: upboard: Fix module alias Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 108/614] arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Greg Kroah-Hartman
` (520 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bhanu Seshu Kumar Valluri,
Manivannan Sadhasivam, Niklas Cassel, Frank Li, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
[ Upstream commit 25423cda145f9ed6ee4a72d9f2603ac2a4685e74 ]
When Root Complex (RC) triggers a Doorbell interrupt to Endpoint (EP), it
triggers the below warning in the EP:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:271
Call trace:
__might_resched+0x130/0x158
__might_sleep+0x70/0x88
mutex_lock+0x2c/0x80
pci_epc_get_msi+0x78/0xd8
pci_epf_test_raise_irq.isra.0+0x74/0x138
pci_epf_test_doorbell_handler+0x34/0x50
The BUG arises because the EP's pci_epf_test_doorbell_handler() which is
running in the hard IRQ context is making an indirect call to
pci_epc_get_msi(), which uses mutex inside.
To fix the issue, convert the hard IRQ handler to a threaded IRQ handler to
allow it to call functions that can sleep during bottom half execution.
Also, register the threaded IRQ handler with IRQF_ONESHOT to keep the
interrupt line disabled until the threaded IRQ handler completes execution.
Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support")
Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
[mani: reworded description a bit]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251014024109.42287-1-bhanuseshukumar@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/endpoint/functions/pci-epf-test.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 31617772ad516..b05e8db575c35 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -730,8 +730,9 @@ static void pci_epf_test_enable_doorbell(struct pci_epf_test *epf_test,
if (bar < BAR_0)
goto err_doorbell_cleanup;
- ret = request_irq(epf->db_msg[0].virq, pci_epf_test_doorbell_handler, 0,
- "pci-ep-test-doorbell", epf_test);
+ ret = request_threaded_irq(epf->db_msg[0].virq, NULL,
+ pci_epf_test_doorbell_handler, IRQF_ONESHOT,
+ "pci-ep-test-doorbell", epf_test);
if (ret) {
dev_err(&epf->dev,
"Failed to request doorbell IRQ: %d\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 108/614] arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 107/614] PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 109/614] firmware: imx: scu-irq: fix OF node leak in Greg Kroah-Hartman
` (519 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randolph Sapp, Michael Walle,
Vignesh Raghavendra, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randolph Sapp <rs@ti.com>
[ Upstream commit 76546090b1726118cd6fb3db7159fc2a3fdda8a0 ]
Update the memory region listed in the k3-am62p.dtsi for the BXS-4-64
GPU to match the Main Memory Map described in the TRM [1].
[1] https://www.ti.com/lit/ug/spruj83b/spruj83b.pdf
Fixes: 29075cc09f43 ("arm64: dts: ti: Introduce AM62P5 family of SoCs")
Signed-off-by: Randolph Sapp <rs@ti.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Link: https://patch.msgid.link/20250919193341.707660-2-rs@ti.com
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62p.dtsi b/arch/arm64/boot/dts/ti/k3-am62p.dtsi
index 75a15c368c11b..dd24c40c7965d 100644
--- a/arch/arm64/boot/dts/ti/k3-am62p.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62p.dtsi
@@ -59,7 +59,7 @@ cbass_main: bus@f0000 {
<0x00 0x01000000 0x00 0x01000000 0x00 0x01b28400>, /* First peripheral window */
<0x00 0x08000000 0x00 0x08000000 0x00 0x00200000>, /* Main CPSW */
<0x00 0x0e000000 0x00 0x0e000000 0x00 0x01d20000>, /* Second peripheral window */
- <0x00 0x0fd00000 0x00 0x0fd00000 0x00 0x00020000>, /* GPU */
+ <0x00 0x0fd80000 0x00 0x0fd80000 0x00 0x00080000>, /* GPU */
<0x00 0x20000000 0x00 0x20000000 0x00 0x0a008000>, /* Third peripheral window */
<0x00 0x30040000 0x00 0x30040000 0x00 0x00080000>, /* PRUSS-M */
<0x00 0x30101000 0x00 0x30101000 0x00 0x00010100>, /* CSI window */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 109/614] firmware: imx: scu-irq: fix OF node leak in
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 108/614] arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 110/614] arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller Greg Kroah-Hartman
` (518 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Peng Fan, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit ee67247843a2b62d1473cfa4df300e69b5190ccf ]
imx_scu_enable_general_irq_channel() calls of_parse_phandle_with_args(),
but does not release the OF node reference. Add a of_node_put() call
to release the reference.
Fixes: 851826c7566e ("firmware: imx: enable imx scu general irq function")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/imx/imx-scu-irq.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
index 6125cccc9ba79..f2b902e95b738 100644
--- a/drivers/firmware/imx/imx-scu-irq.c
+++ b/drivers/firmware/imx/imx-scu-irq.c
@@ -226,8 +226,10 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
- "#mbox-cells", 0, &spec))
+ "#mbox-cells", 0, &spec)) {
i = of_alias_get_id(spec.np, "mu");
+ of_node_put(spec.np);
+ }
/* use mu1 as general mu irq channel if failed */
if (i < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 110/614] arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 109/614] firmware: imx: scu-irq: fix OF node leak in Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 111/614] arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Greg Kroah-Hartman
` (517 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
[ Upstream commit 0dab10c38282e6ef87ef88efb99d4106cce7ed33 ]
With W=1, the following error comes up:
Warning (graph_child_address): /soc@0/usb@a2f8800/usb@a200000/ports: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary
This could be since the controller is only HS capable and only one port
node is added.
Fixes: 4af46b7bd66f ("arm64: dts: qcom: x1e80100: Add USB nodes")
Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251019115630.2222720-1-krishna.kurapati@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/x1e80100.dtsi b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
index 51576d9c935de..6beef835c33ad 100644
--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -4939,15 +4939,8 @@ usb_2_dwc3: usb@a200000 {
dma-coherent;
- ports {
- #address-cells = <1>;
- #size-cells = <0>;
-
- port@0 {
- reg = <0>;
-
- usb_2_dwc3_hs: endpoint {
- };
+ port {
+ usb_2_dwc3_hs: endpoint {
};
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 111/614] arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 110/614] arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 112/614] arm64: dts: qcom: lemans: " Greg Kroah-Hartman
` (516 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
[ Upstream commit 6b3e8a5d6c88609d9ce93789524f818cca0aa485 ]
The PIPE clock is provided by the USB3 PHY, which is predictably not
connected to the HS-only controller. Add "qcom,select-utmi-as-pipe-clk"
quirk to HS only USB controller to disable pipe clock requirement.
Fixes: 4af46b7bd66f ("arm64: dts: qcom: x1e80100: Add USB nodes")
Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20251024105019.2220832-2-krishna.kurapati@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/x1e80100.dtsi b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
index 6beef835c33ad..662ad694cd914 100644
--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -4922,6 +4922,7 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
interconnect-names = "usb-ddr",
"apps-usb";
+ qcom,select-utmi-as-pipe-clk;
wakeup-source;
status = "disabled";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 112/614] arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 111/614] arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Greg Kroah-Hartman
@ 2025-12-16 11:07 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 113/614] tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions Greg Kroah-Hartman
` (515 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati, Abel Vesa,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
[ Upstream commit 0903296efd0b4e17c8d556ce8c33347147301870 ]
The PIPE clock is provided by the USB3 PHY, which is predictably not
connected to the HS-only controller. Add "qcom,select-utmi-as-pipe-clk"
quirk to HS only USB controller to disable pipe clock requirement.
Fixes: de1001525c1a ("arm64: dts: qcom: sa8775p: add USB nodes")
Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://lore.kernel.org/r/20251024105019.2220832-3-krishna.kurapati@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/lemans.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/lemans.dtsi b/arch/arm64/boot/dts/qcom/lemans.dtsi
index cf685cb186edc..c2d2200d845b3 100644
--- a/arch/arm64/boot/dts/qcom/lemans.dtsi
+++ b/arch/arm64/boot/dts/qcom/lemans.dtsi
@@ -4106,6 +4106,7 @@ usb_2: usb@a400000 {
<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_USB2 0>;
interconnect-names = "usb-ddr", "apps-usb";
+ qcom,select-utmi-as-pipe-clk;
wakeup-source;
iommus = <&apps_smmu 0x020 0x0>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 113/614] tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2025-12-16 11:07 ` [PATCH 6.18 112/614] arm64: dts: qcom: lemans: " Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 114/614] arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells Greg Kroah-Hartman
` (514 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willy Tarreau, Thomas Weißschuh,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willy Tarreau <w@1wt.eu>
[ Upstream commit 2602949b22330f1275138e2b5aea5d49126b9757 ]
I recently got occasional build failures at -Os or -Oz that would always
involve waitpid(), where the assembler would complain about this:
init.s: Error: .size expression for waitpid.constprop.0 does not evaluate to a constant
And without -fno-asynchronous-unwind-tables it could also spit such
errors:
init.s:836: Error: CFI instruction used without previous .cfi_startproc
init.s:838: Error: .cfi_endproc without corresponding .cfi_startproc
init.s: Error: open CFI at the end of file; missing .cfi_endproc directive
A trimmed down reproducer is as simple as this:
int main(int argc, char **argv)
{
int ret, status;
if (argc == 0)
ret = waitpid(-1, &status, 0);
else
ret = waitpid(-1, &status, 0);
return status;
}
It produces the following asm code on x86_64:
.text
.section .text.nolibc_memmove_memcpy
.weak memmove
.weak memcpy
memmove:
memcpy:
movq %rdx, %rcx
(...)
retq
.section .text.nolibc_memset
.weak memset
memset:
xchgl %eax, %esi
movq %rdx, %rcx
pushq %rdi
rep stosb
popq %rax
retq
.type waitpid.constprop.0.isra.0, @function
waitpid.constprop.0.isra.0:
subq $8, %rsp
(...)
jmp *.L5(,%rax,8)
.section .rodata
.align 8
.align 4
.L5:
.quad .L10
(...)
.quad .L4
.text
.L10:
(...)
.cfi_def_cfa_offset 8
ret
.cfi_endproc
.LFE273:
.size waitpid.constprop.0.isra.0, .-waitpid.constprop.0.isra.0
It's a bit dense, but here's the explanation: the compiler has emitted a
".text" statement because it knows it's working in the .text section.
Then, our hand-written asm code for the mem* functions forced the section
to .text.something without the compiler knowing about it, so it thinks
the code is still being emitted for .text. As such, without any .section
statement, the waitpid.constprop.0.isra.0 label is in fact placed in the
previously created section, here .text.nolibc_memset.
The waitpid() function involves a switch/case statement that can be
turned to a jump table, which is what the compiler does with the .rodata
section, and after that it restores .text, which is no longer the
previous .text.nolibc_memset section. Then the CFI statements cross a
section, so does the .size calculation, which explains the error.
While a first approach consisting in placing an explicit ".text" at the
end of these functions was verified to work, it's still unreliable as
it depends on what the compiler remembers having emitted previously. A
better approach is to replace the ".section" with ".pushsection", and
place a ".popsection" at the end, so that these code blocks are agnostic
to where they're placed relative to other blocks.
Fixes: 553845eebd60 ("tools/nolibc: x86-64: Use `rep movsb` for `memcpy()` and `memmove()`")
Fixes: 12108aa8c1a1 ("tools/nolibc: x86-64: Use `rep stosb` for `memset()`")
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/arch-x86.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/tools/include/nolibc/arch-x86.h b/tools/include/nolibc/arch-x86.h
index d3efc0c3b8adc..c8b0c3e624a51 100644
--- a/tools/include/nolibc/arch-x86.h
+++ b/tools/include/nolibc/arch-x86.h
@@ -351,7 +351,7 @@ void *memcpy(void *dst, const void *src, size_t len);
void *memset(void *dst, int c, size_t len);
__asm__ (
-".section .text.nolibc_memmove_memcpy\n"
+".pushsection .text.nolibc_memmove_memcpy\n"
".weak memmove\n"
".weak memcpy\n"
"memmove:\n"
@@ -371,8 +371,9 @@ __asm__ (
"rep movsb\n\t"
"cld\n\t"
"retq\n"
+".popsection\n"
-".section .text.nolibc_memset\n"
+".pushsection .text.nolibc_memset\n"
".weak memset\n"
"memset:\n"
"xchgl %eax, %esi\n\t"
@@ -381,6 +382,7 @@ __asm__ (
"rep stosb\n\t"
"popq %rax\n\t"
"retq\n"
+".popsection\n"
);
#endif /* !defined(__x86_64__) */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 114/614] arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 113/614] tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 115/614] arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Greg Kroah-Hartman
` (513 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dzmitry Sankouski,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit 4133486382364f60ea7e4f2c9070555689d9606e ]
Drop the unused address/size-cells properties to silence the DT
checker warning:
pmic@66 (maxim,max77705): '#address-cells', '#size-cells' do not
match any of the regexes: '^pinctrl-[0-9]+$'
Fixes: 7a88a931d095 ("arm64: dts: qcom: sdm845-starqltechn: add max77705 PMIC")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250926-starqltechn-correct_max77705_nodes-v5-1-c6ab35165534@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
index 75a53f0bbebd0..45c7aa0f602d8 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
@@ -606,8 +606,6 @@ pmic@66 {
interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
pinctrl-0 = <&pmic_int_default>;
pinctrl-names = "default";
- #address-cells = <1>;
- #size-cells = <0>;
leds {
compatible = "maxim,max77705-rgb";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 115/614] arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 114/614] arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 116/614] arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Greg Kroah-Hartman
` (512 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Dzmitry Sankouski,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dzmitry Sankouski <dsankouski@gmail.com>
[ Upstream commit 4372b15d89e253e40816f0bde100890cddd25a81 ]
Since max77705 has a register, which indicates interrupt source, it acts
as an interrupt controller.
Direct MAX77705's subdevices to use the IC's internal interrupt
controller, instead of listening to every interrupt fired by the
chip towards the host device.
Fixes: 7a88a931d095 ("arm64: dts: qcom: sdm845-starqltechn: add max77705 PMIC")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250926-starqltechn-correct_max77705_nodes-v5-2-c6ab35165534@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/qcom/sdm845-samsung-starqltechn.dts | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
index 45c7aa0f602d8..215e1491f3e9a 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
@@ -599,11 +599,13 @@ &uart9 {
&i2c14 {
status = "okay";
- pmic@66 {
+ max77705: pmic@66 {
compatible = "maxim,max77705";
reg = <0x66>;
+ #interrupt-cells = <1>;
interrupt-parent = <&pm8998_gpios>;
interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
pinctrl-0 = <&pmic_int_default>;
pinctrl-names = "default";
@@ -644,8 +646,8 @@ max77705_charger: charger@69 {
reg = <0x69>;
compatible = "maxim,max77705-charger";
monitored-battery = <&battery>;
- interrupt-parent = <&pm8998_gpios>;
- interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-parent = <&max77705>;
+ interrupts = <0>;
};
fuel-gauge@36 {
@@ -653,8 +655,8 @@ fuel-gauge@36 {
compatible = "maxim,max77705-battery";
power-supplies = <&max77705_charger>;
maxim,rsns-microohm = <5000>;
- interrupt-parent = <&pm8998_gpios>;
- interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-parent = <&max77705>;
+ interrupts = <2>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 116/614] arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 115/614] arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 117/614] arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Greg Kroah-Hartman
` (511 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gergo Koteles, David Heidelberg,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <soyer@irl.hu>
[ Upstream commit d7ec7d34237498fab7a6afed8da4b7139b0e387c ]
The previous GPIO numbers were wrong. Update them to the correct
ones and fix the label.
Fixes: 288ef8a42612 ("arm64: dts: sdm845: add oneplus6/6t devices")
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250927-slider-correct-v1-1-fb8cc7fdcedf@ixit.cz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
index dcfffb271fcf3..51a9a276399ac 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
@@ -803,8 +803,8 @@ hall_sensor_default: hall-sensor-default-state {
bias-disable;
};
- tri_state_key_default: tri-state-key-default-state {
- pins = "gpio40", "gpio42", "gpio26";
+ alert_slider_default: alert-slider-default-state {
+ pins = "gpio126", "gpio52", "gpio24";
function = "gpio";
drive-strength = <2>;
bias-disable;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 117/614] arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 116/614] arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 118/614] arm64: dts: qcom: sm8650: set ufs as dma coherent Greg Kroah-Hartman
` (510 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
[ Upstream commit 3d4142cac46b4dde4e60908c509c4cf107067114 ]
Add the OLED power supplies to the simple-framebuffer node, so that
the regulators don't get turned off while the simple-fb is being used.
Fixes: c365a026155c ("arm64: dts: qcom: qcm6490-fairphone-fp5: Enable display")
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250930-sc7280-dts-misc-v1-1-5a45923ef705@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
index 519e458e1a890..36d5750584831 100644
--- a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
+++ b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
@@ -47,6 +47,8 @@ framebuffer0: framebuffer@a000000 {
stride = <(1224 * 4)>;
format = "a8r8g8b8";
clocks = <&gcc GCC_DISP_HF_AXI_CLK>;
+ vci-supply = <&vreg_oled_vci>;
+ dvdd-supply = <&vreg_oled_dvdd>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 118/614] arm64: dts: qcom: sm8650: set ufs as dma coherent
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 117/614] arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 119/614] arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node Greg Kroah-Hartman
` (509 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Krzysztof Kozlowski,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit c2703c90161b45bca5b65f362adbae02ed71fcc1 ]
The UFS device is ovbiously dma coherent like the other IOMMU devices
like usb, mmc, ... let's fix this by adding the flag.
To be sure an extensive test has been performed to be sure it's
safe, as downstream uses this flag for UFS as well.
As an experiment, I checked how the dma-coherent could impact
the UFS bandwidth, and it happens the max bandwidth on cached
write is slighly highter (up to 10%) while using less cpu time
since cache sync/flush is skipped.
Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251007-topic-sm8650-upstream-ufs-dma-coherent-v1-1-f3cfeaee04ce@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sm8650.dtsi b/arch/arm64/boot/dts/qcom/sm8650.dtsi
index ebf1971b1bfbe..3b03c13539386 100644
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -3988,6 +3988,8 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
iommus = <&apps_smmu 0x60 0>;
+ dma-coherent;
+
lanes-per-direction = <2>;
qcom,ice = <&ice>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 119/614] arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 118/614] arm64: dts: qcom: sm8650: set ufs as dma coherent Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 120/614] arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Greg Kroah-Hartman
` (508 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Chaitanya Chundru,
Krzysztof Kozlowski, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
[ Upstream commit cc8056a16472d186140d1a66ed5648cee41f4379 ]
Relocate the wake-gpios and perst-gpios properties from the pcie0
controller node to the pcieport0 node. These GPIOs are associated with
the PCIe root port and should reside under the pcieport0 node.
Also rename perst-gpios to reset-gpios to match the expected property name
in the PCIe port node.
Fixes: 141714e163bb ("arm64: dts: qcom: sm8750-mtp: Add WiFi and Bluetooth")
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Tested-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20251008-sm8750-v1-1-daeadfcae980@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8750-mtp.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8750-mtp.dts b/arch/arm64/boot/dts/qcom/sm8750-mtp.dts
index 3bbb53b7c71f3..45b5f75815670 100644
--- a/arch/arm64/boot/dts/qcom/sm8750-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sm8750-mtp.dts
@@ -960,9 +960,6 @@ &pon_resin {
};
&pcie0 {
- wake-gpios = <&tlmm 104 GPIO_ACTIVE_HIGH>;
- perst-gpios = <&tlmm 102 GPIO_ACTIVE_LOW>;
-
pinctrl-0 = <&pcie0_default_state>;
pinctrl-names = "default";
@@ -977,6 +974,9 @@ &pcie0_phy {
};
&pcieport0 {
+ wake-gpios = <&tlmm 104 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&tlmm 102 GPIO_ACTIVE_LOW>;
+
wifi@0 {
compatible = "pci17cb,1107";
reg = <0x10000 0x0 0x0 0x0 0x0>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 120/614] arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 119/614] arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 121/614] arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD Greg Kroah-Hartman
` (507 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Martinz, Konrad Dybcio,
Luca Weiss, Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Martinz <amartinz@shiftphones.com>
[ Upstream commit f404fdcb50021fdad6bc734d69468cc777901a80 ]
It seems we also need to reserve a region of 81 MiB called "removed_mem"
otherwise we can easily hit memory errors with higher RAM usage.
Fixes: 249666e34c24 ("arm64: dts: qcom: add QCM6490 SHIFTphone 8")
Signed-off-by: Alexander Martinz <amartinz@shiftphones.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251009-otter-further-bringup-v2-3-5bb2f4a02cea@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts b/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts
index eb8efba1b9dda..cc99925798873 100644
--- a/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts
+++ b/arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts
@@ -118,6 +118,11 @@ cdsp_mem: cdsp@88f00000 {
no-map;
};
+ removed_mem: removed@c0000000 {
+ reg = <0x0 0xc0000000 0x0 0x5100000>;
+ no-map;
+ };
+
rmtfs_mem: rmtfs@f8500000 {
compatible = "qcom,rmtfs-mem";
reg = <0x0 0xf8500000 0x0 0x600000>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 121/614] arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 120/614] arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 122/614] arm64: dts: qcom: x1-dell-thena: remove dp data-lanes Greg Kroah-Hartman
` (506 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Val Packett,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit 1bdfe3edd4c862f97ac65b60da1db999981fc52a ]
The commit a41d23142d87 ("arm64: dts: qcom: x1e80100-dell-xps13-9345:
Add missing pinctrl for eDP HPD") has applied this change to a very
similar machine, so apply it here too.
This allows us not to rely on the boot firmware to set up the pinctrl
for the eDP HPD line of the internal display.
Fixes: e7733b42111c ("arm64: dts: qcom: Add support for Dell Inspiron 7441 / Latitude 7455")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Val Packett <val@packett.cool>
Link: https://lore.kernel.org/r/20251012224706.14311-1-val@packett.cool
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi b/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
index cc64558ed5e6f..9df66295660c3 100644
--- a/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
@@ -1039,6 +1039,9 @@ &mdss_dp1_out {
&mdss_dp3 {
/delete-property/ #sound-dai-cells;
+ pinctrl-0 = <&edp0_hpd_default>;
+ pinctrl-names = "default";
+
status = "okay";
aux-bus {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 122/614] arm64: dts: qcom: x1-dell-thena: remove dp data-lanes
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 121/614] arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 123/614] arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels Greg Kroah-Hartman
` (505 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Val Packett,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit 147d5eefab8f0e17e9951fb5e0c4c77bada34558 ]
The commit 458de584248a ("arm64: dts: qcom: x1e80100: move dp0/1/2
data-lanes to SoC dtsi") has landed before this file was added, so
the data-lanes lines here remained.
Remove them to enable 4-lane DP on the X1E Dell Inspiron/Latitude.
Fixes: e7733b42111c ("arm64: dts: qcom: Add support for Dell Inspiron 7441 / Latitude 7455")
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Val Packett <val@packett.cool>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251012224909.14988-1-val@packett.cool
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi b/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
index 9df66295660c3..847b678f040c0 100644
--- a/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi
@@ -1023,7 +1023,6 @@ &mdss_dp0 {
};
&mdss_dp0_out {
- data-lanes = <0 1>;
link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
};
@@ -1032,7 +1031,6 @@ &mdss_dp1 {
};
&mdss_dp1_out {
- data-lanes = <0 1>;
link-frequencies = /bits/ 64 <1620000000 2700000000 5400000000 8100000000>;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 123/614] arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 122/614] arm64: dts: qcom: x1-dell-thena: remove dp data-lanes Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 124/614] arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Greg Kroah-Hartman
` (504 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengyu Luo, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengyu Luo <mitltlatltl@gmail.com>
[ Upstream commit fb48d3f3abba9a7bca2814fa2e9db8ac5b9e16b9 ]
The GPI DMA channels in sc8280xp.dtsi are wrong. Let's fix it.
Origianl patch was rebased to the linux-next and formated to a new
patch again later, then it got the GPI DMA channels in the new patch
shifted.
Fixes: 71b12166a2be ("arm64: dts: qcom: sc8280xp: Describe GPI DMA controller nodes")
Signed-off-by: Pengyu Luo <mitltlatltl@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251013115506.103649-1-mitltlatltl@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 170 ++++++++++++-------------
1 file changed, 85 insertions(+), 85 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
index 279e5e6beae20..963ce2362a52e 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
@@ -967,8 +967,8 @@ i2c16: i2c@880000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 6 QCOM_GPI_SPI>,
- <&gpi_dma2 1 6 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 0 QCOM_GPI_I2C>,
+ <&gpi_dma2 1 0 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -989,8 +989,8 @@ spi16: spi@880000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 0 QCOM_GPI_I2C>,
- <&gpi_dma2 1 0 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma2 0 0 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 0 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1011,8 +1011,8 @@ i2c17: i2c@884000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 0 QCOM_GPI_SPI>,
- <&gpi_dma2 1 0 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 1 QCOM_GPI_I2C>,
+ <&gpi_dma2 1 1 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1033,8 +1033,8 @@ spi17: spi@884000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 1 QCOM_GPI_I2C>,
- <&gpi_dma2 1 1 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma2 0 1 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 1 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1069,8 +1069,8 @@ i2c18: i2c@888000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 1 QCOM_GPI_SPI>,
- <&gpi_dma2 1 1 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 2 QCOM_GPI_I2C>,
+ <&gpi_dma2 1 2 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1091,8 +1091,8 @@ spi18: spi@888000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 2 QCOM_GPI_I2C>,
- <&gpi_dma2 1 2 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma2 0 2 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 2 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1131,8 +1131,8 @@ i2c19: i2c@88c000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 2 QCOM_GPI_SPI>,
- <&gpi_dma2 1 2 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 3 QCOM_GPI_I2C>,
+ <&gpi_dma2 1 3 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1153,8 +1153,8 @@ spi19: spi@88c000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 3 QCOM_GPI_I2C>,
- <&gpi_dma2 1 3 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma2 0 3 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 3 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1175,8 +1175,8 @@ i2c20: i2c@890000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 3 QCOM_GPI_SPI>,
- <&gpi_dma2 1 3 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 4 QCOM_GPI_I2C>,
+ <&gpi_dma2 1 4 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1197,8 +1197,8 @@ spi20: spi@890000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 4 QCOM_GPI_I2C>,
- <&gpi_dma2 1 4 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma2 0 4 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 4 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1241,8 +1241,8 @@ spi21: spi@894000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 4 QCOM_GPI_SPI>,
- <&gpi_dma2 1 4 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 5 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 5 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1285,8 +1285,8 @@ spi22: spi@898000 {
<&aggre1_noc MASTER_QUP_2 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma2 0 5 QCOM_GPI_SPI>,
- <&gpi_dma2 1 5 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma2 0 6 QCOM_GPI_SPI>,
+ <&gpi_dma2 1 6 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1338,7 +1338,7 @@ spi23: spi@89c000 {
};
};
- gpi_dma0: dma-controller@900000 {
+ gpi_dma0: dma-controller@900000 {
compatible = "qcom,sc8280xp-gpi-dma", "qcom,sm6350-gpi-dma";
reg = <0 0x00900000 0 0x60000>;
@@ -1393,8 +1393,8 @@ i2c0: i2c@980000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 7 QCOM_GPI_I2C>,
- <&gpi_dma0 1 7 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 0 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1415,8 +1415,8 @@ spi0: spi@980000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C>,
- <&gpi_dma0 1 0 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 0 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 0 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1437,8 +1437,8 @@ i2c1: i2c@984000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 0 QCOM_GPI_SPI>,
- <&gpi_dma0 1 0 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 1 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 1 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1459,8 +1459,8 @@ spi1: spi@984000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 1 QCOM_GPI_I2C>,
- <&gpi_dma0 1 1 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 1 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 1 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1481,8 +1481,8 @@ i2c2: i2c@988000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 1 QCOM_GPI_SPI>,
- <&gpi_dma0 1 1 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 2 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 2 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1503,8 +1503,8 @@ spi2: spi@988000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 2 QCOM_GPI_I2C>,
- <&gpi_dma0 1 2 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 2 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 2 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1539,8 +1539,8 @@ i2c3: i2c@98c000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 2 QCOM_GPI_SPI>,
- <&gpi_dma0 1 2 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 3 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 3 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1561,8 +1561,8 @@ spi3: spi@98c000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 3 QCOM_GPI_I2C>,
- <&gpi_dma0 1 3 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 3 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 3 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1583,8 +1583,8 @@ i2c4: i2c@990000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 3 QCOM_GPI_SPI>,
- <&gpi_dma0 1 3 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 4 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 4 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1605,8 +1605,8 @@ spi4: spi@990000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 4 QCOM_GPI_I2C>,
- <&gpi_dma0 1 4 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 4 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 4 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1627,8 +1627,8 @@ i2c5: i2c@994000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 4 QCOM_GPI_SPI>,
- <&gpi_dma0 1 4 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 5 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 5 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1649,8 +1649,8 @@ spi5: spi@994000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 5 QCOM_GPI_I2C>,
- <&gpi_dma0 1 5 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 5 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 5 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1671,8 +1671,8 @@ i2c6: i2c@998000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 5 QCOM_GPI_SPI>,
- <&gpi_dma0 1 5 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 6 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 6 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1693,8 +1693,8 @@ spi6: spi@998000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 6 QCOM_GPI_I2C>,
- <&gpi_dma0 1 6 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma0 0 6 QCOM_GPI_SPI>,
+ <&gpi_dma0 1 6 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1715,8 +1715,8 @@ i2c7: i2c@99c000 {
<&aggre1_noc MASTER_QUP_0 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma0 0 6 QCOM_GPI_SPI>,
- <&gpi_dma0 1 6 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma0 0 7 QCOM_GPI_I2C>,
+ <&gpi_dma0 1 7 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1800,8 +1800,8 @@ i2c8: i2c@a80000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 7 QCOM_GPI_I2C>,
- <&gpi_dma1 1 7 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 0 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 0 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1822,8 +1822,8 @@ spi8: spi@a80000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 0 QCOM_GPI_I2C>,
- <&gpi_dma1 1 0 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 0 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 0 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1844,8 +1844,8 @@ i2c9: i2c@a84000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 0 QCOM_GPI_SPI>,
- <&gpi_dma1 1 0 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 1 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 1 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1866,8 +1866,8 @@ spi9: spi@a84000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 1 QCOM_GPI_I2C>,
- <&gpi_dma1 1 1 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 1 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 1 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1888,8 +1888,8 @@ i2c10: i2c@a88000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 1 QCOM_GPI_SPI>,
- <&gpi_dma1 1 1 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 2 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 2 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1910,8 +1910,8 @@ spi10: spi@a88000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 2 QCOM_GPI_I2C>,
- <&gpi_dma1 1 2 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 2 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 2 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1932,8 +1932,8 @@ i2c11: i2c@a8c000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 2 QCOM_GPI_SPI>,
- <&gpi_dma1 1 2 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 3 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 3 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1954,8 +1954,8 @@ spi11: spi@a8c000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 3 QCOM_GPI_I2C>,
- <&gpi_dma1 1 3 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 3 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 3 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -1976,8 +1976,8 @@ i2c12: i2c@a90000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 3 QCOM_GPI_SPI>,
- <&gpi_dma1 1 3 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 4 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 4 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -1998,8 +1998,8 @@ spi12: spi@a90000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 4 QCOM_GPI_I2C>,
- <&gpi_dma1 1 4 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 4 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 4 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -2020,8 +2020,8 @@ i2c13: i2c@a94000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 4 QCOM_GPI_SPI>,
- <&gpi_dma1 1 4 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 5 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 5 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -2042,8 +2042,8 @@ spi13: spi@a94000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 5 QCOM_GPI_I2C>,
- <&gpi_dma1 1 5 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 5 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 5 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -2064,8 +2064,8 @@ i2c14: i2c@a98000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 5 QCOM_GPI_SPI>,
- <&gpi_dma1 1 5 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 6 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 6 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
@@ -2086,8 +2086,8 @@ spi14: spi@a98000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 6 QCOM_GPI_I2C>,
- <&gpi_dma1 1 6 QCOM_GPI_I2C>;
+ dmas = <&gpi_dma1 0 6 QCOM_GPI_SPI>,
+ <&gpi_dma1 1 6 QCOM_GPI_SPI>;
dma-names = "tx",
"rx";
@@ -2108,8 +2108,8 @@ i2c15: i2c@a9c000 {
<&aggre1_noc MASTER_QUP_1 0 &mc_virt SLAVE_EBI1 0>;
interconnect-names = "qup-core", "qup-config", "qup-memory";
- dmas = <&gpi_dma1 0 6 QCOM_GPI_SPI>,
- <&gpi_dma1 1 6 QCOM_GPI_SPI>;
+ dmas = <&gpi_dma1 0 7 QCOM_GPI_I2C>,
+ <&gpi_dma1 1 7 QCOM_GPI_I2C>;
dma-names = "tx",
"rx";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 124/614] arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 123/614] arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 125/614] arm64: dts: qcom: sm8250-samsung-common: correct reserved pins Greg Kroah-Hartman
` (503 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 6030fa06360b8b8d898b66ac156adaaf990b83cb ]
Fix the following DT checker warning:
$nodename:0: 'i2c21' does not match '^i2c(@.+|-[a-z0-9]+)?$'
Fixes: 3a4600448bef ("arm64: dts: qcom: sdm845-starqltechn: add display PMIC")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251015-topic-starltechn_i2c_gpio-v1-1-6d303184ee87@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
index 215e1491f3e9a..493c69e991746 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts
@@ -158,7 +158,7 @@ rmtfs_mem: rmtfs-mem@fde00000 {
};
};
- i2c21 {
+ i2c-21 {
compatible = "i2c-gpio";
sda-gpios = <&tlmm 127 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
scl-gpios = <&tlmm 128 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 125/614] arm64: dts: qcom: sm8250-samsung-common: correct reserved pins
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 124/614] arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 126/614] perf hwmon_pmu: Fix uninitialized variable warning Greg Kroah-Hartman
` (502 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Gonçalves,
Dmitry Baryshkov, Konrad Dybcio, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Gonçalves <ghatto404@gmail.com>
[ Upstream commit 42e56b53a1919dbbd78e140a9f8223f8136ac360 ]
The S20 series has additional reserved pins for the fingerprint sensor,
GPIO 20-23. Correct it by adding them into gpio-reserved-ranges.
Fixes: 6657fe9e9f23 ("arm64: dts: qcom: add initial support for Samsung Galaxy S20 FE")
Signed-off-by: Eric Gonçalves <ghatto404@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251016202129.226449-1-ghatto404@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi b/arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi
index cf3d917addd82..ef7ea4f72bf99 100644
--- a/arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250-samsung-common.dtsi
@@ -159,7 +159,8 @@ &pon_resin {
};
&tlmm {
- gpio-reserved-ranges = <40 4>; /* I2C (Unused) */
+ gpio-reserved-ranges = <20 4>, /* SPI (fingerprint scanner) */
+ <40 4>; /* Unused */
};
&usb_1 {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 126/614] perf hwmon_pmu: Fix uninitialized variable warning
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 125/614] arm64: dts: qcom: sm8250-samsung-common: correct reserved pins Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 127/614] phy: mscc: Fix PTP for VSC8574 and VSC8572 Greg Kroah-Hartman
` (501 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Suchanek, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Suchanek <msuchanek@suse.de>
[ Upstream commit 2fee899c068c159e486e62623afe9e2a4975bd79 ]
The line_len is only set on success. Check the return value instead.
util/hwmon_pmu.c: In function ‘perf_pmus__read_hwmon_pmus’:
util/hwmon_pmu.c:742:20: warning: ‘line_len’ may be used uninitialized [-Wmaybe-uninitialized]
742 | if (line_len > 0 && line[line_len - 1] == '\n')
| ^
util/hwmon_pmu.c:719:24: note: ‘line_len’ was declared here
719 | size_t line_len;
Fixes: 53cc0b351ec9 ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs")
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/hwmon_pmu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/perf/util/hwmon_pmu.c b/tools/perf/util/hwmon_pmu.c
index 416dfea9ffff6..5c27256a220a5 100644
--- a/tools/perf/util/hwmon_pmu.c
+++ b/tools/perf/util/hwmon_pmu.c
@@ -742,8 +742,7 @@ int perf_pmus__read_hwmon_pmus(struct list_head *pmus)
continue;
}
io__init(&io, name_fd, buf2, sizeof(buf2));
- io__getline(&io, &line, &line_len);
- if (line_len > 0 && line[line_len - 1] == '\n')
+ if (io__getline(&io, &line, &line_len) > 0 && line[line_len - 1] == '\n')
line[line_len - 1] = '\0';
hwmon_pmu__new(pmus, buf, class_hwmon_ent->d_name, line);
close(name_fd);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 127/614] phy: mscc: Fix PTP for VSC8574 and VSC8572
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 126/614] perf hwmon_pmu: Fix uninitialized variable warning Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 128/614] sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock() Greg Kroah-Hartman
` (500 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Chevallier, Horatiu Vultur,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Horatiu Vultur <horatiu.vultur@microchip.com>
[ Upstream commit ea5df88aeca112aac69e6c32e3dd1433a113b0c9 ]
The PTP initialization is two-step. First part are the function
vsc8584_ptp_probe_once() and vsc8584_ptp_probe() at probe time which
initialize the locks, queues, creates the PTP device. The second part is
the function vsc8584_ptp_init() at config_init() time which initialize
PTP in the HW.
For VSC8574 and VSC8572, the PTP initialization is incomplete. It is
missing the first part but it makes the second part. Meaning that the
ptp_clock_register() is never called.
There is no crash without the first part when enabling PTP but this is
unexpected because some PHys have PTP functionality exposed by the
driver and some don't even though they share the same PTP clock PTP.
Fixes: 774626fa440e ("net: phy: mscc: Add PTP support for 2 more VSC PHYs")
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Link: https://patch.msgid.link/20251023191350.190940-3-horatiu.vultur@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/mscc/mscc_main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
index ef0ef1570d392..48d43f60b8ff8 100644
--- a/drivers/net/phy/mscc/mscc_main.c
+++ b/drivers/net/phy/mscc/mscc_main.c
@@ -2625,7 +2625,7 @@ static struct phy_driver vsc85xx_driver[] = {
.suspend = &genphy_suspend,
.resume = &genphy_resume,
.remove = &vsc85xx_remove,
- .probe = &vsc8574_probe,
+ .probe = &vsc8584_probe,
.set_wol = &vsc85xx_wol_set,
.get_wol = &vsc85xx_wol_get,
.get_tunable = &vsc85xx_get_tunable,
@@ -2648,12 +2648,12 @@ static struct phy_driver vsc85xx_driver[] = {
.config_aneg = &vsc85xx_config_aneg,
.aneg_done = &genphy_aneg_done,
.read_status = &vsc85xx_read_status,
- .handle_interrupt = vsc85xx_handle_interrupt,
+ .handle_interrupt = vsc8584_handle_interrupt,
.config_intr = &vsc85xx_config_intr,
.suspend = &genphy_suspend,
.resume = &genphy_resume,
.remove = &vsc85xx_remove,
- .probe = &vsc8574_probe,
+ .probe = &vsc8584_probe,
.set_wol = &vsc85xx_wol_set,
.get_wol = &vsc85xx_wol_get,
.get_tunable = &vsc85xx_get_tunable,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 128/614] sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 127/614] phy: mscc: Fix PTP for VSC8574 and VSC8572 Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 129/614] arm64: dts: qcom: qcm2290: Fix camss register prop ordering Greg Kroah-Hartman
` (499 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Xin Long,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 622e8838a29845316668ec2e7648428878df7f9a ]
SCTP_DBG_OBJCNT_INC() is called only when sctp_init_sock()
returns 0 after successfully allocating sctp_sk(sk)->ep.
OTOH, SCTP_DBG_OBJCNT_DEC() is called in sctp_close().
The code seems to expect that the socket is always exposed
to userspace once SCTP_DBG_OBJCNT_INC() is incremented, but
there is a path where the assumption is not true.
In sctp_accept(), sctp_sock_migrate() could fail after
sctp_init_sock().
Then, sk_common_release() does not call inet_release() nor
sctp_close(). Instead, it calls sk->sk_prot->destroy().
Let's move SCTP_DBG_OBJCNT_DEC() from sctp_close() to
sctp_destroy_sock().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251023231751.4168390-2-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/socket.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ed8293a342402..d190e75e46454 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1553,8 +1553,6 @@ static void sctp_close(struct sock *sk, long timeout)
spin_unlock_bh(&net->sctp.addr_wq_lock);
sock_put(sk);
-
- SCTP_DBG_OBJCNT_DEC(sock);
}
/* Handle EPIPE error. */
@@ -5109,9 +5107,12 @@ static void sctp_destroy_sock(struct sock *sk)
sp->do_auto_asconf = 0;
list_del(&sp->auto_asconf_list);
}
+
sctp_endpoint_free(sp->ep);
+
sk_sockets_allocated_dec(sk);
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+ SCTP_DBG_OBJCNT_DEC(sock);
}
static void sctp_destruct_sock(struct sock *sk)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 129/614] arm64: dts: qcom: qcm2290: Fix camss register prop ordering
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 128/614] sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 130/614] RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Greg Kroah-Hartman
` (498 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Loic Poulain, Bjorn Andersson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 67445dc8a8060309eeb7aebbc41fa0e58302fc09 ]
The qcm2290 CAMSS node has been applied from the V4 series, but a later
version changed the order of the register property, fix it to prevent
dtb check error.
Fixes: 2b3aef30dd9d ("arm64: dts: qcom: qcm2290: Add CAMSS node")
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250918155456.1158691-1-loic.poulain@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qcm2290.dtsi | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/qcm2290.dtsi b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
index 08141b41de246..3b0ba590ee825 100644
--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
@@ -1685,25 +1685,25 @@ cci_i2c1: i2c-bus@1 {
};
};
- camss: camss@5c6e000 {
+ camss: camss@5c11000 {
compatible = "qcom,qcm2290-camss";
- reg = <0x0 0x5c6e000 0x0 0x1000>,
+ reg = <0x0 0x5c11000 0x0 0x1000>,
+ <0x0 0x5c6e000 0x0 0x1000>,
<0x0 0x5c75000 0x0 0x1000>,
<0x0 0x5c52000 0x0 0x1000>,
<0x0 0x5c53000 0x0 0x1000>,
<0x0 0x5c66000 0x0 0x400>,
<0x0 0x5c68000 0x0 0x400>,
- <0x0 0x5c11000 0x0 0x1000>,
<0x0 0x5c6f000 0x0 0x4000>,
<0x0 0x5c76000 0x0 0x4000>;
- reg-names = "csid0",
+ reg-names = "top",
+ "csid0",
"csid1",
"csiphy0",
"csiphy1",
"csitpg0",
"csitpg1",
- "top",
"vfe0",
"vfe1";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 130/614] RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 129/614] arm64: dts: qcom: qcm2290: Fix camss register prop ordering Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 131/614] ARM: dts: renesas: gose: Remove superfluous port property Greg Kroah-Hartman
` (497 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Yi, Zhu Yanjun, Leon Romanovsky,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <yanjun.zhu@linux.dev>
[ Upstream commit 503a5e4690ae14c18570141bc0dcf7501a8419b0 ]
A NULL pointer dereference can occur in rxe_srq_chk_attr() when
ibv_modify_srq() is invoked twice in succession under certain error
conditions. The first call may fail in rxe_queue_resize(), which leads
rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then
triggers a crash (null deref) when accessing
srq->rq.queue->buf->index_mask.
Call Trace:
<TASK>
rxe_modify_srq+0x170/0x480 [rdma_rxe]
? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe]
? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs]
? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs]
ib_uverbs_modify_srq+0x204/0x290 [ib_uverbs]
? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs]
? tryinc_node_nr_active+0xe6/0x150
? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]
ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs]
? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]
? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]
ib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs]
? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]
ib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs]
? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs]
? __pfx___raw_spin_lock_irqsave+0x10/0x10
? __pfx_do_vfs_ioctl+0x10/0x10
? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0
? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10
ib_uverbs_ioctl+0x13e/0x220 [ib_uverbs]
? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs]
__x64_sys_ioctl+0x138/0x1c0
do_syscall_64+0x82/0x250
? fdget_pos+0x58/0x4c0
? ksys_write+0xf3/0x1c0
? __pfx_ksys_write+0x10/0x10
? do_syscall_64+0xc8/0x250
? __pfx_vm_mmap_pgoff+0x10/0x10
? fget+0x173/0x230
? fput+0x2a/0x80
? ksys_mmap_pgoff+0x224/0x4c0
? do_syscall_64+0xc8/0x250
? do_user_addr_fault+0x37b/0xfe0
? clear_bhb_loop+0x50/0xa0
? clear_bhb_loop+0x50/0xa0
? clear_bhb_loop+0x50/0xa0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Tested-by: Liu Yi <asatsuyu.liu@gmail.com>
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20251027215203.1321-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/rxe/rxe_srq.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
index 3661cb627d28a..2a234f26ac104 100644
--- a/drivers/infiniband/sw/rxe/rxe_srq.c
+++ b/drivers/infiniband/sw/rxe/rxe_srq.c
@@ -171,7 +171,7 @@ int rxe_srq_from_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
udata, mi, &srq->rq.producer_lock,
&srq->rq.consumer_lock);
if (err)
- goto err_free;
+ return err;
srq->rq.max_wr = attr->max_wr;
}
@@ -180,11 +180,6 @@ int rxe_srq_from_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
srq->limit = attr->srq_limit;
return 0;
-
-err_free:
- rxe_queue_cleanup(q);
- srq->rq.queue = NULL;
- return err;
}
void rxe_srq_cleanup(struct rxe_pool_elem *elem)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 131/614] ARM: dts: renesas: gose: Remove superfluous port property
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 130/614] RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 132/614] ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Greg Kroah-Hartman
` (496 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 00df14f34615630f92f97c9d6790bd9d25c4242d ]
'bus-width' is defined for the corresponding vin input port already.
No need to declare it in the output port again. Fixes:
arch/arm/boot/dts/renesas/r8a7793-gose.dtb: composite-in@20 (adi,adv7180cp): ports:port@3:endpoint: Unevaluated properties are not allowed ('bus-width' was unexpected)
from schema $id: http://devicetree.org/schemas/media/i2c/adi,adv7180.yaml#
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250929093616.17679-2-wsa+renesas@sang-engineering.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm/boot/dts/renesas/r8a7793-gose.dts b/arch/arm/boot/dts/renesas/r8a7793-gose.dts
index 45b267ec26794..5c6928c941aca 100644
--- a/arch/arm/boot/dts/renesas/r8a7793-gose.dts
+++ b/arch/arm/boot/dts/renesas/r8a7793-gose.dts
@@ -373,7 +373,6 @@ adv7180_in: endpoint {
port@3 {
reg = <3>;
adv7180_out: endpoint {
- bus-width = <8>;
remote-endpoint = <&vin1ep>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 132/614] ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 131/614] ARM: dts: renesas: gose: Remove superfluous port property Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 133/614] drm/amdgpu: add userq object va track helpers Greg Kroah-Hartman
` (495 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit ca7fffb6e92a7c93604ea2bae0e1c89b20750937 ]
The 'ethernet-ports' node in the SoC DTSI handles them already. Fixes:
arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dtb: switch@44050000 (renesas,r9a06g032-a5psw): Unevaluated properties are not allowed ('#address-cells', '#size-cells' were unexpected)
from schema $id: http://devicetree.org/schemas/net/dsa/renesas,rzn1-a5psw.yaml#
Fixes: 5b6d7c3c5861ad4a ("ARM: dts: r9a06g032-rzn1d400-db: Add switch description")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251007104624.19786-2-wsa+renesas@sang-engineering.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts b/arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts
index 3258b2e274346..4a72aa7663f25 100644
--- a/arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts
+++ b/arch/arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts
@@ -308,8 +308,6 @@ &rtc0 {
&switch {
status = "okay";
- #address-cells = <1>;
- #size-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&pins_eth3>, <&pins_eth4>, <&pins_mdio1>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 133/614] drm/amdgpu: add userq object va track helpers
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 132/614] ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 134/614] drm/amdgpu/userq: fix SDMA and compute validation Greg Kroah-Hartman
` (494 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prike Liang, Alex Deucher,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <Prike.Liang@amd.com>
[ Upstream commit 5cfa33fabf01f2cc0af6b1feed6e65cb81806a37 ]
Add the userq object virtual address list_add() helpers
for tracking the userq obj va address usage.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: a0559012a18a ("drm/amdgpu/userq: fix SDMA and compute validation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 ++++++++++++++++------
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 ++++--
drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 16 ++++----
4 files changed, 52 insertions(+), 21 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
index 656b8a931dae8..52c2d1731aabf 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
@@ -96,6 +96,7 @@ struct amdgpu_bo_va {
* if non-zero, cannot unmap from GPU because user queues may still access it
*/
unsigned int queue_refcount;
+ atomic_t userq_va_mapped;
};
struct amdgpu_bo {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index 1add21160d218..79c7fa0a9ff7b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -44,10 +44,29 @@ u32 amdgpu_userq_get_supported_ip_mask(struct amdgpu_device *adev)
return userq_ip_mask;
}
-int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
- u64 expected_size)
+static int amdgpu_userq_buffer_va_list_add(struct amdgpu_usermode_queue *queue,
+ struct amdgpu_bo_va_mapping *va_map, u64 addr)
+{
+ struct amdgpu_userq_va_cursor *va_cursor;
+ struct userq_va_list;
+
+ va_cursor = kzalloc(sizeof(*va_cursor), GFP_KERNEL);
+ if (!va_cursor)
+ return -ENOMEM;
+
+ INIT_LIST_HEAD(&va_cursor->list);
+ va_cursor->gpu_addr = addr;
+ atomic_set(&va_map->bo_va->userq_va_mapped, 1);
+ list_add(&va_cursor->list, &queue->userq_va_list);
+
+ return 0;
+}
+
+int amdgpu_userq_input_va_validate(struct amdgpu_usermode_queue *queue,
+ u64 addr, u64 expected_size)
{
struct amdgpu_bo_va_mapping *va_map;
+ struct amdgpu_vm *vm = queue->vm;
u64 user_addr;
u64 size;
int r = 0;
@@ -67,6 +86,7 @@ int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
/* Only validate the userq whether resident in the VM mapping range */
if (user_addr >= va_map->start &&
va_map->last - user_addr + 1 >= size) {
+ amdgpu_userq_buffer_va_list_add(queue, va_map, user_addr);
amdgpu_bo_unreserve(vm->root.bo);
return 0;
}
@@ -185,6 +205,7 @@ amdgpu_userq_cleanup(struct amdgpu_userq_mgr *uq_mgr,
uq_funcs->mqd_destroy(uq_mgr, queue);
amdgpu_userq_fence_driver_free(queue);
idr_remove(&uq_mgr->userq_idr, queue_id);
+ list_del(&queue->userq_va_list);
kfree(queue);
}
@@ -505,14 +526,7 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
goto unlock;
}
- /* Validate the userq virtual address.*/
- if (amdgpu_userq_input_va_validate(&fpriv->vm, args->in.queue_va, args->in.queue_size) ||
- amdgpu_userq_input_va_validate(&fpriv->vm, args->in.rptr_va, AMDGPU_GPU_PAGE_SIZE) ||
- amdgpu_userq_input_va_validate(&fpriv->vm, args->in.wptr_va, AMDGPU_GPU_PAGE_SIZE)) {
- r = -EINVAL;
- kfree(queue);
- goto unlock;
- }
+ INIT_LIST_HEAD(&queue->userq_va_list);
queue->doorbell_handle = args->in.doorbell_handle;
queue->queue_type = args->in.ip_type;
queue->vm = &fpriv->vm;
@@ -523,6 +537,15 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
db_info.db_obj = &queue->db_obj;
db_info.doorbell_offset = args->in.doorbell_offset;
+ /* Validate the userq virtual address.*/
+ if (amdgpu_userq_input_va_validate(queue, args->in.queue_va, args->in.queue_size) ||
+ amdgpu_userq_input_va_validate(queue, args->in.rptr_va, AMDGPU_GPU_PAGE_SIZE) ||
+ amdgpu_userq_input_va_validate(queue, args->in.wptr_va, AMDGPU_GPU_PAGE_SIZE)) {
+ r = -EINVAL;
+ kfree(queue);
+ goto unlock;
+ }
+
/* Convert relative doorbell offset into absolute doorbell index */
index = amdgpu_userq_get_doorbell_index(uq_mgr, &db_info, filp);
if (index == (uint64_t)-EINVAL) {
@@ -548,7 +571,6 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
goto unlock;
}
-
qid = idr_alloc(&uq_mgr->userq_idr, queue, 1, AMDGPU_MAX_USERQ_COUNT, GFP_KERNEL);
if (qid < 0) {
drm_file_err(uq_mgr->file, "Failed to allocate a queue id\n");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
index c027dd9166727..dbc13a807ca82 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
@@ -47,6 +47,11 @@ struct amdgpu_userq_obj {
struct amdgpu_bo *obj;
};
+struct amdgpu_userq_va_cursor {
+ u64 gpu_addr;
+ struct list_head list;
+};
+
struct amdgpu_usermode_queue {
int queue_type;
enum amdgpu_userq_state state;
@@ -66,6 +71,8 @@ struct amdgpu_usermode_queue {
u32 xcp_id;
int priority;
struct dentry *debugfs_queue;
+
+ struct list_head userq_va_list;
};
struct amdgpu_userq_funcs {
@@ -136,7 +143,6 @@ int amdgpu_userq_stop_sched_for_enforce_isolation(struct amdgpu_device *adev,
u32 idx);
int amdgpu_userq_start_sched_for_enforce_isolation(struct amdgpu_device *adev,
u32 idx);
-
-int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
- u64 expected_size);
+int amdgpu_userq_input_va_validate(struct amdgpu_usermode_queue *queue,
+ u64 addr, u64 expected_size);
#endif
diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
index 1cd9eaeef38f9..5c63480dda9c4 100644
--- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
@@ -298,8 +298,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
goto free_mqd;
}
- if (amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va,
- max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE)))
+ r = amdgpu_userq_input_va_validate(queue, compute_mqd->eop_va,
+ max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE));
+ if (r)
goto free_mqd;
userq_props->eop_gpu_addr = compute_mqd->eop_va;
@@ -330,8 +331,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
userq_props->tmz_queue =
mqd_user->flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE;
- if (amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va,
- shadow_info.shadow_size))
+ r = amdgpu_userq_input_va_validate(queue, mqd_gfx_v11->shadow_va,
+ shadow_info.shadow_size);
+ if (r)
goto free_mqd;
kfree(mqd_gfx_v11);
@@ -350,9 +352,9 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
r = -ENOMEM;
goto free_mqd;
}
-
- if (amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va,
- shadow_info.csa_size))
+ r = amdgpu_userq_input_va_validate(queue, mqd_sdma_v11->csa_va,
+ shadow_info.csa_size);
+ if (r)
goto free_mqd;
userq_props->csa_addr = mqd_sdma_v11->csa_va;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 134/614] drm/amdgpu/userq: fix SDMA and compute validation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 133/614] drm/amdgpu: add userq object va track helpers Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 135/614] wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Greg Kroah-Hartman
` (493 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prike Liang, Alex Deucher,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit a0559012a18a5a6ad87516e982892765a403b8ab ]
The CSA and EOP buffers have different alignement requirements.
Hardcode them for now as a bug fix. A proper query will be added in
a subsequent patch.
v2: verify gfx shadow helper callback (Prike)
Fixes: 9e46b8bb0539 ("drm/amdgpu: validate userq buffer virtual address and size")
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
index 5c63480dda9c4..f5aa83ff57f35 100644
--- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
@@ -254,7 +254,6 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
struct amdgpu_mqd *mqd_hw_default = &adev->mqds[queue->queue_type];
struct drm_amdgpu_userq_in *mqd_user = args_in;
struct amdgpu_mqd_prop *userq_props;
- struct amdgpu_gfx_shadow_info shadow_info;
int r;
/* Structure to initialize MQD for userqueue using generic MQD init function */
@@ -280,8 +279,6 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
userq_props->doorbell_index = queue->doorbell_index;
userq_props->fence_address = queue->fence_drv->gpu_addr;
- if (adev->gfx.funcs->get_gfx_shadow_info)
- adev->gfx.funcs->get_gfx_shadow_info(adev, &shadow_info, true);
if (queue->queue_type == AMDGPU_HW_IP_COMPUTE) {
struct drm_amdgpu_userq_mqd_compute_gfx11 *compute_mqd;
@@ -299,7 +296,7 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
}
r = amdgpu_userq_input_va_validate(queue, compute_mqd->eop_va,
- max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE));
+ 2048);
if (r)
goto free_mqd;
@@ -312,6 +309,14 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
kfree(compute_mqd);
} else if (queue->queue_type == AMDGPU_HW_IP_GFX) {
struct drm_amdgpu_userq_mqd_gfx11 *mqd_gfx_v11;
+ struct amdgpu_gfx_shadow_info shadow_info;
+
+ if (adev->gfx.funcs->get_gfx_shadow_info) {
+ adev->gfx.funcs->get_gfx_shadow_info(adev, &shadow_info, true);
+ } else {
+ r = -EINVAL;
+ goto free_mqd;
+ }
if (mqd_user->mqd_size != sizeof(*mqd_gfx_v11) || !mqd_user->mqd) {
DRM_ERROR("Invalid GFX MQD\n");
@@ -335,6 +340,10 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
shadow_info.shadow_size);
if (r)
goto free_mqd;
+ r = amdgpu_userq_input_va_validate(queue, mqd_gfx_v11->csa_va,
+ shadow_info.csa_size);
+ if (r)
+ goto free_mqd;
kfree(mqd_gfx_v11);
} else if (queue->queue_type == AMDGPU_HW_IP_DMA) {
@@ -353,7 +362,7 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
goto free_mqd;
}
r = amdgpu_userq_input_va_validate(queue, mqd_sdma_v11->csa_va,
- shadow_info.csa_size);
+ 32);
if (r)
goto free_mqd;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 135/614] wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 134/614] drm/amdgpu/userq: fix SDMA and compute validation Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 136/614] Revert "mtd: rawnand: marvell: fix layouts" Greg Kroah-Hartman
` (492 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Qiang, Miri Korenblit,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Qiang <liqiang01@kylinos.cn>
[ Upstream commit 3df28496673bd8009f1cd3a85a63650c96e369f4 ]
Add a missing NULL pointer check after kzalloc() in
iwl_mld_send_proto_offload(). Without this check, a failed
allocation could lead to a NULL dereference.
Fixes: d1e879ec600f9 ("wifi: iwlwifi: add iwlmld sub-driver")
Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
Link: https://patch.msgid.link/20251017041128.1379715-1-liqiang01@kylinos.cn
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
index 1d4282a21f09e..dd85be94433cc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c
@@ -1794,6 +1794,10 @@ iwl_mld_send_proto_offload(struct iwl_mld *mld,
u32 enabled = 0;
cmd = kzalloc(hcmd.len[0], GFP_KERNEL);
+ if (!cmd) {
+ IWL_DEBUG_WOWLAN(mld, "Failed to allocate proto offload cmd\n");
+ return -ENOMEM;
+ }
#if IS_ENABLED(CONFIG_IPV6)
struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(vif);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 136/614] Revert "mtd: rawnand: marvell: fix layouts"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 135/614] wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 137/614] mtd: nand: relax ECC parameter validation check Greg Kroah-Hartman
` (491 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aryan Srivastava, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
[ Upstream commit fbd72cb463fdea3a0c900dd5d6e813cdebc3a73c ]
This reverts commit e6a30d0c48a1e8a68f1cc413bee65302ab03ddfb.
This change resulted in the 8bit ECC layouts having the incorrect amount
of read/write chunks, the last spare bytes chunk would always be missed.
Fixes: e6a30d0c48a1 ("mtd: rawnand: marvell: fix layouts")
Signed-off-by: Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 303b3016a070b..38b7eb5b992c8 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -290,13 +290,16 @@ static const struct marvell_hw_ecc_layout marvell_nfc_layouts[] = {
MARVELL_LAYOUT( 2048, 512, 4, 1, 1, 2048, 32, 30, 0, 0, 0),
MARVELL_LAYOUT( 2048, 512, 8, 2, 1, 1024, 0, 30,1024,32, 30),
MARVELL_LAYOUT( 2048, 512, 8, 2, 1, 1024, 0, 30,1024,64, 30),
- MARVELL_LAYOUT( 2048, 512, 16, 4, 4, 512, 0, 30, 0, 32, 30),
+ MARVELL_LAYOUT( 2048, 512, 12, 3, 2, 704, 0, 30,640, 0, 30),
+ MARVELL_LAYOUT( 2048, 512, 16, 5, 4, 512, 0, 30, 0, 32, 30),
MARVELL_LAYOUT( 4096, 512, 4, 2, 2, 2048, 32, 30, 0, 0, 0),
- MARVELL_LAYOUT( 4096, 512, 8, 4, 4, 1024, 0, 30, 0, 64, 30),
- MARVELL_LAYOUT( 4096, 512, 16, 8, 8, 512, 0, 30, 0, 32, 30),
+ MARVELL_LAYOUT( 4096, 512, 8, 5, 4, 1024, 0, 30, 0, 64, 30),
+ MARVELL_LAYOUT( 4096, 512, 12, 6, 5, 704, 0, 30,576, 32, 30),
+ MARVELL_LAYOUT( 4096, 512, 16, 9, 8, 512, 0, 30, 0, 32, 30),
MARVELL_LAYOUT( 8192, 512, 4, 4, 4, 2048, 0, 30, 0, 0, 0),
- MARVELL_LAYOUT( 8192, 512, 8, 8, 8, 1024, 0, 30, 0, 160, 30),
- MARVELL_LAYOUT( 8192, 512, 16, 16, 16, 512, 0, 30, 0, 32, 30),
+ MARVELL_LAYOUT( 8192, 512, 8, 9, 8, 1024, 0, 30, 0, 160, 30),
+ MARVELL_LAYOUT( 8192, 512, 12, 12, 11, 704, 0, 30,448, 64, 30),
+ MARVELL_LAYOUT( 8192, 512, 16, 17, 16, 512, 0, 30, 0, 32, 30),
};
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 137/614] mtd: nand: relax ECC parameter validation check
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 136/614] Revert "mtd: rawnand: marvell: fix layouts" Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 138/614] mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove Greg Kroah-Hartman
` (490 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aryan Srivastava, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
[ Upstream commit 050553c683f21eebd7d1020df9b2ec852e2a9e4e ]
Due to the custom handling and layouts of certain nand controllers this
validity check will always fail for certain layouts. The check
inherently depends on even chunk sizing and this is not always the
case.
Modify the check to only print a warning, instead of failing to
init the attached NAND. This allows various 8 bit and 12 ECC strength
layouts to be used.
Fixes: 68c18dae6888 ("mtd: rawnand: marvell: add missing layouts")
Signed-off-by: Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/nand_base.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index c7d9501f646b3..ad6d66309597b 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -6338,11 +6338,14 @@ static int nand_scan_tail(struct nand_chip *chip)
ecc->steps = mtd->writesize / ecc->size;
if (!base->ecc.ctx.nsteps)
base->ecc.ctx.nsteps = ecc->steps;
- if (ecc->steps * ecc->size != mtd->writesize) {
- WARN(1, "Invalid ECC parameters\n");
- ret = -EINVAL;
- goto err_nand_manuf_cleanup;
- }
+
+ /*
+ * Validity check: Warn if ECC parameters are not compatible with page size.
+ * Due to the custom handling of ECC blocks in certain controllers the check
+ * may result in an expected failure.
+ */
+ if (ecc->steps * ecc->size != mtd->writesize)
+ pr_warn("ECC parameters may be invalid in reference to underlying NAND chip\n");
if (!ecc->total) {
ecc->total = ecc->steps * ecc->bytes;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 138/614] mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 137/614] mtd: nand: relax ECC parameter validation check Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 139/614] bpf: Refactor stack map trace depth calculation into helper function Greg Kroah-Hartman
` (489 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit cdf44f1add4ec9ee80569d5a43e6e9bba0d74c7a ]
The driver calls gpiod_get_optional() in the probe function but
never calls gpiod_put() in the remove function or in the probe
error path. This leads to a GPIO descriptor resource leak.
The lpc32xx_mlc.c driver in the same directory handles this
correctly by calling gpiod_put() on both paths.
Add gpiod_put() in the remove function and in the probe error path
to fix the resource leak.
Fixes: 6b923db2867c ("mtd: rawnand: lpc32xx_slc: switch to using gpiod API")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/lpc32xx_slc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mtd/nand/raw/lpc32xx_slc.c b/drivers/mtd/nand/raw/lpc32xx_slc.c
index b54d76547ffb2..fea3705a21386 100644
--- a/drivers/mtd/nand/raw/lpc32xx_slc.c
+++ b/drivers/mtd/nand/raw/lpc32xx_slc.c
@@ -937,6 +937,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
dma_release_channel(host->dma_chan);
enable_wp:
lpc32xx_wp_enable(host);
+ gpiod_put(host->wp_gpio);
return res;
}
@@ -962,6 +963,7 @@ static void lpc32xx_nand_remove(struct platform_device *pdev)
writel(tmp, SLC_CTRL(host->io_base));
lpc32xx_wp_enable(host);
+ gpiod_put(host->wp_gpio);
}
static int lpc32xx_nand_resume(struct platform_device *pdev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 139/614] bpf: Refactor stack map trace depth calculation into helper function
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 138/614] mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 140/614] bpf: Fix stackmap overflow check in __bpf_get_stackid() Greg Kroah-Hartman
` (488 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnaud Lecomte, Andrii Nakryiko,
Yonghong Song, Song Liu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Lecomte <contact@arnaud-lcm.com>
[ Upstream commit e17d62fedd10ae56e2426858bd0757da544dbc73 ]
Extract the duplicated maximum allowed depth computation for stack
traces stored in BPF stacks from bpf_get_stackid() and __bpf_get_stack()
into a dedicated stack_map_calculate_max_depth() helper function.
This unifies the logic for:
- The max depth computation
- Enforcing the sysctl_perf_event_max_stack limit
No functional changes for existing code paths.
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20251025192858.31424-1-contact@arnaud-lcm.com
Stable-dep-of: 23f852daa4ba ("bpf: Fix stackmap overflow check in __bpf_get_stackid()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/stackmap.c | 47 +++++++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 15 deletions(-)
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 4d53cdd1374cf..5e9ad050333c2 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -42,6 +42,28 @@ static inline int stack_map_data_size(struct bpf_map *map)
sizeof(struct bpf_stack_build_id) : sizeof(u64);
}
+/**
+ * stack_map_calculate_max_depth - Calculate maximum allowed stack trace depth
+ * @size: Size of the buffer/map value in bytes
+ * @elem_size: Size of each stack trace element
+ * @flags: BPF stack trace flags (BPF_F_USER_STACK, BPF_F_USER_BUILD_ID, ...)
+ *
+ * Return: Maximum number of stack trace entries that can be safely stored
+ */
+static u32 stack_map_calculate_max_depth(u32 size, u32 elem_size, u64 flags)
+{
+ u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ u32 max_depth;
+ u32 curr_sysctl_max_stack = READ_ONCE(sysctl_perf_event_max_stack);
+
+ max_depth = size / elem_size;
+ max_depth += skip;
+ if (max_depth > curr_sysctl_max_stack)
+ return curr_sysctl_max_stack;
+
+ return max_depth;
+}
+
static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
{
u64 elem_size = sizeof(struct stack_map_bucket) +
@@ -300,20 +322,17 @@ static long __bpf_get_stackid(struct bpf_map *map,
BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
u64, flags)
{
- u32 max_depth = map->value_size / stack_map_data_size(map);
- u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ u32 elem_size = stack_map_data_size(map);
bool user = flags & BPF_F_USER_STACK;
struct perf_callchain_entry *trace;
bool kernel = !user;
+ u32 max_depth;
if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
return -EINVAL;
- max_depth += skip;
- if (max_depth > sysctl_perf_event_max_stack)
- max_depth = sysctl_perf_event_max_stack;
-
+ max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);
trace = get_perf_callchain(regs, kernel, user, max_depth,
false, false);
@@ -406,7 +425,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
struct perf_callchain_entry *trace_in,
void *buf, u32 size, u64 flags, bool may_fault)
{
- u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
+ u32 trace_nr, copy_len, elem_size, max_depth;
bool user_build_id = flags & BPF_F_USER_BUILD_ID;
bool crosstask = task && task != current;
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
@@ -438,21 +457,20 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
goto clear;
}
- num_elem = size / elem_size;
- max_depth = num_elem + skip;
- if (sysctl_perf_event_max_stack < max_depth)
- max_depth = sysctl_perf_event_max_stack;
+ max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
if (may_fault)
rcu_read_lock(); /* need RCU for perf's callchain below */
- if (trace_in)
+ if (trace_in) {
trace = trace_in;
- else if (kernel && task)
+ trace->nr = min_t(u32, trace->nr, max_depth);
+ } else if (kernel && task) {
trace = get_callchain_entry_for_task(task, max_depth);
- else
+ } else {
trace = get_perf_callchain(regs, kernel, user, max_depth,
crosstask, false);
+ }
if (unlikely(!trace) || trace->nr < skip) {
if (may_fault)
@@ -461,7 +479,6 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
}
trace_nr = trace->nr - skip;
- trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
copy_len = trace_nr * elem_size;
ips = trace->ip + skip;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 140/614] bpf: Fix stackmap overflow check in __bpf_get_stackid()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 139/614] bpf: Refactor stack map trace depth calculation into helper function Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 141/614] perf/x86/intel/cstate: Remove PC3 support from LunarLake Greg Kroah-Hartman
` (487 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c9b724fbb41cf2538b7b,
Arnaud Lecomte, Andrii Nakryiko, Yonghong Song, Song Liu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaud Lecomte <contact@arnaud-lcm.com>
[ Upstream commit 23f852daa4bab4d579110e034e4d513f7d490846 ]
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
contains more stack entries than the stack map bucket can hold,
leading to an out-of-bounds write in the bucket's data array.
Fixes: ee2a098851bf ("bpf: Adjust BPF stack helper functions to accommodate skip > 0")
Reported-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20251025192941.1500-1-contact@arnaud-lcm.com
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/stackmap.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 5e9ad050333c2..2365541c81dd1 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -251,8 +251,8 @@ static long __bpf_get_stackid(struct bpf_map *map,
{
struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
+ u32 hash, id, trace_nr, trace_len, i, max_depth;
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
- u32 hash, id, trace_nr, trace_len, i;
bool user = flags & BPF_F_USER_STACK;
u64 *ips;
bool hash_matches;
@@ -261,7 +261,8 @@ static long __bpf_get_stackid(struct bpf_map *map,
/* skipping more than usable stack trace */
return -EFAULT;
- trace_nr = trace->nr - skip;
+ max_depth = stack_map_calculate_max_depth(map->value_size, stack_map_data_size(map), flags);
+ trace_nr = min_t(u32, trace->nr - skip, max_depth - skip);
trace_len = trace_nr * sizeof(u64);
ips = trace->ip + skip;
hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
@@ -390,15 +391,11 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
return -EFAULT;
nr_kernel = count_kernel_ip(trace);
+ __u64 nr = trace->nr; /* save original */
if (kernel) {
- __u64 nr = trace->nr;
-
trace->nr = nr_kernel;
ret = __bpf_get_stackid(map, trace, flags);
-
- /* restore nr */
- trace->nr = nr;
} else { /* user */
u64 skip = flags & BPF_F_SKIP_FIELD_MASK;
@@ -409,6 +406,10 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
flags = (flags & ~BPF_F_SKIP_FIELD_MASK) | skip;
ret = __bpf_get_stackid(map, trace, flags);
}
+
+ /* restore nr */
+ trace->nr = nr;
+
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 141/614] perf/x86/intel/cstate: Remove PC3 support from LunarLake
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 140/614] bpf: Fix stackmap overflow check in __bpf_get_stackid() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 142/614] task_work: Fix NMI race condition Greg Kroah-Hartman
` (486 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Rui, Peter Zijlstra (Intel),
Kan Liang, Dapeng Mi, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
[ Upstream commit 4ba45f041abe60337fdeeb68553b9ee1217d544e ]
LunarLake doesn't support Package C3. Remove the PC3 residency counter
support from LunarLake.
Fixes: 26579860fbd5 ("perf/x86/intel/cstate: Add Lunarlake support")
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20251023223754.1743928-3-zide.chen@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/cstate.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index ec753e39b0077..6f5286a99e0c3 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -70,7 +70,7 @@
* perf code: 0x01
* Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,KNL,
* GLM,CNL,KBL,CML,ICL,TGL,TNT,RKL,
- * ADL,RPL,MTL,ARL,LNL
+ * ADL,RPL,MTL,ARL
* Scope: Package (physical package)
* MSR_PKG_C6_RESIDENCY: Package C6 Residency Counter.
* perf code: 0x02
@@ -522,7 +522,6 @@ static const struct cstate_model lnl_cstates __initconst = {
BIT(PERF_CSTATE_CORE_C7_RES),
.pkg_events = BIT(PERF_CSTATE_PKG_C2_RES) |
- BIT(PERF_CSTATE_PKG_C3_RES) |
BIT(PERF_CSTATE_PKG_C6_RES) |
BIT(PERF_CSTATE_PKG_C10_RES),
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 142/614] task_work: Fix NMI race condition
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 141/614] perf/x86/intel/cstate: Remove PC3 support from LunarLake Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 143/614] drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros Greg Kroah-Hartman
` (485 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josh Poimboeuf,
Peter Zijlstra (Intel), Steven Rostedt (Google), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit ef1ea98c8fffe227e5319215d84a53fa2a4bcebc ]
__schedule()
// disable irqs
<NMI>
task_work_add(current, work, TWA_NMI_CURRENT);
</NMI>
// current = next;
// enable irqs
<IRQ>
task_work_set_notify_irq()
test_and_set_tsk_thread_flag(current,
TIF_NOTIFY_RESUME); // wrong task!
</IRQ>
// original task skips task work on its next return to user (or exit!)
Fixes: 466e4d801cd4 ("task_work: Add TWA_NMI_CURRENT as an additional notify mode.")
Reported-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://patch.msgid.link/20250924080118.425949403@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/task_work.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/kernel/task_work.c b/kernel/task_work.c
index d1efec571a4a4..0f7519f8e7c93 100644
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -9,7 +9,12 @@ static struct callback_head work_exited; /* all we need is ->next == NULL */
#ifdef CONFIG_IRQ_WORK
static void task_work_set_notify_irq(struct irq_work *entry)
{
- test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
+ /*
+ * no-op IPI
+ *
+ * TWA_NMI_CURRENT will already have set the TIF flag, all
+ * this interrupt does it tickle the return-to-user path.
+ */
}
static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) =
IRQ_WORK_INIT_HARD(task_work_set_notify_irq);
@@ -86,6 +91,7 @@ int task_work_add(struct task_struct *task, struct callback_head *work,
break;
#ifdef CONFIG_IRQ_WORK
case TWA_NMI_CURRENT:
+ set_tsk_thread_flag(current, TIF_NOTIFY_RESUME);
irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume));
break;
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 143/614] drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 142/614] task_work: Fix NMI race condition Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 144/614] x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Greg Kroah-Hartman
` (484 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Tomi Valkeinen,
Marek Vasut, Tomi Valkeinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 42bbf82b73bda18bbc3e158cb6fda040bb586feb ]
The RXSETR_CRCEN(n) and RXSETR_ECCEN(n) macros both take parameter (n),
add the missing macro parameter. Neither of those macros is used by the
driver, so for now the bug is harmless.
Fixes: 685e8dae19df ("drm/rcar-du: dsi: Implement DSI command support")
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reported-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://patch.msgid.link/20251028232959.109936-2-marek.vasut+renesas@mailbox.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h
index 76521276e2af8..dd871e17dcf53 100644
--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h
+++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h
@@ -50,8 +50,8 @@
#define TXCMPPD3R 0x16c
#define RXSETR 0x200
-#define RXSETR_CRCEN (((n) & 0xf) << 24)
-#define RXSETR_ECCEN (((n) & 0xf) << 16)
+#define RXSETR_CRCEN(n) (((n) & 0xf) << 24)
+#define RXSETR_ECCEN(n) (((n) & 0xf) << 16)
#define RXPSETR 0x210
#define RXPSETR_LPPDACC (1 << 0)
#define RXPSR 0x220
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 144/614] x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 143/614] drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 145/614] accel/ivpu: Remove skip of dma unmap for imported buffers Greg Kroah-Hartman
` (483 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tengda Wu, Borislav Petkov (AMD),
Andrey Ryabinin, Josh Poimboeuf, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tengda Wu <wutengda@huaweicloud.com>
[ Upstream commit ced37e9ceae50e4cb6cd058963bd315ec9afa651 ]
When triggering a stack dump via sysrq (echo t > /proc/sysrq-trigger),
KASAN may report false-positive out-of-bounds access:
BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
Call Trace:
dump_stack_lvl
print_address_description.constprop.0
print_report
__show_regs
show_trace_log_lvl
sched_show_task
show_state_filter
sysrq_handle_showstate
__handle_sysrq
write_sysrq_trigger
proc_reg_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe
The issue occurs as follows:
Task A (walk other tasks' stacks) Task B (running)
1. echo t > /proc/sysrq-trigger
show_trace_log_lvl
regs = unwind_get_entry_regs()
show_regs_if_on_stack(regs)
2. The stack value pointed by
`regs` keeps changing, and
so are the tags in its
KASAN shadow region.
__show_regs(regs)
regs->ax, regs->bx, ...
3. hit KASAN redzones, OOB
When task A walks task B's stack without suspending it, the continuous changes
in task B's stack (and corresponding KASAN shadow tags) may cause task A to
hit KASAN redzones when accessing obsolete values on the stack, resulting in
false positive reports.
Simply stopping the task before unwinding is not a viable fix, as it would
alter the state intended to inspect. This is especially true for diagnosing
misbehaving tasks (e.g., in a hard lockup), where stopping might fail or hide
the root cause by changing the call stack.
Therefore, fix this by disabling KASAN checks during asynchronous stack
unwinding, which is identified when the unwinding task does not match the
current task (task != current).
[ bp: Align arguments on function's opening brace. ]
Fixes: 3b3fa11bc700 ("x86/dumpstack: Print any pt_regs found on the stack")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://patch.msgid.link/all/20251023090632.269121-1-wutengda@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/dumpstack.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 71ee20102a8af..b10684dedc589 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -181,8 +181,8 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
* in false positive reports. Disable instrumentation to avoid those.
*/
__no_kmsan_checks
-static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
- unsigned long *stack, const char *log_lvl)
+static void __show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+ unsigned long *stack, const char *log_lvl)
{
struct unwind_state state;
struct stack_info stack_info = {0};
@@ -303,6 +303,25 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
}
}
+static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+ unsigned long *stack, const char *log_lvl)
+{
+ /*
+ * Disable KASAN to avoid false positives during walking another
+ * task's stacks, as values on these stacks may change concurrently
+ * with task execution.
+ */
+ bool disable_kasan = task && task != current;
+
+ if (disable_kasan)
+ kasan_disable_current();
+
+ __show_trace_log_lvl(task, regs, stack, log_lvl);
+
+ if (disable_kasan)
+ kasan_enable_current();
+}
+
void show_stack(struct task_struct *task, unsigned long *sp,
const char *loglvl)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 145/614] accel/ivpu: Remove skip of dma unmap for imported buffers
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 144/614] x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 146/614] tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set Greg Kroah-Hartman
` (482 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Hugo, Karol Wachowski,
Maciej Falkowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Falkowski <maciej.falkowski@linux.intel.com>
[ Upstream commit c063c1bbee67391f12956d2ffdd5da00eb87ff79 ]
Rework of imported buffers introduced in the commit
e0c0891cd63b ("accel/ivpu: Rework bind/unbind of imported buffers")
switched the logic of imported buffers by dma mapping/unmapping
them just as the regular buffers.
The commit didn't include removal of skipping dma unmap of imported
buffers which results in them being mapped without unmapping.
Fixes: e0c0891cd63b ("accel/ivpu: Rework bind/unbind of imported buffers")
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Link: https://patch.msgid.link/20251027150933.2384538-1-maciej.falkowski@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_gem.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c
index 1fca969df19dc..a38e41f9c7123 100644
--- a/drivers/accel/ivpu/ivpu_gem.c
+++ b/drivers/accel/ivpu/ivpu_gem.c
@@ -157,9 +157,6 @@ static void ivpu_bo_unbind_locked(struct ivpu_bo *bo)
bo->ctx = NULL;
}
- if (drm_gem_is_imported(&bo->base.base))
- return;
-
if (bo->base.sgt) {
if (bo->base.base.import_attach) {
dma_buf_unmap_attachment(bo->base.base.import_attach,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 146/614] tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 145/614] accel/ivpu: Remove skip of dma unmap for imported buffers Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 147/614] tools/nolibc/dirent: avoid errno in readdir_r Greg Kroah-Hartman
` (481 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Thomas Weißschuh,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit c485ca3aff2442adea4c08ceb5183e671ebed22a ]
There is no errno variable when NOLIBC_IGNORE_ERRNO is defined. As such,
simply print the message with "unknown error" rather than the integer
value of errno.
Fixes: acab7bcdb1bc ("tools/nolibc/stdio: add perror() to report the errno value")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/stdio.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/include/nolibc/stdio.h b/tools/include/nolibc/stdio.h
index 7630234408c58..724d05ce69624 100644
--- a/tools/include/nolibc/stdio.h
+++ b/tools/include/nolibc/stdio.h
@@ -600,7 +600,11 @@ int sscanf(const char *str, const char *format, ...)
static __attribute__((unused))
void perror(const char *msg)
{
+#ifdef NOLIBC_IGNORE_ERRNO
+ fprintf(stderr, "%s%sunknown error\n", (msg && *msg) ? msg : "", (msg && *msg) ? ": " : "");
+#else
fprintf(stderr, "%s%serrno=%d\n", (msg && *msg) ? msg : "", (msg && *msg) ? ": " : "", errno);
+#endif
}
static __attribute__((unused))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 147/614] tools/nolibc/dirent: avoid errno in readdir_r
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 146/614] tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 148/614] clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops Greg Kroah-Hartman
` (480 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Thomas Weißschuh,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit 4ada5679f18dbbe92d87c37a842c3368e6ab5e4a ]
Using errno is not possible when NOLIBC_IGNORE_ERRNO is set. Use
sys_lseek instead of lseek as that avoids using errno.
Fixes: 665fa8dea90d ("tools/nolibc: add support for directory access")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/nolibc/dirent.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/include/nolibc/dirent.h b/tools/include/nolibc/dirent.h
index 758b95c48e7a4..61a122a60327d 100644
--- a/tools/include/nolibc/dirent.h
+++ b/tools/include/nolibc/dirent.h
@@ -86,9 +86,9 @@ int readdir_r(DIR *dirp, struct dirent *entry, struct dirent **result)
* readdir() can only return one entry at a time.
* Make sure the non-returned ones are not skipped.
*/
- ret = lseek(fd, ldir->d_off, SEEK_SET);
- if (ret == -1)
- return errno;
+ ret = sys_lseek(fd, ldir->d_off, SEEK_SET);
+ if (ret < 0)
+ return -ret;
entry->d_ino = ldir->d_ino;
/* the destination should always be big enough */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 148/614] clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 147/614] tools/nolibc/dirent: avoid errno in readdir_r Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 149/614] soc: qcom: smem: fix hwspinlock resource leak in probe error paths Greg Kroah-Hartman
` (479 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Taniya Das, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <taniya.das@oss.qualcomm.com>
[ Upstream commit 0820c9373369c83de5202871d02682d583a91a9c ]
Fix "gcc_sdcc2_apps_clk_src: rcg didn't update its configuration" during
boot. This happens due to the floor_ops tries to update the rcg
configuration even if the clock is not enabled.
The shared_floor_ops ensures that the RCG is safely parked and the new
parent configuration is cached in the parked_cfg when the clock is off.
Ensure to use the ops for the other SDCC clock instances as well.
Fixes: 39d6dcf67fe9 ("clk: qcom: gcc: Add support for QCS615 GCC clocks")
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251029-sdcc_rcg2_shared_ops-v3-1-ecf47d9601d1@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-qcs615.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/qcom/gcc-qcs615.c b/drivers/clk/qcom/gcc-qcs615.c
index 9695446bc2a3c..5b3b8dd4f114b 100644
--- a/drivers/clk/qcom/gcc-qcs615.c
+++ b/drivers/clk/qcom/gcc-qcs615.c
@@ -784,7 +784,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = {
.name = "gcc_sdcc1_apps_clk_src",
.parent_data = gcc_parent_data_1,
.num_parents = ARRAY_SIZE(gcc_parent_data_1),
- .ops = &clk_rcg2_floor_ops,
+ .ops = &clk_rcg2_shared_floor_ops,
},
};
@@ -806,7 +806,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
.name = "gcc_sdcc1_ice_core_clk_src",
.parent_data = gcc_parent_data_0,
.num_parents = ARRAY_SIZE(gcc_parent_data_0),
- .ops = &clk_rcg2_floor_ops,
+ .ops = &clk_rcg2_shared_floor_ops,
},
};
@@ -830,7 +830,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
.name = "gcc_sdcc2_apps_clk_src",
.parent_data = gcc_parent_data_8,
.num_parents = ARRAY_SIZE(gcc_parent_data_8),
- .ops = &clk_rcg2_floor_ops,
+ .ops = &clk_rcg2_shared_floor_ops,
},
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 149/614] soc: qcom: smem: fix hwspinlock resource leak in probe error paths
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 148/614] clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 150/614] pinctrl: stm32: fix hwspinlock resource leak in probe function Greg Kroah-Hartman
` (478 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit dc5db35073a19f6d3c30bea367b551c1a784ef8f ]
The hwspinlock acquired via hwspin_lock_request_specific() is not
released on several error paths. This results in resource leakage
when probe fails.
Switch to devm_hwspin_lock_request_specific() to automatically
handle cleanup on probe failure. Remove the manual hwspin_lock_free()
in qcom_smem_remove() as devm handles it automatically.
Fixes: 20bb6c9de1b7 ("soc: qcom: smem: map only partitions used by local HOST")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251029022733.255-1-vulab@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/smem.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
index c4c45f15dca4f..f1d1b5aa5e4db 100644
--- a/drivers/soc/qcom/smem.c
+++ b/drivers/soc/qcom/smem.c
@@ -1190,7 +1190,7 @@ static int qcom_smem_probe(struct platform_device *pdev)
return dev_err_probe(&pdev->dev, hwlock_id,
"failed to retrieve hwlock\n");
- smem->hwlock = hwspin_lock_request_specific(hwlock_id);
+ smem->hwlock = devm_hwspin_lock_request_specific(&pdev->dev, hwlock_id);
if (!smem->hwlock)
return -ENXIO;
@@ -1243,7 +1243,6 @@ static void qcom_smem_remove(struct platform_device *pdev)
{
platform_device_unregister(__smem->socinfo);
- hwspin_lock_free(__smem->hwlock);
__smem = NULL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 150/614] pinctrl: stm32: fix hwspinlock resource leak in probe function
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 149/614] soc: qcom: smem: fix hwspinlock resource leak in probe error paths Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 151/614] drm: nova: select NOVA_CORE Greg Kroah-Hartman
` (477 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Antonio Borneo,
Linus Walleij, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 002679f79ed605e543fbace465557317cd307c9a ]
In stm32_pctl_probe(), hwspin_lock_request_specific() is called to
request a hwspinlock, but the acquired lock is not freed on multiple
error paths after this call. This causes resource leakage when the
function fails to initialize properly.
Use devm_hwspin_lock_request_specific() instead of
hwspin_lock_request_specific() to automatically manage the hwspinlock
resource lifecycle.
Fixes: 97cfb6cd34f2 ("pinctrl: stm32: protect configuration registers with a hwspinlock")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index 3ebb468de830d..e73feb8ac90d1 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1671,7 +1671,7 @@ int stm32_pctl_probe(struct platform_device *pdev)
if (hwlock_id == -EPROBE_DEFER)
return hwlock_id;
} else {
- pctl->hwlock = hwspin_lock_request_specific(hwlock_id);
+ pctl->hwlock = devm_hwspin_lock_request_specific(dev, hwlock_id);
}
spin_lock_init(&pctl->irqmux_lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 151/614] drm: nova: select NOVA_CORE
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 150/614] pinctrl: stm32: fix hwspinlock resource leak in probe function Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 152/614] accel/ivpu: Fix race condition when unbinding BOs Greg Kroah-Hartman
` (476 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Courbot, John Hubbard,
Danilo Krummrich, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit 97ad568cd6a58804129ba071f3258b5c4782fb0d ]
The nova-drm driver does not provide any value without nova-core being
selected as well, hence select NOVA_CORE.
Fixes: cdeaeb9dd762 ("drm: nova-drm: add initial driver skeleton")
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Link: https://patch.msgid.link/20251028110058.340320-2-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nova/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/nova/Kconfig b/drivers/gpu/drm/nova/Kconfig
index cca6a3fea879b..bd1df08791911 100644
--- a/drivers/gpu/drm/nova/Kconfig
+++ b/drivers/gpu/drm/nova/Kconfig
@@ -4,6 +4,7 @@ config DRM_NOVA
depends on PCI
depends on RUST
select AUXILIARY_BUS
+ select NOVA_CORE
default n
help
Choose this if you want to build the Nova DRM driver for Nvidia
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 152/614] accel/ivpu: Fix race condition when unbinding BOs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 151/614] drm: nova: select NOVA_CORE Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 153/614] pidfs: add missing PIDFD_INFO_SIZE_VER1 Greg Kroah-Hartman
` (475 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomasz Rusinowicz, Jeff Hugo,
Karol Wachowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
[ Upstream commit 00812636df370bedf4e44a0c81b86ea96bca8628 ]
Fix 'Memory manager not clean during takedown' warning that occurs
when ivpu_gem_bo_free() removes the BO from the BOs list before it
gets unmapped. Then file_priv_unbind() triggers a warning in
drm_mm_takedown() during context teardown.
Protect the unmapping sequence with bo_list_lock to ensure the BO is
always fully unmapped when removed from the list. This ensures the BO
is either fully unmapped at context teardown time or present on the
list and unmapped by file_priv_unbind().
Fixes: 48aea7f2a2ef ("accel/ivpu: Fix locking in ivpu_bo_remove_all_bos_from_context()")
Signed-off-by: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20251029071451.184243-1-karol.wachowski@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/ivpu/ivpu_gem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c
index a38e41f9c7123..fda0a18e6d639 100644
--- a/drivers/accel/ivpu/ivpu_gem.c
+++ b/drivers/accel/ivpu/ivpu_gem.c
@@ -314,7 +314,6 @@ static void ivpu_gem_bo_free(struct drm_gem_object *obj)
mutex_lock(&vdev->bo_list_lock);
list_del(&bo->bo_list_node);
- mutex_unlock(&vdev->bo_list_lock);
drm_WARN_ON(&vdev->drm, !drm_gem_is_imported(&bo->base.base) &&
!dma_resv_test_signaled(obj->resv, DMA_RESV_USAGE_READ));
@@ -325,6 +324,8 @@ static void ivpu_gem_bo_free(struct drm_gem_object *obj)
ivpu_bo_unbind_locked(bo);
ivpu_bo_unlock(bo);
+ mutex_unlock(&vdev->bo_list_lock);
+
drm_WARN_ON(&vdev->drm, bo->mmu_mapped);
drm_WARN_ON(&vdev->drm, bo->ctx);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 153/614] pidfs: add missing PIDFD_INFO_SIZE_VER1
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 152/614] accel/ivpu: Fix race condition when unbinding BOs Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 154/614] pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info Greg Kroah-Hartman
` (474 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Mikhalitsyn, Oleg Nesterov,
Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 4061c43a99772c66c378cfacaa71550ab3b35909 ]
We grew struct pidfd_info not too long ago.
Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-3-ca449b7b7aa0@kernel.org
Fixes: 1d8db6fd698d ("pidfs, coredump: add PIDFD_INFO_COREDUMP")
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/pidfd.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/uapi/linux/pidfd.h b/include/uapi/linux/pidfd.h
index 957db425d459a..6ccbabd9a68d8 100644
--- a/include/uapi/linux/pidfd.h
+++ b/include/uapi/linux/pidfd.h
@@ -28,6 +28,7 @@
#define PIDFD_INFO_COREDUMP (1UL << 4) /* Only returned if requested. */
#define PIDFD_INFO_SIZE_VER0 64 /* sizeof first published struct */
+#define PIDFD_INFO_SIZE_VER1 72 /* sizeof second published struct */
/*
* Values for @coredump_mask in pidfd_info.
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 154/614] pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 153/614] pidfs: add missing PIDFD_INFO_SIZE_VER1 Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 155/614] arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration Greg Kroah-Hartman
` (473 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Mikhalitsyn, Oleg Nesterov,
Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit d8fc51d8fa3b9894713e7eebcf574bee488fa3e1 ]
Validate that the size of struct pidfd_info is correctly updated.
Link: https://patch.msgid.link/20251028-work-coredump-signal-v1-4-ca449b7b7aa0@kernel.org
Fixes: 1d8db6fd698d ("pidfs, coredump: add PIDFD_INFO_COREDUMP")
Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/pidfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/pidfs.c b/fs/pidfs.c
index 0ef5b47d796a2..f4d7dac1b4494 100644
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -306,6 +306,8 @@ static long pidfd_info(struct file *file, unsigned int cmd, unsigned long arg)
const struct cred *c;
__u64 mask;
+ BUILD_BUG_ON(sizeof(struct pidfd_info) != PIDFD_INFO_SIZE_VER1);
+
if (!uinfo)
return -EINVAL;
if (usize < PIDFD_INFO_SIZE_VER0)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 155/614] arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 154/614] pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 156/614] i3c: fix refcount inconsistency in i3c_master_register Greg Kroah-Hartman
` (472 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aniket Limaye, Udit Kumar,
Vignesh Raghavendra, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aniket Limaye <a-limaye@ti.com>
[ Upstream commit 671c852fc53d1b6f5eccdb03c1889a484c9d1996 ]
The I2C pins for some of the instances on J784S4/J742S2/AM69 are
configured as PIN_INPUT_PULLUP while these pins are open-drain type and
do not support internal pull-ups [0][1][2]. The pullup configuration
bits in the corresponding padconfig registers are reserved and any
writes to them have no effect and readback checks on those bits fail.
Update the pinmux settings to use PIN_INPUT instead of PIN_INPUT_PULLUP
to reflect the correct hardware behaviour.
[0]: https://www.ti.com/lit/gpn/tda4ah-q1 (J784S4 Datasheet: Table 5-1. Pin Attributes)
[1]: https://www.ti.com/lit/gpn/tda4ape-q1 (J742S2 Datasheet: Table 5-1. Pin Attributes)
[2]: https://www.ti.com/lit/gpn/am69a (AM69 Datasheet: Table 5-1. Pin Attributes)
Fixes: e20a06aca5c9 ("arm64: dts: ti: Add support for J784S4 EVM board")
Fixes: 635fb18ba008 ("arch: arm64: dts: Add support for AM69 Starter Kit")
Fixes: 0ec1a48d99dd ("arm64: dts: ti: k3-am69-sk: Add pinmux for RPi Header")
Signed-off-by: Aniket Limaye <a-limaye@ti.com>
Reviewed-by: Udit Kumar <u-kumar1@ti.com>
Link: https://patch.msgid.link/20251022122638.234367-1-a-limaye@ti.com
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 ++++----
arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
index 5896e57b5b9ed..0e2d12cb051da 100644
--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
@@ -236,8 +236,8 @@ J784S4_IOPAD(0x0d4, PIN_OUTPUT, 11) /* (AN38) SPI0_CLK.UART8_TXD */
main_i2c0_pins_default: main-i2c0-default-pins {
pinctrl-single,pins = <
- J784S4_IOPAD(0x0e0, PIN_INPUT_PULLUP, 0) /* (AN36) I2C0_SCL */
- J784S4_IOPAD(0x0e4, PIN_INPUT_PULLUP, 0) /* (AP37) I2C0_SDA */
+ J784S4_IOPAD(0x0e0, PIN_INPUT, 0) /* (AN36) I2C0_SCL */
+ J784S4_IOPAD(0x0e4, PIN_INPUT, 0) /* (AP37) I2C0_SDA */
>;
};
@@ -416,8 +416,8 @@ J784S4_WKUP_IOPAD(0x088, PIN_OUTPUT, 0) /* (J37) WKUP_GPIO0_12.MCU_UART0_TXD */
mcu_i2c0_pins_default: mcu-i2c0-default-pins {
pinctrl-single,pins = <
- J784S4_WKUP_IOPAD(0x0a0, PIN_INPUT_PULLUP, 0) /* (M35) MCU_I2C0_SCL */
- J784S4_WKUP_IOPAD(0x0a4, PIN_INPUT_PULLUP, 0) /* (G34) MCU_I2C0_SDA */
+ J784S4_WKUP_IOPAD(0x0a0, PIN_INPUT, 0) /* (M35) MCU_I2C0_SCL */
+ J784S4_WKUP_IOPAD(0x0a4, PIN_INPUT, 0) /* (G34) MCU_I2C0_SDA */
>;
};
diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
index 419c1a70e028d..2834f0a8bbee0 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
@@ -270,8 +270,8 @@ J784S4_IOPAD(0x0d4, PIN_OUTPUT, 11) /* (AN38) SPI0_CLK.UART8_TXD */
main_i2c0_pins_default: main-i2c0-default-pins {
pinctrl-single,pins = <
- J784S4_IOPAD(0x0e0, PIN_INPUT_PULLUP, 0) /* (AN36) I2C0_SCL */
- J784S4_IOPAD(0x0e4, PIN_INPUT_PULLUP, 0) /* (AP37) I2C0_SDA */
+ J784S4_IOPAD(0x0e0, PIN_INPUT, 0) /* (AN36) I2C0_SCL */
+ J784S4_IOPAD(0x0e4, PIN_INPUT, 0) /* (AP37) I2C0_SDA */
>;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 156/614] i3c: fix refcount inconsistency in i3c_master_register
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 155/614] arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 157/614] i3c: master: svc: Prevent incomplete IBI transaction Greg Kroah-Hartman
` (471 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuhao Fu, Frank Li,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
[ Upstream commit 9d4f219807d5ac11fb1d596e4ddb09336b040067 ]
In `i3c_master_register`, a possible refcount inconsistency has been
identified, causing possible resource leak.
Function `of_node_get` increases the refcount of `parent->of_node`. If
function `i3c_bus_init` fails, the function returns immediately without
a corresponding decrease, resulting in an inconsistent refcounter.
Move call i3c_bus_init() after device_initialize() to let callback
i3c_masterdev_release() release of_node.
Reported-by: Shuhao Fu <sfual@cse.ust.hk>
Closes: https://lore.kernel.org/linux-i3c/aO2tjp_FsV_WohPG@osx.local/T/#m2c05a982beeb14e7bf039c1d8db856734bf234c7
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251016143814.2551256-1-Frank.Li@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index d946db75df706..66513a27e6e77 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -2883,10 +2883,6 @@ int i3c_master_register(struct i3c_master_controller *master,
INIT_LIST_HEAD(&master->boardinfo.i2c);
INIT_LIST_HEAD(&master->boardinfo.i3c);
- ret = i3c_bus_init(i3cbus, master->dev.of_node);
- if (ret)
- return ret;
-
device_initialize(&master->dev);
dev_set_name(&master->dev, "i3c-%d", i3cbus->id);
@@ -2894,6 +2890,10 @@ int i3c_master_register(struct i3c_master_controller *master,
master->dev.coherent_dma_mask = parent->coherent_dma_mask;
master->dev.dma_parms = parent->dma_parms;
+ ret = i3c_bus_init(i3cbus, master->dev.of_node);
+ if (ret)
+ goto err_put_dev;
+
ret = of_populate_i3c_bus(master);
if (ret)
goto err_put_dev;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 157/614] i3c: master: svc: Prevent incomplete IBI transaction
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 156/614] i3c: fix refcount inconsistency in i3c_master_register Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 158/614] random: use offstack cpumask when necessary Greg Kroah-Hartman
` (470 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanley Chu, Frank Li, Miquel Raynal,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chu <yschu@nuvoton.com>
[ Upstream commit 3a36273e5a07dda0ccec193800f3b78c3c0380af ]
If no free IBI slot is available, svc_i3c_master_handle_ibi returns
immediately. This causes the STOP condition to be missed because the
EmitStop request is sent when the transfer is not complete. To resolve
this, svc_i3c_master_handle_ibi must wait for the transfer to complete
before returning.
Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Signed-off-by: Stanley Chu <yschu@nuvoton.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20251027034715.708243-1-yschu@nuvoton.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master/svc-i3c-master.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 9641e66a4e5f2..e70a64f2a32fa 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -406,21 +406,27 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
int ret, val;
u8 *buf;
- slot = i3c_generic_ibi_get_free_slot(data->ibi_pool);
- if (!slot)
- return -ENOSPC;
-
- slot->len = 0;
- buf = slot->data;
-
+ /*
+ * Wait for transfer to complete before returning. Otherwise, the EmitStop
+ * request might be sent when the transfer is not complete.
+ */
ret = readl_relaxed_poll_timeout(master->regs + SVC_I3C_MSTATUS, val,
SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
if (ret) {
dev_err(master->dev, "Timeout when polling for COMPLETE\n");
- i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
return ret;
}
+ slot = i3c_generic_ibi_get_free_slot(data->ibi_pool);
+ if (!slot) {
+ dev_dbg(master->dev, "No free ibi slot, drop the data\n");
+ writel(SVC_I3C_MDATACTRL_FLUSHRB, master->regs + SVC_I3C_MDATACTRL);
+ return -ENOSPC;
+ }
+
+ slot->len = 0;
+ buf = slot->data;
+
while (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)) &&
slot->len < SVC_I3C_FIFO_SIZE) {
mdatactrl = readl(master->regs + SVC_I3C_MDATACTRL);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 158/614] random: use offstack cpumask when necessary
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 157/614] i3c: master: svc: Prevent incomplete IBI transaction Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message Greg Kroah-Hartman
` (469 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Jason A. Donenfeld,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 5d49f1a5bd358d24e5f88b23b46da833de1dbec8 ]
The entropy generation function keeps a local cpu mask on the stack,
which can trigger warnings in configurations with a large number of
CPUs:
drivers/char/random.c:1292:20: error: stack frame size (1288)
exceeds limit (1280) in 'try_to_generate_entropy' [-Werror,-Wframe-larger-than]
Use the cpumask interface to dynamically allocate it in those
configurations.
Fixes: 1c21fe00eda7 ("random: spread out jitter callback to different CPUs")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/random.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index b8b24b6ed3fe4..4ba5f0c4c8b24 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1296,6 +1296,7 @@ static void __cold try_to_generate_entropy(void)
struct entropy_timer_state *stack = PTR_ALIGN((void *)stack_bytes, SMP_CACHE_BYTES);
unsigned int i, num_different = 0;
unsigned long last = random_get_entropy();
+ cpumask_var_t timer_cpus;
int cpu = -1;
for (i = 0; i < NUM_TRIAL_SAMPLES - 1; ++i) {
@@ -1310,13 +1311,15 @@ static void __cold try_to_generate_entropy(void)
atomic_set(&stack->samples, 0);
timer_setup_on_stack(&stack->timer, entropy_timer, 0);
+ if (!alloc_cpumask_var(&timer_cpus, GFP_KERNEL))
+ goto out;
+
while (!crng_ready() && !signal_pending(current)) {
/*
* Check !timer_pending() and then ensure that any previous callback has finished
* executing by checking timer_delete_sync_try(), before queueing the next one.
*/
if (!timer_pending(&stack->timer) && timer_delete_sync_try(&stack->timer) >= 0) {
- struct cpumask timer_cpus;
unsigned int num_cpus;
/*
@@ -1326,19 +1329,19 @@ static void __cold try_to_generate_entropy(void)
preempt_disable();
/* Only schedule callbacks on timer CPUs that are online. */
- cpumask_and(&timer_cpus, housekeeping_cpumask(HK_TYPE_TIMER), cpu_online_mask);
- num_cpus = cpumask_weight(&timer_cpus);
+ cpumask_and(timer_cpus, housekeeping_cpumask(HK_TYPE_TIMER), cpu_online_mask);
+ num_cpus = cpumask_weight(timer_cpus);
/* In very bizarre case of misconfiguration, fallback to all online. */
if (unlikely(num_cpus == 0)) {
- timer_cpus = *cpu_online_mask;
- num_cpus = cpumask_weight(&timer_cpus);
+ *timer_cpus = *cpu_online_mask;
+ num_cpus = cpumask_weight(timer_cpus);
}
/* Basic CPU round-robin, which avoids the current CPU. */
do {
- cpu = cpumask_next(cpu, &timer_cpus);
+ cpu = cpumask_next(cpu, timer_cpus);
if (cpu >= nr_cpu_ids)
- cpu = cpumask_first(&timer_cpus);
+ cpu = cpumask_first(timer_cpus);
} while (cpu == smp_processor_id() && num_cpus > 1);
/* Expiring the timer at `jiffies` means it's the next tick. */
@@ -1354,6 +1357,8 @@ static void __cold try_to_generate_entropy(void)
}
mix_pool_bytes(&stack->entropy, sizeof(stack->entropy));
+ free_cpumask_var(timer_cpus);
+out:
timer_delete_sync(&stack->timer);
timer_destroy_on_stack(&stack->timer);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 158/614] random: use offstack cpumask when necessary Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-17 11:22 ` Barry K. Nathan
2025-12-16 11:08 ` [PATCH 6.18 160/614] wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() Greg Kroah-Hartman
` (468 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Keller, Jonathan Corbet,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <jacob.e.keller@intel.com>
[ Upstream commit e5e7ca66a7fc6b8073c30a048e1157b88d427980 ]
The python version of the kernel-doc parser emits some strange warnings
with just a line number in certain cases:
$ ./scripts/kernel-doc -Wall -none 'include/linux/virtio_config.h'
Warning: 174
Warning: 184
Warning: 190
Warning: include/linux/virtio_config.h:226 No description found for return value of '__virtio_test_bit'
Warning: include/linux/virtio_config.h:259 No description found for return value of 'virtio_has_feature'
Warning: include/linux/virtio_config.h:283 No description found for return value of 'virtio_has_dma_quirk'
Warning: include/linux/virtio_config.h:392 No description found for return value of 'virtqueue_set_affinity'
I eventually tracked this down to the lone call of emit_msg() in the
KernelEntry class, which looks like:
self.emit_msg(self.new_start_line, f"duplicate section name '{name}'\n")
This looks like all the other emit_msg calls. Unfortunately, the definition
within the KernelEntry class takes only a message parameter and not a line
number. The intended message is passed as the warning!
Pass the filename to the KernelEntry class, and use this to build the log
message in the same way as the KernelDoc class does.
To avoid future errors, mark the warning parameter for both emit_msg
definitions as a keyword-only argument. This will prevent accidentally
passing a string as the warning parameter in the future.
Also fix the call in dump_section to avoid an unnecessary additional
newline.
Fixes: e3b42e94cf10 ("scripts/lib/kdoc/kdoc_parser.py: move kernel entry to a class")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20251030-jk-fix-kernel-doc-duplicate-return-warning-v2-1-ec4b5c662881@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/lib/kdoc/kdoc_parser.py | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/scripts/lib/kdoc/kdoc_parser.py b/scripts/lib/kdoc/kdoc_parser.py
index 2376f180b1fa9..ccbc1fe4b7ccd 100644
--- a/scripts/lib/kdoc/kdoc_parser.py
+++ b/scripts/lib/kdoc/kdoc_parser.py
@@ -274,6 +274,8 @@ class KernelEntry:
self.leading_space = None
+ self.fname = fname
+
# State flags
self.brcount = 0
self.declaration_start_line = ln + 1
@@ -288,9 +290,11 @@ class KernelEntry:
return '\n'.join(self._contents) + '\n'
# TODO: rename to emit_message after removal of kernel-doc.pl
- def emit_msg(self, log_msg, warning=True):
+ def emit_msg(self, ln, msg, *, warning=True):
"""Emit a message"""
+ log_msg = f"{self.fname}:{ln} {msg}"
+
if not warning:
self.config.log.info(log_msg)
return
@@ -336,7 +340,7 @@ class KernelEntry:
# Only warn on user-specified duplicate section names
if name != SECTION_DEFAULT:
self.emit_msg(self.new_start_line,
- f"duplicate section name '{name}'\n")
+ f"duplicate section name '{name}'")
# Treat as a new paragraph - add a blank line
self.sections[name] += '\n' + contents
else:
@@ -387,15 +391,15 @@ class KernelDoc:
self.emit_msg(0,
'Python 3.7 or later is required for correct results')
- def emit_msg(self, ln, msg, warning=True):
+ def emit_msg(self, ln, msg, *, warning=True):
"""Emit a message"""
- log_msg = f"{self.fname}:{ln} {msg}"
-
if self.entry:
- self.entry.emit_msg(log_msg, warning)
+ self.entry.emit_msg(ln, msg, warning=warning)
return
+ log_msg = f"{self.fname}:{ln} {msg}"
+
if warning:
self.config.log.warning(log_msg)
else:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 160/614] wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 161/614] wifi: ath12k: fix reusing m3 memory Greg Kroah-Hartman
` (467 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Baochen Qiang,
Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit be5febd51c478bc8e24ad3480435f2754a403b14 ]
When the call to ath12k_wmi_arp_ns_offload() fails, the temporary memory
allocation for offload is not freed before returning. Fix that by
freeing offload in the error path.
Fixes: 1666108c74c4 ("wifi: ath12k: support ARP and NS offload")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251028170457.134608-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/wow.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath12k/wow.c b/drivers/net/wireless/ath/ath12k/wow.c
index dce9bd0bcaefb..e8481626f1940 100644
--- a/drivers/net/wireless/ath/ath12k/wow.c
+++ b/drivers/net/wireless/ath/ath12k/wow.c
@@ -758,6 +758,7 @@ static int ath12k_wow_arp_ns_offload(struct ath12k *ar, bool enable)
if (ret) {
ath12k_warn(ar->ab, "failed to set arp ns offload vdev %i: enable %d, ret %d\n",
arvif->vdev_id, enable, ret);
+ kfree(offload);
return ret;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 161/614] wifi: ath12k: fix reusing m3 memory
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 160/614] wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 162/614] wifi: ath12k: fix error handling in creating hardware group Greg Kroah-Hartman
` (466 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 00575bb44b2c2aa53d0a768de2b80c9c1af0174d ]
During firmware recovery or suspend/resume, m3 memory could be reused if
the size of the new m3 binary is equal to or less than that of the
existing memory. There will be issues for the latter case, since
m3_mem->size will be updated with a smaller value and this value is
eventually used in the free path, where the original total size should be
used instead.
To fix it, add a new member in m3_mem_region structure to track the original
memory size and use it in free path.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
Fixes: 05090ae82f44 ("wifi: ath12k: check M3 buffer size as well whey trying to reuse it")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251029-ath12k-fix-m3-reuse-v1-1-69225bacfc5d@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/qmi.c | 11 +++++++----
drivers/net/wireless/ath/ath12k/qmi.h | 5 ++++-
2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c
index 36325e62aa242..8de9aee2498ec 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.c
+++ b/drivers/net/wireless/ath/ath12k/qmi.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/elf.h>
@@ -3114,9 +3114,10 @@ static void ath12k_qmi_m3_free(struct ath12k_base *ab)
if (!m3_mem->vaddr)
return;
- dma_free_coherent(ab->dev, m3_mem->size,
+ dma_free_coherent(ab->dev, m3_mem->total_size,
m3_mem->vaddr, m3_mem->paddr);
m3_mem->vaddr = NULL;
+ m3_mem->total_size = 0;
m3_mem->size = 0;
}
@@ -3152,7 +3153,7 @@ static int ath12k_qmi_m3_load(struct ath12k_base *ab)
/* In recovery/resume cases, M3 buffer is not freed, try to reuse that */
if (m3_mem->vaddr) {
- if (m3_mem->size >= m3_len)
+ if (m3_mem->total_size >= m3_len)
goto skip_m3_alloc;
/* Old buffer is too small, free and reallocate */
@@ -3164,11 +3165,13 @@ static int ath12k_qmi_m3_load(struct ath12k_base *ab)
GFP_KERNEL);
if (!m3_mem->vaddr) {
ath12k_err(ab, "failed to allocate memory for M3 with size %zu\n",
- fw->size);
+ m3_len);
ret = -ENOMEM;
goto out;
}
+ m3_mem->total_size = m3_len;
+
skip_m3_alloc:
memcpy(m3_mem->vaddr, m3_data, m3_len);
m3_mem->size = m3_len;
diff --git a/drivers/net/wireless/ath/ath12k/qmi.h b/drivers/net/wireless/ath/ath12k/qmi.h
index 4767d9a2e309e..7a88268aa1e9e 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.h
+++ b/drivers/net/wireless/ath/ath12k/qmi.h
@@ -1,7 +1,7 @@
/* SPDX-License-Identifier: BSD-3-Clause-Clear */
/*
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#ifndef ATH12K_QMI_H
@@ -120,6 +120,9 @@ struct target_info {
};
struct m3_mem_region {
+ /* total memory allocated */
+ u32 total_size;
+ /* actual memory being used */
u32 size;
dma_addr_t paddr;
void *vaddr;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 162/614] wifi: ath12k: fix error handling in creating hardware group
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 161/614] wifi: ath12k: fix reusing m3 memory Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 163/614] wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create() Greg Kroah-Hartman
` (465 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, a-development, Baochen Qiang,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
[ Upstream commit 088a099690e4c0d291db505013317ab5dd58b4d5 ]
In ath12k_core_init() when ath12k_core_hw_group_create() fails,
ath12k_core_hw_group_destroy() is called where for each device below
path would get executed
ath12k_core_soc_destroy()
ath12k_qmi_deinit_service()
qmi_handle_release()
This results in kernel crash in case one of the device fails at
qmi_handle_init() when creating hardware group:
ath12k_pci 0000:10:00.0: failed to initialize qmi handle
ath12k_pci 0000:10:00.0: failed to initialize qmi :-517
ath12k_pci 0000:10:00.0: failed to create soc core: -517
ath12k_pci 0000:10:00.0: unable to create hw group
BUG: unable to handle page fault for address: ffffffffffffffb7
RIP: 0010:qmi_handle_release
Call Trace:
<TASK>
ath12k_qmi_deinit_service
ath12k_core_hw_group_destroy
ath12k_core_init
ath12k_pci_probe
The detailed reason is, when qmi_handle_init() fails for a device
ab->qmi.handle is not correctly initialized. Then
ath12k_core_hw_group_create() returns failure, since error handing
is done for all device, eventually qmi_handle_release() is called for the
issue device and finally kernel crashes due to the uninitialized
ab->qmi.handle.
Fix this by moving error handling to ath12k_core_hw_group_create(), this
way the issue device can be skipped.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Fixes: 6f245ea0ec6c ("wifi: ath12k: introduce device group abstraction")
Link: https://lore.kernel.org/ath12k/fabc97122016d1a66a53ddedd965d134@posteo.net
Reported-by: a-development <a-development@posteo.de>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220518
Tested-by: a-development <a-development@posteo.de>
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251030-fix-hw-group-create-err-handling-v1-1-0659e4d15fb9@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/core.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
index 5d494c5cdc0da..a2137b363c2fe 100644
--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
@@ -2106,14 +2106,27 @@ static int ath12k_core_hw_group_create(struct ath12k_hw_group *ag)
ret = ath12k_core_soc_create(ab);
if (ret) {
mutex_unlock(&ab->core_lock);
- ath12k_err(ab, "failed to create soc core: %d\n", ret);
- return ret;
+ ath12k_err(ab, "failed to create soc %d core: %d\n", i, ret);
+ goto destroy;
}
mutex_unlock(&ab->core_lock);
}
return 0;
+
+destroy:
+ for (i--; i >= 0; i--) {
+ ab = ag->ab[i];
+ if (!ab)
+ continue;
+
+ mutex_lock(&ab->core_lock);
+ ath12k_core_soc_destroy(ab);
+ mutex_unlock(&ab->core_lock);
+ }
+
+ return ret;
}
void ath12k_core_hw_group_set_mlo_capable(struct ath12k_hw_group *ag)
@@ -2188,7 +2201,7 @@ int ath12k_core_init(struct ath12k_base *ab)
if (ret) {
mutex_unlock(&ag->mutex);
ath12k_warn(ab, "unable to create hw group\n");
- goto err_destroy_hw_group;
+ goto err_unassign_hw_group;
}
}
@@ -2196,8 +2209,7 @@ int ath12k_core_init(struct ath12k_base *ab)
return 0;
-err_destroy_hw_group:
- ath12k_core_hw_group_destroy(ab->ag);
+err_unassign_hw_group:
ath12k_core_hw_group_unassign(ab);
err_unregister_notifier:
ath12k_core_panic_notifier_unregister(ab);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 163/614] wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 162/614] wifi: ath12k: fix error handling in creating hardware group Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 164/614] wifi: ath12k: unassign arvif on scan vdev create failure Greg Kroah-Hartman
` (464 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rameshkumar Sundaram,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
[ Upstream commit 448bf7b51426bcca54b5ac1ddd1045a36c9d1dea ]
Currently, vdev limit check is performed only in
ath12k_mac_assign_vif_to_vdev(). If the host has already created
maximum number of vdevs for the radio (ar) and a scan request
arrives for the same radio, ath12k_mac_initiate_hw_scan() attempts
to create a vdev without checking the limit, causing firmware asserts.
Centralize the vdev limit guard by moving the check into
ath12k_mac_vdev_create() so that all callers obey the limit.
While doing this, update the condition from
`num_created_vdevs > (TARGET_NUM_VDEVS(ab) - 1)` to
`num_created_vdevs >= TARGET_NUM_VDEVS(ab)` for clarity and to
eliminate unnecessary arithmetic.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: 0d6e6736ed9f ("wifi: ath12k: scan statemachine changes for single wiphy")
Fixes: 4938ba733ee2 ("wifi: ath12k: modify remain on channel for single wiphy")
Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251026182254.1399650-2-rameshkumar.sundaram@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 0cec6c47fca29..8f139505019c4 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -9687,6 +9687,12 @@ int ath12k_mac_vdev_create(struct ath12k *ar, struct ath12k_link_vif *arvif)
if (vif->type == NL80211_IFTYPE_MONITOR && ar->monitor_vdev_created)
return -EINVAL;
+ if (ar->num_created_vdevs >= TARGET_NUM_VDEVS(ab)) {
+ ath12k_warn(ab, "failed to create vdev, reached max vdev limit %d\n",
+ TARGET_NUM_VDEVS(ab));
+ return -ENOSPC;
+ }
+
link_id = arvif->link_id;
if (link_id < IEEE80211_MLD_MAX_NUM_LINKS) {
@@ -10046,12 +10052,6 @@ static struct ath12k *ath12k_mac_assign_vif_to_vdev(struct ieee80211_hw *hw,
if (arvif->is_created)
goto flush;
- if (ar->num_created_vdevs > (TARGET_NUM_VDEVS(ab) - 1)) {
- ath12k_warn(ab, "failed to create vdev, reached max vdev limit %d\n",
- TARGET_NUM_VDEVS(ab));
- goto unlock;
- }
-
ret = ath12k_mac_vdev_create(ar, arvif);
if (ret) {
ath12k_warn(ab, "failed to create vdev %pM ret %d", vif->addr, ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 164/614] wifi: ath12k: unassign arvif on scan vdev create failure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 163/614] wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 165/614] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS Greg Kroah-Hartman
` (463 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rameshkumar Sundaram,
Vasanthakumar Thiagarajan, Jeff Johnson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
[ Upstream commit e70515039d44be61b6a73aafb401d141b0034d12 ]
During scan and remain-on-channel requests, a scan link vif (arvif) is
assigned and a temporary vdev is created. If vdev creation fails, the
assigned arvif is left attached until the virtual interface is removed,
leaving a stale link in ahvif.
Fix this by freeing the stale arvif and resetting the corresponding link in
ahvif by calling ath12k_mac_unassign_link_vif() when vdev creation fails.
While at it, propagate the actual error code from ath12k_mac_vdev_create()
instead of returning -EINVAL in ath12k_mac_initiate_hw_scan().
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: 477cabfdb776 ("wifi: ath12k: modify link arvif creation and removal for MLO")
Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251026182254.1399650-3-rameshkumar.sundaram@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 8f139505019c4..095b49a39683c 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -5059,7 +5059,8 @@ static int ath12k_mac_initiate_hw_scan(struct ieee80211_hw *hw,
ret = ath12k_mac_vdev_create(ar, arvif);
if (ret) {
ath12k_warn(ar->ab, "unable to create scan vdev %d\n", ret);
- return -EINVAL;
+ ath12k_mac_unassign_link_vif(arvif);
+ return ret;
}
}
@@ -12895,6 +12896,7 @@ static int ath12k_mac_op_remain_on_channel(struct ieee80211_hw *hw,
if (ret) {
ath12k_warn(ar->ab, "unable to create scan vdev for roc: %d\n",
ret);
+ ath12k_mac_unassign_link_vif(arvif);
return ret;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 165/614] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 164/614] wifi: ath12k: unassign arvif on scan vdev create failure Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 166/614] arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller Greg Kroah-Hartman
` (462 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Georgi Djakov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit 8cf9b43f6b4d90e19a9341edefdd46842d4adb55 ]
>From the initial submission the interconnect driver missed the link from
SNOC_PNOC to the USB 2 configuration space. Add missing link in order to
let the platform configure and utilize this path.
Fixes: 7add937f5222 ("interconnect: qcom: Add MSM8996 interconnect provider driver")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251002-fix-msm8996-icc-v1-1-a36a05d1f869@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/interconnect/qcom/msm8996.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/interconnect/qcom/msm8996.c b/drivers/interconnect/qcom/msm8996.c
index b73566c9b21f9..84cfafb22aa17 100644
--- a/drivers/interconnect/qcom/msm8996.c
+++ b/drivers/interconnect/qcom/msm8996.c
@@ -552,6 +552,7 @@ static struct qcom_icc_node mas_venus_vmem = {
static const u16 mas_snoc_pnoc_links[] = {
MSM8996_SLAVE_BLSP_1,
MSM8996_SLAVE_BLSP_2,
+ MSM8996_SLAVE_USB_HS,
MSM8996_SLAVE_SDCC_1,
MSM8996_SLAVE_SDCC_2,
MSM8996_SLAVE_SDCC_4,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 166/614] arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 165/614] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 167/614] accel/amdxdna: Fix incorrect command state for timed out job Greg Kroah-Hartman
` (461 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Bjorn Andersson, Georgi Djakov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit 242f7558e7bf54cb63c06506f7b0630dd67d45a4 ]
Add the missing interconnects to the USB2 host. The Fixes tag points to
the commit which broke probing of the USB host on that platform.
Fixes: 130733a10079 ("interconnect: qcom: msm8996: Promote to core_initcall")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Acked-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20251002-fix-msm8996-icc-v1-2-a36a05d1f869@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index c75b522f6eba6..33608b1d7d060 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -3496,6 +3496,9 @@ usb2: usb@76f8800 {
<&gcc GCC_USB20_MASTER_CLK>;
assigned-clock-rates = <19200000>, <60000000>;
+ interconnects = <&pnoc MASTER_USB_HS &bimc SLAVE_EBI_CH0>,
+ <&bimc MASTER_AMPSS_M0 &pnoc SLAVE_USB_HS>;
+ interconnect-names = "usb-ddr", "apps-usb";
power-domains = <&gcc USB30_GDSC>;
qcom,select-utmi-as-pipe-clk;
status = "disabled";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 167/614] accel/amdxdna: Fix incorrect command state for timed out job
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 166/614] arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 168/614] interconnect: debugfs: Fix incorrect error handling for NULL path Greg Kroah-Hartman
` (460 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD), Lizhi Hou,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit 6fb7f298883246e21f60f971065adcb789ae6eba ]
When a command times out, mark it as ERT_CMD_STATE_TIMEOUT. Any other
commands that are canceled due to this timeout should be marked as
ERT_CMD_STATE_ABORT.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251029193423.2430463-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/aie2_ctx.c | 15 +++++++++++++--
drivers/accel/amdxdna/amdxdna_ctx.h | 1 +
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index e9f9b1fa5dc1b..c9f712f0ec00c 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -204,10 +204,13 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size)
cmd_abo = job->cmd_bo;
- if (unlikely(!data))
+ if (unlikely(job->job_timeout)) {
+ amdxdna_cmd_set_state(cmd_abo, ERT_CMD_STATE_TIMEOUT);
+ ret = -EINVAL;
goto out;
+ }
- if (unlikely(size != sizeof(u32))) {
+ if (unlikely(!data) || unlikely(size != sizeof(u32))) {
amdxdna_cmd_set_state(cmd_abo, ERT_CMD_STATE_ABORT);
ret = -EINVAL;
goto out;
@@ -260,6 +263,13 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size)
int ret = 0;
cmd_abo = job->cmd_bo;
+
+ if (unlikely(job->job_timeout)) {
+ amdxdna_cmd_set_state(cmd_abo, ERT_CMD_STATE_TIMEOUT);
+ ret = -EINVAL;
+ goto out;
+ }
+
if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) {
amdxdna_cmd_set_state(cmd_abo, ERT_CMD_STATE_ABORT);
ret = -EINVAL;
@@ -362,6 +372,7 @@ aie2_sched_job_timedout(struct drm_sched_job *sched_job)
xdna = hwctx->client->xdna;
trace_xdna_job(sched_job, hwctx->name, "job timedout", job->seq);
+ job->job_timeout = true;
mutex_lock(&xdna->dev_lock);
aie2_hwctx_stop(xdna, hwctx, sched_job);
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
index 7cd7a55936f09..8c1d181df6e79 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.h
+++ b/drivers/accel/amdxdna/amdxdna_ctx.h
@@ -105,6 +105,7 @@ struct amdxdna_sched_job {
/* user can wait on this fence */
struct dma_fence *out_fence;
bool job_done;
+ bool job_timeout;
u64 seq;
struct amdxdna_gem_obj *cmd_bo;
size_t bo_cnt;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 168/614] interconnect: debugfs: Fix incorrect error handling for NULL path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 167/614] accel/amdxdna: Fix incorrect command state for timed out job Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 169/614] arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Greg Kroah-Hartman
` (459 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuan-Wei Chiu, Georgi Djakov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
[ Upstream commit 6bfe104fd0f94d0248af22c256ce725ee087157b ]
The icc_commit_set() function, used by the debugfs interface, checks
the validity of the global cur_path pointer using IS_ERR_OR_NULL().
However, in the specific case where cur_path is NULL, while
IS_ERR_OR_NULL(NULL) correctly evaluates to true, the subsequent call
to PTR_ERR(NULL) returns 0.
This causes the function to return a success code (0) instead of an
error, misleading the user into believing their bandwidth request was
successfully committed when, in fact, no operation was performed.
Fix this by adding an explicit check to return -EINVAL if cur_path is
NULL. This prevents silent failures and ensures that an invalid
operational sequence is immediately and clearly reported as an error.
Fixes: 770c69f037c1 ("interconnect: Add debugfs test client")
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Link: https://lore.kernel.org/r/20251010151447.2289779-1-visitorckw@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/interconnect/debugfs-client.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
index bc3fd8a7b9eb4..778deeb4a7e8a 100644
--- a/drivers/interconnect/debugfs-client.c
+++ b/drivers/interconnect/debugfs-client.c
@@ -117,7 +117,12 @@ static int icc_commit_set(void *data, u64 val)
mutex_lock(&debugfs_lock);
- if (IS_ERR_OR_NULL(cur_path)) {
+ if (!cur_path) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ if (IS_ERR(cur_path)) {
ret = PTR_ERR(cur_path);
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 169/614] arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 168/614] interconnect: debugfs: Fix incorrect error handling for NULL path Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 170/614] cgroup: add cgroup namespace to tree after owner is set Greg Kroah-Hartman
` (458 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Niklas Söderlund,
Geert Uytterhoeven, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marek.vasut+renesas@mailbox.org>
[ Upstream commit 9d22a34a016313137b9e534a918f1f9aa790aa69 ]
The DisplayPort connector on Retronix R-Car V4H Sparrow Hawk board
is a full-size DisplayPort connector. Fix the copy-paste error and
update the DT node name and labels accordingly. No functional change.
Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251027184604.34550-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
index 1da8e476b2193..ff07d984cbf29 100644
--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
@@ -119,13 +119,13 @@ memory@600000000 {
};
/* Page 27 / DSI to Display */
- mini-dp-con {
+ dp-con {
compatible = "dp-connector";
label = "CN6";
type = "full-size";
port {
- mini_dp_con_in: endpoint {
+ dp_con_in: endpoint {
remote-endpoint = <&sn65dsi86_out>;
};
};
@@ -407,7 +407,7 @@ sn65dsi86_in: endpoint {
port@1 {
reg = <1>;
sn65dsi86_out: endpoint {
- remote-endpoint = <&mini_dp_con_in>;
+ remote-endpoint = <&dp_con_in>;
};
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 170/614] cgroup: add cgroup namespace to tree after owner is set
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 169/614] arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 171/614] drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
` (457 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Jeff Layton,
Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 768b1565d9d1e1eebf7567f477f7f46c05a98a4d ]
Otherwise we trip VFS_WARN_ON_ONC() in __ns_tree_add_raw().
Link: https://patch.msgid.link/20251029-work-namespace-nstree-listns-v4-6-2e6f823ebdc0@kernel.org
Fixes: 7c6059398533 ("cgroup: support ns lookup")
Tested-by: syzbot@syzkaller.appspotmail.com
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
index fdbe57578e688..db9617556dd70 100644
--- a/kernel/cgroup/namespace.c
+++ b/kernel/cgroup/namespace.c
@@ -30,7 +30,6 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
ret = ns_common_init(new_ns);
if (ret)
return ERR_PTR(ret);
- ns_tree_add(new_ns);
return no_free_ptr(new_ns);
}
@@ -86,6 +85,7 @@ struct cgroup_namespace *copy_cgroup_ns(u64 flags,
new_ns->ucounts = ucounts;
new_ns->root_cset = cset;
+ ns_tree_add(new_ns);
return new_ns;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 171/614] drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 170/614] cgroup: add cgroup namespace to tree after owner is set Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 172/614] perf lock contention: Load kernel map before lookup Greg Kroah-Hartman
` (456 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Matt Coster,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit f1aa93005d0d6fb3293ca9c3eb08d1d1557117bf ]
The call to devm_platform_ioremap_resource() was replaced by a call to
devm_platform_get_and_ioremap_resource(), but the comment referring to
the function's possible returned error codes was not updated.
Fixes: 927f3e0253c11276 ("drm/imagination: Implement MIPS firmware processor and MMU support")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Matt Coster <matt.coster@imgtec.com>
Link: https://patch.msgid.link/2266514318480d17f52c7e5e67578dae6827914e.1761745586.git.geert+renesas@glider.be
Signed-off-by: Matt Coster <matt.coster@imgtec.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/imagination/pvr_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/imagination/pvr_device.c b/drivers/gpu/drm/imagination/pvr_device.c
index 294b6019b4155..78d6b8a0a4506 100644
--- a/drivers/gpu/drm/imagination/pvr_device.c
+++ b/drivers/gpu/drm/imagination/pvr_device.c
@@ -48,7 +48,7 @@
*
* Return:
* * 0 on success, or
- * * Any error returned by devm_platform_ioremap_resource().
+ * * Any error returned by devm_platform_get_and_ioremap_resource().
*/
static int
pvr_device_reg_init(struct pvr_device *pvr_dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 172/614] perf lock contention: Load kernel map before lookup
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 171/614] drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
@ 2025-12-16 11:08 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 173/614] perf record: skip synthesize event when open evsel failed Greg Kroah-Hartman
` (455 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 553d18c98a896094b99a01765b9698b204183d49 ]
On some machines, it caused troubles when it tried to find kernel
symbols. I think it's because kernel modules and kallsyms are messed
up during load and split.
Basically we want to make sure the kernel map is loaded and the code has
it in the lock_contention_read(). But recently we added more lookups in
the lock_contention_prepare() which is called before _read().
Also the kernel map (kallsyms) may not be the first one in the group
like on ARM. Let's use machine__kernel_map() rather than just loading
the first map.
Reviewed-by: Ian Rogers <irogers@google.com>
Fixes: 688d2e8de231c54e ("perf lock contention: Add -l/--lock-addr option")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf_lock_contention.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/bpf_lock_contention.c b/tools/perf/util/bpf_lock_contention.c
index 60b81d586323f..7b5671f13c535 100644
--- a/tools/perf/util/bpf_lock_contention.c
+++ b/tools/perf/util/bpf_lock_contention.c
@@ -184,6 +184,9 @@ int lock_contention_prepare(struct lock_contention *con)
struct evlist *evlist = con->evlist;
struct target *target = con->target;
+ /* make sure it loads the kernel map before lookup */
+ map__load(machine__kernel_map(con->machine));
+
skel = lock_contention_bpf__open();
if (!skel) {
pr_err("Failed to open lock-contention BPF skeleton\n");
@@ -749,9 +752,6 @@ int lock_contention_read(struct lock_contention *con)
bpf_prog_test_run_opts(prog_fd, &opts);
}
- /* make sure it loads the kernel map */
- maps__load_first(machine->kmaps);
-
prev_key = NULL;
while (!bpf_map_get_next_key(fd, prev_key, &key)) {
s64 ls_key;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 173/614] perf record: skip synthesize event when open evsel failed
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2025-12-16 11:08 ` [PATCH 6.18 172/614] perf lock contention: Load kernel map before lookup Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 174/614] clk: qcom: tcsrcc-glymur: Update register offsets for clock refs Greg Kroah-Hartman
` (454 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuai Xue, Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
[ Upstream commit 163e5f2b96632b7fb2eaa965562aca0dbdf9f996 ]
When using perf record with the `--overwrite` option, a segmentation fault
occurs if an event fails to open. For example:
perf record -e cycles-ct -F 1000 -a --overwrite
Error:
cycles-ct:H: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat'
perf: Segmentation fault
#0 0x6466b6 in dump_stack debug.c:366
#1 0x646729 in sighandler_dump_stack debug.c:378
#2 0x453fd1 in sigsegv_handler builtin-record.c:722
#3 0x7f8454e65090 in __restore_rt libc-2.32.so[54090]
#4 0x6c5671 in __perf_event__synthesize_id_index synthetic-events.c:1862
#5 0x6c5ac0 in perf_event__synthesize_id_index synthetic-events.c:1943
#6 0x458090 in record__synthesize builtin-record.c:2075
#7 0x45a85a in __cmd_record builtin-record.c:2888
#8 0x45deb6 in cmd_record builtin-record.c:4374
#9 0x4e5e33 in run_builtin perf.c:349
#10 0x4e60bf in handle_internal_command perf.c:401
#11 0x4e6215 in run_argv perf.c:448
#12 0x4e653a in main perf.c:555
#13 0x7f8454e4fa72 in __libc_start_main libc-2.32.so[3ea72]
#14 0x43a3ee in _start ??:0
The --overwrite option implies --tail-synthesize, which collects non-sample
events reflecting the system status when recording finishes. However, when
evsel opening fails (e.g., unsupported event 'cycles-ct'), session->evlist
is not initialized and remains NULL. The code unconditionally calls
record__synthesize() in the error path, which iterates through the NULL
evlist pointer and causes a segfault.
To fix it, move the record__synthesize() call inside the error check block, so
it's only called when there was no error during recording, ensuring that evlist
is properly initialized.
Fixes: 4ea648aec019 ("perf record: Add --tail-synthesize option")
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-record.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index d76f01956e33b..b1fb87016d5aa 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -2883,11 +2883,11 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
rec->bytes_written += off_cpu_write(rec->session);
record__read_lost_samples(rec);
- record__synthesize(rec, true);
/* this will be recalculated during process_buildids() */
rec->samples = 0;
if (!err) {
+ record__synthesize(rec, true);
if (!rec->timestamp_filename) {
record__finish_output(rec);
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 174/614] clk: qcom: tcsrcc-glymur: Update register offsets for clock refs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 173/614] perf record: skip synthesize event when open evsel failed Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 175/614] timers/migration: Convert "while" loops to use "for" Greg Kroah-Hartman
` (453 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taniya Das, Abel Vesa,
Jagadeesh Kona, Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taniya Das <taniya.das@oss.qualcomm.com>
[ Upstream commit a4aa1ceb89f5c0d27a55671d88699cf5eae7331b ]
Update the register offsets for all the clock ref branches to match the
new address mapping in the TCSR subsystem.
Fixes: 2c1d6ce4f3da ("clk: qcom: Add TCSR clock driver for Glymur SoC")
Signed-off-by: Taniya Das <taniya.das@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Tested-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251031-tcsrcc_glymur-v1-1-0efb031f0ac5@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/tcsrcc-glymur.c | 54 ++++++++++++++++----------------
1 file changed, 27 insertions(+), 27 deletions(-)
diff --git a/drivers/clk/qcom/tcsrcc-glymur.c b/drivers/clk/qcom/tcsrcc-glymur.c
index c1f8b6d10b7fd..215bc2ac548da 100644
--- a/drivers/clk/qcom/tcsrcc-glymur.c
+++ b/drivers/clk/qcom/tcsrcc-glymur.c
@@ -28,10 +28,10 @@ enum {
};
static struct clk_branch tcsr_edp_clkref_en = {
- .halt_reg = 0x1c,
+ .halt_reg = 0x60,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x1c,
+ .enable_reg = 0x60,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_edp_clkref_en",
@@ -45,10 +45,10 @@ static struct clk_branch tcsr_edp_clkref_en = {
};
static struct clk_branch tcsr_pcie_1_clkref_en = {
- .halt_reg = 0x4,
+ .halt_reg = 0x48,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x4,
+ .enable_reg = 0x48,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_pcie_1_clkref_en",
@@ -62,10 +62,10 @@ static struct clk_branch tcsr_pcie_1_clkref_en = {
};
static struct clk_branch tcsr_pcie_2_clkref_en = {
- .halt_reg = 0x8,
+ .halt_reg = 0x4c,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x8,
+ .enable_reg = 0x4c,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_pcie_2_clkref_en",
@@ -79,10 +79,10 @@ static struct clk_branch tcsr_pcie_2_clkref_en = {
};
static struct clk_branch tcsr_pcie_3_clkref_en = {
- .halt_reg = 0x10,
+ .halt_reg = 0x54,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x10,
+ .enable_reg = 0x54,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_pcie_3_clkref_en",
@@ -96,10 +96,10 @@ static struct clk_branch tcsr_pcie_3_clkref_en = {
};
static struct clk_branch tcsr_pcie_4_clkref_en = {
- .halt_reg = 0x14,
+ .halt_reg = 0x58,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x14,
+ .enable_reg = 0x58,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_pcie_4_clkref_en",
@@ -113,10 +113,10 @@ static struct clk_branch tcsr_pcie_4_clkref_en = {
};
static struct clk_branch tcsr_usb2_1_clkref_en = {
- .halt_reg = 0x28,
+ .halt_reg = 0x6c,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x28,
+ .enable_reg = 0x6c,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb2_1_clkref_en",
@@ -130,10 +130,10 @@ static struct clk_branch tcsr_usb2_1_clkref_en = {
};
static struct clk_branch tcsr_usb2_2_clkref_en = {
- .halt_reg = 0x2c,
+ .halt_reg = 0x70,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x2c,
+ .enable_reg = 0x70,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb2_2_clkref_en",
@@ -147,10 +147,10 @@ static struct clk_branch tcsr_usb2_2_clkref_en = {
};
static struct clk_branch tcsr_usb2_3_clkref_en = {
- .halt_reg = 0x30,
+ .halt_reg = 0x74,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x30,
+ .enable_reg = 0x74,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb2_3_clkref_en",
@@ -164,10 +164,10 @@ static struct clk_branch tcsr_usb2_3_clkref_en = {
};
static struct clk_branch tcsr_usb2_4_clkref_en = {
- .halt_reg = 0x44,
+ .halt_reg = 0x88,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x44,
+ .enable_reg = 0x88,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb2_4_clkref_en",
@@ -181,10 +181,10 @@ static struct clk_branch tcsr_usb2_4_clkref_en = {
};
static struct clk_branch tcsr_usb3_0_clkref_en = {
- .halt_reg = 0x20,
+ .halt_reg = 0x64,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x20,
+ .enable_reg = 0x64,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb3_0_clkref_en",
@@ -198,10 +198,10 @@ static struct clk_branch tcsr_usb3_0_clkref_en = {
};
static struct clk_branch tcsr_usb3_1_clkref_en = {
- .halt_reg = 0x24,
+ .halt_reg = 0x68,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x24,
+ .enable_reg = 0x68,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb3_1_clkref_en",
@@ -215,10 +215,10 @@ static struct clk_branch tcsr_usb3_1_clkref_en = {
};
static struct clk_branch tcsr_usb4_1_clkref_en = {
- .halt_reg = 0x0,
+ .halt_reg = 0x44,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x0,
+ .enable_reg = 0x44,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb4_1_clkref_en",
@@ -232,10 +232,10 @@ static struct clk_branch tcsr_usb4_1_clkref_en = {
};
static struct clk_branch tcsr_usb4_2_clkref_en = {
- .halt_reg = 0x18,
+ .halt_reg = 0x5c,
.halt_check = BRANCH_HALT_DELAY,
.clkr = {
- .enable_reg = 0x18,
+ .enable_reg = 0x5c,
.enable_mask = BIT(0),
.hw.init = &(const struct clk_init_data) {
.name = "tcsr_usb4_2_clkref_en",
@@ -268,7 +268,7 @@ static const struct regmap_config tcsr_cc_glymur_regmap_config = {
.reg_bits = 32,
.reg_stride = 4,
.val_bits = 32,
- .max_register = 0x44,
+ .max_register = 0x94,
.fast_io = true,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 175/614] timers/migration: Convert "while" loops to use "for"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 174/614] clk: qcom: tcsrcc-glymur: Update register offsets for clock refs Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 176/614] timers/migration: Remove locking on group connection Greg Kroah-Hartman
` (452 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frederic Weisbecker, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
[ Upstream commit 6c181b5667eea3e6564d334443536a5974190e15 ]
Both the "do while" and "while" loops in tmigr_setup_groups() eventually
mimic the behaviour of "for" loops.
Simplify accordingly.
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251024132536.39841-2-frederic@kernel.org
Stable-dep-of: 5eb579dfd46b ("timers/migration: Fix imbalanced NUMA trees")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/timer_migration.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/kernel/time/timer_migration.c b/kernel/time/timer_migration.c
index c0c54dc5314c3..1e371f1fdc86c 100644
--- a/kernel/time/timer_migration.c
+++ b/kernel/time/timer_migration.c
@@ -1642,22 +1642,23 @@ static void tmigr_connect_child_parent(struct tmigr_group *child,
static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
{
struct tmigr_group *group, *child, **stack;
- int top = 0, err = 0, i = 0;
+ int i, top = 0, err = 0;
struct list_head *lvllist;
stack = kcalloc(tmigr_hierarchy_levels, sizeof(*stack), GFP_KERNEL);
if (!stack)
return -ENOMEM;
- do {
+ for (i = 0; i < tmigr_hierarchy_levels; i++) {
group = tmigr_get_group(cpu, node, i);
if (IS_ERR(group)) {
err = PTR_ERR(group);
+ i--;
break;
}
top = i;
- stack[i++] = group;
+ stack[i] = group;
/*
* When booting only less CPUs of a system than CPUs are
@@ -1667,16 +1668,18 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
* be different from tmigr_hierarchy_levels, contains only a
* single group.
*/
- if (group->parent || list_is_singular(&tmigr_level_list[i - 1]))
+ if (group->parent || list_is_singular(&tmigr_level_list[i]))
break;
+ }
- } while (i < tmigr_hierarchy_levels);
-
- /* Assert single root */
- WARN_ON_ONCE(!err && !group->parent && !list_is_singular(&tmigr_level_list[top]));
+ /* Assert single root without parent */
+ if (WARN_ON_ONCE(i >= tmigr_hierarchy_levels))
+ return -EINVAL;
+ if (WARN_ON_ONCE(!err && !group->parent && !list_is_singular(&tmigr_level_list[top])))
+ return -EINVAL;
- while (i > 0) {
- group = stack[--i];
+ for (; i >= 0; i--) {
+ group = stack[i];
if (err < 0) {
list_del(&group->list);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 176/614] timers/migration: Remove locking on group connection
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 175/614] timers/migration: Convert "while" loops to use "for" Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 177/614] timers/migration: Fix imbalanced NUMA trees Greg Kroah-Hartman
` (451 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frederic Weisbecker, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
[ Upstream commit fa9620355d4192200f15cb3d97c6eb9c02442249 ]
Initializing the tmc's group, the group's number of children and the
group's parent can all be done without locking because:
1) Reading the group's parent and its group mask is done locklessly.
2) The connections prepared for a given CPU hierarchy are visible to the
target CPU once online, thanks to the CPU hotplug enforced memory
ordering.
3) In case of a newly created upper level, the new root and its
connections and initialization are made visible by the CPU which made
the connections. When that CPUs goes idle in the future, the new link
is published by tmigr_inactive_up() through the atomic RmW on
->migr_state.
4) If CPUs were still walking up the active hierarchy, they could observe
the new root earlier. In this case the ordering is enforced by an
early initialization of the group mask and by barriers that maintain
address dependency as explained in:
b729cc1ec21a ("timers/migration: Fix another race between hotplug and idle entry/exit")
de3ced72a792 ("timers/migration: Enforce group initialization visibility to tree walkers")
5) Timers are propagated by a chain of group locking from the bottom to
the top. And while doing so, the tree also propagates groups links
and initialization. Therefore remote expiration, which also relies
on group locking, will observe those links and initialization while
holding the root lock before walking the tree remotely and update
remote timers. This is especially important for migrators in the
active hierarchy that may observe the new root early.
Therefore the locking is unnecessary at initialization. If anything, it
just brings confusion. Remove it.
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251024132536.39841-3-frederic@kernel.org
Stable-dep-of: 5eb579dfd46b ("timers/migration: Fix imbalanced NUMA trees")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/timer_migration.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/kernel/time/timer_migration.c b/kernel/time/timer_migration.c
index 1e371f1fdc86c..5f8aef94ca0f7 100644
--- a/kernel/time/timer_migration.c
+++ b/kernel/time/timer_migration.c
@@ -1573,9 +1573,6 @@ static void tmigr_connect_child_parent(struct tmigr_group *child,
{
struct tmigr_walk data;
- raw_spin_lock_irq(&child->lock);
- raw_spin_lock_nested(&parent->lock, SINGLE_DEPTH_NESTING);
-
if (activate) {
/*
* @child is the old top and @parent the new one. In this
@@ -1596,9 +1593,6 @@ static void tmigr_connect_child_parent(struct tmigr_group *child,
*/
smp_store_release(&child->parent, parent);
- raw_spin_unlock(&parent->lock);
- raw_spin_unlock_irq(&child->lock);
-
trace_tmigr_connect_child_parent(child);
if (!activate)
@@ -1695,13 +1689,9 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
if (i == 0) {
struct tmigr_cpu *tmc = per_cpu_ptr(&tmigr_cpu, cpu);
- raw_spin_lock_irq(&group->lock);
-
tmc->tmgroup = group;
tmc->groupmask = BIT(group->num_children++);
- raw_spin_unlock_irq(&group->lock);
-
trace_tmigr_connect_cpu_parent(tmc);
/* There are no children that need to be connected */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 177/614] timers/migration: Fix imbalanced NUMA trees
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 176/614] timers/migration: Remove locking on group connection Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 178/614] power: supply: rt5033_charger: Fix device node reference leaks Greg Kroah-Hartman
` (450 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frederic Weisbecker, Thomas Gleixner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
[ Upstream commit 5eb579dfd46b4949117ecb0f1ba2f12d3dc9a6f2 ]
When a CPU from a new node boots, the old root may happen to be
connected to the new root even if their node mismatch, as depicted in
the following scenario:
1) CPU 0 boots and creates the first group for node 0.
[GRP0:0]
node 0
|
CPU 0
2) CPU 1 from node 1 boots and creates a new top that corresponds to
node 1, but it also connects the old root from node 0 to the new root
from node 1 by mistake.
[GRP1:0]
node 1
/ \
/ \
[GRP0:0] [GRP0:1]
node 0 node 1
| |
CPU 0 CPU 1
3) This eventually leads to an imbalanced tree where some node 0 CPUs
migrate node 1 timers (and vice versa) way before reaching the
crossnode groups, resulting in more frequent remote memory accesses
than expected.
[GRP2:0]
NUMA_NO_NODE
/ \
[GRP1:0] [GRP1:1]
node 1 node 0
/ \ |
/ \ [...]
[GRP0:0] [GRP0:1]
node 0 node 1
| |
CPU 0... CPU 1...
A balanced tree should only contain groups having children that belong
to the same node:
[GRP2:0]
NUMA_NO_NODE
/ \
[GRP1:0] [GRP1:0]
node 0 node 1
/ \ / \
/ \ / \
[GRP0:0] [...] [...] [GRP0:1]
node 0 node 1
| |
CPU 0... CPU 1...
In order to fix this, the hierarchy must be unfolded up to the crossnode
level as soon as a node mismatch is detected. For example the stage 2
above should lead to this layout:
[GRP2:0]
NUMA_NO_NODE
/ \
[GRP1:0] [GRP1:1]
node 0 node 1
/ \
/ \
[GRP0:0] [GRP0:1]
node 0 node 1
| |
CPU 0 CPU 1
This means that not only GRP1:0 must be created but also GRP1:1 and
GRP2:0 in order to prepare a balanced tree for next CPUs to boot.
Fixes: 7ee988770326 ("timers: Implement the hierarchical pull model")
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251024132536.39841-4-frederic@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/timer_migration.c | 231 +++++++++++++++++++---------------
1 file changed, 127 insertions(+), 104 deletions(-)
diff --git a/kernel/time/timer_migration.c b/kernel/time/timer_migration.c
index 5f8aef94ca0f7..49635a2b7ee28 100644
--- a/kernel/time/timer_migration.c
+++ b/kernel/time/timer_migration.c
@@ -420,6 +420,8 @@ static struct list_head *tmigr_level_list __read_mostly;
static unsigned int tmigr_hierarchy_levels __read_mostly;
static unsigned int tmigr_crossnode_level __read_mostly;
+static struct tmigr_group *tmigr_root;
+
static DEFINE_PER_CPU(struct tmigr_cpu, tmigr_cpu);
#define TMIGR_NONE 0xFF
@@ -522,11 +524,9 @@ struct tmigr_walk {
typedef bool (*up_f)(struct tmigr_group *, struct tmigr_group *, struct tmigr_walk *);
-static void __walk_groups(up_f up, struct tmigr_walk *data,
- struct tmigr_cpu *tmc)
+static void __walk_groups_from(up_f up, struct tmigr_walk *data,
+ struct tmigr_group *child, struct tmigr_group *group)
{
- struct tmigr_group *child = NULL, *group = tmc->tmgroup;
-
do {
WARN_ON_ONCE(group->level >= tmigr_hierarchy_levels);
@@ -544,6 +544,12 @@ static void __walk_groups(up_f up, struct tmigr_walk *data,
} while (group);
}
+static void __walk_groups(up_f up, struct tmigr_walk *data,
+ struct tmigr_cpu *tmc)
+{
+ __walk_groups_from(up, data, NULL, tmc->tmgroup);
+}
+
static void walk_groups(up_f up, struct tmigr_walk *data, struct tmigr_cpu *tmc)
{
lockdep_assert_held(&tmc->lock);
@@ -1498,21 +1504,6 @@ static void tmigr_init_group(struct tmigr_group *group, unsigned int lvl,
s.seq = 0;
atomic_set(&group->migr_state, s.state);
- /*
- * If this is a new top-level, prepare its groupmask in advance.
- * This avoids accidents where yet another new top-level is
- * created in the future and made visible before the current groupmask.
- */
- if (list_empty(&tmigr_level_list[lvl])) {
- group->groupmask = BIT(0);
- /*
- * The previous top level has prepared its groupmask already,
- * simply account it as the first child.
- */
- if (lvl > 0)
- group->num_children = 1;
- }
-
timerqueue_init_head(&group->events);
timerqueue_init(&group->groupevt.nextevt);
group->groupevt.nextevt.expires = KTIME_MAX;
@@ -1567,22 +1558,51 @@ static struct tmigr_group *tmigr_get_group(unsigned int cpu, int node,
return group;
}
+static bool tmigr_init_root(struct tmigr_group *group, bool activate)
+{
+ if (!group->parent && group != tmigr_root) {
+ /*
+ * This is the new top-level, prepare its groupmask in advance
+ * to avoid accidents where yet another new top-level is
+ * created in the future and made visible before this groupmask.
+ */
+ group->groupmask = BIT(0);
+ WARN_ON_ONCE(activate);
+
+ return true;
+ }
+
+ return false;
+
+}
+
static void tmigr_connect_child_parent(struct tmigr_group *child,
struct tmigr_group *parent,
bool activate)
{
- struct tmigr_walk data;
+ if (tmigr_init_root(parent, activate)) {
+ /*
+ * The previous top level had prepared its groupmask already,
+ * simply account it in advance as the first child. If some groups
+ * have been created between the old and new root due to node
+ * mismatch, the new root's child will be intialized accordingly.
+ */
+ parent->num_children = 1;
+ }
- if (activate) {
+ /* Connecting old root to new root ? */
+ if (!parent->parent && activate) {
/*
- * @child is the old top and @parent the new one. In this
- * case groupmask is pre-initialized and @child already
- * accounted, along with its new sibling corresponding to the
- * CPU going up.
+ * @child is the old top, or in case of node mismatch, some
+ * intermediate group between the old top and the new one in
+ * @parent. In this case the @child must be pre-accounted above
+ * as the first child. Its new inactive sibling corresponding
+ * to the CPU going up has been accounted as the second child.
*/
- WARN_ON_ONCE(child->groupmask != BIT(0) || parent->num_children != 2);
+ WARN_ON_ONCE(parent->num_children != 2);
+ child->groupmask = BIT(0);
} else {
- /* Adding @child for the CPU going up to @parent. */
+ /* Common case adding @child for the CPU going up to @parent. */
child->groupmask = BIT(parent->num_children++);
}
@@ -1594,56 +1614,28 @@ static void tmigr_connect_child_parent(struct tmigr_group *child,
smp_store_release(&child->parent, parent);
trace_tmigr_connect_child_parent(child);
-
- if (!activate)
- return;
-
- /*
- * To prevent inconsistent states, active children need to be active in
- * the new parent as well. Inactive children are already marked inactive
- * in the parent group:
- *
- * * When new groups were created by tmigr_setup_groups() starting from
- * the lowest level (and not higher then one level below the current
- * top level), then they are not active. They will be set active when
- * the new online CPU comes active.
- *
- * * But if a new group above the current top level is required, it is
- * mandatory to propagate the active state of the already existing
- * child to the new parent. So tmigr_connect_child_parent() is
- * executed with the formerly top level group (child) and the newly
- * created group (parent).
- *
- * * It is ensured that the child is active, as this setup path is
- * executed in hotplug prepare callback. This is exectued by an
- * already connected and !idle CPU. Even if all other CPUs go idle,
- * the CPU executing the setup will be responsible up to current top
- * level group. And the next time it goes inactive, it will release
- * the new childmask and parent to subsequent walkers through this
- * @child. Therefore propagate active state unconditionally.
- */
- data.childmask = child->groupmask;
-
- /*
- * There is only one new level per time (which is protected by
- * tmigr_mutex). When connecting the child and the parent and set the
- * child active when the parent is inactive, the parent needs to be the
- * uppermost level. Otherwise there went something wrong!
- */
- WARN_ON(!tmigr_active_up(parent, child, &data) && parent->parent);
}
-static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
+static int tmigr_setup_groups(unsigned int cpu, unsigned int node,
+ struct tmigr_group *start, bool activate)
{
struct tmigr_group *group, *child, **stack;
- int i, top = 0, err = 0;
- struct list_head *lvllist;
+ int i, top = 0, err = 0, start_lvl = 0;
+ bool root_mismatch = false;
stack = kcalloc(tmigr_hierarchy_levels, sizeof(*stack), GFP_KERNEL);
if (!stack)
return -ENOMEM;
- for (i = 0; i < tmigr_hierarchy_levels; i++) {
+ if (start) {
+ stack[start->level] = start;
+ start_lvl = start->level + 1;
+ }
+
+ if (tmigr_root)
+ root_mismatch = tmigr_root->numa_node != node;
+
+ for (i = start_lvl; i < tmigr_hierarchy_levels; i++) {
group = tmigr_get_group(cpu, node, i);
if (IS_ERR(group)) {
err = PTR_ERR(group);
@@ -1656,23 +1648,25 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
/*
* When booting only less CPUs of a system than CPUs are
- * available, not all calculated hierarchy levels are required.
+ * available, not all calculated hierarchy levels are required,
+ * unless a node mismatch is detected.
*
* The loop is aborted as soon as the highest level, which might
* be different from tmigr_hierarchy_levels, contains only a
- * single group.
+ * single group, unless the nodes mismatch below tmigr_crossnode_level
*/
- if (group->parent || list_is_singular(&tmigr_level_list[i]))
+ if (group->parent)
+ break;
+ if ((!root_mismatch || i >= tmigr_crossnode_level) &&
+ list_is_singular(&tmigr_level_list[i]))
break;
}
/* Assert single root without parent */
if (WARN_ON_ONCE(i >= tmigr_hierarchy_levels))
return -EINVAL;
- if (WARN_ON_ONCE(!err && !group->parent && !list_is_singular(&tmigr_level_list[top])))
- return -EINVAL;
- for (; i >= 0; i--) {
+ for (; i >= start_lvl; i--) {
group = stack[i];
if (err < 0) {
@@ -1692,48 +1686,63 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
tmc->tmgroup = group;
tmc->groupmask = BIT(group->num_children++);
+ tmigr_init_root(group, activate);
+
trace_tmigr_connect_cpu_parent(tmc);
/* There are no children that need to be connected */
continue;
} else {
child = stack[i - 1];
- /* Will be activated at online time */
- tmigr_connect_child_parent(child, group, false);
+ tmigr_connect_child_parent(child, group, activate);
}
+ }
- /* check if uppermost level was newly created */
- if (top != i)
- continue;
-
- WARN_ON_ONCE(top == 0);
+ if (err < 0)
+ goto out;
- lvllist = &tmigr_level_list[top];
+ if (activate) {
+ struct tmigr_walk data;
/*
- * Newly created root level should have accounted the upcoming
- * CPU's child group and pre-accounted the old root.
+ * To prevent inconsistent states, active children need to be active in
+ * the new parent as well. Inactive children are already marked inactive
+ * in the parent group:
+ *
+ * * When new groups were created by tmigr_setup_groups() starting from
+ * the lowest level, then they are not active. They will be set active
+ * when the new online CPU comes active.
+ *
+ * * But if new groups above the current top level are required, it is
+ * mandatory to propagate the active state of the already existing
+ * child to the new parents. So tmigr_active_up() activates the
+ * new parents while walking up from the old root to the new.
+ *
+ * * It is ensured that @start is active, as this setup path is
+ * executed in hotplug prepare callback. This is executed by an
+ * already connected and !idle CPU. Even if all other CPUs go idle,
+ * the CPU executing the setup will be responsible up to current top
+ * level group. And the next time it goes inactive, it will release
+ * the new childmask and parent to subsequent walkers through this
+ * @child. Therefore propagate active state unconditionally.
*/
- if (group->num_children == 2 && list_is_singular(lvllist)) {
- /*
- * The target CPU must never do the prepare work, except
- * on early boot when the boot CPU is the target. Otherwise
- * it may spuriously activate the old top level group inside
- * the new one (nevertheless whether old top level group is
- * active or not) and/or release an uninitialized childmask.
- */
- WARN_ON_ONCE(cpu == raw_smp_processor_id());
-
- lvllist = &tmigr_level_list[top - 1];
- list_for_each_entry(child, lvllist, list) {
- if (child->parent)
- continue;
+ WARN_ON_ONCE(!start->parent);
+ data.childmask = start->groupmask;
+ __walk_groups_from(tmigr_active_up, &data, start, start->parent);
+ }
- tmigr_connect_child_parent(child, group, true);
- }
+ /* Root update */
+ if (list_is_singular(&tmigr_level_list[top])) {
+ group = list_first_entry(&tmigr_level_list[top],
+ typeof(*group), list);
+ WARN_ON_ONCE(group->parent);
+ if (tmigr_root) {
+ /* Old root should be the same or below */
+ WARN_ON_ONCE(tmigr_root->level > top);
}
+ tmigr_root = group;
}
-
+out:
kfree(stack);
return err;
@@ -1741,12 +1750,26 @@ static int tmigr_setup_groups(unsigned int cpu, unsigned int node)
static int tmigr_add_cpu(unsigned int cpu)
{
+ struct tmigr_group *old_root = tmigr_root;
int node = cpu_to_node(cpu);
int ret;
- mutex_lock(&tmigr_mutex);
- ret = tmigr_setup_groups(cpu, node);
- mutex_unlock(&tmigr_mutex);
+ guard(mutex)(&tmigr_mutex);
+
+ ret = tmigr_setup_groups(cpu, node, NULL, false);
+
+ /* Root has changed? Connect the old one to the new */
+ if (ret >= 0 && old_root && old_root != tmigr_root) {
+ /*
+ * The target CPU must never do the prepare work, except
+ * on early boot when the boot CPU is the target. Otherwise
+ * it may spuriously activate the old top level group inside
+ * the new one (nevertheless whether old top level group is
+ * active or not) and/or release an uninitialized childmask.
+ */
+ WARN_ON_ONCE(cpu == raw_smp_processor_id());
+ ret = tmigr_setup_groups(-1, old_root->numa_node, old_root, true);
+ }
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 178/614] power: supply: rt5033_charger: Fix device node reference leaks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 177/614] timers/migration: Fix imbalanced NUMA trees Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 179/614] power: supply: cw2015: Check devm_delayed_work_autocancel() return code Greg Kroah-Hartman
` (449 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 6cdc4d488c2f3a61174bfba4e8cc4ac92c219258 ]
The device node pointers `np_conn` and `np_edev`, obtained from
of_parse_phandle() and of_get_parent() respectively, are not released.
This results in a reference count leak.
Add of_node_put() calls after the last use of these device nodes to
properly release their references and fix the leaks.
Fixes: 8242336dc8a8 ("power: supply: rt5033_charger: Add cable detection and USB OTG supply")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20250929113234.1726-1-vulab@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/rt5033_charger.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/power/supply/rt5033_charger.c b/drivers/power/supply/rt5033_charger.c
index 2fdc584397075..de724f23e453b 100644
--- a/drivers/power/supply/rt5033_charger.c
+++ b/drivers/power/supply/rt5033_charger.c
@@ -701,6 +701,8 @@ static int rt5033_charger_probe(struct platform_device *pdev)
np_conn = of_parse_phandle(pdev->dev.of_node, "richtek,usb-connector", 0);
np_edev = of_get_parent(np_conn);
charger->edev = extcon_find_edev_by_node(np_edev);
+ of_node_put(np_edev);
+ of_node_put(np_conn);
if (IS_ERR(charger->edev)) {
dev_warn(charger->dev, "no extcon device found in device-tree\n");
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 179/614] power: supply: cw2015: Check devm_delayed_work_autocancel() return code
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 178/614] power: supply: rt5033_charger: Fix device node reference leaks Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 180/614] power: supply: max17040: Check iio_read_channel_processed() " Greg Kroah-Hartman
` (448 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivan Abramov, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit 92ec7e7b86ec0aff9cd7db64d9dce50a0ea7c542 ]
Since devm_delayed_work_autocancel() may fail, add return code check and
exit cw_bat_probe() on error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Link: https://patch.msgid.link/20251008120711.556021-1-i.abramov@mt-integration.ru
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/cw2015_battery.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index 2263d5d3448fd..0806abea2372f 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -699,7 +699,13 @@ static int cw_bat_probe(struct i2c_client *client)
if (!cw_bat->battery_workqueue)
return -ENOMEM;
- devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ ret = devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ if (ret) {
+ dev_err_probe(&client->dev, ret,
+ "Failed to register delayed work\n");
+ return ret;
+ }
+
queue_delayed_work(cw_bat->battery_workqueue,
&cw_bat->battery_delay_work, msecs_to_jiffies(10));
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 180/614] power: supply: max17040: Check iio_read_channel_processed() return code
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 179/614] power: supply: cw2015: Check devm_delayed_work_autocancel() return code Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 181/614] power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() Greg Kroah-Hartman
` (447 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivan Abramov, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit 2c68ac48c52ad146523f32b01d70009622bf81aa ]
Since iio_read_channel_processed() may fail, return its exit code on error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 814755c48f8b ("power: max17040: get thermal data from adc if available")
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Link: https://patch.msgid.link/20251008133648.559286-1-i.abramov@mt-integration.ru
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/max17040_battery.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/max17040_battery.c b/drivers/power/supply/max17040_battery.c
index c1640bc6accd2..48453508688a4 100644
--- a/drivers/power/supply/max17040_battery.c
+++ b/drivers/power/supply/max17040_battery.c
@@ -388,6 +388,7 @@ static int max17040_get_property(struct power_supply *psy,
union power_supply_propval *val)
{
struct max17040_chip *chip = power_supply_get_drvdata(psy);
+ int ret;
switch (psp) {
case POWER_SUPPLY_PROP_ONLINE:
@@ -410,7 +411,10 @@ static int max17040_get_property(struct power_supply *psy,
if (!chip->channel_temp)
return -ENODATA;
- iio_read_channel_processed(chip->channel_temp, &val->intval);
+ ret = iio_read_channel_processed(chip->channel_temp, &val->intval);
+ if (ret)
+ return ret;
+
val->intval /= 100; /* Convert from milli- to deci-degree */
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 181/614] power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 180/614] power: supply: max17040: Check iio_read_channel_processed() " Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 182/614] power: supply: rt9467: Prevent using uninitialized local variable " Greg Kroah-Hartman
` (446 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivan Abramov, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit 8b27fe2d8d2380118c343629175385ff587e2fe4 ]
The return value of rt9467_set_value_from_ranges() when setting AICL VTH is
not checked, even though it may fail.
Log error and return from rt9467_run_aicl() on fail.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver")
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Link: https://patch.msgid.link/20251009144725.562278-1-i.abramov@mt-integration.ru
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/rt9467-charger.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/power/supply/rt9467-charger.c b/drivers/power/supply/rt9467-charger.c
index fe773dd8b404f..b4917514bd701 100644
--- a/drivers/power/supply/rt9467-charger.c
+++ b/drivers/power/supply/rt9467-charger.c
@@ -588,6 +588,10 @@ static int rt9467_run_aicl(struct rt9467_chg_data *data)
aicl_vth = mivr_vth + RT9467_AICLVTH_GAP_uV;
ret = rt9467_set_value_from_ranges(data, F_AICL_VTH,
RT9467_RANGE_AICL_VTH, aicl_vth);
+ if (ret) {
+ dev_err(data->dev, "Failed to set AICL VTH\n");
+ return ret;
+ }
/* Trigger AICL function */
ret = regmap_field_write(data->rm_field[F_AICL_MEAS], 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 182/614] power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 181/614] power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 183/614] power: supply: wm831x: Check wm831x_set_bits() return value Greg Kroah-Hartman
` (445 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Murad Masimov, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murad Masimov <m.masimov@mt-integration.ru>
[ Upstream commit 15aca30cc6c69806054b896a2ccf7577239cb878 ]
There is a typo in rt9467_set_value_from_ranges() that can cause leaving local
variable sel with an undefined value which is then used in regmap_field_write().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver")
Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
Link: https://patch.msgid.link/20251009145308.1830893-1-m.masimov@mt-integration.ru
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/rt9467-charger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/rt9467-charger.c b/drivers/power/supply/rt9467-charger.c
index b4917514bd701..44c26fb37a775 100644
--- a/drivers/power/supply/rt9467-charger.c
+++ b/drivers/power/supply/rt9467-charger.c
@@ -376,7 +376,7 @@ static int rt9467_set_value_from_ranges(struct rt9467_chg_data *data,
if (rsel == RT9467_RANGE_VMIVR) {
ret = linear_range_get_selector_high(range, value, &sel, &found);
if (ret)
- value = range->max_sel;
+ sel = range->max_sel;
} else {
linear_range_get_selector_within(range, value, &sel);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 183/614] power: supply: wm831x: Check wm831x_set_bits() return value
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 182/614] power: supply: rt9467: Prevent using uninitialized local variable " Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 184/614] power: supply: qcom_battmgr: clamp charge control thresholds Greg Kroah-Hartman
` (444 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivan Abramov, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit ea14bae6df18942bccb467fcf5ff33ca677b8253 ]
Since wm831x_set_bits() may return error, log failure and exit from
wm831x_usb_limit_change() in such case.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 626b6cd5f52e ("power: wm831x_power: Support USB charger current limit management")
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Link: https://patch.msgid.link/20251009170553.566561-1-i.abramov@mt-integration.ru
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/wm831x_power.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/power/supply/wm831x_power.c b/drivers/power/supply/wm831x_power.c
index 6acdba7885ca5..78fa0573ef25c 100644
--- a/drivers/power/supply/wm831x_power.c
+++ b/drivers/power/supply/wm831x_power.c
@@ -144,6 +144,7 @@ static int wm831x_usb_limit_change(struct notifier_block *nb,
struct wm831x_power,
usb_notify);
unsigned int i, best;
+ int ret;
/* Find the highest supported limit */
best = 0;
@@ -156,8 +157,13 @@ static int wm831x_usb_limit_change(struct notifier_block *nb,
dev_dbg(wm831x_power->wm831x->dev,
"Limiting USB current to %umA", wm831x_usb_limits[best]);
- wm831x_set_bits(wm831x_power->wm831x, WM831X_POWER_STATE,
- WM831X_USB_ILIM_MASK, best);
+ ret = wm831x_set_bits(wm831x_power->wm831x, WM831X_POWER_STATE,
+ WM831X_USB_ILIM_MASK, best);
+ if (ret < 0) {
+ dev_err(wm831x_power->wm831x->dev,
+ "Failed to set USB current limit: %d\n", ret);
+ return ret;
+ }
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 184/614] power: supply: qcom_battmgr: clamp charge control thresholds
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 183/614] power: supply: wm831x: Check wm831x_set_bits() return value Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 185/614] power: supply: qcom_battmgr: support disabling charge control Greg Kroah-Hartman
` (443 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Val Packett, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit 8809980fdc8a86070667032fa4005ee83f1c62f3 ]
The sysfs API documentation says that drivers "round written values to
the nearest supported value" for charge_control_end_threshold.
Let's do this for both thresholds, as userspace (e.g. upower) generally
does not expect these writes to fail at all.
Fixes: cc3e883a0625 ("power: supply: qcom_battmgr: Add charge control support")
Signed-off-by: Val Packett <val@packett.cool>
Link: https://patch.msgid.link/20251012233333.19144-3-val@packett.cool
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_battmgr.c | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
index 3c2837ef34617..c8028606bba00 100644
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -678,12 +678,7 @@ static int qcom_battmgr_set_charge_start_threshold(struct qcom_battmgr *battmgr,
u32 target_soc, delta_soc;
int ret;
- if (start_soc < CHARGE_CTRL_START_THR_MIN ||
- start_soc > CHARGE_CTRL_START_THR_MAX) {
- dev_err(battmgr->dev, "charge control start threshold exceed range: [%u - %u]\n",
- CHARGE_CTRL_START_THR_MIN, CHARGE_CTRL_START_THR_MAX);
- return -EINVAL;
- }
+ start_soc = clamp(start_soc, CHARGE_CTRL_START_THR_MIN, CHARGE_CTRL_START_THR_MAX);
/*
* If the new start threshold is larger than the old end threshold,
@@ -716,12 +711,7 @@ static int qcom_battmgr_set_charge_end_threshold(struct qcom_battmgr *battmgr, i
u32 delta_soc = CHARGE_CTRL_DELTA_SOC;
int ret;
- if (end_soc < CHARGE_CTRL_END_THR_MIN ||
- end_soc > CHARGE_CTRL_END_THR_MAX) {
- dev_err(battmgr->dev, "charge control end threshold exceed range: [%u - %u]\n",
- CHARGE_CTRL_END_THR_MIN, CHARGE_CTRL_END_THR_MAX);
- return -EINVAL;
- }
+ end_soc = clamp(end_soc, CHARGE_CTRL_END_THR_MIN, CHARGE_CTRL_END_THR_MAX);
if (battmgr->info.charge_ctrl_start && end_soc > battmgr->info.charge_ctrl_start)
delta_soc = end_soc - battmgr->info.charge_ctrl_start;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 185/614] power: supply: qcom_battmgr: support disabling charge control
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 184/614] power: supply: qcom_battmgr: clamp charge control thresholds Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 186/614] power: supply: apm_power: only unset own apm_get_power_status Greg Kroah-Hartman
` (442 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Val Packett, Sebastian Reichel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Val Packett <val@packett.cool>
[ Upstream commit 446fcf494691da4e685923e5fad02b163955fc0e ]
Existing userspace (in particular, upower) disables charge control by
setting the start threshold to 0 and the stop threshold to 100.
Handle that by actually setting the enable bit to 0 when a start
threshold of 0 was requested.
Fixes: cc3e883a0625 ("power: supply: qcom_battmgr: Add charge control support")
Signed-off-by: Val Packett <val@packett.cool>
Link: https://patch.msgid.link/20251012233333.19144-4-val@packett.cool
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/qcom_battmgr.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qcom_battmgr.c
index c8028606bba00..e6f01e0122e1c 100644
--- a/drivers/power/supply/qcom_battmgr.c
+++ b/drivers/power/supply/qcom_battmgr.c
@@ -257,6 +257,7 @@ struct qcom_battmgr_info {
unsigned int capacity_warning;
unsigned int cycle_count;
unsigned int charge_count;
+ bool charge_ctrl_enable;
unsigned int charge_ctrl_start;
unsigned int charge_ctrl_end;
char model_number[BATTMGR_STRING_LEN];
@@ -659,13 +660,13 @@ static int qcom_battmgr_bat_get_property(struct power_supply *psy,
}
static int qcom_battmgr_set_charge_control(struct qcom_battmgr *battmgr,
- u32 target_soc, u32 delta_soc)
+ bool enable, u32 target_soc, u32 delta_soc)
{
struct qcom_battmgr_charge_ctrl_request request = {
.hdr.owner = cpu_to_le32(PMIC_GLINK_OWNER_BATTMGR),
.hdr.type = cpu_to_le32(PMIC_GLINK_REQ_RESP),
.hdr.opcode = cpu_to_le32(BATTMGR_CHG_CTRL_LIMIT_EN),
- .enable = cpu_to_le32(1),
+ .enable = cpu_to_le32(enable),
.target_soc = cpu_to_le32(target_soc),
.delta_soc = cpu_to_le32(delta_soc),
};
@@ -677,6 +678,7 @@ static int qcom_battmgr_set_charge_start_threshold(struct qcom_battmgr *battmgr,
{
u32 target_soc, delta_soc;
int ret;
+ bool enable = start_soc != 0;
start_soc = clamp(start_soc, CHARGE_CTRL_START_THR_MIN, CHARGE_CTRL_START_THR_MAX);
@@ -696,9 +698,10 @@ static int qcom_battmgr_set_charge_start_threshold(struct qcom_battmgr *battmgr,
}
mutex_lock(&battmgr->lock);
- ret = qcom_battmgr_set_charge_control(battmgr, target_soc, delta_soc);
+ ret = qcom_battmgr_set_charge_control(battmgr, enable, target_soc, delta_soc);
mutex_unlock(&battmgr->lock);
if (!ret) {
+ battmgr->info.charge_ctrl_enable = enable;
battmgr->info.charge_ctrl_start = start_soc;
battmgr->info.charge_ctrl_end = target_soc;
}
@@ -710,6 +713,7 @@ static int qcom_battmgr_set_charge_end_threshold(struct qcom_battmgr *battmgr, i
{
u32 delta_soc = CHARGE_CTRL_DELTA_SOC;
int ret;
+ bool enable = battmgr->info.charge_ctrl_enable;
end_soc = clamp(end_soc, CHARGE_CTRL_END_THR_MIN, CHARGE_CTRL_END_THR_MAX);
@@ -717,7 +721,7 @@ static int qcom_battmgr_set_charge_end_threshold(struct qcom_battmgr *battmgr, i
delta_soc = end_soc - battmgr->info.charge_ctrl_start;
mutex_lock(&battmgr->lock);
- ret = qcom_battmgr_set_charge_control(battmgr, end_soc, delta_soc);
+ ret = qcom_battmgr_set_charge_control(battmgr, enable, end_soc, delta_soc);
mutex_unlock(&battmgr->lock);
if (!ret) {
battmgr->info.charge_ctrl_start = end_soc - delta_soc;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 186/614] power: supply: apm_power: only unset own apm_get_power_status
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 185/614] power: supply: qcom_battmgr: support disabling charge control Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 187/614] scsi: target: Do not write NUL characters into ASCII configfs output Greg Kroah-Hartman
` (441 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahelenia Ziemiańska,
Sebastian Reichel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
[ Upstream commit bd44ea12919ac4e83c9f3997240fe58266aa8799 ]
Mirroring drivers/macintosh/apm_emu.c, this means that
modprobe apm_power && modprobe $anotherdriver && modprobe -r apm_power
leaves $anotherdriver's apm_get_power_status instead of deleting it.
Fixes: 3788ec932bfd ("[BATTERY] APM emulation driver for class batteries")
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Link: https://patch.msgid.link/xczpgox57hxbunkcbdl5fxhc4gnsajsipldfidi7355afezk64@tarta.nabijaczleweli.xyz
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/apm_power.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/apm_power.c b/drivers/power/supply/apm_power.c
index 9236e00785786..9933cdc5c387a 100644
--- a/drivers/power/supply/apm_power.c
+++ b/drivers/power/supply/apm_power.c
@@ -364,7 +364,8 @@ static int __init apm_battery_init(void)
static void __exit apm_battery_exit(void)
{
- apm_get_power_status = NULL;
+ if (apm_get_power_status == apm_battery_apm_get_power_status)
+ apm_get_power_status = NULL;
}
module_init(apm_battery_init);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 187/614] scsi: target: Do not write NUL characters into ASCII configfs output
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 186/614] power: supply: apm_power: only unset own apm_get_power_status Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 188/614] scsi: target: Fix LUN/device R/W and total command stats Greg Kroah-Hartman
` (440 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Martin K. Petersen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit c03b55f235e283cae49c88b9602fd11096b92eba ]
NUL characters are not allowed in ASCII configfs output. Hence this
patch.
Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251027184639.3501254-2-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_configfs.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index b19acd662726d..1bd28482e7cb3 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2772,7 +2772,6 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page)
cur_len = snprintf(buf, LU_GROUP_NAME_BUF, "%s/%s\n",
config_item_name(&hba->hba_group.cg_item),
config_item_name(&dev->dev_group.cg_item));
- cur_len++; /* Extra byte for NULL terminator */
if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) {
pr_warn("Ran out of lu_gp_show_attr"
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 188/614] scsi: target: Fix LUN/device R/W and total command stats
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 187/614] scsi: target: Do not write NUL characters into ASCII configfs output Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 189/614] fs/9p: Dont open remote file with APPEND mode when writeback cache is used Greg Kroah-Hartman
` (439 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Christie, Dmitry Bogdanov,
Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit 95aa2041c654161d1b5c1eca5379d67d91ef1cf2 ]
In commit 9cf2317b795d ("scsi: target: Move I/O path stats to per CPU")
I saw we sometimes use %u and also misread the spec. As a result I
thought all the stats were supposed to be 32-bit only. However, for the
majority of cases we support currently, the spec specifies u64 bit
stats. This patch converts the stats changed in the commit above to u64.
Fixes: 9cf2317b795d ("scsi: target: Move I/O path stats to per CPU")
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Link: https://patch.msgid.link/20250917221338.14813-2-michael.christie@oracle.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_stat.c | 24 ++++++++++++------------
include/target/target_core_base.h | 12 ++++++------
2 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/drivers/target/target_core_stat.c b/drivers/target/target_core_stat.c
index 6bdf2d8bd6942..4fdc307ea38bc 100644
--- a/drivers/target/target_core_stat.c
+++ b/drivers/target/target_core_stat.c
@@ -282,7 +282,7 @@ static ssize_t target_stat_lu_num_cmds_show(struct config_item *item,
struct se_device *dev = to_stat_lu_dev(item);
struct se_dev_io_stats *stats;
unsigned int cpu;
- u32 cmds = 0;
+ u64 cmds = 0;
for_each_possible_cpu(cpu) {
stats = per_cpu_ptr(dev->stats, cpu);
@@ -290,7 +290,7 @@ static ssize_t target_stat_lu_num_cmds_show(struct config_item *item,
}
/* scsiLuNumCommands */
- return snprintf(page, PAGE_SIZE, "%u\n", cmds);
+ return snprintf(page, PAGE_SIZE, "%llu\n", cmds);
}
static ssize_t target_stat_lu_read_mbytes_show(struct config_item *item,
@@ -299,7 +299,7 @@ static ssize_t target_stat_lu_read_mbytes_show(struct config_item *item,
struct se_device *dev = to_stat_lu_dev(item);
struct se_dev_io_stats *stats;
unsigned int cpu;
- u32 bytes = 0;
+ u64 bytes = 0;
for_each_possible_cpu(cpu) {
stats = per_cpu_ptr(dev->stats, cpu);
@@ -307,7 +307,7 @@ static ssize_t target_stat_lu_read_mbytes_show(struct config_item *item,
}
/* scsiLuReadMegaBytes */
- return snprintf(page, PAGE_SIZE, "%u\n", bytes >> 20);
+ return snprintf(page, PAGE_SIZE, "%llu\n", bytes >> 20);
}
static ssize_t target_stat_lu_write_mbytes_show(struct config_item *item,
@@ -316,7 +316,7 @@ static ssize_t target_stat_lu_write_mbytes_show(struct config_item *item,
struct se_device *dev = to_stat_lu_dev(item);
struct se_dev_io_stats *stats;
unsigned int cpu;
- u32 bytes = 0;
+ u64 bytes = 0;
for_each_possible_cpu(cpu) {
stats = per_cpu_ptr(dev->stats, cpu);
@@ -324,7 +324,7 @@ static ssize_t target_stat_lu_write_mbytes_show(struct config_item *item,
}
/* scsiLuWrittenMegaBytes */
- return snprintf(page, PAGE_SIZE, "%u\n", bytes >> 20);
+ return snprintf(page, PAGE_SIZE, "%llu\n", bytes >> 20);
}
static ssize_t target_stat_lu_resets_show(struct config_item *item, char *page)
@@ -1044,7 +1044,7 @@ static ssize_t target_stat_auth_num_cmds_show(struct config_item *item,
struct se_dev_entry *deve;
unsigned int cpu;
ssize_t ret;
- u32 cmds = 0;
+ u64 cmds = 0;
rcu_read_lock();
deve = target_nacl_find_deve(nacl, lacl->mapped_lun);
@@ -1059,7 +1059,7 @@ static ssize_t target_stat_auth_num_cmds_show(struct config_item *item,
}
/* scsiAuthIntrOutCommands */
- ret = snprintf(page, PAGE_SIZE, "%u\n", cmds);
+ ret = snprintf(page, PAGE_SIZE, "%llu\n", cmds);
rcu_read_unlock();
return ret;
}
@@ -1073,7 +1073,7 @@ static ssize_t target_stat_auth_read_mbytes_show(struct config_item *item,
struct se_dev_entry *deve;
unsigned int cpu;
ssize_t ret;
- u32 bytes = 0;
+ u64 bytes = 0;
rcu_read_lock();
deve = target_nacl_find_deve(nacl, lacl->mapped_lun);
@@ -1088,7 +1088,7 @@ static ssize_t target_stat_auth_read_mbytes_show(struct config_item *item,
}
/* scsiAuthIntrReadMegaBytes */
- ret = snprintf(page, PAGE_SIZE, "%u\n", bytes >> 20);
+ ret = snprintf(page, PAGE_SIZE, "%llu\n", bytes >> 20);
rcu_read_unlock();
return ret;
}
@@ -1102,7 +1102,7 @@ static ssize_t target_stat_auth_write_mbytes_show(struct config_item *item,
struct se_dev_entry *deve;
unsigned int cpu;
ssize_t ret;
- u32 bytes = 0;
+ u64 bytes = 0;
rcu_read_lock();
deve = target_nacl_find_deve(nacl, lacl->mapped_lun);
@@ -1117,7 +1117,7 @@ static ssize_t target_stat_auth_write_mbytes_show(struct config_item *item,
}
/* scsiAuthIntrWrittenMegaBytes */
- ret = snprintf(page, PAGE_SIZE, "%u\n", bytes >> 20);
+ ret = snprintf(page, PAGE_SIZE, "%llu\n", bytes >> 20);
rcu_read_unlock();
return ret;
}
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index c4d9116904aa0..27e1f9d5f0c6c 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -671,9 +671,9 @@ struct se_lun_acl {
};
struct se_dev_entry_io_stats {
- u32 total_cmds;
- u32 read_bytes;
- u32 write_bytes;
+ u64 total_cmds;
+ u64 read_bytes;
+ u64 write_bytes;
};
struct se_dev_entry {
@@ -806,9 +806,9 @@ struct se_device_queue {
};
struct se_dev_io_stats {
- u32 total_cmds;
- u32 read_bytes;
- u32 write_bytes;
+ u64 total_cmds;
+ u64 read_bytes;
+ u64 write_bytes;
};
struct se_device {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 189/614] fs/9p: Dont open remote file with APPEND mode when writeback cache is used
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 188/614] scsi: target: Fix LUN/device R/W and total command stats Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 190/614] drm/panthor: Handle errors returned by drm_sched_entity_init() Greg Kroah-Hartman
` (438 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tingmao Wang, Dominique Martinet,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tingmao Wang <m@maowtm.org>
[ Upstream commit a63dd8fd137933551bfd9aeeeaa942f04c7aad65 ]
When page cache is used, writebacks are done on a page granularity, and it
is expected that the underlying filesystem (such as v9fs) should respect
the write position. However, currently v9fs will passthrough O_APPEND to
the server even on cached mode. This causes data corruption if a sync or
fstat gets between two writes to the same file.
This patch removes the APPEND flag from the open request we send to the
server when writeback caching is involved. I believe keeping server-side
APPEND is probably fine for uncached mode (even if two fds are opened, one
without O_APPEND and one with it, this should still be fine since they
would use separate fid for the writes).
Signed-off-by: Tingmao Wang <m@maowtm.org>
Fixes: 4eb3117888a9 ("fs/9p: Rework cache modes and add new options to Documentation")
Message-ID: <20251102235631.8724-1-m@maowtm.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/vfs_file.c | 11 ++++++++---
fs/9p/vfs_inode.c | 3 +--
fs/9p/vfs_inode_dotl.c | 2 +-
3 files changed, 10 insertions(+), 6 deletions(-)
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index eb0b083da269b..d1db03093d4c3 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -43,14 +43,18 @@ int v9fs_file_open(struct inode *inode, struct file *file)
struct v9fs_session_info *v9ses;
struct p9_fid *fid;
int omode;
+ int o_append;
p9_debug(P9_DEBUG_VFS, "inode: %p file: %p\n", inode, file);
v9ses = v9fs_inode2v9ses(inode);
- if (v9fs_proto_dotl(v9ses))
+ if (v9fs_proto_dotl(v9ses)) {
omode = v9fs_open_to_dotl_flags(file->f_flags);
- else
+ o_append = P9_DOTL_APPEND;
+ } else {
omode = v9fs_uflags2omode(file->f_flags,
v9fs_proto_dotu(v9ses));
+ o_append = P9_OAPPEND;
+ }
fid = file->private_data;
if (!fid) {
fid = v9fs_fid_clone(file_dentry(file));
@@ -58,9 +62,10 @@ int v9fs_file_open(struct inode *inode, struct file *file)
return PTR_ERR(fid);
if ((v9ses->cache & CACHE_WRITEBACK) && (omode & P9_OWRITE)) {
- int writeback_omode = (omode & ~P9_OWRITE) | P9_ORDWR;
+ int writeback_omode = (omode & ~(P9_OWRITE | o_append)) | P9_ORDWR;
p9_debug(P9_DEBUG_CACHE, "write-only file with writeback enabled, try opening O_RDWR\n");
+
err = p9_client_open(fid, writeback_omode);
if (err < 0) {
p9_debug(P9_DEBUG_CACHE, "could not open O_RDWR, disabling caches\n");
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index d0c77ec31b1dd..0f3189a0a516a 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -786,7 +786,7 @@ v9fs_vfs_atomic_open(struct inode *dir, struct dentry *dentry,
p9_omode = v9fs_uflags2omode(flags, v9fs_proto_dotu(v9ses));
if ((v9ses->cache & CACHE_WRITEBACK) && (p9_omode & P9_OWRITE)) {
- p9_omode = (p9_omode & ~P9_OWRITE) | P9_ORDWR;
+ p9_omode = (p9_omode & ~(P9_OWRITE | P9_OAPPEND)) | P9_ORDWR;
p9_debug(P9_DEBUG_CACHE,
"write-only file with writeback enabled, creating w/ O_RDWR\n");
}
@@ -1393,4 +1393,3 @@ static const struct inode_operations v9fs_symlink_inode_operations = {
.getattr = v9fs_vfs_getattr,
.setattr = v9fs_vfs_setattr,
};
-
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index be297e3354688..6312b3590f743 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -282,7 +282,7 @@ v9fs_vfs_atomic_open_dotl(struct inode *dir, struct dentry *dentry,
}
if ((v9ses->cache & CACHE_WRITEBACK) && (p9_omode & P9_OWRITE)) {
- p9_omode = (p9_omode & ~P9_OWRITE) | P9_ORDWR;
+ p9_omode = (p9_omode & ~(P9_OWRITE | P9_DOTL_APPEND)) | P9_ORDWR;
p9_debug(P9_DEBUG_CACHE,
"write-only file with writeback enabled, creating w/ O_RDWR\n");
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 190/614] drm/panthor: Handle errors returned by drm_sched_entity_init()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 189/614] fs/9p: Dont open remote file with APPEND mode when writeback cache is used Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 191/614] drm/panthor: Fix group_free_queue() for partially initialized queues Greg Kroah-Hartman
` (437 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liviu Dudau, Boris Brezillon,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@collabora.com>
[ Upstream commit bb7939e332c64c4ef33974a0eae4f3841acfa8eb ]
In practice it's not going to fail because we're passing the current
sanity checks done by drm_sched_entity_init(), and that's the only
reason it would return an error, but better safe than sorry.
Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251031160318.832427-1-boris.brezillon@collabora.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 3d1f57e3990f4..85ef9a7acc147 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3403,6 +3403,8 @@ group_create_queue(struct panthor_group *group,
drm_sched = &queue->scheduler;
ret = drm_sched_entity_init(&queue->entity, 0, &drm_sched, 1, NULL);
+ if (ret)
+ goto err_free_queue;
return queue;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 191/614] drm/panthor: Fix group_free_queue() for partially initialized queues
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 190/614] drm/panthor: Handle errors returned by drm_sched_entity_init() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 192/614] drm/panthor: Fix UAF race between device unplug and FW event processing Greg Kroah-Hartman
` (436 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrián Larumbe, Liviu Dudau,
Boris Brezillon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@collabora.com>
[ Upstream commit 94a6d20feadbbe24e8a7b1c56394789ea5358fcc ]
group_free_queue() can be called on a partially initialized queue
object if something fails in group_create_queue(). Make sure we don't
call drm_sched_entity_destroy() on an entity that hasn't been
initialized.
Fixes: 7d9c3442b02a ("drm/panthor: Defer scheduler entitiy destruction to queue release")
Reviewed-by: Adrián Larumbe <adrian.larumbe@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20251031160318.832427-2-boris.brezillon@collabora.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 85ef9a7acc147..a39f0fb370dc6 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -895,7 +895,8 @@ static void group_free_queue(struct panthor_group *group, struct panthor_queue *
if (IS_ERR_OR_NULL(queue))
return;
- drm_sched_entity_destroy(&queue->entity);
+ if (queue->entity.fence_context)
+ drm_sched_entity_destroy(&queue->entity);
if (queue->scheduler.ops)
drm_sched_fini(&queue->scheduler);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 192/614] drm/panthor: Fix UAF race between device unplug and FW event processing
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 191/614] drm/panthor: Fix group_free_queue() for partially initialized queues Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 193/614] drm/panthor: Fix race with suspend during unplug Greg Kroah-Hartman
` (435 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ketil Johnsen, Liviu Dudau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ketil Johnsen <ketil.johnsen@arm.com>
[ Upstream commit 7051f6ba968fa69918d72cc26de4d6cf7ea05b90 ]
The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.
Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().
Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block")
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251027140217.121274-1-ketil.johnsen@arm.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index a39f0fb370dc6..0279e19aadae9 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3859,6 +3859,7 @@ void panthor_sched_unplug(struct panthor_device *ptdev)
struct panthor_scheduler *sched = ptdev->scheduler;
cancel_delayed_work_sync(&sched->tick_work);
+ disable_work_sync(&sched->fw_events_work);
mutex_lock(&sched->lock);
if (sched->pm.has_ref) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 193/614] drm/panthor: Fix race with suspend during unplug
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 192/614] drm/panthor: Fix UAF race between device unplug and FW event processing Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 194/614] drm/panthor: Fix UAF on kernel BO VA nodes Greg Kroah-Hartman
` (434 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ketil Johnsen, Boris Brezillon,
Liviu Dudau, Steven Price, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ketil Johnsen <ketil.johnsen@arm.com>
[ Upstream commit 08be57e6e8aa20ea5a6dd2552e38ac168d6a9b11 ]
There is a race between panthor_device_unplug() and
panthor_device_suspend() which can lead to IRQ handlers running on a
powered down GPU. This is how it can happen:
- unplug routine calls drm_dev_unplug()
- panthor_device_suspend() can now execute, and will skip a lot of
important work because the device is currently marked as unplugged.
- IRQs will remain active in this case and IRQ handlers can therefore
try to access a powered down GPU.
The fix is simply to take the PM ref in panthor_device_unplug() a
little bit earlier, before drm_dev_unplug().
Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
Fixes: 5fe909cae118a ("drm/panthor: Add the device logical block")
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251022103242.1083311-1-ketil.johnsen@arm.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_device.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_device.c b/drivers/gpu/drm/panthor/panthor_device.c
index 81df49880bd87..962a10e00848e 100644
--- a/drivers/gpu/drm/panthor/panthor_device.c
+++ b/drivers/gpu/drm/panthor/panthor_device.c
@@ -83,6 +83,8 @@ void panthor_device_unplug(struct panthor_device *ptdev)
return;
}
+ drm_WARN_ON(&ptdev->base, pm_runtime_get_sync(ptdev->base.dev) < 0);
+
/* Call drm_dev_unplug() so any access to HW blocks happening after
* that point get rejected.
*/
@@ -93,8 +95,6 @@ void panthor_device_unplug(struct panthor_device *ptdev)
*/
mutex_unlock(&ptdev->unplug.lock);
- drm_WARN_ON(&ptdev->base, pm_runtime_get_sync(ptdev->base.dev) < 0);
-
/* Now, try to cleanly shutdown the GPU before the device resources
* get reclaimed.
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 194/614] drm/panthor: Fix UAF on kernel BO VA nodes
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 193/614] drm/panthor: Fix race with suspend during unplug Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 195/614] firmware: ti_sci: Set IO Isolation only if the firmware is capable Greg Kroah-Hartman
` (433 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Ivar Hesselberg Simonsen,
Boris Brezillon, Liviu Dudau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@collabora.com>
[ Upstream commit 98dd5143447af0ee33551776d8b2560c35d0bc4a ]
If the MMU is down, panthor_vm_unmap_range() might return an error.
We expect the page table to be updated still, and if the MMU is blocked,
the rest of the GPU should be blocked too, so no risk of accessing
physical memory returned to the system (which the current code doesn't
cover for anyway).
Proceed with the rest of the cleanup instead of bailing out and leaving
the va_node inserted in the drm_mm, which leads to UAF when other
adjacent nodes are removed from the drm_mm tree.
Reported-by: Lars-Ivar Hesselberg Simonsen <lars-ivar.simonsen@arm.com>
Closes: https://gitlab.freedesktop.org/panfrost/linux/-/issues/57
Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251031154818.821054-2-boris.brezillon@collabora.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_gem.c | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c
index 3f43686f01958..14ed09d700f2f 100644
--- a/drivers/gpu/drm/panthor/panthor_gem.c
+++ b/drivers/gpu/drm/panthor/panthor_gem.c
@@ -86,7 +86,6 @@ static void panthor_gem_free_object(struct drm_gem_object *obj)
void panthor_kernel_bo_destroy(struct panthor_kernel_bo *bo)
{
struct panthor_vm *vm;
- int ret;
if (IS_ERR_OR_NULL(bo))
return;
@@ -94,18 +93,11 @@ void panthor_kernel_bo_destroy(struct panthor_kernel_bo *bo)
vm = bo->vm;
panthor_kernel_bo_vunmap(bo);
- if (drm_WARN_ON(bo->obj->dev,
- to_panthor_bo(bo->obj)->exclusive_vm_root_gem != panthor_vm_root_gem(vm)))
- goto out_free_bo;
-
- ret = panthor_vm_unmap_range(vm, bo->va_node.start, bo->va_node.size);
- if (ret)
- goto out_free_bo;
-
+ drm_WARN_ON(bo->obj->dev,
+ to_panthor_bo(bo->obj)->exclusive_vm_root_gem != panthor_vm_root_gem(vm));
+ panthor_vm_unmap_range(vm, bo->va_node.start, bo->va_node.size);
panthor_vm_free_va(vm, &bo->va_node);
drm_gem_object_put(bo->obj);
-
-out_free_bo:
panthor_vm_put(vm);
kfree(bo);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 195/614] firmware: ti_sci: Set IO Isolation only if the firmware is capable
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 194/614] drm/panthor: Fix UAF on kernel BO VA nodes Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 196/614] ns: add NS_COMMON_INIT() Greg Kroah-Hartman
` (432 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Richard (TI.com),
Kevin Hilman, Nishanth Menon, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
[ Upstream commit 999e9bc953e321651d69556fdd5dfd178f96f128 ]
Prevent calling ti_sci_cmd_set_io_isolation() on firmware
that does not support the IO_ISOLATION capability. Add the
MSG_FLAG_CAPS_IO_ISOLATION capability flag and check it before
attempting to set IO isolation during suspend/resume operations.
Without this check, systems with older firmware may experience
undefined behavior or errors when entering/exiting suspend states.
Fixes: ec24643bdd62 ("firmware: ti_sci: Add system suspend and resume call")
Signed-off-by: Thomas Richard (TI.com) <thomas.richard@bootlin.com>
Reviewed-by: Kevin Hilman <khilman@baylibre.com>
Link: https://patch.msgid.link/20251031-ti-sci-io-isolation-v2-1-60d826b65949@bootlin.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/ti_sci.c | 21 +++++++++++++--------
drivers/firmware/ti_sci.h | 2 ++
2 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index 49fd2ae01055d..8d96a3c12b36a 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -3751,9 +3751,11 @@ static int __maybe_unused ti_sci_suspend_noirq(struct device *dev)
struct ti_sci_info *info = dev_get_drvdata(dev);
int ret = 0;
- ret = ti_sci_cmd_set_io_isolation(&info->handle, TISCI_MSG_VALUE_IO_ENABLE);
- if (ret)
- return ret;
+ if (info->fw_caps & MSG_FLAG_CAPS_IO_ISOLATION) {
+ ret = ti_sci_cmd_set_io_isolation(&info->handle, TISCI_MSG_VALUE_IO_ENABLE);
+ if (ret)
+ return ret;
+ }
return 0;
}
@@ -3767,9 +3769,11 @@ static int __maybe_unused ti_sci_resume_noirq(struct device *dev)
u8 pin;
u8 mode;
- ret = ti_sci_cmd_set_io_isolation(&info->handle, TISCI_MSG_VALUE_IO_DISABLE);
- if (ret)
- return ret;
+ if (info->fw_caps & MSG_FLAG_CAPS_IO_ISOLATION) {
+ ret = ti_sci_cmd_set_io_isolation(&info->handle, TISCI_MSG_VALUE_IO_DISABLE);
+ if (ret)
+ return ret;
+ }
ret = ti_sci_msg_cmd_lpm_wake_reason(&info->handle, &source, &time, &pin, &mode);
/* Do not fail to resume on error as the wake reason is not critical */
@@ -3928,11 +3932,12 @@ static int ti_sci_probe(struct platform_device *pdev)
}
ti_sci_msg_cmd_query_fw_caps(&info->handle, &info->fw_caps);
- dev_dbg(dev, "Detected firmware capabilities: %s%s%s%s\n",
+ dev_dbg(dev, "Detected firmware capabilities: %s%s%s%s%s\n",
info->fw_caps & MSG_FLAG_CAPS_GENERIC ? "Generic" : "",
info->fw_caps & MSG_FLAG_CAPS_LPM_PARTIAL_IO ? " Partial-IO" : "",
info->fw_caps & MSG_FLAG_CAPS_LPM_DM_MANAGED ? " DM-Managed" : "",
- info->fw_caps & MSG_FLAG_CAPS_LPM_ABORT ? " LPM-Abort" : ""
+ info->fw_caps & MSG_FLAG_CAPS_LPM_ABORT ? " LPM-Abort" : "",
+ info->fw_caps & MSG_FLAG_CAPS_IO_ISOLATION ? " IO-Isolation" : ""
);
ti_sci_setup_ops(info);
diff --git a/drivers/firmware/ti_sci.h b/drivers/firmware/ti_sci.h
index 701c416b2e78f..7559cde17b6cc 100644
--- a/drivers/firmware/ti_sci.h
+++ b/drivers/firmware/ti_sci.h
@@ -149,6 +149,7 @@ struct ti_sci_msg_req_reboot {
* MSG_FLAG_CAPS_LPM_PARTIAL_IO: Partial IO in LPM
* MSG_FLAG_CAPS_LPM_DM_MANAGED: LPM can be managed by DM
* MSG_FLAG_CAPS_LPM_ABORT: Abort entry to LPM
+ * MSG_FLAG_CAPS_IO_ISOLATION: IO Isolation support
*
* Response to a generic message with message type TI_SCI_MSG_QUERY_FW_CAPS
* providing currently available SOC/firmware capabilities. SoC that don't
@@ -160,6 +161,7 @@ struct ti_sci_msg_resp_query_fw_caps {
#define MSG_FLAG_CAPS_LPM_PARTIAL_IO TI_SCI_MSG_FLAG(4)
#define MSG_FLAG_CAPS_LPM_DM_MANAGED TI_SCI_MSG_FLAG(5)
#define MSG_FLAG_CAPS_LPM_ABORT TI_SCI_MSG_FLAG(9)
+#define MSG_FLAG_CAPS_IO_ISOLATION TI_SCI_MSG_FLAG(7)
#define MSG_MASK_CAPS_LPM GENMASK_ULL(4, 1)
u64 fw_caps;
} __packed;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 196/614] ns: add NS_COMMON_INIT()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 195/614] firmware: ti_sci: Set IO Isolation only if the firmware is capable Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 197/614] ns: initialize ns_list_node for initial namespaces Greg Kroah-Hartman
` (431 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner, Christian Brauner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit d915fe20e5cba4bd50e41e792a32dcddc7490e25 ]
Add an initializer that can be used for the ns common initialization for
static namespace such as most init namespaces.
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/87ecqhy2y5.ffs@tglx
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 3dd50c58664e ("ns: initialize ns_list_node for initial namespaces")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ns_common.h | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index f5b68b8abb543..3a72c3f81eca4 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -119,6 +119,16 @@ void __ns_common_free(struct ns_common *ns);
struct user_namespace *: CLONE_NEWUSER, \
struct uts_namespace *: CLONE_NEWUTS)
+#define NS_COMMON_INIT(nsname, refs) \
+{ \
+ .ns_type = ns_common_type(&nsname), \
+ .ns_id = 0, \
+ .inum = ns_init_inum(&nsname), \
+ .ops = to_ns_operations(&nsname), \
+ .stashed = NULL, \
+ .__ns_ref = REFCOUNT_INIT(refs), \
+}
+
#define ns_common_init(__ns) \
__ns_common_init(to_ns_common(__ns), \
ns_common_type(__ns), \
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 197/614] ns: initialize ns_list_node for initial namespaces
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 196/614] ns: add NS_COMMON_INIT() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 198/614] iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Greg Kroah-Hartman
` (430 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Jeff Layton,
Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 3dd50c58664e2684bd610a57bf3ab713cbb0ea91 ]
Make sure that the list is always initialized for initial namespaces.
Link: https://patch.msgid.link/20251029-work-namespace-nstree-listns-v4-8-2e6f823ebdc0@kernel.org
Fixes: 885fc8ac0a4d ("nstree: make iterator generic")
Tested-by: syzbot@syzkaller.appspotmail.com
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ns_common.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index 3a72c3f81eca4..71a5e28344d11 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -127,6 +127,7 @@ void __ns_common_free(struct ns_common *ns);
.ops = to_ns_operations(&nsname), \
.stashed = NULL, \
.__ns_ref = REFCOUNT_INIT(refs), \
+ .ns_list_node = LIST_HEAD_INIT(nsname.ns.ns_list_node), \
}
#define ns_common_init(__ns) \
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 198/614] iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 197/614] ns: initialize ns_list_node for initial namespaces Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 199/614] cleanup: fix scoped_class() Greg Kroah-Hartman
` (429 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Songtang Liu,
Dheeraj Kumar Srivastava, Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Songtang Liu <liusongtang@bytedance.com>
[ Upstream commit a0c7005333f9a968abb058b1d77bbcd7fb7fd1e7 ]
In iommu_mmio_write(), it validates the user-provided offset with the
check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`.
This assumes a 4-byte access. However, the corresponding
show handler, iommu_mmio_show(), uses readq() to perform an 8-byte
(64-bit) read.
If a user provides an offset equal to `mmio_phys_end - 4`, the check
passes, and will lead to a 4-byte out-of-bounds read.
Fix this by adjusting the boundary check to use sizeof(u64), which
corresponds to the size of the readq() operation.
Fixes: 7a4ee419e8c1 ("iommu/amd: Add debugfs support to dump IOMMU MMIO registers")
Signed-off-by: Songtang Liu <liusongtang@bytedance.com>
Reviewed-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava@amd.com>
Tested-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c
index 10fa217a71199..20b04996441d6 100644
--- a/drivers/iommu/amd/debugfs.c
+++ b/drivers/iommu/amd/debugfs.c
@@ -37,7 +37,7 @@ static ssize_t iommu_mmio_write(struct file *filp, const char __user *ubuf,
if (ret)
return ret;
- if (iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4) {
+ if (iommu->dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64)) {
iommu->dbg_mmio_offset = -1;
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 199/614] cleanup: fix scoped_class()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 198/614] iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 200/614] drm/xe: Enforce correct user fence signaling order using Greg Kroah-Hartman
` (428 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Axboe, Christian Brauner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 4e97bae1b412cd6ed8053b3d8a242122952985cc ]
This is a class, not a guard so why on earth is it checking for guard
pointers or conditional lock acquisition? None of it makes any sense at
all.
I'm not sure what happened back then. Maybe I had a brief psychedelic
period that I completely forgot about and spaced out into a zone where
that initial macro implementation made any sense at all.
Link: https://patch.msgid.link/20251103-work-creds-init_cred-v1-1-cb3ec8711a6a@kernel.org
Fixes: 5c21c5f22d07 ("cleanup: add a scoped version of CLASS()")
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/cleanup.h | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h
index 2573585b7f068..19c7e475d3a4d 100644
--- a/include/linux/cleanup.h
+++ b/include/linux/cleanup.h
@@ -290,15 +290,16 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
class_##_name##_t var __cleanup(class_##_name##_destructor) = \
class_##_name##_constructor
-#define scoped_class(_name, var, args) \
- for (CLASS(_name, var)(args); \
- __guard_ptr(_name)(&var) || !__is_cond_ptr(_name); \
- ({ goto _label; })) \
- if (0) { \
-_label: \
- break; \
+#define __scoped_class(_name, var, _label, args...) \
+ for (CLASS(_name, var)(args); ; ({ goto _label; })) \
+ if (0) { \
+_label: \
+ break; \
} else
+#define scoped_class(_name, var, args...) \
+ __scoped_class(_name, var, __UNIQUE_ID(label), args)
+
/*
* DEFINE_GUARD(name, type, lock, unlock):
* trivial wrapper around DEFINE_CLASS() above specifically
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 200/614] drm/xe: Enforce correct user fence signaling order using
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 199/614] cleanup: fix scoped_class() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 13:35 ` Thomas Hellström
2025-12-16 11:09 ` [PATCH 6.18 201/614] spi: tegra210-quad: Fix timeout handling Greg Kroah-Hartman
` (427 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Brost, Thomas Hellström,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <matthew.brost@intel.com>
[ Upstream commit adda4e855ab6409a3edaa585293f1f2069ab7299 ]
Prevent application hangs caused by out-of-order fence signaling when
user fences are attached. Use drm_syncobj (via dma-fence-chain) to
guarantee that each user fence signals in order, regardless of the
signaling order of the attached fences. Ensure user fence writebacks to
user space occur in the correct sequence.
v7:
- Skip drm_syncbj create of error (CI)
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_exec_queue.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
index cb5f204c08ed6..a6efe4e8ab556 100644
--- a/drivers/gpu/drm/xe/xe_exec_queue.c
+++ b/drivers/gpu/drm/xe/xe_exec_queue.c
@@ -344,6 +344,9 @@ void xe_exec_queue_destroy(struct kref *ref)
struct xe_exec_queue *q = container_of(ref, struct xe_exec_queue, refcount);
struct xe_exec_queue *eq, *next;
+ if (q->ufence_syncobj)
+ drm_syncobj_put(q->ufence_syncobj);
+
if (q->ufence_syncobj)
drm_syncobj_put(q->ufence_syncobj);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 201/614] spi: tegra210-quad: Fix timeout handling
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 200/614] drm/xe: Enforce correct user fence signaling order using Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 202/614] libbpf: Fix parsing of multi-split BTF Greg Kroah-Hartman
` (426 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thierry Reding, Vishwaroop A,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishwaroop A <va@nvidia.com>
[ Upstream commit b4e002d8a7cee3b1d70efad0e222567f92a73000 ]
When the CPU that the QSPI interrupt handler runs on (typically CPU 0)
is excessively busy, it can lead to rare cases of the IRQ thread not
running before the transfer timeout is reached.
While handling the timeouts, any pending transfers are cleaned up and
the message that they correspond to is marked as failed, which leaves
the curr_xfer field pointing at stale memory.
To avoid this, clear curr_xfer to NULL upon timeout and check for this
condition when the IRQ thread is finally run.
While at it, also make sure to clear interrupts on failure so that new
interrupts can be run.
A better, more involved, fix would move the interrupt clearing into a
hard IRQ handler. Ideally we would also want to signal that the IRQ
thread no longer needs to be run after the timeout is hit to avoid the
extra check for a valid transfer.
Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Vishwaroop A <va@nvidia.com>
Link: https://patch.msgid.link/20251028155703.4151791-2-va@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-tegra210-quad.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c
index 3be7499db21ec..d9ca3d7b082f2 100644
--- a/drivers/spi/spi-tegra210-quad.c
+++ b/drivers/spi/spi-tegra210-quad.c
@@ -1024,8 +1024,10 @@ static void tegra_qspi_handle_error(struct tegra_qspi *tqspi)
dev_err(tqspi->dev, "error in transfer, fifo status 0x%08x\n", tqspi->status_reg);
tegra_qspi_dump_regs(tqspi);
tegra_qspi_flush_fifos(tqspi, true);
- if (device_reset(tqspi->dev) < 0)
+ if (device_reset(tqspi->dev) < 0) {
dev_warn_once(tqspi->dev, "device reset failed\n");
+ tegra_qspi_mask_clear_irq(tqspi);
+ }
}
static void tegra_qspi_transfer_end(struct spi_device *spi)
@@ -1176,9 +1178,11 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi,
}
/* Reset controller if timeout happens */
- if (device_reset(tqspi->dev) < 0)
+ if (device_reset(tqspi->dev) < 0) {
dev_warn_once(tqspi->dev,
"device reset failed\n");
+ tegra_qspi_mask_clear_irq(tqspi);
+ }
ret = -EIO;
goto exit;
}
@@ -1200,11 +1204,13 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi,
tegra_qspi_transfer_end(spi);
spi_transfer_delay_exec(xfer);
}
+ tqspi->curr_xfer = NULL;
transfer_phase++;
}
ret = 0;
exit:
+ tqspi->curr_xfer = NULL;
msg->status = ret;
return ret;
@@ -1290,6 +1296,8 @@ static int tegra_qspi_non_combined_seq_xfer(struct tegra_qspi *tqspi,
msg->actual_length += xfer->len + dummy_bytes;
complete_xfer:
+ tqspi->curr_xfer = NULL;
+
if (ret < 0) {
tegra_qspi_transfer_end(spi);
spi_transfer_delay_exec(xfer);
@@ -1395,6 +1403,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_qspi *tqspi)
tegra_qspi_calculate_curr_xfer_param(tqspi, t);
tegra_qspi_start_cpu_based_transfer(tqspi, t);
exit:
+ tqspi->curr_xfer = NULL;
spin_unlock_irqrestore(&tqspi->lock, flags);
return IRQ_HANDLED;
}
@@ -1480,6 +1489,15 @@ static irqreturn_t tegra_qspi_isr_thread(int irq, void *context_data)
{
struct tegra_qspi *tqspi = context_data;
+ /*
+ * Occasionally the IRQ thread takes a long time to wake up (usually
+ * when the CPU that it's running on is excessively busy) and we have
+ * already reached the timeout before and cleaned up the timed out
+ * transfer. Avoid any processing in that case and bail out early.
+ */
+ if (!tqspi->curr_xfer)
+ return IRQ_NONE;
+
tqspi->status_reg = tegra_qspi_readl(tqspi, QSPI_FIFO_STATUS);
if (tqspi->cur_direction & DATA_DIR_TX)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 202/614] libbpf: Fix parsing of multi-split BTF
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 201/614] spi: tegra210-quad: Fix timeout handling Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 203/614] ARM: dts: am33xx: Add missing serial console speed Greg Kroah-Hartman
` (425 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Maguire, Andrii Nakryiko,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit 4f596acc260e691a2e348f64230392f3472feea3 ]
When creating multi-split BTF we correctly set the start string offset
to be the size of the base string section plus the base BTF start
string offset; the latter is needed for multi-split BTF since the
offset is non-zero there.
Unfortunately the BTF parsing case needed that logic and it was
missed.
Fixes: 4e29128a9ace ("libbpf/btf: Fix string handling to support multi-split BTF")
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20251104203309.318429-2-alan.maguire@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/bpf/btf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 18907f0fcf9f0..9f141395c074e 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -1061,7 +1061,7 @@ static struct btf *btf_new(const void *data, __u32 size, struct btf *base_btf, b
if (base_btf) {
btf->base_btf = base_btf;
btf->start_id = btf__type_cnt(base_btf);
- btf->start_str_off = base_btf->hdr->str_len;
+ btf->start_str_off = base_btf->hdr->str_len + base_btf->start_str_off;
}
if (is_mmap) {
@@ -5818,7 +5818,7 @@ void btf_set_base_btf(struct btf *btf, const struct btf *base_btf)
{
btf->base_btf = (struct btf *)base_btf;
btf->start_id = btf__type_cnt(base_btf);
- btf->start_str_off = base_btf->hdr->str_len;
+ btf->start_str_off = base_btf->hdr->str_len + base_btf->start_str_off;
}
int btf__relocate(struct btf *btf, const struct btf *base_btf)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 203/614] ARM: dts: am33xx: Add missing serial console speed
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 202/614] libbpf: Fix parsing of multi-split BTF Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 204/614] ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Greg Kroah-Hartman
` (424 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Matti Vaittinen,
Bruno Thomsen, Kevin Hilman, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 9c95fc710b0d05f797db9e26d56524efa74f8978 ]
Without a serial console speed specified in chosen/stdout-path in the
DTB, the serial console uses the default speed of the serial driver,
unless explicitly overridden in a legacy console= kernel command-line
parameter.
After dropping "ti,omap3-uart" from the list of compatible values in DT,
AM33xx serial ports can no longer be used with the legacy OMAP serial
driver, but only with the OMAP-flavored 8250 serial driver (which is
mutually-exclusive with the former). However, replacing
CONFIG_SERIAL_OMAP=y by CONFIG_SERIAL_8250_OMAP=y (with/without enabling
CONFIG_SERIAL_8250_OMAP_TTYO_FIXUP) may not be sufficient to restore
serial console functionality: the legacy OMAP serial driver defaults to
115200 bps, while the 8250 serial driver defaults to 9600 bps, causing
no visible output on the serial console when no appropriate console=
kernel command-line parameter is specified.
Fix this for all AM33xx boards by adding ":115200n8" to
chosen/stdout-path. This requires replacing the "&uartN" reference by
the corresponding "serialN" DT alias.
Fixes: ca8be8fc2c306efb ("ARM: dts: am33xx-l4: fix UART compatible")
Fixes: 077e1cde78c3f904 ("ARM: omap2plus_defconfig: Enable 8250_OMAP")
Closes: https://lore.kernel.org/CAMuHMdUb7Jb2=GqK3=Rn+Gv5G9KogcQieqDvjDCkJA4zyX4VcA@mail.gmail.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
Tested-by: Matti Vaittinen <mazziesaccount@gmail.com>
Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
Link: https://lore.kernel.org/r/63cef5c3643d359e8ec13366ca79377f12dd73b1.1759398641.git.geert+renesas@glider.be
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi | 2 +-
arch/arm/boot/dts/ti/omap/am335x-boneblue.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-evm.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-evmsk.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-guardian.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-icev2.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-pdu001.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts | 2 +-
arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 2 +-
12 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi b/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi
index ad1e60a9b6fde..b75dabfa56ae7 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi
@@ -16,7 +16,7 @@ memory@80000000 {
};
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
leds {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-boneblue.dts b/arch/arm/boot/dts/ti/omap/am335x-boneblue.dts
index f579df4c2c540..d430f0bef1653 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-boneblue.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-boneblue.dts
@@ -13,7 +13,7 @@ / {
compatible = "ti,am335x-bone-blue", "ti,am33xx";
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
leds {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts b/arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts
index 648e97fe1dfd5..ae5bc58984972 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts
@@ -12,7 +12,7 @@ / {
"ti,am33xx";
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
leds {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-evm.dts b/arch/arm/boot/dts/ti/omap/am335x-evm.dts
index 20222f82f21bf..856fa1191ed24 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-evm.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-evm.dts
@@ -23,7 +23,7 @@ memory@80000000 {
};
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
vbat: fixedregulator0 {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-evmsk.dts b/arch/arm/boot/dts/ti/omap/am335x-evmsk.dts
index eba888dcd60e7..d8baccdf8bc46 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-evmsk.dts
@@ -30,7 +30,7 @@ memory@80000000 {
};
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
vbat: fixedregulator0 {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-guardian.dts b/arch/arm/boot/dts/ti/omap/am335x-guardian.dts
index 4b070e634b281..6ce3a2d029eed 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-guardian.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-guardian.dts
@@ -14,7 +14,7 @@ / {
compatible = "bosch,am335x-guardian", "ti,am33xx";
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
tick-timer = &timer2;
};
diff --git a/arch/arm/boot/dts/ti/omap/am335x-icev2.dts b/arch/arm/boot/dts/ti/omap/am335x-icev2.dts
index 6f0f4fba043b9..ba488bba6925d 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-icev2.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-icev2.dts
@@ -22,7 +22,7 @@ memory@80000000 {
};
chosen {
- stdout-path = &uart3;
+ stdout-path = "serial3:115200n8";
};
vbat: fixedregulator0 {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts b/arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts
index 06a352f98b220..476a6bdaf43f3 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts
@@ -15,7 +15,7 @@ / {
compatible = "myir,myd-am335x", "myir,myc-am335x", "ti,am33xx";
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
clk12m: clk12m {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts b/arch/arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts
index d28d397288476..23caaaabf3513 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts
@@ -147,7 +147,7 @@ simple-audio-card,codec {
};
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
leds {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-pdu001.dts b/arch/arm/boot/dts/ti/omap/am335x-pdu001.dts
index c9ccb9de21ad7..9f611debc2090 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-pdu001.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-pdu001.dts
@@ -21,7 +21,7 @@ / {
compatible = "ti,am33xx";
chosen {
- stdout-path = &uart3;
+ stdout-path = "serial3:115200n8";
};
cpus {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts b/arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts
index 78ce860e59b3d..24d9f90fad01f 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts
@@ -15,7 +15,7 @@ / {
compatible = "ti,am335x-pocketbeagle", "ti,am335x-bone", "ti,am33xx";
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
leds {
diff --git a/arch/arm/boot/dts/ti/omap/am335x-sl50.dts b/arch/arm/boot/dts/ti/omap/am335x-sl50.dts
index f3524e5ee43e2..1dc4e344efd63 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-sl50.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-sl50.dts
@@ -25,7 +25,7 @@ memory@80000000 {
};
chosen {
- stdout-path = &uart0;
+ stdout-path = "serial0:115200n8";
};
leds {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 204/614] ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 203/614] ARM: dts: am33xx: Add missing serial console speed Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 205/614] ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible Greg Kroah-Hartman
` (423 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yegor Yefremov, Kevin Hilman,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yegor Yefremov <yegorslists@googlemail.com>
[ Upstream commit d0c4b1723c419a18cb434903c7754954ecb51d35 ]
Fixes: 8e9d75fd2ec2 ("ARM: dts: am335x-netcom: add GPIO names for NetCom Plus 2-port devices")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Link: https://lore.kernel.org/r/20251007103851.3765678-1-yegorslists@googlemail.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts b/arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts
index f66d57bb685ee..f0519ab301416 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-netcom-plus-2xx.dts
@@ -222,10 +222,10 @@ &gpio3 {
"ModeA1",
"ModeA2",
"ModeA3",
- "NC",
- "NC",
- "NC",
- "NC",
+ "ModeB0",
+ "ModeB1",
+ "ModeB2",
+ "ModeB3",
"NC",
"NC",
"NC",
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 205/614] ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 204/614] ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 206/614] ARM: dts: omap3: n900: " Greg Kroah-Hartman
` (422 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit f7f3bc18300a230e0f1bfb17fc8889435c1e47f5 ]
The "ti,twl4030-power-beagleboard-xm" compatible string is obsolete and
is not supported by any in-kernel driver. Currently, the kernel falls
back to the second entry, "ti,twl4030-power-idle-osc-off", to bind a
driver to this node.
Make this fallback explicit by removing the obsolete board-specific
compatible. This preserves the existing functionality while making the
DTS compliant with the new, stricter 'ti,twl.yaml' binding.
Fixes: 9188883fd66e9 ("ARM: dts: Enable twl4030 off-idle configuration for selected omaps")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/r/20250914192516.164629-3-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts b/arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts
index 08ee0f8ea68fd..71b39a923d37c 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts
+++ b/arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts
@@ -291,7 +291,7 @@ codec {
};
twl_power: power {
- compatible = "ti,twl4030-power-beagleboard-xm", "ti,twl4030-power-idle-osc-off";
+ compatible = "ti,twl4030-power-idle-osc-off";
ti,use_poweroff;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 206/614] ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 205/614] ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 207/614] entry,unwind/deferred: Fix unwind_reset_info() placement Greg Kroah-Hartman
` (421 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 3862123e9b56663c7a3e4a308e6e65bffe44f646 ]
The "ti,twl4030-power-n900" compatible string is obsolete and is not
supported by any in-kernel driver. Currently, the kernel falls back to
the second entry, "ti,twl4030-power-idle-osc-off", to bind a driver to
this node.
Make this fallback explicit by removing the obsolete board-specific
compatible. This preserves the existing functionality while making the
DTS compliant with the new, stricter 'ti,twl.yaml' binding.
Fixes: daebabd578647 ("mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/r/20250914192516.164629-4-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/ti/omap/omap3-n900.dts b/arch/arm/boot/dts/ti/omap/omap3-n900.dts
index c50ca572d1b9b..7db73d9bed9e4 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-n900.dts
+++ b/arch/arm/boot/dts/ti/omap/omap3-n900.dts
@@ -508,7 +508,7 @@ twl_audio: audio {
};
twl_power: power {
- compatible = "ti,twl4030-power-n900", "ti,twl4030-power-idle-osc-off";
+ compatible = "ti,twl4030-power-idle-osc-off";
ti,use_poweroff;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 207/614] entry,unwind/deferred: Fix unwind_reset_info() placement
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 206/614] ARM: dts: omap3: n900: " Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 208/614] arm64: tegra: Add pinctrl definitions for pcie-ep nodes Greg Kroah-Hartman
` (420 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Rothwell, Ingo Molnar,
Peter Zijlstra (Intel), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit cf76553aaa363620f58a6b6409bf544f4bcfa8de ]
Stephen reported that on KASAN builds he's seeing:
vmlinux.o: warning: objtool: user_exc_vmm_communication+0x15a: call to __kasan_check_read() leaves .noinstr.text section
vmlinux.o: warning: objtool: exc_debug_user+0x182: call to __kasan_check_read() leaves .noinstr.text section
vmlinux.o: warning: objtool: exc_int3+0x123: call to __kasan_check_read() leaves .noinstr.text section
vmlinux.o: warning: objtool: noist_exc_machine_check+0x17a: call to __kasan_check_read() leaves .noinstr.text section
vmlinux.o: warning: objtool: fred_exc_machine_check+0x17e: call to __kasan_check_read() leaves .noinstr.text section
This turns out to be atomic ops from unwind_reset_info() that have
explicit instrumentation. Place unwind_reset_info() in the preceding
instrumentation_begin() section.
Fixes: c6439bfaabf2 ("Merge tag 'trace-deferred-unwind-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reported-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20251105100014.GY4068168@noisy.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/irq-entry-common.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/irq-entry-common.h b/include/linux/irq-entry-common.h
index d643c7c87822e..ba1ed42f8a1c2 100644
--- a/include/linux/irq-entry-common.h
+++ b/include/linux/irq-entry-common.h
@@ -253,11 +253,11 @@ static __always_inline void exit_to_user_mode_prepare(struct pt_regs *regs)
static __always_inline void exit_to_user_mode(void)
{
instrumentation_begin();
+ unwind_reset_info();
trace_hardirqs_on_prepare();
lockdep_hardirqs_on_prepare();
instrumentation_end();
- unwind_reset_info();
user_enter_irqoff();
arch_exit_to_user_mode();
lockdep_hardirqs_on(CALLER_ADDR0);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 208/614] arm64: tegra: Add pinctrl definitions for pcie-ep nodes
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 207/614] entry,unwind/deferred: Fix unwind_reset_info() placement Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 209/614] coresight: ETR: Fix ETR buffer use-after-free issue Greg Kroah-Hartman
` (419 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Manikanta Maddireddy,
Thierry Reding, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 21ef26d0e71f053e809926d45b86b0afbc3686bb ]
When the PCIe controller is running in endpoint mode, the controller
initialization is triggered by a PERST# (PCIe reset) GPIO deassertion.
The driver has configured an IRQ to trigger when the PERST# GPIO changes
state. Without the pinctrl definition, we do not get an IRQ when PERST#
is deasserted, so the PCIe controller never gets initialized.
Add the missing definitions, so that the controller actually gets
initialized.
Fixes: ec142c44b026 ("arm64: tegra: Add P2U and PCIe controller nodes to Tegra234 DT")
Fixes: 0580286d0d22 ("arm64: tegra: Add Tegra234 PCIe C4 EP definition")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Manikanta Maddireddy <mmaddireddy@nvidia.com>
[treding@nvidia.com: add blank lines to separate blocks]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 61 ++++++++++++++++++++++++
1 file changed, 61 insertions(+)
diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
index df034dbb82853..5657045c53d90 100644
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -9,6 +9,7 @@
#include <dt-bindings/power/tegra234-powergate.h>
#include <dt-bindings/reset/tegra234-reset.h>
#include <dt-bindings/thermal/tegra234-bpmp-thermal.h>
+#include <dt-bindings/pinctrl/pinctrl-tegra.h>
/ {
compatible = "nvidia,tegra234";
@@ -127,6 +128,56 @@ gpio: gpio@2200000 {
pinmux: pinmux@2430000 {
compatible = "nvidia,tegra234-pinmux";
reg = <0x0 0x2430000 0x0 0x19100>;
+
+ pex_rst_c4_in_state: pinmux-pex-rst-c4-in {
+ pex_rst {
+ nvidia,pins = "pex_l4_rst_n_pl1";
+ nvidia,function = "rsvd1";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+ };
+ };
+
+ pex_rst_c5_in_state: pinmux-pex-rst-c5-in {
+ pex_rst {
+ nvidia,pins = "pex_l5_rst_n_paf1";
+ nvidia,function = "rsvd1";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+ };
+ };
+
+ pex_rst_c6_in_state: pinmux-pex-rst-c6-in {
+ pex_rst {
+ nvidia,pins = "pex_l6_rst_n_paf3";
+ nvidia,function = "rsvd1";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+ };
+ };
+
+ pex_rst_c7_in_state: pinmux-pex-rst-c7-in {
+ pex_rst {
+ nvidia,pins = "pex_l7_rst_n_pag1";
+ nvidia,function = "rsvd1";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+ };
+ };
+
+ pex_rst_c10_in_state: pinmux-pex-rst-c10-in {
+ pex_rst {
+ nvidia,pins = "pex_l10_rst_n_pag7";
+ nvidia,function = "rsvd1";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_ENABLE>;
+ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+ };
+ };
};
gpcdma: dma-controller@2600000 {
@@ -4630,6 +4681,8 @@ pcie-ep@140e0000 {
<&bpmp TEGRA234_RESET_PEX2_CORE_10>;
reset-names = "apb", "core";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pex_rst_c10_in_state>;
interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
interrupt-names = "intr";
@@ -4881,6 +4934,8 @@ pcie-ep@14160000 {
<&bpmp TEGRA234_RESET_PEX0_CORE_4>;
reset-names = "apb", "core";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pex_rst_c4_in_state>;
interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
interrupt-names = "intr";
nvidia,bpmp = <&bpmp 4>;
@@ -5023,6 +5078,8 @@ pcie-ep@141a0000 {
<&bpmp TEGRA234_RESET_PEX1_CORE_5>;
reset-names = "apb", "core";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pex_rst_c5_in_state>;
interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
interrupt-names = "intr";
@@ -5115,6 +5172,8 @@ pcie-ep@141c0000 {
<&bpmp TEGRA234_RESET_PEX1_CORE_6>;
reset-names = "apb", "core";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pex_rst_c6_in_state>;
interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
interrupt-names = "intr";
@@ -5207,6 +5266,8 @@ pcie-ep@141e0000 {
<&bpmp TEGRA234_RESET_PEX2_CORE_7>;
reset-names = "apb", "core";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pex_rst_c7_in_state>;
interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
interrupt-names = "intr";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 209/614] coresight: ETR: Fix ETR buffer use-after-free issue
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 208/614] arm64: tegra: Add pinctrl definitions for pcie-ep nodes Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 210/614] x86/boot: Fix page table access in 5-level to 4-level paging transition Greg Kroah-Hartman
` (418 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaoqi Zhuang, Suzuki K Poulose,
Leo Yan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoqi Zhuang <xiaoqi.zhuang@oss.qualcomm.com>
[ Upstream commit 35501ac3c7d40a7bb9568c2f89d6b56beaf9bed3 ]
When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed
and enabled again, currently sysfs_buf will point to the newly
allocated memory(buf_new) and free the old memory(buf_old). But the
etr_buf that is being used by the ETR remains pointed to buf_old, not
updated to buf_new. In this case, it will result in a memory
use-after-free issue.
Fix this by checking ETR's mode before updating and releasing buf_old,
if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
Fixes: bd2767ec3df2 ("coresight: Fix run time warnings while reusing ETR buffer")
Signed-off-by: Xiaoqi Zhuang <xiaoqi.zhuang@oss.qualcomm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Tested-by: Leo Yan <leo.yan@arm.com>
Link: https://lore.kernel.org/r/20251021-fix_etr_issue-v3-1-99a2d066fee2@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-tmc-etr.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index b07fcdb3fe1a8..800be06598c1b 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -1250,6 +1250,13 @@ static struct etr_buf *tmc_etr_get_sysfs_buffer(struct coresight_device *csdev)
* with the lock released.
*/
raw_spin_lock_irqsave(&drvdata->spinlock, flags);
+
+ /*
+ * If the ETR is already enabled, continue with the existing buffer.
+ */
+ if (coresight_get_mode(csdev) == CS_MODE_SYSFS)
+ goto out;
+
sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) {
raw_spin_unlock_irqrestore(&drvdata->spinlock, flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 210/614] x86/boot: Fix page table access in 5-level to 4-level paging transition
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 209/614] coresight: ETR: Fix ETR buffer use-after-free issue Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 211/614] efi/libstub: " Greg Kroah-Hartman
` (417 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael van der Westhuizen,
Tobias Fleig, Kiryl Shutsemau, Usama Arif, Borislav Petkov (AMD),
Ard Biesheuvel, Dave Hansen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <usamaarif642@gmail.com>
[ Upstream commit eb2266312507d7b757859e2227aa5c4ba6280ebe ]
When transitioning from 5-level to 4-level paging, the existing code
incorrectly accesses page table entries by directly dereferencing CR3 and
applying PAGE_MASK. This approach has several issues:
- __native_read_cr3() returns the raw CR3 register value, which on x86_64
includes not just the physical address but also flags. Bits above the
physical address width of the system i.e. above __PHYSICAL_MASK_SHIFT) are
also not masked.
- The PGD entry is masked by PAGE_SIZE which doesn't take into account the
higher bits such as _PAGE_BIT_NOPTISHADOW.
Replace this with proper accessor functions:
- native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out
of CR3 (like SME or LAM bits). All remaining bits are real address bits or
reserved and must be 0.
- mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags
above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above
the max physical address are reserved and must be 0.
Fixes: e9d0e6330eb8 ("x86/boot/compressed/64: Prepare new top-level page table for trampoline")
Reported-by: Michael van der Westhuizen <rmikey@meta.com>
Reported-by: Tobias Fleig <tfleig@meta.com>
Co-developed-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Usama Arif <usamaarif642@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lore.kernel.org/r/a482fd68-ce54-472d-8df1-33d6ac9f6bb5@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/boot/compressed/pgtable_64.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c
index bdd26050dff77..0e89e197e1126 100644
--- a/arch/x86/boot/compressed/pgtable_64.c
+++ b/arch/x86/boot/compressed/pgtable_64.c
@@ -3,6 +3,7 @@
#include <asm/bootparam.h>
#include <asm/bootparam_utils.h>
#include <asm/e820/types.h>
+#include <asm/pgtable.h>
#include <asm/processor.h>
#include "../string.h"
#include "efi.h"
@@ -168,9 +169,10 @@ asmlinkage void configure_5level_paging(struct boot_params *bp, void *pgtable)
* For 4- to 5-level paging transition, set up current CR3 as
* the first and the only entry in a new top-level page table.
*/
- *trampoline_32bit = __native_read_cr3() | _PAGE_TABLE_NOENC;
+ *trampoline_32bit = native_read_cr3_pa() | _PAGE_TABLE_NOENC;
} else {
- unsigned long src;
+ u64 *new_cr3;
+ pgd_t *pgdp;
/*
* For 5- to 4-level paging transition, copy page table pointed
@@ -180,8 +182,9 @@ asmlinkage void configure_5level_paging(struct boot_params *bp, void *pgtable)
* We cannot just point to the page table from trampoline as it
* may be above 4G.
*/
- src = *(unsigned long *)__native_read_cr3() & PAGE_MASK;
- memcpy(trampoline_32bit, (void *)src, PAGE_SIZE);
+ pgdp = (pgd_t *)native_read_cr3_pa();
+ new_cr3 = (u64 *)(native_pgd_val(pgdp[0]) & PTE_PFN_MASK);
+ memcpy(trampoline_32bit, new_cr3, PAGE_SIZE);
}
toggle_la57(trampoline_32bit);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 211/614] efi/libstub: Fix page table access in 5-level to 4-level paging transition
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 210/614] x86/boot: Fix page table access in 5-level to 4-level paging transition Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 212/614] locktorture: Fix memory leak in param_set_cpumask() Greg Kroah-Hartman
` (416 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael van der Westhuizen,
Tobias Fleig, Kiryl Shutsemau, Usama Arif, Borislav Petkov (AMD),
Ard Biesheuvel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Usama Arif <usamaarif642@gmail.com>
[ Upstream commit 84361123413efc84b06f3441c6c827b95d902732 ]
When transitioning from 5-level to 4-level paging, the existing code
incorrectly accesses page table entries by directly dereferencing CR3 and
applying PAGE_MASK. This approach has several issues:
- __native_read_cr3() returns the raw CR3 register value, which on x86_64
includes not just the physical address but also flags Bits above the
physical address width of the system (i.e. above __PHYSICAL_MASK_SHIFT) are
also not masked.
- The pgd value is masked by PAGE_SIZE which doesn't take into account the
higher bits such as _PAGE_BIT_NOPTISHADOW.
Replace this with proper accessor functions:
- native_read_cr3_pa(): Uses CR3_ADDR_MASK to additionally mask metadata out
of CR3 (like SME or LAM bits). All remaining bits are real address bits or
reserved and must be 0.
- mask pgd value with PTE_PFN_MASK instead of PAGE_MASK, accounting for flags
above bit 51 (_PAGE_BIT_NOPTISHADOW in particular). Bits below 51, but above
the max physical address are reserved and must be 0.
Fixes: cb1c9e02b0c1 ("x86/efistub: Perform 4/5 level paging switch from the stub")
Reported-by: Michael van der Westhuizen <rmikey@meta.com>
Reported-by: Tobias Fleig <tfleig@meta.com>
Co-developed-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Usama Arif <usamaarif642@gmail.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20251103141002.2280812-3-usamaarif642@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/x86-5lvl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/firmware/efi/libstub/x86-5lvl.c b/drivers/firmware/efi/libstub/x86-5lvl.c
index f1c5fb45d5f7c..c00d0ae7ed5d5 100644
--- a/drivers/firmware/efi/libstub/x86-5lvl.c
+++ b/drivers/firmware/efi/libstub/x86-5lvl.c
@@ -66,7 +66,7 @@ void efi_5level_switch(void)
bool have_la57 = native_read_cr4() & X86_CR4_LA57;
bool need_toggle = want_la57 ^ have_la57;
u64 *pgt = (void *)la57_toggle + PAGE_SIZE;
- u64 *cr3 = (u64 *)__native_read_cr3();
+ pgd_t *cr3 = (pgd_t *)native_read_cr3_pa();
u64 *new_cr3;
if (!la57_toggle || !need_toggle)
@@ -82,7 +82,7 @@ void efi_5level_switch(void)
new_cr3[0] = (u64)cr3 | _PAGE_TABLE_NOENC;
} else {
/* take the new root table pointer from the current entry #0 */
- new_cr3 = (u64 *)(cr3[0] & PAGE_MASK);
+ new_cr3 = (u64 *)(native_pgd_val(cr3[0]) & PTE_PFN_MASK);
/* copy the new root table if it is not 32-bit addressable */
if ((u64)new_cr3 > U32_MAX)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 212/614] locktorture: Fix memory leak in param_set_cpumask()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 211/614] efi/libstub: " Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 213/614] wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() Greg Kroah-Hartman
` (415 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Changzhong, Wang Liang,
Paul E. McKenney, Frederic Weisbecker, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <wangliang74@huawei.com>
[ Upstream commit e52b43883d084a9af263c573f2a1bd1ca5088389 ]
With CONFIG_CPUMASK_OFFSTACK=y, the 'bind_writers' buffer is allocated via
alloc_cpumask_var() in param_set_cpumask(). But it is not freed, when
setting the module parameter multiple times by sysfs interface or removing
module.
Below kmemleak trace is seen for this issue:
unreferenced object 0xffff888100aabff8 (size 8):
comm "bash", pid 323, jiffies 4295059233
hex dump (first 8 bytes):
07 00 00 00 00 00 00 00 ........
backtrace (crc ac50919):
__kmalloc_node_noprof+0x2e5/0x420
alloc_cpumask_var_node+0x1f/0x30
param_set_cpumask+0x26/0xb0 [locktorture]
param_attr_store+0x93/0x100
module_attr_store+0x1b/0x30
kernfs_fop_write_iter+0x114/0x1b0
vfs_write+0x300/0x410
ksys_write+0x60/0xd0
do_syscall_64+0xa4/0x260
entry_SYSCALL_64_after_hwframe+0x77/0x7f
This issue can be reproduced by:
insmod locktorture.ko bind_writers=1
rmmod locktorture
or:
insmod locktorture.ko bind_writers=1
echo 2 > /sys/module/locktorture/parameters/bind_writers
Considering that setting the module parameter 'bind_writers' or
'bind_readers' by sysfs interface has no real effect, set the parameter
permissions to 0444. To fix the memory leak when removing module, free
'bind_writers' and 'bind_readers' memory in lock_torture_cleanup().
Fixes: 73e341242483 ("locktorture: Add readers_bind and writers_bind module parameters")
Suggested-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/locktorture.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index ce0362f0a8719..6567e5eeacc0e 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -103,8 +103,8 @@ static const struct kernel_param_ops lt_bind_ops = {
.get = param_get_cpumask,
};
-module_param_cb(bind_readers, <_bind_ops, &bind_readers, 0644);
-module_param_cb(bind_writers, <_bind_ops, &bind_writers, 0644);
+module_param_cb(bind_readers, <_bind_ops, &bind_readers, 0444);
+module_param_cb(bind_writers, <_bind_ops, &bind_writers, 0444);
long torture_sched_setaffinity(pid_t pid, const struct cpumask *in_mask, bool dowarn);
@@ -1211,6 +1211,10 @@ static void lock_torture_cleanup(void)
cxt.cur_ops->exit();
cxt.init_called = false;
}
+
+ free_cpumask_var(bind_readers);
+ free_cpumask_var(bind_writers);
+
torture_cleanup_end();
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 213/614] wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 212/614] locktorture: Fix memory leak in param_set_cpumask() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 214/614] wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Greg Kroah-Hartman
` (414 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih, Fedor Pchelkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 28a45575289f3292aa9cb7bacae18ba3ee7a6adf ]
Allow adding rx_skb to rx_free_queue for later reuse on the common error
handling path, otherwise free it.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}")
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251104135720.321110-2-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/usb.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
index 6cf89aee252ed..e8e064cf7e0ad 100644
--- a/drivers/net/wireless/realtek/rtw89/usb.c
+++ b/drivers/net/wireless/realtek/rtw89/usb.c
@@ -410,8 +410,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
if (skb_queue_len(&rtwusb->rx_queue) >= RTW89_USB_MAX_RXQ_LEN) {
rtw89_warn(rtwdev, "rx_queue overflow\n");
- dev_kfree_skb_any(rx_skb);
- continue;
+ goto free_or_reuse;
}
memset(&desc_info, 0, sizeof(desc_info));
@@ -422,7 +421,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
rtw89_debug(rtwdev, RTW89_DBG_HCI,
"failed to allocate RX skb of size %u\n",
desc_info.pkt_size);
- continue;
+ goto free_or_reuse;
}
pkt_offset = desc_info.offset + desc_info.rxd_len;
@@ -432,6 +431,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
rtw89_core_rx(rtwdev, &desc_info, skb);
+free_or_reuse:
if (skb_queue_len(&rtwusb->rx_free_queue) >= RTW89_USB_RX_SKB_NUM)
dev_kfree_skb_any(rx_skb);
else
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 214/614] wifi: rtw89: usb: fix leak in rtw89_usb_write_port()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 213/614] wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1 Greg Kroah-Hartman
` (413 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih, Fedor Pchelkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 7543818e97d5d54b3b2f75f1c4dedee298d7d914 ]
When there is an attempt to write data and RTW89_FLAG_UNPLUGGED is set,
this means device is disconnected and no urb is submitted. Return
appropriate error code to the caller to properly free the allocated
resources.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}")
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251104135720.321110-3-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/usb.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
index e8e064cf7e0ad..512a46dd9d06a 100644
--- a/drivers/net/wireless/realtek/rtw89/usb.c
+++ b/drivers/net/wireless/realtek/rtw89/usb.c
@@ -256,7 +256,7 @@ static int rtw89_usb_write_port(struct rtw89_dev *rtwdev, u8 ch_dma,
int ret;
if (test_bit(RTW89_FLAG_UNPLUGGED, rtwdev->flags))
- return 0;
+ return -ENODEV;
urb = usb_alloc_urb(0, GFP_ATOMIC);
if (!urb)
@@ -305,8 +305,9 @@ static void rtw89_usb_ops_tx_kick_off(struct rtw89_dev *rtwdev, u8 txch)
ret = rtw89_usb_write_port(rtwdev, txch, skb->data, skb->len,
txcb);
if (ret) {
- rtw89_err(rtwdev, "write port txch %d failed: %d\n",
- txch, ret);
+ if (ret != -ENODEV)
+ rtw89_err(rtwdev, "write port txch %d failed: %d\n",
+ txch, ret);
skb_dequeue(&txcb->tx_ack_queue);
kfree(txcb);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 214/614] wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-17 9:42 ` Jiri Slaby
2025-12-16 11:09 ` [PATCH 6.18 216/614] mfd: da9055: Fix missing regmap_del_irq_chip() in error path Greg Kroah-Hartman
` (412 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianyou Li, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 0e6c07a3c30cdc4509fc5e7dc490d4cc6e5c241a ]
The recent change for perf c2c annotate broke build without slang
support like below.
builtin-annotate.c: In function 'hists__find_annotations':
builtin-annotate.c:522:73: error: 'NO_ADDR' undeclared (first use in this function); did you mean 'NR_ADDR'?
522 | key = hist_entry__tui_annotate(he, evsel, NULL, NO_ADDR);
| ^~~~~~~
| NR_ADDR
builtin-annotate.c:522:73: note: each undeclared identifier is reported only once for each function it appears in
builtin-annotate.c:522:31: error: too many arguments to function 'hist_entry__tui_annotate'
522 | key = hist_entry__tui_annotate(he, evsel, NULL, NO_ADDR);
| ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from util/sort.h:6,
from builtin-annotate.c:28:
util/hist.h:756:19: note: declared here
756 | static inline int hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
| ^~~~~~~~~~~~~~~~~~~~~~~~
And I noticed that it missed to update the other side of #ifdef
HAVE_SLANG_SUPPORT. Let's fix it.
Cc: Tianyou Li <tianyou.li@intel.com>
Fixes: cd3466cd2639783d ("perf c2c: Add annotation support to perf c2c report")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/hist.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index c64005278687c..a4f244a046866 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -709,6 +709,8 @@ struct block_hist {
struct hist_entry he;
};
+#define NO_ADDR 0
+
#ifdef HAVE_SLANG_SUPPORT
#include "../ui/keysyms.h"
void attr_to_script(char *buf, struct perf_event_attr *attr);
@@ -746,14 +748,16 @@ int evlist__tui_browse_hists(struct evlist *evlist __maybe_unused,
static inline int __hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
struct map_symbol *ms __maybe_unused,
struct evsel *evsel __maybe_unused,
- struct hist_browser_timer *hbt __maybe_unused)
+ struct hist_browser_timer *hbt __maybe_unused,
+ u64 al_addr __maybe_unused)
{
return 0;
}
static inline int hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
struct evsel *evsel __maybe_unused,
- struct hist_browser_timer *hbt __maybe_unused)
+ struct hist_browser_timer *hbt __maybe_unused,
+ u64 al_addr __maybe_unused)
{
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 216/614] mfd: da9055: Fix missing regmap_del_irq_chip() in error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1 Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 217/614] wifi: ath12k: Fix timeout error during beacon stats retrieval Greg Kroah-Hartman
` (411 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 1b58acfd067ca16116b9234cd6b2d30cc8ab7502 ]
When da9055_device_init() fails after regmap_add_irq_chip()
succeeds but mfd_add_devices() fails, the error handling path
only calls mfd_remove_devices() but forgets to call
regmap_del_irq_chip(). This results in a resource leak.
Fix this by adding regmap_del_irq_chip() to the error path so
that resources are released properly.
Fixes: 2896434cf272 ("mfd: DA9055 core driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251010011737.1078-1-vulab@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/da9055-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/da9055-core.c b/drivers/mfd/da9055-core.c
index 1f727ef60d638..8c989b74f924e 100644
--- a/drivers/mfd/da9055-core.c
+++ b/drivers/mfd/da9055-core.c
@@ -388,6 +388,7 @@ int da9055_device_init(struct da9055 *da9055)
err:
mfd_remove_devices(da9055->dev);
+ regmap_del_irq_chip(da9055->chip_irq, da9055->irq_data);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 217/614] wifi: ath12k: Fix timeout error during beacon stats retrieval
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 216/614] mfd: da9055: Fix missing regmap_del_irq_chip() in error path Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 218/614] ext4: correct the checking of quota files before moving extents Greg Kroah-Hartman
` (410 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manish Dharanenthiran,
Vasanthakumar Thiagarajan, Baochen Qiang, Jeff Johnson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
[ Upstream commit 2977567b244f056d86658160659f06cd6c78ba3d ]
Currently, for beacon_stats, ath12k_mac_get_fw_stats() is called
for each started BSS on the specified hardware.
ath12k_mac_get_fw_stats() will wait for the fw_stats_done completion
after fetching the requested data from firmware. For the beacon_stats,
fw_stats_done completion will be set only when stats are received for
all BSSes. However, for other stats like vdev_stats or pdev_stats, there
is one request to the firmware for all enabled BSSes. Since beacon_stats
is fetched individually for all BSSes enabled in that pdev, waiting for
the completion event results in a timeout error when multiple BSSes are
enabled.
Avoid this by completing the fw_stats_done immediately after
updating the requested BSS's beacon stats in the list. Subsequently,
this list will be used to display the beacon stats for all enabled
BSSes in the requested pdev.
Additionally, remove 'num_bcn_recvd' from the ath12k_fw_stats struct
as it is no longer needed.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: 9fe4669ae919 ("wifi: ath12k: Request beacon stats from firmware")
Signed-off-by: Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251031-beacon_stats-v1-2-f52fce7b03ac@qti.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/core.c | 2 --
drivers/net/wireless/ath/ath12k/core.h | 1 -
drivers/net/wireless/ath/ath12k/wmi.c | 10 +---------
3 files changed, 1 insertion(+), 12 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
index a2137b363c2fe..cc352eef19399 100644
--- a/drivers/net/wireless/ath/ath12k/core.c
+++ b/drivers/net/wireless/ath/ath12k/core.c
@@ -1,7 +1,6 @@
// SPDX-License-Identifier: BSD-3-Clause-Clear
/*
* Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
@@ -1250,7 +1249,6 @@ void ath12k_fw_stats_reset(struct ath12k *ar)
spin_lock_bh(&ar->data_lock);
ath12k_fw_stats_free(&ar->fw_stats);
ar->fw_stats.num_vdev_recvd = 0;
- ar->fw_stats.num_bcn_recvd = 0;
spin_unlock_bh(&ar->data_lock);
}
diff --git a/drivers/net/wireless/ath/ath12k/core.h b/drivers/net/wireless/ath/ath12k/core.h
index 3d1956966a485..d7688b383f62c 100644
--- a/drivers/net/wireless/ath/ath12k/core.h
+++ b/drivers/net/wireless/ath/ath12k/core.h
@@ -644,7 +644,6 @@ struct ath12k_fw_stats {
struct list_head vdevs;
struct list_head bcn;
u32 num_vdev_recvd;
- u32 num_bcn_recvd;
};
struct ath12k_dbg_htt_stats {
diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
index e76275bd6916f..e647b842a6a1c 100644
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
@@ -8418,18 +8418,10 @@ static void ath12k_wmi_fw_stats_process(struct ath12k *ar,
ath12k_warn(ab, "empty beacon stats");
return;
}
- /* Mark end until we reached the count of all started VDEVs
- * within the PDEV
- */
- if (ar->num_started_vdevs)
- is_end = ((++ar->fw_stats.num_bcn_recvd) ==
- ar->num_started_vdevs);
list_splice_tail_init(&stats->bcn,
&ar->fw_stats.bcn);
-
- if (is_end)
- complete(&ar->fw_stats_done);
+ complete(&ar->fw_stats_done);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 218/614] ext4: correct the checking of quota files before moving extents
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 217/614] wifi: ath12k: Fix timeout error during beacon stats retrieval Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 219/614] accel/amdxdna: Fix dma_fence leak when job is canceled Greg Kroah-Hartman
` (409 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Jan Kara, Theodore Tso,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit a2e5a3cea4b18f6e2575acc444a5e8cce1fc8260 ]
The move extent operation should return -EOPNOTSUPP if any of the inodes
is a quota inode, rather than requiring both to be quota inodes.
Fixes: 02749a4c2082 ("ext4: add ext4_is_quota_file()")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Message-ID: <20251013015128.499308-2-yi.zhang@huaweicloud.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/move_extent.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 4b091c21908fd..0f4b7c89edd39 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -485,7 +485,7 @@ mext_check_arguments(struct inode *orig_inode,
return -ETXTBSY;
}
- if (ext4_is_quota_file(orig_inode) && ext4_is_quota_file(donor_inode)) {
+ if (ext4_is_quota_file(orig_inode) || ext4_is_quota_file(donor_inode)) {
ext4_debug("ext4 move extent: The argument files should not be quota files [ino:orig %lu, donor %lu]\n",
orig_inode->i_ino, donor_inode->i_ino);
return -EOPNOTSUPP;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 219/614] accel/amdxdna: Fix dma_fence leak when job is canceled
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 218/614] ext4: correct the checking of quota files before moving extents Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 220/614] hfs: fix potential use after free in hfs_correct_next_unused_CNID() Greg Kroah-Hartman
` (408 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD), Lizhi Hou,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit dea9f84776b96a703f504631ebe9fea07bd2c181 ]
Currently, dma_fence_put(job->fence) is called in job notification
callback. However, if a job is canceled, the notification callback is never
invoked, leading to a memory leak. Move dma_fence_put(job->fence)
to the job cleanup function to ensure the fence is always released.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251105194140.1004314-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/aie2_ctx.c | 1 -
drivers/accel/amdxdna/amdxdna_ctx.c | 1 +
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index c9f712f0ec00c..2e479a8d86c31 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -189,7 +189,6 @@ aie2_sched_notify(struct amdxdna_sched_job *job)
up(&job->hwctx->priv->job_sem);
job->job_done = true;
- dma_fence_put(fence);
mmput_async(job->mm);
aie2_job_put(job);
}
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index 4bfe4ef20550f..856fb25086f12 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -389,6 +389,7 @@ void amdxdna_sched_job_cleanup(struct amdxdna_sched_job *job)
trace_amdxdna_debug_point(job->hwctx->name, job->seq, "job release");
amdxdna_arg_bos_put(job);
amdxdna_gem_put_obj(job->cmd_bo);
+ dma_fence_put(job->fence);
}
int amdxdna_cmd_submit(struct amdxdna_client *client,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 220/614] hfs: fix potential use after free in hfs_correct_next_unused_CNID()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 219/614] accel/amdxdna: Fix dma_fence leak when job is canceled Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 221/614] arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T Greg Kroah-Hartman
` (407 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Viacheslav Dubeyko,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08 ]
This code calls hfs_bnode_put(node) which drops the refcount and then
dreferences "node" on the next line. It's only safe to use "node"
when we're holding a reference so flip these two lines around.
Fixes: a06ec283e125 ("hfs: add logic of correcting a next unused CNID")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/aN-Xw8KnbSnuIcLk@stanley.mountain
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hfs/catalog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
index caebabb6642f1..b80ba40e38776 100644
--- a/fs/hfs/catalog.c
+++ b/fs/hfs/catalog.c
@@ -322,9 +322,9 @@ int hfs_correct_next_unused_CNID(struct super_block *sb, u32 cnid)
}
}
+ node_id = node->prev;
hfs_bnode_put(node);
- node_id = node->prev;
} while (node_id >= leaf_head);
return -ENOENT;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 221/614] arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 220/614] hfs: fix potential use after free in hfs_correct_next_unused_CNID() Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 222/614] io_uring: use WRITE_ONCE for user shared memory Greg Kroah-Hartman
` (406 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, FUKAUMI Naoki, Heiko Stuebner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <naoki@radxa.com>
[ Upstream commit fbf90d1b697faf61bb8b3ed72be6a8ebeb09de3d ]
The Radxa ROCK 5B+/5T USB Type-C port supports Dual Role Data and
should also act as a host. However, currently, when acting as a host,
only self-powered devices work.
Since the ROCK 5B+ supports Dual Role Power, set the power-role
property to "dual" and the try-power-role property to "sink". (along
with related properties)
The ROCK 5T should only support the "source" power-role.
This allows the port to act as a host, supply power to the port, and
allow bus-powered devices to work.
Note that on the ROCK 5T, with this patch applied, it has been
observed that some bus-powered devices do not work correctly. Also,
it has been observed that after connecting a device (and the data-role
switches to host), connecting a host device does not switch the
data-role back to the device role. These issues should be addressed
separately.
Note that there is a separate known issue where USB 3.0 SuperSpeed
devices do not work when oriented in reverse. This issue should also be
addressed separately. (USB 2.0/1.1 devices work in both orientations)
Fixes: 67b2c15d8fb3c ("arm64: dts: rockchip: add USB-C support for ROCK 5B/5B+/5T")
Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://patch.msgid.link/20251104085227.820-1-naoki@radxa.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi | 4 ++--
arch/arm64/boot/dts/rockchip/rk3588-rock-5b-plus.dts | 5 +++++
arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 ++++
arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts | 4 ++++
4 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi
index 3bbe78810ec6f..7aac77dfc5f16 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi
@@ -331,12 +331,12 @@ usb_con: connector {
data-role = "dual";
/* fusb302 supports PD Rev 2.0 Ver 1.2 */
pd-revision = /bits/ 8 <0x2 0x0 0x1 0x2>;
- power-role = "sink";
- try-power-role = "sink";
op-sink-microwatt = <1000000>;
sink-pdos =
<PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)>,
<PDO_VAR(5000, 20000, 5000)>;
+ source-pdos =
+ <PDO_FIXED(5000, 3000, PDO_FIXED_USB_COMM)>;
altmodes {
displayport {
diff --git a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-plus.dts b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-plus.dts
index 5e984a44120e4..07a840d9b3859 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-plus.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b-plus.dts
@@ -110,6 +110,11 @@ vcc5v0_host_en: vcc5v0-host-en {
};
};
+&usb_con {
+ power-role = "dual";
+ try-power-role = "sink";
+};
+
&usbdp_phy0 {
pinctrl-names = "default";
pinctrl-0 = <&usbc_sbu_dc>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts
index 8ef01010d985b..da13dafcbc823 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts
@@ -49,6 +49,10 @@ vcc5v0_host_en: vcc5v0-host-en {
};
};
+&usb_con {
+ power-role = "sink";
+};
+
&usbdp_phy0 {
pinctrl-names = "default";
pinctrl-0 = <&usbc_sbu_dc>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts b/arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts
index c1763835f53d4..0dd90c744380b 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts
@@ -130,6 +130,10 @@ usbc_sbu_dc: usbc-sbu-dc {
};
};
+&usb_con {
+ power-role = "source";
+};
+
&usbdp_phy0 {
pinctrl-names = "default";
pinctrl-0 = <&usbc_sbu_dc>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 222/614] io_uring: use WRITE_ONCE for user shared memory
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 221/614] arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 223/614] perf/x86: Fix NULL event access and potential PEBS record loss Greg Kroah-Hartman
` (405 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pavel Begunkov, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
[ Upstream commit 93e197e524b14d185d011813b72773a1a49d932d ]
IORING_SETUP_NO_MMAP rings remain user accessible even before the ctx
setup is finalised, so use WRITE_ONCE consistently when initialising
rings.
Fixes: 03d89a2de25bb ("io_uring: support for user allocated memory for rings/sqes")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/io_uring.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 02339b74ba8d4..765abec2571f0 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3623,10 +3623,6 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx,
if (!(ctx->flags & IORING_SETUP_NO_SQARRAY))
ctx->sq_array = (u32 *)((char *)rings + sq_array_offset);
- rings->sq_ring_mask = p->sq_entries - 1;
- rings->cq_ring_mask = p->cq_entries - 1;
- rings->sq_ring_entries = p->sq_entries;
- rings->cq_ring_entries = p->cq_entries;
if (p->flags & IORING_SETUP_SQE128)
size = array_size(2 * sizeof(struct io_uring_sqe), p->sq_entries);
@@ -3649,6 +3645,12 @@ static __cold int io_allocate_scq_urings(struct io_ring_ctx *ctx,
return ret;
}
ctx->sq_sqes = io_region_get_ptr(&ctx->sq_region);
+
+ memset(rings, 0, sizeof(*rings));
+ WRITE_ONCE(rings->sq_ring_mask, ctx->sq_entries - 1);
+ WRITE_ONCE(rings->cq_ring_mask, ctx->cq_entries - 1);
+ WRITE_ONCE(rings->sq_ring_entries, ctx->sq_entries);
+ WRITE_ONCE(rings->cq_ring_entries, ctx->cq_entries);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 223/614] perf/x86: Fix NULL event access and potential PEBS record loss
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 222/614] io_uring: use WRITE_ONCE for user shared memory Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 224/614] perf/x86/intel: Correct large PEBS flag check Greg Kroah-Hartman
` (404 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Peter Zijlstra,
Dapeng Mi, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
[ Upstream commit 7e772a93eb61cb6265bdd1c5bde17d0f2718b452 ]
When intel_pmu_drain_pebs_icl() is called to drain PEBS records, the
perf_event_overflow() could be called to process the last PEBS record.
While perf_event_overflow() could trigger the interrupt throttle and
stop all events of the group, like what the below call-chain shows.
perf_event_overflow()
-> __perf_event_overflow()
->__perf_event_account_interrupt()
-> perf_event_throttle_group()
-> perf_event_throttle()
-> event->pmu->stop()
-> x86_pmu_stop()
The side effect of stopping the events is that all corresponding event
pointers in cpuc->events[] array are cleared to NULL.
Assume there are two PEBS events (event a and event b) in a group. When
intel_pmu_drain_pebs_icl() calls perf_event_overflow() to process the
last PEBS record of PEBS event a, interrupt throttle is triggered and
all pointers of event a and event b are cleared to NULL. Then
intel_pmu_drain_pebs_icl() tries to process the last PEBS record of
event b and encounters NULL pointer access.
To avoid this issue, move cpuc->events[] clearing from x86_pmu_stop()
to x86_pmu_del(). It's safe since cpuc->active_mask or
cpuc->pebs_enabled is always checked before access the event pointer
from cpuc->events[].
Closes: https://lore.kernel.org/oe-lkp/202507042103.a15d2923-lkp@intel.com
Fixes: 9734e25fbf5a ("perf: Fix the throttle logic for a group")
Reported-by: kernel test robot <oliver.sang@intel.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20251029102136.61364-3-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index fa6c47b509897..dd9ff120ad437 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -1344,6 +1344,7 @@ static void x86_pmu_enable(struct pmu *pmu)
hwc->state |= PERF_HES_ARCH;
x86_pmu_stop(event, PERF_EF_UPDATE);
+ cpuc->events[hwc->idx] = NULL;
}
/*
@@ -1365,6 +1366,7 @@ static void x86_pmu_enable(struct pmu *pmu)
* if cpuc->enabled = 0, then no wrmsr as
* per x86_pmu_enable_event()
*/
+ cpuc->events[hwc->idx] = event;
x86_pmu_start(event, PERF_EF_RELOAD);
}
cpuc->n_added = 0;
@@ -1531,7 +1533,6 @@ static void x86_pmu_start(struct perf_event *event, int flags)
event->hw.state = 0;
- cpuc->events[idx] = event;
__set_bit(idx, cpuc->active_mask);
static_call(x86_pmu_enable)(event);
perf_event_update_userpage(event);
@@ -1610,7 +1611,6 @@ void x86_pmu_stop(struct perf_event *event, int flags)
if (test_bit(hwc->idx, cpuc->active_mask)) {
static_call(x86_pmu_disable)(event);
__clear_bit(hwc->idx, cpuc->active_mask);
- cpuc->events[hwc->idx] = NULL;
WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
hwc->state |= PERF_HES_STOPPED;
}
@@ -1648,6 +1648,7 @@ static void x86_pmu_del(struct perf_event *event, int flags)
* Not a TXN, therefore cleanup properly.
*/
x86_pmu_stop(event, PERF_EF_UPDATE);
+ cpuc->events[event->hw.idx] = NULL;
for (i = 0; i < cpuc->n_events; i++) {
if (event == cpuc->event_list[i])
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 224/614] perf/x86/intel: Correct large PEBS flag check
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 223/614] perf/x86: Fix NULL event access and potential PEBS record loss Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 225/614] regulator: core: disable supply if enabling main regulator fails Greg Kroah-Hartman
` (403 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dapeng Mi, Peter Zijlstra (Intel),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dapeng Mi <dapeng1.mi@linux.intel.com>
[ Upstream commit 5e4e355ae7cdeb0fef5dbe908866e1f895abfacc ]
current large PEBS flag check only checks if sample_regs_user contains
unsupported GPRs but doesn't check if sample_regs_intr contains
unsupported GPRs.
Of course, currently PEBS HW supports to sample all perf supported GPRs,
the missed check doesn't cause real issue. But it won't be true any more
after the subsequent patches support to sample SSP register. SSP
sampling is not supported by adaptive PEBS HW and it would be supported
until arch-PEBS HW. So correct this issue.
Fixes: a47ba4d77e12 ("perf/x86: Enable free running PEBS for REGS_USER/INTR")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20251029102136.61364-5-dapeng1.mi@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index fe65be0b9d9c4..9b824ed6fc1de 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4029,7 +4029,9 @@ static unsigned long intel_pmu_large_pebs_flags(struct perf_event *event)
if (!event->attr.exclude_kernel)
flags &= ~PERF_SAMPLE_REGS_USER;
if (event->attr.sample_regs_user & ~PEBS_GP_REGS)
- flags &= ~(PERF_SAMPLE_REGS_USER | PERF_SAMPLE_REGS_INTR);
+ flags &= ~PERF_SAMPLE_REGS_USER;
+ if (event->attr.sample_regs_intr & ~PEBS_GP_REGS)
+ flags &= ~PERF_SAMPLE_REGS_INTR;
return flags;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 225/614] regulator: core: disable supply if enabling main regulator fails
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 224/614] perf/x86/intel: Correct large PEBS flag check Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 226/614] md: delete mddev kobj before deleting gendisk kobj Greg Kroah-Hartman
` (402 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
[ Upstream commit fb1ebb10468da414d57153ddebaab29c38ef1a78 ]
For 'always-on' and 'boot-on' regulators, the set_machine_constraints()
may enable supply before enabling the main regulator, however if the
latter fails, the function returns with an error but the supply remains
enabled.
When this happens, the regulator_register() function continues on the
error path where it puts the supply regulator. Since enabling the supply
is not balanced with a disable call, a warning similar to the following
gets issued from _regulator_put():
[ 1.603889] WARNING: CPU: 2 PID: 44 at _regulator_put+0x8c/0xa0
[ 1.603908] Modules linked in:
[ 1.603926] CPU: 2 UID: 0 PID: 44 Comm: kworker/u16:3 Not tainted 6.18.0-rc4 #0 NONE
[ 1.603938] Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT)
[ 1.603945] Workqueue: async async_run_entry_fn
[ 1.603958] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1.603967] pc : _regulator_put+0x8c/0xa0
[ 1.603976] lr : _regulator_put+0x7c/0xa0
...
[ 1.604140] Call trace:
[ 1.604145] _regulator_put+0x8c/0xa0 (P)
[ 1.604156] regulator_register+0x2ec/0xbf0
[ 1.604166] devm_regulator_register+0x60/0xb0
[ 1.604178] rpm_reg_probe+0x120/0x208
[ 1.604187] platform_probe+0x64/0xa8
...
In order to avoid this, change the set_machine_constraints() function to
disable the supply if enabling the main regulator fails.
Fixes: 05f224ca6693 ("regulator: core: Clean enabling always-on regulators + their supplies")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20251107-regulator-disable-supply-v1-1-c95f0536f1b5@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index dd7b10e768c06..fc93612f4ec0c 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1618,6 +1618,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)
* and we have control then make sure it is enabled.
*/
if (rdev->constraints->always_on || rdev->constraints->boot_on) {
+ bool supply_enabled = false;
+
/* If we want to enable this regulator, make sure that we know
* the supplying regulator.
*/
@@ -1637,11 +1639,14 @@ static int set_machine_constraints(struct regulator_dev *rdev)
rdev->supply = NULL;
return ret;
}
+ supply_enabled = true;
}
ret = _regulator_do_enable(rdev);
if (ret < 0 && ret != -EINVAL) {
rdev_err(rdev, "failed to enable: %pe\n", ERR_PTR(ret));
+ if (supply_enabled)
+ regulator_disable(rdev->supply);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 226/614] md: delete mddev kobj before deleting gendisk kobj
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 225/614] regulator: core: disable supply if enabling main regulator fails Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 227/614] md: fix rcu protection in md_wakeup_thread Greg Kroah-Hartman
` (401 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiao Ni, Li Nan, Yu Kuai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <xni@redhat.com>
[ Upstream commit cc394b94dc40b661efc9895665abf03640ffff2d ]
In sync del gendisk path, it deletes gendisk first and the directory
/sys/block/md is removed. Then it releases mddev kobj in a delayed work.
If we enable debug log in sysfs_remove_group, we can see the debug log
'sysfs group bitmap not found for kobject md'. It's the reason that the
parent kobj has been deleted, so it can't find parent directory.
In creating path, it allocs gendisk first, then adds mddev kobj. So it
should delete mddev kobj before deleting gendisk.
Before commit 9e59d609763f ("md: call del_gendisk in control path"), it
releases mddev kobj first. If the kobj hasn't been deleted, it does clean
job and deletes the kobj. Then it calls del_gendisk and releases gendisk
kobj. So it doesn't need to call kobject_del to delete mddev kobj. After
this patch, in sync del gendisk path, the sequence changes. So it needs
to call kobject_del to delete mddev kobj.
After this patch, the sequence is:
1. kobject del mddev kobj
2. del_gendisk deletes gendisk kobj
3. mddev_delayed_delete releases mddev kobj
4. md_kobj_release releases gendisk kobj
Link: https://lore.kernel.org/linux-raid/20250928012424.61370-1-xni@redhat.com
Fixes: 9e59d609763f ("md: call del_gendisk in control path")
Signed-off-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 41c476b40c7a3..8128c8839a082 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -941,8 +941,10 @@ void mddev_unlock(struct mddev *mddev)
* do_md_stop. dm raid only uses md_stop to stop. So dm raid
* doesn't need to check MD_DELETED when getting reconfig lock
*/
- if (test_bit(MD_DELETED, &mddev->flags))
+ if (test_bit(MD_DELETED, &mddev->flags)) {
+ kobject_del(&mddev->kobj);
del_gendisk(mddev->gendisk);
+ }
}
}
EXPORT_SYMBOL_GPL(mddev_unlock);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 227/614] md: fix rcu protection in md_wakeup_thread
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 226/614] md: delete mddev kobj before deleting gendisk kobj Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 228/614] md: avoid repeated calls to del_gendisk Greg Kroah-Hartman
` (400 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yun Zhou, Li Nan, Yu Kuai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit 0dc76205549b4c25705e54345f211b9f66e018a0 ]
We attempted to use RCU to protect the pointer 'thread', but directly
passed the value when calling md_wakeup_thread(). This means that the
RCU pointer has been acquired before rcu_read_lock(), which renders
rcu_read_lock() ineffective and could lead to a use-after-free.
Link: https://lore.kernel.org/linux-raid/20251015083227.1079009-1-yun.zhou@windriver.com
Fixes: 446931543982 ("md: protect md_thread with rcu")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 14 ++++++--------
drivers/md/md.h | 8 +++++++-
2 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 8128c8839a082..6062e0deb6160 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -99,7 +99,7 @@ static int remove_and_add_spares(struct mddev *mddev,
struct md_rdev *this);
static void mddev_detach(struct mddev *mddev);
static void export_rdev(struct md_rdev *rdev, struct mddev *mddev);
-static void md_wakeup_thread_directly(struct md_thread __rcu *thread);
+static void md_wakeup_thread_directly(struct md_thread __rcu **thread);
/*
* Default number of read corrections we'll attempt on an rdev
@@ -5136,7 +5136,7 @@ static void stop_sync_thread(struct mddev *mddev, bool locked)
* Thread might be blocked waiting for metadata update which will now
* never happen
*/
- md_wakeup_thread_directly(mddev->sync_thread);
+ md_wakeup_thread_directly(&mddev->sync_thread);
if (work_pending(&mddev->sync_work))
flush_work(&mddev->sync_work);
@@ -8375,22 +8375,21 @@ static int md_thread(void *arg)
return 0;
}
-static void md_wakeup_thread_directly(struct md_thread __rcu *thread)
+static void md_wakeup_thread_directly(struct md_thread __rcu **thread)
{
struct md_thread *t;
rcu_read_lock();
- t = rcu_dereference(thread);
+ t = rcu_dereference(*thread);
if (t)
wake_up_process(t->tsk);
rcu_read_unlock();
}
-void md_wakeup_thread(struct md_thread __rcu *thread)
+void __md_wakeup_thread(struct md_thread __rcu *thread)
{
struct md_thread *t;
- rcu_read_lock();
t = rcu_dereference(thread);
if (t) {
pr_debug("md: waking up MD thread %s.\n", t->tsk->comm);
@@ -8398,9 +8397,8 @@ void md_wakeup_thread(struct md_thread __rcu *thread)
if (wq_has_sleeper(&t->wqueue))
wake_up(&t->wqueue);
}
- rcu_read_unlock();
}
-EXPORT_SYMBOL(md_wakeup_thread);
+EXPORT_SYMBOL(__md_wakeup_thread);
struct md_thread *md_register_thread(void (*run) (struct md_thread *),
struct mddev *mddev, const char *name)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 1979c2d4fe89e..5d5f780b84477 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -882,6 +882,12 @@ struct md_io_clone {
#define THREAD_WAKEUP 0
+#define md_wakeup_thread(thread) do { \
+ rcu_read_lock(); \
+ __md_wakeup_thread(thread); \
+ rcu_read_unlock(); \
+} while (0)
+
static inline void safe_put_page(struct page *p)
{
if (p) put_page(p);
@@ -895,7 +901,7 @@ extern struct md_thread *md_register_thread(
struct mddev *mddev,
const char *name);
extern void md_unregister_thread(struct mddev *mddev, struct md_thread __rcu **threadp);
-extern void md_wakeup_thread(struct md_thread __rcu *thread);
+extern void __md_wakeup_thread(struct md_thread __rcu *thread);
extern void md_check_recovery(struct mddev *mddev);
extern void md_reap_sync_thread(struct mddev *mddev);
extern enum sync_action md_sync_action(struct mddev *mddev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 228/614] md: avoid repeated calls to del_gendisk
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 227/614] md: fix rcu protection in md_wakeup_thread Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 229/614] nbd: defer config put in recv_work Greg Kroah-Hartman
` (399 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiao Ni, Yu Kuai, Li Nan,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <xni@redhat.com>
[ Upstream commit 90e3bb44c0a86e245d8e5c6520206fa113acb1ee ]
There is a uaf problem which is found by case 23rdev-lifetime:
Oops: general protection fault, probably for non-canonical address 0xdead000000000122
RIP: 0010:bdi_unregister+0x4b/0x170
Call Trace:
<TASK>
__del_gendisk+0x356/0x3e0
mddev_unlock+0x351/0x360
rdev_attr_store+0x217/0x280
kernfs_fop_write_iter+0x14a/0x210
vfs_write+0x29e/0x550
ksys_write+0x74/0xf0
do_syscall_64+0xbb/0x380
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff5250a177e
The sequence is:
1. rdev remove path gets reconfig_mutex
2. rdev remove path release reconfig_mutex in mddev_unlock
3. md stop calls do_md_stop and sets MD_DELETED
4. rdev remove path calls del_gendisk because MD_DELETED is set
5. md stop path release reconfig_mutex and calls del_gendisk again
So there is a race condition we should resolve. This patch adds a
flag MD_DO_DELETE to avoid the race condition.
Link: https://lore.kernel.org/linux-raid/20251029063419.21700-1-xni@redhat.com
Fixes: 9e59d609763f ("md: call del_gendisk in control path")
Signed-off-by: Xiao Ni <xni@redhat.com>
Suggested-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 3 ++-
drivers/md/md.h | 1 +
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6062e0deb6160..5d40beaecc9c7 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -941,7 +941,8 @@ void mddev_unlock(struct mddev *mddev)
* do_md_stop. dm raid only uses md_stop to stop. So dm raid
* doesn't need to check MD_DELETED when getting reconfig lock
*/
- if (test_bit(MD_DELETED, &mddev->flags)) {
+ if (test_bit(MD_DELETED, &mddev->flags) &&
+ !test_and_set_bit(MD_DO_DELETE, &mddev->flags)) {
kobject_del(&mddev->kobj);
del_gendisk(mddev->gendisk);
}
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 5d5f780b84477..fd6e001c1d38f 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -354,6 +354,7 @@ enum mddev_flags {
MD_HAS_MULTIPLE_PPLS,
MD_NOT_READY,
MD_BROKEN,
+ MD_DO_DELETE,
MD_DELETED,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 229/614] nbd: defer config put in recv_work
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 228/614] md: avoid repeated calls to del_gendisk Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 230/614] scsi: stex: Fix reboot_notifier leak in probe error path Greg Kroah-Hartman
` (398 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+56fbf4c7ddf65e95c7cc,
Zheng Qixing, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <zhengqixing@huawei.com>
[ Upstream commit 9517b82d8d422d426a988b213fdd45c6b417b86d ]
There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and
NBD_CMD_RECONFIGURE:
nbd_genl_connect // conf_ref=2 (connect and recv_work A)
nbd_open // conf_ref=3
recv_work A done // conf_ref=2
NBD_CLEAR_SOCK // conf_ref=1
nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)
close nbd // conf_ref=1
recv_work B
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Or only running NBD_CLEAR_SOCK:
nbd_genl_connect // conf_ref=2
nbd_open // conf_ref=3
NBD_CLEAR_SOCK // conf_ref=2
close nbd
nbd_release
config_put // conf_ref=1
recv_work
config_put // conf_ref=0
atomic_dec(&config->recv_threads); -> UAF
Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the
waiter") moved nbd_config_put() to run before waking up the waiter in
recv_work, in order to ensure that nbd_start_device_ioctl() would not
be woken up while nbd->task_recv was still uncleared.
However, in nbd_start_device_ioctl(), after being woken up it explicitly
calls flush_workqueue() to make sure all current works are finished.
Therefore, there is no need to move the config put ahead of the wakeup.
Move nbd_config_put() to the end of recv_work, so that the reference is
held for the whole lifetime of the worker thread. This makes sure the
config cannot be freed while recv_work is still running, even if clear
+ reconfigure interleave.
In addition, we don't need to worry about recv_work dropping the last
nbd_put (which causes deadlock):
path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=1 (trigger recv_work)
open nbd // nbd_refs=2
NBD_CLEAR_SOCK
close nbd
nbd_release
nbd_disconnect_and_put
flush_workqueue // recv_work done
nbd_config_put
nbd_put // nbd_refs=1
nbd_put // nbd_refs=0
queue_work
path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):
connect // nbd_refs=2 (trigger recv_work)
open nbd // nbd_refs=3
NBD_CLEAR_SOCK // conf_refs=2
close nbd
nbd_release
nbd_config_put // conf_refs=1
nbd_put // nbd_refs=2
recv_work done // conf_refs=0, nbd_refs=1
rmmod // nbd_refs=0
Reported-by: syzbot+56fbf4c7ddf65e95c7cc@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6907edce.a70a0220.37351b.0014.GAE@google.com/T/
Fixes: 87aac3a80af5 ("nbd: make the config put is called before the notifying the waiter")
Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/nbd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index a853c65ac65df..215fc18115b78 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1024,9 +1024,9 @@ static void recv_work(struct work_struct *work)
nbd_mark_nsock_dead(nbd, nsock, 1);
mutex_unlock(&nsock->tx_lock);
- nbd_config_put(nbd);
atomic_dec(&config->recv_threads);
wake_up(&config->recv_wq);
+ nbd_config_put(nbd);
kfree(args);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 230/614] scsi: stex: Fix reboot_notifier leak in probe error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 229/614] nbd: defer config put in recv_work Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 231/614] scsi: smartpqi: Fix device resources accessed after device removal Greg Kroah-Hartman
` (397 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Martin K. Petersen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 20da637eb545b04753e20c675cfe97b04c7b600b ]
In stex_probe(), register_reboot_notifier() is called at the beginning,
but if any subsequent initialization step fails, the function returns
without unregistering the notifier, resulting in a resource leak.
Add unregister_reboot_notifier() in the out_disable error path to ensure
proper cleanup on all failure paths.
Fixes: 61b745fa63db ("scsi: stex: Add S6 support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251104094847.270-1-vulab@iscas.ac.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/stex.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
index d8ad02c293205..e02f28e5a104e 100644
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -1844,6 +1844,7 @@ static int stex_probe(struct pci_dev *pdev, const struct pci_device_id *id)
out_scsi_host_put:
scsi_host_put(host);
out_disable:
+ unregister_reboot_notifier(&stex_notifier);
pci_disable_device(pdev);
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 231/614] scsi: smartpqi: Fix device resources accessed after device removal
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 230/614] scsi: stex: Fix reboot_notifier leak in probe error path Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 232/614] staging: most: remove broken i2c driver Greg Kroah-Hartman
` (396 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Scott Teel, Scott Benesh,
Mike McGowen, Don Brace, Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike McGowen <mike.mcgowen@microchip.com>
[ Upstream commit b518e86d1a70a88f6592a7c396cf1b93493d1aab ]
Correct possible race conditions during device removal.
Previously, a scheduled work item to reset a LUN could still execute
after the device was removed, leading to use-after-free and other
resource access issues.
This race condition occurs because the abort handler may schedule a LUN
reset concurrently with device removal via sdev_destroy(), leading to
use-after-free and improper access to freed resources.
- Check in the device reset handler if the device is still present in
the controller's SCSI device list before running; if not, the reset
is skipped.
- Cancel any pending TMF work that has not started in sdev_destroy().
- Ensure device freeing in sdev_destroy() is done while holding the
LUN reset mutex to avoid races with ongoing resets.
Fixes: 2d80f4054f7f ("scsi: smartpqi: Update deleting a LUN via sysfs")
Reviewed-by: Scott Teel <scott.teel@microchip.com>
Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
Signed-off-by: Mike McGowen <mike.mcgowen@microchip.com>
Signed-off-by: Don Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20251106163823.786828-3-don.brace@microchip.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/smartpqi/smartpqi_init.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 03c97e60d36f6..fdc856845a05d 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -6410,10 +6410,22 @@ static int pqi_device_reset(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev
static int pqi_device_reset_handler(struct pqi_ctrl_info *ctrl_info, struct pqi_scsi_dev *device, u8 lun, struct scsi_cmnd *scmd, u8 scsi_opcode)
{
+ unsigned long flags;
int rc;
mutex_lock(&ctrl_info->lun_reset_mutex);
+ spin_lock_irqsave(&ctrl_info->scsi_device_list_lock, flags);
+ if (pqi_find_scsi_dev(ctrl_info, device->bus, device->target, device->lun) == NULL) {
+ dev_warn(&ctrl_info->pci_dev->dev,
+ "skipping reset of scsi %d:%d:%d:%u, device has been removed\n",
+ ctrl_info->scsi_host->host_no, device->bus, device->target, device->lun);
+ spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);
+ mutex_unlock(&ctrl_info->lun_reset_mutex);
+ return 0;
+ }
+ spin_unlock_irqrestore(&ctrl_info->scsi_device_list_lock, flags);
+
dev_err(&ctrl_info->pci_dev->dev,
"resetting scsi %d:%d:%d:%u SCSI cmd at %p due to cmd opcode 0x%02x\n",
ctrl_info->scsi_host->host_no, device->bus, device->target, lun, scmd, scsi_opcode);
@@ -6594,7 +6606,9 @@ static void pqi_sdev_destroy(struct scsi_device *sdev)
{
struct pqi_ctrl_info *ctrl_info;
struct pqi_scsi_dev *device;
+ struct pqi_tmf_work *tmf_work;
int mutex_acquired;
+ unsigned int lun;
unsigned long flags;
ctrl_info = shost_to_hba(sdev->host);
@@ -6621,8 +6635,13 @@ static void pqi_sdev_destroy(struct scsi_device *sdev)
mutex_unlock(&ctrl_info->scan_mutex);
+ for (lun = 0, tmf_work = device->tmf_work; lun < PQI_MAX_LUNS_PER_DEVICE; lun++, tmf_work++)
+ cancel_work_sync(&tmf_work->work_struct);
+
+ mutex_lock(&ctrl_info->lun_reset_mutex);
pqi_dev_info(ctrl_info, "removed", device);
pqi_free_device(device);
+ mutex_unlock(&ctrl_info->lun_reset_mutex);
}
static int pqi_getpciinfo_ioctl(struct pqi_ctrl_info *ctrl_info, void __user *arg)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 232/614] staging: most: remove broken i2c driver
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 231/614] scsi: smartpqi: Fix device resources accessed after device removal Greg Kroah-Hartman
@ 2025-12-16 11:09 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 233/614] iio: imu: bmi270: fix dev_err_probe error msg Greg Kroah-Hartman
` (395 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Gromm, Johan Hovold,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 495df2da6944477d282d5cc0c13174d06e25b310 ]
The MOST I2C driver has been completely broken for five years without
anyone noticing so remove the driver from staging.
Specifically, commit 723de0f9171e ("staging: most: remove device from
interface structure") started requiring drivers to set the interface
device pointer before registration, but the I2C driver was never updated
which results in a NULL pointer dereference if anyone ever tries to
probe it.
Fixes: 723de0f9171e ("staging: most: remove device from interface structure")
Cc: Christian Gromm <christian.gromm@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251029093442.29256-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/most/Kconfig | 2 -
drivers/staging/most/Makefile | 1 -
drivers/staging/most/i2c/Kconfig | 13 --
drivers/staging/most/i2c/Makefile | 4 -
drivers/staging/most/i2c/i2c.c | 374 ------------------------------
5 files changed, 394 deletions(-)
delete mode 100644 drivers/staging/most/i2c/Kconfig
delete mode 100644 drivers/staging/most/i2c/Makefile
delete mode 100644 drivers/staging/most/i2c/i2c.c
diff --git a/drivers/staging/most/Kconfig b/drivers/staging/most/Kconfig
index 6f420cbcdcfff..e89658df6f124 100644
--- a/drivers/staging/most/Kconfig
+++ b/drivers/staging/most/Kconfig
@@ -24,6 +24,4 @@ source "drivers/staging/most/video/Kconfig"
source "drivers/staging/most/dim2/Kconfig"
-source "drivers/staging/most/i2c/Kconfig"
-
endif
diff --git a/drivers/staging/most/Makefile b/drivers/staging/most/Makefile
index 8b3fc5a7af514..e45084df7803a 100644
--- a/drivers/staging/most/Makefile
+++ b/drivers/staging/most/Makefile
@@ -3,4 +3,3 @@
obj-$(CONFIG_MOST_NET) += net/
obj-$(CONFIG_MOST_VIDEO) += video/
obj-$(CONFIG_MOST_DIM2) += dim2/
-obj-$(CONFIG_MOST_I2C) += i2c/
diff --git a/drivers/staging/most/i2c/Kconfig b/drivers/staging/most/i2c/Kconfig
deleted file mode 100644
index ff64283cbad18..0000000000000
--- a/drivers/staging/most/i2c/Kconfig
+++ /dev/null
@@ -1,13 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-#
-# MOST I2C configuration
-#
-
-config MOST_I2C
- tristate "I2C"
- depends on I2C
- help
- Say Y here if you want to connect via I2C to network transceiver.
-
- To compile this driver as a module, choose M here: the
- module will be called most_i2c.
diff --git a/drivers/staging/most/i2c/Makefile b/drivers/staging/most/i2c/Makefile
deleted file mode 100644
index 71099dd0f85b9..0000000000000
--- a/drivers/staging/most/i2c/Makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-obj-$(CONFIG_MOST_I2C) += most_i2c.o
-
-most_i2c-objs := i2c.o
diff --git a/drivers/staging/most/i2c/i2c.c b/drivers/staging/most/i2c/i2c.c
deleted file mode 100644
index 184b2dd11fc34..0000000000000
--- a/drivers/staging/most/i2c/i2c.c
+++ /dev/null
@@ -1,374 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * i2c.c - Hardware Dependent Module for I2C Interface
- *
- * Copyright (C) 2013-2015, Microchip Technology Germany II GmbH & Co. KG
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/i2c.h>
-#include <linux/interrupt.h>
-#include <linux/err.h>
-#include <linux/most.h>
-
-enum { CH_RX, CH_TX, NUM_CHANNELS };
-
-#define MAX_BUFFERS_CONTROL 32
-#define MAX_BUF_SIZE_CONTROL 256
-
-/**
- * list_first_mbo - get the first mbo from a list
- * @ptr: the list head to take the mbo from.
- */
-#define list_first_mbo(ptr) \
- list_first_entry(ptr, struct mbo, list)
-
-static unsigned int polling_rate;
-module_param(polling_rate, uint, 0644);
-MODULE_PARM_DESC(polling_rate, "Polling rate [Hz]. Default = 0 (use IRQ)");
-
-struct hdm_i2c {
- struct most_interface most_iface;
- struct most_channel_capability capabilities[NUM_CHANNELS];
- struct i2c_client *client;
- struct rx {
- struct delayed_work dwork;
- struct list_head list;
- bool int_disabled;
- unsigned int delay;
- } rx;
- char name[64];
-};
-
-static inline struct hdm_i2c *to_hdm(struct most_interface *iface)
-{
- return container_of(iface, struct hdm_i2c, most_iface);
-}
-
-static irqreturn_t most_irq_handler(int, void *);
-static void pending_rx_work(struct work_struct *);
-
-/**
- * configure_channel - called from MOST core to configure a channel
- * @most_iface: interface the channel belongs to
- * @ch_idx: channel to be configured
- * @channel_config: structure that holds the configuration information
- *
- * Return 0 on success, negative on failure.
- *
- * Receives configuration information from MOST core and initialize the
- * corresponding channel.
- */
-static int configure_channel(struct most_interface *most_iface,
- int ch_idx,
- struct most_channel_config *channel_config)
-{
- int ret;
- struct hdm_i2c *dev = to_hdm(most_iface);
- unsigned int delay, pr;
-
- BUG_ON(ch_idx < 0 || ch_idx >= NUM_CHANNELS);
-
- if (channel_config->data_type != MOST_CH_CONTROL) {
- pr_err("bad data type for channel %d\n", ch_idx);
- return -EPERM;
- }
-
- if (channel_config->direction != dev->capabilities[ch_idx].direction) {
- pr_err("bad direction for channel %d\n", ch_idx);
- return -EPERM;
- }
-
- if (channel_config->direction == MOST_CH_RX) {
- if (!polling_rate) {
- if (dev->client->irq <= 0) {
- pr_err("bad irq: %d\n", dev->client->irq);
- return -ENOENT;
- }
- dev->rx.int_disabled = false;
- ret = request_irq(dev->client->irq, most_irq_handler, 0,
- dev->client->name, dev);
- if (ret) {
- pr_err("request_irq(%d) failed: %d\n",
- dev->client->irq, ret);
- return ret;
- }
- } else {
- delay = msecs_to_jiffies(MSEC_PER_SEC / polling_rate);
- dev->rx.delay = delay ? delay : 1;
- pr = MSEC_PER_SEC / jiffies_to_msecs(dev->rx.delay);
- pr_info("polling rate is %u Hz\n", pr);
- }
- }
-
- return 0;
-}
-
-/**
- * enqueue - called from MOST core to enqueue a buffer for data transfer
- * @most_iface: intended interface
- * @ch_idx: ID of the channel the buffer is intended for
- * @mbo: pointer to the buffer object
- *
- * Return 0 on success, negative on failure.
- *
- * Transmit the data over I2C if it is a "write" request or push the buffer into
- * list if it is an "read" request
- */
-static int enqueue(struct most_interface *most_iface,
- int ch_idx, struct mbo *mbo)
-{
- struct hdm_i2c *dev = to_hdm(most_iface);
- int ret;
-
- BUG_ON(ch_idx < 0 || ch_idx >= NUM_CHANNELS);
-
- if (ch_idx == CH_RX) {
- /* RX */
- if (!polling_rate)
- disable_irq(dev->client->irq);
- cancel_delayed_work_sync(&dev->rx.dwork);
- list_add_tail(&mbo->list, &dev->rx.list);
- if (dev->rx.int_disabled || polling_rate)
- pending_rx_work(&dev->rx.dwork.work);
- if (!polling_rate)
- enable_irq(dev->client->irq);
- } else {
- /* TX */
- ret = i2c_master_send(dev->client, mbo->virt_address,
- mbo->buffer_length);
- if (ret <= 0) {
- mbo->processed_length = 0;
- mbo->status = MBO_E_INVAL;
- } else {
- mbo->processed_length = mbo->buffer_length;
- mbo->status = MBO_SUCCESS;
- }
- mbo->complete(mbo);
- }
-
- return 0;
-}
-
-/**
- * poison_channel - called from MOST core to poison buffers of a channel
- * @most_iface: pointer to the interface the channel to be poisoned belongs to
- * @ch_idx: corresponding channel ID
- *
- * Return 0 on success, negative on failure.
- *
- * If channel direction is RX, complete the buffers in list with
- * status MBO_E_CLOSE
- */
-static int poison_channel(struct most_interface *most_iface,
- int ch_idx)
-{
- struct hdm_i2c *dev = to_hdm(most_iface);
- struct mbo *mbo;
-
- BUG_ON(ch_idx < 0 || ch_idx >= NUM_CHANNELS);
-
- if (ch_idx == CH_RX) {
- if (!polling_rate)
- free_irq(dev->client->irq, dev);
- cancel_delayed_work_sync(&dev->rx.dwork);
-
- while (!list_empty(&dev->rx.list)) {
- mbo = list_first_mbo(&dev->rx.list);
- list_del(&mbo->list);
-
- mbo->processed_length = 0;
- mbo->status = MBO_E_CLOSE;
- mbo->complete(mbo);
- }
- }
-
- return 0;
-}
-
-static void do_rx_work(struct hdm_i2c *dev)
-{
- struct mbo *mbo;
- unsigned char msg[MAX_BUF_SIZE_CONTROL];
- int ret;
- u16 pml, data_size;
-
- /* Read PML (2 bytes) */
- ret = i2c_master_recv(dev->client, msg, 2);
- if (ret <= 0) {
- pr_err("Failed to receive PML\n");
- return;
- }
-
- pml = (msg[0] << 8) | msg[1];
- if (!pml)
- return;
-
- data_size = pml + 2;
-
- /* Read the whole message, including PML */
- ret = i2c_master_recv(dev->client, msg, data_size);
- if (ret <= 0) {
- pr_err("Failed to receive a Port Message\n");
- return;
- }
-
- mbo = list_first_mbo(&dev->rx.list);
- list_del(&mbo->list);
-
- mbo->processed_length = min(data_size, mbo->buffer_length);
- memcpy(mbo->virt_address, msg, mbo->processed_length);
- mbo->status = MBO_SUCCESS;
- mbo->complete(mbo);
-}
-
-/**
- * pending_rx_work - Read pending messages through I2C
- * @work: definition of this work item
- *
- * Invoked by the Interrupt Service Routine, most_irq_handler()
- */
-static void pending_rx_work(struct work_struct *work)
-{
- struct hdm_i2c *dev = container_of(work, struct hdm_i2c, rx.dwork.work);
-
- if (list_empty(&dev->rx.list))
- return;
-
- do_rx_work(dev);
-
- if (polling_rate) {
- schedule_delayed_work(&dev->rx.dwork, dev->rx.delay);
- } else {
- dev->rx.int_disabled = false;
- enable_irq(dev->client->irq);
- }
-}
-
-/*
- * most_irq_handler - Interrupt Service Routine
- * @irq: irq number
- * @_dev: private data
- *
- * Schedules a delayed work
- *
- * By default the interrupt line behavior is Active Low. Once an interrupt is
- * generated by the device, until driver clears the interrupt (by reading
- * the PMP message), device keeps the interrupt line in low state. Since i2c
- * read is done in work queue, the interrupt line must be disabled temporarily
- * to avoid ISR being called repeatedly. Re-enable the interrupt in workqueue,
- * after reading the message.
- *
- * Note: If we use the interrupt line in Falling edge mode, there is a
- * possibility to miss interrupts when ISR is getting executed.
- *
- */
-static irqreturn_t most_irq_handler(int irq, void *_dev)
-{
- struct hdm_i2c *dev = _dev;
-
- disable_irq_nosync(irq);
- dev->rx.int_disabled = true;
- schedule_delayed_work(&dev->rx.dwork, 0);
-
- return IRQ_HANDLED;
-}
-
-/*
- * i2c_probe - i2c probe handler
- * @client: i2c client device structure
- * @id: i2c client device id
- *
- * Return 0 on success, negative on failure.
- *
- * Register the i2c client device as a MOST interface
- */
-static int i2c_probe(struct i2c_client *client)
-{
- struct hdm_i2c *dev;
- int ret, i;
-
- dev = kzalloc(sizeof(*dev), GFP_KERNEL);
- if (!dev)
- return -ENOMEM;
-
- /* ID format: i2c-<bus>-<address> */
- snprintf(dev->name, sizeof(dev->name), "i2c-%d-%04x",
- client->adapter->nr, client->addr);
-
- for (i = 0; i < NUM_CHANNELS; i++) {
- dev->capabilities[i].data_type = MOST_CH_CONTROL;
- dev->capabilities[i].num_buffers_packet = MAX_BUFFERS_CONTROL;
- dev->capabilities[i].buffer_size_packet = MAX_BUF_SIZE_CONTROL;
- }
- dev->capabilities[CH_RX].direction = MOST_CH_RX;
- dev->capabilities[CH_RX].name_suffix = "rx";
- dev->capabilities[CH_TX].direction = MOST_CH_TX;
- dev->capabilities[CH_TX].name_suffix = "tx";
-
- dev->most_iface.interface = ITYPE_I2C;
- dev->most_iface.description = dev->name;
- dev->most_iface.num_channels = NUM_CHANNELS;
- dev->most_iface.channel_vector = dev->capabilities;
- dev->most_iface.configure = configure_channel;
- dev->most_iface.enqueue = enqueue;
- dev->most_iface.poison_channel = poison_channel;
-
- INIT_LIST_HEAD(&dev->rx.list);
-
- INIT_DELAYED_WORK(&dev->rx.dwork, pending_rx_work);
-
- dev->client = client;
- i2c_set_clientdata(client, dev);
-
- ret = most_register_interface(&dev->most_iface);
- if (ret) {
- pr_err("Failed to register i2c as a MOST interface\n");
- kfree(dev);
- return ret;
- }
-
- return 0;
-}
-
-/*
- * i2c_remove - i2c remove handler
- * @client: i2c client device structure
- *
- * Return 0 on success.
- *
- * Unregister the i2c client device as a MOST interface
- */
-static void i2c_remove(struct i2c_client *client)
-{
- struct hdm_i2c *dev = i2c_get_clientdata(client);
-
- most_deregister_interface(&dev->most_iface);
- kfree(dev);
-}
-
-static const struct i2c_device_id i2c_id[] = {
- { "most_i2c" },
- { } /* Terminating entry */
-};
-
-MODULE_DEVICE_TABLE(i2c, i2c_id);
-
-static struct i2c_driver i2c_driver = {
- .driver = {
- .name = "hdm_i2c",
- },
- .probe = i2c_probe,
- .remove = i2c_remove,
- .id_table = i2c_id,
-};
-
-module_i2c_driver(i2c_driver);
-
-MODULE_AUTHOR("Andrey Shvetsov <andrey.shvetsov@k2l.de>");
-MODULE_DESCRIPTION("I2C Hardware Dependent Module");
-MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 233/614] iio: imu: bmi270: fix dev_err_probe error msg
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2025-12-16 11:09 ` [PATCH 6.18 232/614] staging: most: remove broken i2c driver Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 234/614] dt-bindings: PCI: amlogic: Fix the register name of the DBI region Greg Kroah-Hartman
` (394 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rodrigo Gobbi, Andy Shevchenko,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
[ Upstream commit 02f86101e430cce9a99a044b483c4ed5b91bb3b8 ]
The bmi270 can be connected to I2C or a SPI interface. If it is a SPI,
during probe, if devm_regmap_init() fails, it should print the "spi"
term rather "i2c".
Fixes: 92cc50a00574 ("iio: imu: bmi270: Add spi driver for bmi270 imu")
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/bmi270/bmi270_spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/imu/bmi270/bmi270_spi.c b/drivers/iio/imu/bmi270/bmi270_spi.c
index 19dd7734f9d07..80c9fa1d685ab 100644
--- a/drivers/iio/imu/bmi270/bmi270_spi.c
+++ b/drivers/iio/imu/bmi270/bmi270_spi.c
@@ -60,7 +60,7 @@ static int bmi270_spi_probe(struct spi_device *spi)
&bmi270_spi_regmap_config);
if (IS_ERR(regmap))
return dev_err_probe(dev, PTR_ERR(regmap),
- "Failed to init i2c regmap");
+ "Failed to init spi regmap\n");
return bmi270_core_probe(dev, regmap, chip_info);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 234/614] dt-bindings: PCI: amlogic: Fix the register name of the DBI region
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 233/614] iio: imu: bmi270: fix dev_err_probe error msg Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 235/614] RDMA/rtrs: server: Fix error handling in get_or_create_srv Greg Kroah-Hartman
` (393 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Manivannan Sadhasivam, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit 4813dea9e272ba0a57c50b8d51d440dd8e3ccdd7 ]
Binding incorrectly specifies the 'DBI' region as 'ELBI'. DBI is a must
have region for DWC controllers as it has the Root Port and controller
specific registers, while ELBI has optional registers.
Hence, fix the binding. Though this is an ABI break, this change is needed
to accurately describe the PCI memory map.
Fixes: 7cd210391101 ("dt-bindings: PCI: meson: add DT bindings for Amlogic Meson PCIe controller")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20251101-pci-meson-fix-v1-1-c50dcc56ed6a@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml b/Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml
index 79a21ba0f9fd6..c8258ef403283 100644
--- a/Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml
+++ b/Documentation/devicetree/bindings/pci/amlogic,axg-pcie.yaml
@@ -36,13 +36,13 @@ properties:
reg:
items:
- - description: External local bus interface registers
+ - description: Data Bus Interface registers
- description: Meson designed configuration registers
- description: PCIe configuration space
reg-names:
items:
- - const: elbi
+ - const: dbi
- const: cfg
- const: config
@@ -113,7 +113,7 @@ examples:
pcie: pcie@f9800000 {
compatible = "amlogic,axg-pcie", "snps,dw-pcie";
reg = <0xf9800000 0x400000>, <0xff646000 0x2000>, <0xf9f00000 0x100000>;
- reg-names = "elbi", "cfg", "config";
+ reg-names = "dbi", "cfg", "config";
interrupts = <GIC_SPI 177 IRQ_TYPE_EDGE_RISING>;
clocks = <&pclk>, <&clk_port>, <&clk_phy>;
clock-names = "pclk", "port", "general";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 235/614] RDMA/rtrs: server: Fix error handling in get_or_create_srv
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 234/614] dt-bindings: PCI: amlogic: Fix the register name of the DBI region Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 236/614] ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Greg Kroah-Hartman
` (392 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ma Ke, Jack Wang, Leon Romanovsky,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
[ Upstream commit a338d6e849ab31f32c08b4fcac11c0c72afbb150 ]
After device_initialize() is called, use put_device() to release the
device according to kernel device management rules. While direct
kfree() work in this case, using put_device() is more correct.
Found by code review.
Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://patch.msgid.link/20251110005158.13394-1-make24@iscas.ac.cn
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
index ef4abdea3c2d2..9ecc6343455d6 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
@@ -1450,7 +1450,7 @@ static struct rtrs_srv_sess *get_or_create_srv(struct rtrs_srv_ctx *ctx,
kfree(srv->chunks);
err_free_srv:
- kfree(srv);
+ put_device(&srv->dev);
return ERR_PTR(-ENOMEM);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 236/614] ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 235/614] RDMA/rtrs: server: Fix error handling in get_or_create_srv Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 237/614] coresight: tmc: add the handle of the event to the path Greg Kroah-Hartman
` (391 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Alexandre Torgue,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit e40b061cd379f4897e705d17cf1b4572ad0f3963 ]
Move st,adc-freq, st,mod-12b, st,ref-sel, and st,sample-time properties
from the touchscreen subnode to the parent touch@44 node. These properties
are defined in the st,stmpe.yaml schema for the parent node, not the
touchscreen subnode, resolving the validation error about unevaluated
properties.
Fixes: 27538a18a4fcc ("ARM: dts: stm32: add STM32MP1-based Phytec SoM")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://lore.kernel.org/r/20250915224611.169980-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi b/arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi
index bf0c32027baf7..370b2afbf15bf 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi
@@ -185,13 +185,13 @@ touch@44 {
interrupt-parent = <&gpioi>;
vio-supply = <&v3v3>;
vcc-supply = <&v3v3>;
+ st,sample-time = <4>;
+ st,mod-12b = <1>;
+ st,ref-sel = <0>;
+ st,adc-freq = <1>;
touchscreen {
compatible = "st,stmpe-ts";
- st,sample-time = <4>;
- st,mod-12b = <1>;
- st,ref-sel = <0>;
- st,adc-freq = <1>;
st,ave-ctrl = <1>;
st,touch-det-delay = <2>;
st,settling = <2>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 237/614] coresight: tmc: add the handle of the event to the path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 236/614] ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 238/614] ntfs3: init run lock for extend inode Greg Kroah-Hartman
` (390 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carl Worth, Leo Yan, Jie Gan,
Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carl Worth <carl@os.amperecomputing.com>
[ Upstream commit aaa5abcc9d44d2c8484f779ab46d242d774cabcb ]
The handle is essential for retrieving the AUX_EVENT of each CPU and is
required in perf mode. It has been added to the coresight_path so that
dependent devices can access it from the path when needed.
The existing bug can be reproduced with:
perf record -e cs_etm//k -C 0-9 dd if=/dev/zero of=/dev/null
Showing an oops as follows:
Unable to handle kernel paging request at virtual address 000f6e84934ed19e
Call trace:
tmc_etr_get_buffer+0x30/0x80 [coresight_tmc] (P)
catu_enable_hw+0xbc/0x3d0 [coresight_catu]
catu_enable+0x70/0xe0 [coresight_catu]
coresight_enable_path+0xb0/0x258 [coresight]
Fixes: 080ee83cc361 ("Coresight: Change functions to accept the coresight_path")
Signed-off-by: Carl Worth <carl@os.amperecomputing.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Co-developed-by: Jie Gan <jie.gan@oss.qualcomm.com>
Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20250925-fix_helper_data-v2-1-edd8a07c1646@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 ++-
include/linux/coresight.h | 10 ++++++----
3 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
index f677c08233ba1..5c256af6e54af 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -520,6 +520,7 @@ static void etm_event_start(struct perf_event *event, int flags)
goto out;
path = etm_event_cpu_path(event_data, cpu);
+ path->handle = handle;
/* We need a sink, no need to continue without one */
sink = coresight_get_sink(path);
if (WARN_ON_ONCE(!sink))
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index 800be06598c1b..60b0e0a6da057 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -1334,7 +1334,8 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
struct etr_buf *tmc_etr_get_buffer(struct coresight_device *csdev,
enum cs_mode mode, void *data)
{
- struct perf_output_handle *handle = data;
+ struct coresight_path *path = data;
+ struct perf_output_handle *handle = path->handle;
struct etr_perf_buffer *etr_perf;
switch (mode) {
diff --git a/include/linux/coresight.h b/include/linux/coresight.h
index 6de59ce8ef8ca..2626105e37191 100644
--- a/include/linux/coresight.h
+++ b/include/linux/coresight.h
@@ -332,12 +332,14 @@ static struct coresight_dev_list (var) = { \
/**
* struct coresight_path - data needed by enable/disable path
- * @path_list: path from source to sink.
- * @trace_id: trace_id of the whole path.
+ * @path_list: path from source to sink.
+ * @trace_id: trace_id of the whole path.
+ * @handle: handle of the aux_event.
*/
struct coresight_path {
- struct list_head path_list;
- u8 trace_id;
+ struct list_head path_list;
+ u8 trace_id;
+ struct perf_output_handle *handle;
};
enum cs_mode {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 238/614] ntfs3: init run lock for extend inode
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 237/614] coresight: tmc: add the handle of the event to the path Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 239/614] drm/panthor: Fix potential memleak of vma structure Greg Kroah-Hartman
` (389 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+bdeb22a4b9a09ab9aa45,
Edward Adam Davis, Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit be99c62ac7e7af514e4b13f83c891a3cccefaa48 ]
After setting the inode mode of $Extend to a regular file, executing the
truncate system call will enter the do_truncate() routine, causing the
run_lock uninitialized error reported by syzbot.
Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to
a regular file, the do_truncate() routine would not be entered.
Add the run_lock initialization when loading $Extend.
syzbot reported:
INFO: trying to register non-static key.
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984
register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299
__lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112
lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868
down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590
ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860
ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387
ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808
Fixes: 4e8011ffec79 ("ntfs3: pretend $Extend records as regular files")
Reported-by: syzbot+bdeb22a4b9a09ab9aa45@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bdeb22a4b9a09ab9aa45
Tested-by: syzbot+bdeb22a4b9a09ab9aa45@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 3a0676871bade..05004f8880ce6 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -472,6 +472,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
/* Records in $Extend are not a files or general directories. */
inode->i_op = &ntfs_file_inode_operations;
mode = S_IFREG;
+ init_rwsem(&ni->file.run_lock);
} else {
err = -EINVAL;
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 239/614] drm/panthor: Fix potential memleak of vma structure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 238/614] ntfs3: init run lock for extend inode Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 240/614] scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Greg Kroah-Hartman
` (388 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akash Goel, Boris Brezillon,
Steven Price, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash Goel <akash.goel@arm.com>
[ Upstream commit 4492d54d59872bb72e119ff9f77969ab4d8a0e6b ]
This commit addresses a memleak issue of panthor_vma (or drm_gpuva)
structure in Panthor driver, that can happen if the GPU page table
update operation to map the pages fail.
The issue is very unlikely to occur in practice.
v2: Add panthor_vm_op_ctx_return_vma() helper (Boris)
v3: Add WARN_ON_ONCE (Boris)
Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
Signed-off-by: Akash Goel <akash.goel@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251021081042.1377406-1-akash.goel@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_mmu.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
index 7870e7dbaa5d4..15961629872e1 100644
--- a/drivers/gpu/drm/panthor/panthor_mmu.c
+++ b/drivers/gpu/drm/panthor/panthor_mmu.c
@@ -1146,6 +1146,20 @@ static void panthor_vm_cleanup_op_ctx(struct panthor_vm_op_ctx *op_ctx,
}
}
+static void
+panthor_vm_op_ctx_return_vma(struct panthor_vm_op_ctx *op_ctx,
+ struct panthor_vma *vma)
+{
+ for (u32 i = 0; i < ARRAY_SIZE(op_ctx->preallocated_vmas); i++) {
+ if (!op_ctx->preallocated_vmas[i]) {
+ op_ctx->preallocated_vmas[i] = vma;
+ return;
+ }
+ }
+
+ WARN_ON_ONCE(1);
+}
+
static struct panthor_vma *
panthor_vm_op_ctx_get_vma(struct panthor_vm_op_ctx *op_ctx)
{
@@ -2085,8 +2099,10 @@ static int panthor_gpuva_sm_step_map(struct drm_gpuva_op *op, void *priv)
ret = panthor_vm_map_pages(vm, op->map.va.addr, flags_to_prot(vma->flags),
op_ctx->map.sgt, op->map.gem.offset,
op->map.va.range);
- if (ret)
+ if (ret) {
+ panthor_vm_op_ctx_return_vma(op_ctx, vma);
return ret;
+ }
/* Ref owned by the mapping now, clear the obj field so we don't release the
* pinning/obj ref behind GPUVA's back.
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 240/614] scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 239/614] drm/panthor: Fix potential memleak of vma structure Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 241/614] md: delete md_redundancy_group when array is becoming inactive Greg Kroah-Hartman
` (387 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avri Altman, Bart Van Assche,
Bean Huo, Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bean Huo <beanhuo@micron.com>
[ Upstream commit d794b499f948801f54d67ddbc34a6eac5a6d150a ]
The function ufshcd_read_string_desc() was duplicating memory starting
from the beginning of struct uc_string_id, which included the length and
type fields. As a result, the allocated buffer contained unwanted
metadata in addition to the string itself.
The correct behavior is to duplicate only the Unicode character array in
the structure. Update the code so that only the actual string content is
copied into the new buffer.
Fixes: 5f57704dbcfe ("scsi: ufs: Use kmemdup in ufshcd_read_string_desc()")
Reviewed-by: Avri Altman <avri.altman@sandisk.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Bean Huo <beanhuo@micron.com>
Link: https://patch.msgid.link/20251107230518.4060231-3-beanhuo@iokpp.de
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index d6a060a724618..12f5a7a973128 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -3837,7 +3837,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index,
str[ret++] = '\0';
} else {
- str = kmemdup(uc_str, uc_str->len, GFP_KERNEL);
+ str = kmemdup(uc_str->uc, uc_str->len, GFP_KERNEL);
if (!str) {
ret = -ENOMEM;
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 241/614] md: delete md_redundancy_group when array is becoming inactive
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 240/614] scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 242/614] md: init bioset in mddev_init Greg Kroah-Hartman
` (386 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Xiao Ni, Yu Kuai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 0ce112d9171ad766d4c6716951e73f91a0bfc184 ]
'md_redundancy_group' are created in md_run() and deleted in del_gendisk(),
but these are not paired. Writing inactive/active to sysfs array_state can
trigger md_run() multiple times without del_gendisk(), leading to
duplicate creation as below:
sysfs: cannot create duplicate filename '/devices/virtual/block/md0/md/sync_action'
Call Trace:
dump_stack_lvl+0x9f/0x120
dump_stack+0x14/0x20
sysfs_warn_dup+0x96/0xc0
sysfs_add_file_mode_ns+0x19c/0x1b0
internal_create_group+0x213/0x830
sysfs_create_group+0x17/0x20
md_run+0x856/0xe60
? __x64_sys_openat+0x23/0x30
do_md_run+0x26/0x1d0
array_state_store+0x559/0x760
md_attr_store+0xc9/0x1e0
sysfs_kf_write+0x6f/0xa0
kernfs_fop_write_iter+0x141/0x2a0
vfs_write+0x1fc/0x5a0
ksys_write+0x79/0x180
__x64_sys_write+0x1d/0x30
x64_sys_call+0x2818/0x2880
do_syscall_64+0xa9/0x580
entry_SYSCALL_64_after_hwframe+0x4b/0x53
md: cannot register extra attributes for md0
Creation of it depends on 'pers', its lifecycle cannot be aligned with
gendisk. So fix this issue by triggering 'md_redundancy_group' deletion
when the array is becoming inactive.
Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-2-linan666@huaweicloud.com
Fixes: 790abe4d77af ("md: remove/add redundancy group only in level change")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5d40beaecc9c7..7b21eb1dbc533 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6872,6 +6872,10 @@ static int do_md_stop(struct mddev *mddev, int mode)
if (!md_is_rdwr(mddev))
set_disk_ro(disk, 0);
+ if (mode == 2 && mddev->pers->sync_request &&
+ mddev->to_remove == NULL)
+ mddev->to_remove = &md_redundancy_group;
+
__md_stop_writes(mddev);
__md_stop(mddev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 242/614] md: init bioset in mddev_init
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 241/614] md: delete md_redundancy_group when array is becoming inactive Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 243/614] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Greg Kroah-Hartman
` (385 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Nan, Xiao Ni, Yu Kuai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 381a3ce1c0ffed647c9b913e142b099c7e9d5afc ]
IO operations may be needed before md_run(), such as updating metadata
after writing sysfs. Without bioset, this triggers a NULL pointer
dereference as below:
BUG: kernel NULL pointer dereference, address: 0000000000000020
Call Trace:
md_update_sb+0x658/0xe00
new_level_store+0xc5/0x120
md_attr_store+0xc9/0x1e0
sysfs_kf_write+0x6f/0xa0
kernfs_fop_write_iter+0x141/0x2a0
vfs_write+0x1fc/0x5a0
ksys_write+0x79/0x180
__x64_sys_write+0x1d/0x30
x64_sys_call+0x2818/0x2880
do_syscall_64+0xa9/0x580
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Reproducer
```
mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd]
echo inactive > /sys/block/md0/md/array_state
echo 10 > /sys/block/md0/md/new_level
```
mddev_init() can only be called once per mddev, no need to test if bioset
has been initialized anymore.
Link: https://lore.kernel.org/linux-raid/20251103125757.1405796-3-linan666@huaweicloud.com
Fixes: d981ed841930 ("md: Add new_level sysfs interface")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md.c | 69 +++++++++++++++++++++++--------------------------
1 file changed, 33 insertions(+), 36 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 7b21eb1dbc533..cef5b2954ac5a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -730,6 +730,8 @@ static void mddev_clear_bitmap_ops(struct mddev *mddev)
int mddev_init(struct mddev *mddev)
{
+ int err = 0;
+
if (!IS_ENABLED(CONFIG_MD_BITMAP))
mddev->bitmap_id = ID_BITMAP_NONE;
else
@@ -741,10 +743,23 @@ int mddev_init(struct mddev *mddev)
if (percpu_ref_init(&mddev->writes_pending, no_op,
PERCPU_REF_ALLOW_REINIT, GFP_KERNEL)) {
- percpu_ref_exit(&mddev->active_io);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto exit_acitve_io;
}
+ err = bioset_init(&mddev->bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
+ if (err)
+ goto exit_writes_pending;
+
+ err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
+ if (err)
+ goto exit_bio_set;
+
+ err = bioset_init(&mddev->io_clone_set, BIO_POOL_SIZE,
+ offsetof(struct md_io_clone, bio_clone), 0);
+ if (err)
+ goto exit_sync_set;
+
/* We want to start with the refcount at zero */
percpu_ref_put(&mddev->writes_pending);
@@ -773,11 +788,24 @@ int mddev_init(struct mddev *mddev)
INIT_WORK(&mddev->del_work, mddev_delayed_delete);
return 0;
+
+exit_sync_set:
+ bioset_exit(&mddev->sync_set);
+exit_bio_set:
+ bioset_exit(&mddev->bio_set);
+exit_writes_pending:
+ percpu_ref_exit(&mddev->writes_pending);
+exit_acitve_io:
+ percpu_ref_exit(&mddev->active_io);
+ return err;
}
EXPORT_SYMBOL_GPL(mddev_init);
void mddev_destroy(struct mddev *mddev)
{
+ bioset_exit(&mddev->bio_set);
+ bioset_exit(&mddev->sync_set);
+ bioset_exit(&mddev->io_clone_set);
percpu_ref_exit(&mddev->active_io);
percpu_ref_exit(&mddev->writes_pending);
}
@@ -6387,29 +6415,9 @@ int md_run(struct mddev *mddev)
nowait = nowait && bdev_nowait(rdev->bdev);
}
- if (!bioset_initialized(&mddev->bio_set)) {
- err = bioset_init(&mddev->bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
- if (err)
- return err;
- }
- if (!bioset_initialized(&mddev->sync_set)) {
- err = bioset_init(&mddev->sync_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
- if (err)
- goto exit_bio_set;
- }
-
- if (!bioset_initialized(&mddev->io_clone_set)) {
- err = bioset_init(&mddev->io_clone_set, BIO_POOL_SIZE,
- offsetof(struct md_io_clone, bio_clone), 0);
- if (err)
- goto exit_sync_set;
- }
-
pers = get_pers(mddev->level, mddev->clevel);
- if (!pers) {
- err = -EINVAL;
- goto abort;
- }
+ if (!pers)
+ return -EINVAL;
if (mddev->level != pers->head.id) {
mddev->level = pers->head.id;
mddev->new_level = pers->head.id;
@@ -6420,8 +6428,7 @@ int md_run(struct mddev *mddev)
pers->start_reshape == NULL) {
/* This personality cannot handle reshaping... */
put_pers(pers);
- err = -EINVAL;
- goto abort;
+ return -EINVAL;
}
if (pers->sync_request) {
@@ -6548,12 +6555,6 @@ int md_run(struct mddev *mddev)
mddev->private = NULL;
put_pers(pers);
md_bitmap_destroy(mddev);
-abort:
- bioset_exit(&mddev->io_clone_set);
-exit_sync_set:
- bioset_exit(&mddev->sync_set);
-exit_bio_set:
- bioset_exit(&mddev->bio_set);
return err;
}
EXPORT_SYMBOL_GPL(md_run);
@@ -6778,10 +6779,6 @@ static void __md_stop(struct mddev *mddev)
mddev->private = NULL;
put_pers(pers);
clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-
- bioset_exit(&mddev->bio_set);
- bioset_exit(&mddev->sync_set);
- bioset_exit(&mddev->io_clone_set);
}
void md_stop(struct mddev *mddev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 243/614] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 242/614] md: init bioset in mddev_init Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 244/614] powerpc/kdump: Fix size calculation for hot-removed memory ranges Greg Kroah-Hartman
` (384 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello (AMD) (kernel.org),
Gautham R. Shenoy, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gautham R. Shenoy <gautham.shenoy@amd.com>
[ Upstream commit bb31fef0d03ed17d587b40e3458786be408fb9df ]
amd_pstate_change_mode_without_dvr_change() calls cppc_set_auto_sel()
for all the present CPUs.
However, this callpath eventually calls cppc_set_reg_val() which
accesses the per-cpu cpc_desc_ptr object. This object is initialized
only for online CPUs via acpi_soft_cpu_online() -->
__acpi_processor_start() --> acpi_cppc_processor_probe().
Hence, restrict calling cppc_set_auto_sel() to only the online CPUs.
Fixes: 3ca7bc818d8c ("cpufreq: amd-pstate: Add guided mode control support via sysfs")
Suggested-by: Mario Limonciello (AMD) (kernel.org) <superm1@kernel.org>
Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/amd-pstate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
index b44f0f7a5ba1c..602e4fa81d6c5 100644
--- a/drivers/cpufreq/amd-pstate.c
+++ b/drivers/cpufreq/amd-pstate.c
@@ -1282,7 +1282,7 @@ static int amd_pstate_change_mode_without_dvr_change(int mode)
if (cpu_feature_enabled(X86_FEATURE_CPPC) || cppc_state == AMD_PSTATE_ACTIVE)
return 0;
- for_each_present_cpu(cpu) {
+ for_each_online_cpu(cpu) {
cppc_set_auto_sel(cpu, (cppc_state == AMD_PSTATE_PASSIVE) ? 0 : 1);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 244/614] powerpc/kdump: Fix size calculation for hot-removed memory ranges
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 243/614] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 245/614] powerpc/32: Fix unpaired stwcx. on interrupt exit Greg Kroah-Hartman
` (383 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shirisha G, Sourabh Jain,
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <sourabhjain@linux.ibm.com>
[ Upstream commit 7afe2383eff05f76f4ce2cfda658b7889c89f101 ]
The elfcorehdr segment in the kdump image stores information about the
memory regions (called crash memory ranges) that the kdump kernel must
capture.
When a memory hot-remove event occurs, the kernel regenerates the
elfcorehdr for the currently loaded kdump image to remove the
hot-removed memory from the crash memory ranges.
Call chain:
remove_mem_range()
update_crash_elfcorehdr()
arch_crash_handle_hotplug_event()
crash_handle_hotplug_event()
While removing the hot-removed memory from the crash memory ranges in
remove_mem_range(), if the removed memory lies within an existing crash
range, that range is split into two. During this split, the size of the
second range was being calculated incorrectly.
This leads to dump capture failure with makedumpfile with below error:
$ makedumpfile -l -d 31 /proc/vmcore /tmp/vmcore
readpage_elf: Attempt to read non-existent page at 0xbbdab0000.
readmem: type_addr: 0, addr:c000000bbdab7f00, size:16
validate_mem_section: Can't read mem_section array.
readpage_elf: Attempt to read non-existent page at 0xbbdab0000.
readmem: type_addr: 0, addr:c000000bbdab7f00, size:8
get_mm_sparsemem: Can't get the address of mem_section.
The updated crash memory range in PT_LOAD entry is holding incorrect
data (checkout FileSiz and MemSiz):
readelf -a /proc/vmcore
<snip...>
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000b013d0000 0xc000000b80000000 0x0000000b80000000
0xffffffffc0000000 0xffffffffc0000000 RWE 0x0
<snip...>
Update the size calculation for the new crash memory range to fix this
issue.
Note: This problem will not occur if the kdump kernel is loaded or
reloaded after a memory hot-remove operation.
Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support")
Reported-by: Shirisha G <shirisha@linux.ibm.com>
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20251105033941.1752287-1-sourabhjain@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kexec/ranges.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kexec/ranges.c b/arch/powerpc/kexec/ranges.c
index 3702b0bdab141..426bdca4667e7 100644
--- a/arch/powerpc/kexec/ranges.c
+++ b/arch/powerpc/kexec/ranges.c
@@ -697,8 +697,8 @@ int remove_mem_range(struct crash_mem **mem_ranges, u64 base, u64 size)
* two half.
*/
else {
+ size = mem_rngs->ranges[i].end - end + 1;
mem_rngs->ranges[i].end = base - 1;
- size = mem_rngs->ranges[i].end - end;
ret = add_mem_range(mem_ranges, end + 1, size);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 245/614] powerpc/32: Fix unpaired stwcx. on interrupt exit
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 244/614] powerpc/kdump: Fix size calculation for hot-removed memory ranges Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 246/614] macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Greg Kroah-Hartman
` (382 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy,
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 10e1c77c3636d815db802ceef588522c2d2d947c ]
Commit b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C
exception exit from ppc64") erroneouly copied to powerpc/32 the logic
from powerpc/64 based on feature CPU_FTR_STCX_CHECKS_ADDRESS which is
always 0 on powerpc/32.
Re-instate the logic implemented by commit b64f87c16f3c ("[POWERPC]
Avoid unpaired stwcx. on some processors") which is based on
CPU_FTR_NEED_PAIRED_STWCX feature.
Fixes: b96bae3ae2cb ("powerpc/32: Replace ASM exception exit by C exception exit from ppc64")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/6040b5dbcf5cdaa1cd919fcf0790f12974ea6e5a.1757666244.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/entry_32.S | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index f4a8c98772491..1beb578c64114 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -263,10 +263,9 @@ interrupt_return:
mtspr SPRN_SRR1,r12
BEGIN_FTR_SECTION
+ lwarx r0,0,r1
+END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX)
stwcx. r0,0,r1 /* to clear the reservation */
-FTR_SECTION_ELSE
- lwarx r0,0,r1
-ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS)
lwz r3,_CCR(r1)
lwz r4,_LINK(r1)
@@ -306,10 +305,9 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS)
mtspr SPRN_SRR1,r12
BEGIN_FTR_SECTION
+ lwarx r0,0,r1
+END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRED_STWCX)
stwcx. r0,0,r1 /* to clear the reservation */
-FTR_SECTION_ELSE
- lwarx r0,0,r1
-ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS)
lwz r3,_LINK(r1)
lwz r4,_CTR(r1)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 246/614] macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 245/614] powerpc/32: Fix unpaired stwcx. on interrupt exit Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 247/614] wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() Greg Kroah-Hartman
` (381 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Madhavan Srinivasan,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <leo.lilong@huawei.com>
[ Upstream commit 1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f ]
The following warning appears when running syzkaller, and this issue also
exists in the mainline code.
------------[ cut here ]------------
list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.
WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130
Modules linked in:
CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:__list_add_valid_or_report+0xf7/0x130
RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817
RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001
RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c
R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100
R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48
FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 80000000
Call Trace:
<TASK>
input_register_handler+0xb3/0x210
mac_hid_start_emulation+0x1c5/0x290
mac_hid_toggle_emumouse+0x20a/0x240
proc_sys_call_handler+0x4c2/0x6e0
new_sync_write+0x1b1/0x2d0
vfs_write+0x709/0x950
ksys_write+0x12a/0x250
do_syscall_64+0x5a/0x110
entry_SYSCALL_64_after_hwframe+0x78/0xe2
The WARNING occurs when two processes concurrently write to the mac-hid
emulation sysctl, causing a race condition in mac_hid_toggle_emumouse().
Both processes read old_val=0, then both try to register the input handler,
leading to a double list_add of the same handler.
CPU0 CPU1
------------------------- -------------------------
vfs_write() //write 1 vfs_write() //write 1
proc_sys_write() proc_sys_write()
mac_hid_toggle_emumouse() mac_hid_toggle_emumouse()
old_val = *valp // old_val=0
old_val = *valp // old_val=0
mutex_lock_killable()
proc_dointvec() // *valp=1
mac_hid_start_emulation()
input_register_handler()
mutex_unlock()
mutex_lock_killable()
proc_dointvec()
mac_hid_start_emulation()
input_register_handler() //Trigger Warning
mutex_unlock()
Fix this by moving the old_val read inside the mutex lock region.
Fixes: 99b089c3c38a ("Input: Mac button emulation - implement as an input filter")
Signed-off-by: Long Li <leo.lilong@huawei.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250819091035.2263329-1-leo.lilong@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/macintosh/mac_hid.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/macintosh/mac_hid.c b/drivers/macintosh/mac_hid.c
index 369d72f59b3c1..06fd910b3fd1a 100644
--- a/drivers/macintosh/mac_hid.c
+++ b/drivers/macintosh/mac_hid.c
@@ -187,13 +187,14 @@ static int mac_hid_toggle_emumouse(const struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
int *valp = table->data;
- int old_val = *valp;
+ int old_val;
int rc;
rc = mutex_lock_killable(&mac_hid_emumouse_mutex);
if (rc)
return rc;
+ old_val = *valp;
rc = proc_dointvec(table, write, buffer, lenp, ppos);
if (rc == 0 && write && *valp != old_val) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 247/614] wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 246/614] macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 248/614] nbd: defer config unlock in nbd_genl_connect Greg Kroah-Hartman
` (380 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Johannes Berg,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 5e88e864118c20e63a1571d0ff0a152e5d684959 ]
In one of the error paths, the memory allocated for skb_rx is not freed.
Fix that by freeing it before returning.
Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20251110175316.106591-1-nihaal@cse.iitm.ac.in
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/st/cw1200/bh.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/st/cw1200/bh.c b/drivers/net/wireless/st/cw1200/bh.c
index 3b4ded2ac801c..37232ee220375 100644
--- a/drivers/net/wireless/st/cw1200/bh.c
+++ b/drivers/net/wireless/st/cw1200/bh.c
@@ -317,10 +317,12 @@ static int cw1200_bh_rx_helper(struct cw1200_common *priv,
if (wsm_id & 0x0400) {
int rc = wsm_release_tx_buffer(priv, 1);
- if (WARN_ON(rc < 0))
+ if (WARN_ON(rc < 0)) {
+ dev_kfree_skb(skb_rx);
return rc;
- else if (rc > 0)
+ } else if (rc > 0) {
*tx = 1;
+ }
}
/* cw1200_wsm_rx takes care on SKB livetime */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 248/614] nbd: defer config unlock in nbd_genl_connect
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 247/614] wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 249/614] net: export netdev_get_by_index_lock() Greg Kroah-Hartman
` (379 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Qixing, Yu Kuai, Jens Axboe,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Qixing <zhengqixing@huawei.com>
[ Upstream commit 1649714b930f9ea6233ce0810ba885999da3b5d4 ]
There is one use-after-free warning when running NBD_CMD_CONNECT and
NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1
close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290
nbd_genl_connect+0x16d0/0x1ab0
genl_family_rcv_msg_doit+0x1f3/0x310
genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced by adding a small delay before
refcount_inc(&nbd->config_refs) in nbd_genl_connect():
mutex_unlock(&nbd->config_lock);
if (!ret) {
set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);
+ printk("before sleep\n");
+ mdelay(5 * 1000);
+ printk("after sleep\n");
refcount_inc(&nbd->config_refs);
nbd_connect_reply(info, nbd->index);
}
Fixes: e46c7287b1c2 ("nbd: add a basic netlink interface")
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/nbd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 215fc18115b78..a05ff68e58d06 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -2241,12 +2241,13 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
ret = nbd_start_device(nbd);
out:
- mutex_unlock(&nbd->config_lock);
if (!ret) {
set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);
refcount_inc(&nbd->config_refs);
nbd_connect_reply(info, nbd->index);
}
+ mutex_unlock(&nbd->config_lock);
+
nbd_config_put(nbd);
if (put_dev)
nbd_put(nbd);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 249/614] net: export netdev_get_by_index_lock()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 248/614] nbd: defer config unlock in nbd_genl_connect Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 250/614] io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock Greg Kroah-Hartman
` (378 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Wei, Jakub Kicinski,
Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wei <dw@davidwei.uk>
[ Upstream commit c07a491c1b735e0c27454ea5c27a446d43401b1e ]
Need to call netdev_get_by_index_lock() from io_uring/zcrx.c, but it is
currently private to net. Export the function in linux/netdevice.h.
Signed-off-by: David Wei <dw@davidwei.uk>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: b6c5f9454ef3 ("io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/netdevice.h | 1 +
net/core/dev.h | 1 -
2 files changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d1a687444b275..77c46a2823eca 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3401,6 +3401,7 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex);
struct net_device *__dev_get_by_index(struct net *net, int ifindex);
struct net_device *netdev_get_by_index(struct net *net, int ifindex,
netdevice_tracker *tracker, gfp_t gfp);
+struct net_device *netdev_get_by_index_lock(struct net *net, int ifindex);
struct net_device *netdev_get_by_name(struct net *net, const char *name,
netdevice_tracker *tracker, gfp_t gfp);
struct net_device *netdev_get_by_flags_rcu(struct net *net, netdevice_tracker *tracker,
diff --git a/net/core/dev.h b/net/core/dev.h
index 900880e8b5b4b..df8a90fe89f8f 100644
--- a/net/core/dev.h
+++ b/net/core/dev.h
@@ -29,7 +29,6 @@ struct napi_struct *
netdev_napi_by_id_lock(struct net *net, unsigned int napi_id);
struct net_device *dev_get_by_napi_id(unsigned int napi_id);
-struct net_device *netdev_get_by_index_lock(struct net *net, int ifindex);
struct net_device *__netdev_put_lock(struct net_device *dev, struct net *net);
struct net_device *
netdev_xa_find_lock(struct net *net, struct net_device *dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 250/614] io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 249/614] net: export netdev_get_by_index_lock() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 251/614] fs/ntfs3: Initialize allocated memory before use Greg Kroah-Hartman
` (377 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Wei, Pavel Begunkov,
Jakub Kicinski, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wei <dw@davidwei.uk>
[ Upstream commit b6c5f9454ef34fd2753ba7843ef4d9a295c43eee ]
netdev ops must be called under instance lock or rtnl_lock, but
io_register_zcrx_ifq() isn't doing this for netdev_queue_get_dma_dev().
Fix this by taking the instance lock using netdev_get_by_index_lock().
Extended the instance lock section to include attaching a memory
provider. Could not move io_zcrx_create_area() outside, since the dmabuf
codepath IORING_ZCRX_AREA_DMABUF requires ifq->dev.
Fixes: 59b8b32ac8d4 ("io_uring/zcrx: add support for custom DMA devices")
Signed-off-by: David Wei <dw@davidwei.uk>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/zcrx.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index b1b723222cdb8..875ad40cf6591 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -599,29 +599,30 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
if (ret)
goto err;
- ifq->netdev = netdev_get_by_index(current->nsproxy->net_ns, reg.if_idx,
- &ifq->netdev_tracker, GFP_KERNEL);
+ ifq->netdev = netdev_get_by_index_lock(current->nsproxy->net_ns, reg.if_idx);
if (!ifq->netdev) {
ret = -ENODEV;
goto err;
}
+ netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);
ifq->dev = netdev_queue_get_dma_dev(ifq->netdev, reg.if_rxq);
if (!ifq->dev) {
ret = -EOPNOTSUPP;
- goto err;
+ goto netdev_put_unlock;
}
get_device(ifq->dev);
ret = io_zcrx_create_area(ifq, &area);
if (ret)
- goto err;
+ goto netdev_put_unlock;
mp_param.mp_ops = &io_uring_pp_zc_ops;
mp_param.mp_priv = ifq;
- ret = net_mp_open_rxq(ifq->netdev, reg.if_rxq, &mp_param);
+ ret = __net_mp_open_rxq(ifq->netdev, reg.if_rxq, &mp_param, NULL);
if (ret)
- goto err;
+ goto netdev_put_unlock;
+ netdev_unlock(ifq->netdev);
ifq->if_rxq = reg.if_rxq;
reg.zcrx_id = id;
@@ -640,6 +641,9 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
goto err;
}
return 0;
+netdev_put_unlock:
+ netdev_put(ifq->netdev, &ifq->netdev_tracker);
+ netdev_unlock(ifq->netdev);
err:
scoped_guard(mutex, &ctx->mmap_lock)
xa_erase(&ctx->zcrx_ctxs, id);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 251/614] fs/ntfs3: Initialize allocated memory before use
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 250/614] io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 252/614] coresight: Change device mode to atomic type Greg Kroah-Hartman
` (376 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+332bd4e9d148f11a87dc,
syzbot+0399100e525dd9696764, Khalid Aziz, Bartlomiej Kubik,
Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
[ Upstream commit a8a3ca23bbd9d849308a7921a049330dc6c91398 ]
KMSAN reports: Multiple uninitialized values detected:
- KMSAN: uninit-value in ntfs_read_hdr (3)
- KMSAN: uninit-value in bcmp (3)
Memory is allocated by __getname(), which is a wrapper for
kmem_cache_alloc(). This memory is used before being properly
cleared. Change kmem_cache_alloc() to kmem_cache_zalloc() to
properly allocate and clear memory before use.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations")
Tested-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com
Reported-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=332bd4e9d148f11a87dc
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations")
Tested-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com
Reported-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0399100e525dd9696764
Reviewed-by: Khalid Aziz <khalid@kernel.org>
Signed-off-by: Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 05004f8880ce6..164fd63dff40d 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -1279,7 +1279,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
fa |= FILE_ATTRIBUTE_READONLY;
/* Allocate PATH_MAX bytes. */
- new_de = __getname();
+ new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
if (!new_de) {
err = -ENOMEM;
goto out1;
@@ -1720,10 +1720,9 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry)
struct NTFS_DE *de;
/* Allocate PATH_MAX bytes. */
- de = __getname();
+ de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
if (!de)
return -ENOMEM;
- memset(de, 0, PATH_MAX);
/* Mark rw ntfs as dirty. It will be cleared at umount. */
ntfs_set_state(sbi, NTFS_DIRTY_DIRTY);
@@ -1759,7 +1758,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry)
return -EINVAL;
/* Allocate PATH_MAX bytes. */
- de = __getname();
+ de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
if (!de)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 252/614] coresight: Change device mode to atomic type
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 251/614] fs/ntfs3: Initialize allocated memory before use Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 253/614] coresight: etm4x: Always set tracers device mode on target CPU Greg Kroah-Hartman
` (375 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Leach, James Clark, Leo Yan,
Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 693d1eaca940f277af24c74873ef2313816ff444 ]
The device mode is defined as local type. This type cannot promise
SMP-safe access.
Change to atomic type and impose relax ordering, which ensures the
SMP-safe synchronisation and the ordering between the mode setting and
relevant operations.
Fixes: 22fd532eaa0c ("coresight: etm3x: adding operation mode for etm_enable()")
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-1-f55553b6c8b3@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/coresight.h | 25 +++++++++++--------------
1 file changed, 11 insertions(+), 14 deletions(-)
diff --git a/include/linux/coresight.h b/include/linux/coresight.h
index 2626105e37191..fafc9ec13f9f4 100644
--- a/include/linux/coresight.h
+++ b/include/linux/coresight.h
@@ -251,15 +251,11 @@ struct coresight_trace_id_map {
* by @coresight_ops.
* @access: Device i/o access abstraction for this device.
* @dev: The device entity associated to this component.
- * @mode: This tracer's mode, i.e sysFS, Perf or disabled. This is
- * actually an 'enum cs_mode', but is stored in an atomic type.
- * This is always accessed through local_read() and local_set(),
- * but wherever it's done from within the Coresight device's lock,
- * a non-atomic read would also work. This is the main point of
- * synchronisation between code happening inside the sysfs mode's
- * coresight_mutex and outside when running in Perf mode. A compare
- * and exchange swap is done to atomically claim one mode or the
- * other.
+ * @mode: The device mode, i.e sysFS, Perf or disabled. This is actually
+ * an 'enum cs_mode' but stored in an atomic type. Access is always
+ * through atomic APIs, ensuring SMP-safe synchronisation between
+ * racing from sysFS and Perf mode. A compare-and-exchange
+ * operation is done to atomically claim one mode or the other.
* @refcnt: keep track of what is in use. Only access this outside of the
* device's spinlock when the coresight_mutex held and mode ==
* CS_MODE_SYSFS. Otherwise it must be accessed from inside the
@@ -288,7 +284,7 @@ struct coresight_device {
const struct coresight_ops *ops;
struct csdev_access access;
struct device dev;
- local_t mode;
+ atomic_t mode;
int refcnt;
bool orphan;
/* sink specific fields */
@@ -623,13 +619,14 @@ static inline bool coresight_is_percpu_sink(struct coresight_device *csdev)
static inline bool coresight_take_mode(struct coresight_device *csdev,
enum cs_mode new_mode)
{
- return local_cmpxchg(&csdev->mode, CS_MODE_DISABLED, new_mode) ==
- CS_MODE_DISABLED;
+ int curr = CS_MODE_DISABLED;
+
+ return atomic_try_cmpxchg_acquire(&csdev->mode, &curr, new_mode);
}
static inline enum cs_mode coresight_get_mode(struct coresight_device *csdev)
{
- return local_read(&csdev->mode);
+ return atomic_read_acquire(&csdev->mode);
}
static inline void coresight_set_mode(struct coresight_device *csdev,
@@ -645,7 +642,7 @@ static inline void coresight_set_mode(struct coresight_device *csdev,
WARN(new_mode != CS_MODE_DISABLED && current_mode != CS_MODE_DISABLED &&
current_mode != new_mode, "Device already in use\n");
- local_set(&csdev->mode, new_mode);
+ atomic_set_release(&csdev->mode, new_mode);
}
struct coresight_device *coresight_register(struct coresight_desc *desc);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 253/614] coresight: etm4x: Always set tracers device mode on target CPU
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 252/614] coresight: Change device mode to atomic type Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 254/614] coresight: etm3x: " Greg Kroah-Hartman
` (374 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yeoreum Yun, mike Leach, James Clark,
Leo Yan, Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 28eee2158575aea8fee7807adb9248ceaf9196f1 ]
When enabling a tracer via SysFS interface, the device mode may be set
by any CPU - not necessarily the target CPU. This can lead to race
condition in SMP, and may result in incorrect mode values being read.
Consider the following example, where CPU0 attempts to enable the tracer
on CPU1 (the target CPU):
CPU0 CPU1
etm4_enable()
` coresight_take_mode(SYSFS)
` etm4_enable_sysfs()
` smp_call_function_single() ----> etm4_enable_hw_smp_call()
/
/ CPU idle:
/ etm4_cpu_save()
/ ` coresight_get_mode()
Failed to enable h/w / ^^^
` coresight_set_mode(DISABLED) <-' Read the intermediate SYSFS mode
In this case, CPU0 initiates the operation by taking the SYSFS mode to
avoid conflicts with the Perf mode. It then sends an IPI to CPU1 to
configure the tracer registers. If any error occurs during this process,
CPU0 rolls back by setting the mode to DISABLED.
However, if CPU1 enters an idle state during this time, it might read
the intermediate SYSFS mode. As a result, the CPU PM flow could wrongly
save and restore tracer context that is actually disabled.
To resolve the issue, this commit moves the device mode setting logic on
the target CPU. This ensures that the device mode is only modified by
the target CPU, eliminating race condition between mode writes and reads
across CPUs.
An additional change introduces the etm4_disable_sysfs_smp_call()
function for SMP calls, which disables the tracer and explicitly set the
mode to DISABLED during SysFS operations. Rename
etm4_disable_hw_smp_call() to etm4_disable_sysfs_smp_call() for naming
consistency.
The flow is updated with this change:
CPU0 CPU1
etm4_enable()
` etm4_enable_sysfs()
` smp_call_function_single() ----> etm4_enable_hw_smp_call()
` coresight_take_mode(SYSFS)
Failed, set back to DISABLED
` coresight_set_mode(DISABLED)
CPU idle:
etm4_cpu_save()
` coresight_get_mode()
^^^
Read out the DISABLED mode
Fixes: c38a9ec2b2c1 ("coresight: etm4x: moving etm_drvdata::enable to atomic field")
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: mike Leach <mike.leach@linaro.org>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-2-f55553b6c8b3@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../coresight/coresight-etm4x-core.c | 60 ++++++++++++-------
1 file changed, 38 insertions(+), 22 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 020f070bf17dc..1324b40d54210 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -589,13 +589,26 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
return rc;
}
-static void etm4_enable_hw_smp_call(void *info)
+static void etm4_enable_sysfs_smp_call(void *info)
{
struct etm4_enable_arg *arg = info;
+ struct coresight_device *csdev;
if (WARN_ON(!arg))
return;
+
+ csdev = arg->drvdata->csdev;
+ if (!coresight_take_mode(csdev, CS_MODE_SYSFS)) {
+ /* Someone is already using the tracer */
+ arg->rc = -EBUSY;
+ return;
+ }
+
arg->rc = etm4_enable_hw(arg->drvdata);
+
+ /* The tracer didn't start */
+ if (arg->rc)
+ coresight_set_mode(csdev, CS_MODE_DISABLED);
}
/*
@@ -808,13 +821,14 @@ static int etm4_enable_perf(struct coresight_device *csdev,
struct perf_event *event,
struct coresight_path *path)
{
- int ret = 0;
struct etmv4_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+ int ret;
- if (WARN_ON_ONCE(drvdata->cpu != smp_processor_id())) {
- ret = -EINVAL;
- goto out;
- }
+ if (WARN_ON_ONCE(drvdata->cpu != smp_processor_id()))
+ return -EINVAL;
+
+ if (!coresight_take_mode(csdev, CS_MODE_PERF))
+ return -EBUSY;
/* Configure the tracer based on the session's specifics */
ret = etm4_parse_event_config(csdev, event);
@@ -830,6 +844,9 @@ static int etm4_enable_perf(struct coresight_device *csdev,
ret = etm4_enable_hw(drvdata);
out:
+ /* Failed to start tracer; roll back to DISABLED mode */
+ if (ret)
+ coresight_set_mode(csdev, CS_MODE_DISABLED);
return ret;
}
@@ -861,7 +878,7 @@ static int etm4_enable_sysfs(struct coresight_device *csdev, struct coresight_pa
*/
arg.drvdata = drvdata;
ret = smp_call_function_single(drvdata->cpu,
- etm4_enable_hw_smp_call, &arg, 1);
+ etm4_enable_sysfs_smp_call, &arg, 1);
if (!ret)
ret = arg.rc;
if (!ret)
@@ -882,11 +899,6 @@ static int etm4_enable(struct coresight_device *csdev, struct perf_event *event,
{
int ret;
- if (!coresight_take_mode(csdev, mode)) {
- /* Someone is already using the tracer */
- return -EBUSY;
- }
-
switch (mode) {
case CS_MODE_SYSFS:
ret = etm4_enable_sysfs(csdev, path);
@@ -898,10 +910,6 @@ static int etm4_enable(struct coresight_device *csdev, struct perf_event *event,
ret = -EINVAL;
}
- /* The tracer didn't start */
- if (ret)
- coresight_set_mode(csdev, CS_MODE_DISABLED);
-
return ret;
}
@@ -953,10 +961,9 @@ static void etm4_disable_trace_unit(struct etmv4_drvdata *drvdata)
isb();
}
-static void etm4_disable_hw(void *info)
+static void etm4_disable_hw(struct etmv4_drvdata *drvdata)
{
u32 control;
- struct etmv4_drvdata *drvdata = info;
struct etmv4_config *config = &drvdata->config;
struct coresight_device *csdev = drvdata->csdev;
struct csdev_access *csa = &csdev->access;
@@ -993,6 +1000,15 @@ static void etm4_disable_hw(void *info)
"cpu: %d disable smp call done\n", drvdata->cpu);
}
+static void etm4_disable_sysfs_smp_call(void *info)
+{
+ struct etmv4_drvdata *drvdata = info;
+
+ etm4_disable_hw(drvdata);
+
+ coresight_set_mode(drvdata->csdev, CS_MODE_DISABLED);
+}
+
static int etm4_disable_perf(struct coresight_device *csdev,
struct perf_event *event)
{
@@ -1022,6 +1038,8 @@ static int etm4_disable_perf(struct coresight_device *csdev,
/* TRCVICTLR::SSSTATUS, bit[9] */
filters->ssstatus = (control & BIT(9));
+ coresight_set_mode(drvdata->csdev, CS_MODE_DISABLED);
+
/*
* perf will release trace ids when _free_aux() is
* called at the end of the session.
@@ -1047,7 +1065,8 @@ static void etm4_disable_sysfs(struct coresight_device *csdev)
* Executing etm4_disable_hw on the cpu whose ETM is being disabled
* ensures that register writes occur when cpu is powered.
*/
- smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1);
+ smp_call_function_single(drvdata->cpu, etm4_disable_sysfs_smp_call,
+ drvdata, 1);
raw_spin_unlock(&drvdata->spinlock);
@@ -1087,9 +1106,6 @@ static void etm4_disable(struct coresight_device *csdev,
etm4_disable_perf(csdev, event);
break;
}
-
- if (mode)
- coresight_set_mode(csdev, CS_MODE_DISABLED);
}
static int etm4_resume_perf(struct coresight_device *csdev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 254/614] coresight: etm3x: Always set tracers device mode on target CPU
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 253/614] coresight: etm4x: Always set tracers device mode on target CPU Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 255/614] coresight: etm4x: Correct polling IDLE bit Greg Kroah-Hartman
` (373 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Leach, James Clark, Leo Yan,
Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit ab3fde32afe6a77e5cc60f868e44e6e09424752b ]
The ETMv3 driver shares the same issue as ETMv4 regarding race
conditions when accessing the device mode.
This commit applies the same fix: ensuring that the device mode is
modified only by the target CPU to eliminate race conditions across
CPUs.
Fixes: 22fd532eaa0c ("coresight: etm3x: adding operation mode for etm_enable()")
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-3-f55553b6c8b3@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../coresight/coresight-etm3x-core.c | 59 +++++++++++++------
1 file changed, 40 insertions(+), 19 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
index 45630a1cd32fb..a5e809589d3e3 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
@@ -439,13 +439,26 @@ struct etm_enable_arg {
int rc;
};
-static void etm_enable_hw_smp_call(void *info)
+static void etm_enable_sysfs_smp_call(void *info)
{
struct etm_enable_arg *arg = info;
+ struct coresight_device *csdev;
if (WARN_ON(!arg))
return;
+
+ csdev = arg->drvdata->csdev;
+ if (!coresight_take_mode(csdev, CS_MODE_SYSFS)) {
+ /* Someone is already using the tracer */
+ arg->rc = -EBUSY;
+ return;
+ }
+
arg->rc = etm_enable_hw(arg->drvdata);
+
+ /* The tracer didn't start */
+ if (arg->rc)
+ coresight_set_mode(csdev, CS_MODE_DISABLED);
}
static int etm_cpu_id(struct coresight_device *csdev)
@@ -465,16 +478,26 @@ static int etm_enable_perf(struct coresight_device *csdev,
struct coresight_path *path)
{
struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+ int ret;
if (WARN_ON_ONCE(drvdata->cpu != smp_processor_id()))
return -EINVAL;
+ if (!coresight_take_mode(csdev, CS_MODE_PERF))
+ return -EBUSY;
+
/* Configure the tracer based on the session's specifics */
etm_parse_event_config(drvdata, event);
drvdata->traceid = path->trace_id;
/* And enable it */
- return etm_enable_hw(drvdata);
+ ret = etm_enable_hw(drvdata);
+
+ /* Failed to start tracer; roll back to DISABLED mode */
+ if (ret)
+ coresight_set_mode(csdev, CS_MODE_DISABLED);
+
+ return ret;
}
static int etm_enable_sysfs(struct coresight_device *csdev, struct coresight_path *path)
@@ -494,7 +517,7 @@ static int etm_enable_sysfs(struct coresight_device *csdev, struct coresight_pat
if (cpu_online(drvdata->cpu)) {
arg.drvdata = drvdata;
ret = smp_call_function_single(drvdata->cpu,
- etm_enable_hw_smp_call, &arg, 1);
+ etm_enable_sysfs_smp_call, &arg, 1);
if (!ret)
ret = arg.rc;
if (!ret)
@@ -517,12 +540,6 @@ static int etm_enable(struct coresight_device *csdev, struct perf_event *event,
enum cs_mode mode, struct coresight_path *path)
{
int ret;
- struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
-
- if (!coresight_take_mode(csdev, mode)) {
- /* Someone is already using the tracer */
- return -EBUSY;
- }
switch (mode) {
case CS_MODE_SYSFS:
@@ -535,17 +552,12 @@ static int etm_enable(struct coresight_device *csdev, struct perf_event *event,
ret = -EINVAL;
}
- /* The tracer didn't start */
- if (ret)
- coresight_set_mode(drvdata->csdev, CS_MODE_DISABLED);
-
return ret;
}
-static void etm_disable_hw(void *info)
+static void etm_disable_hw(struct etm_drvdata *drvdata)
{
int i;
- struct etm_drvdata *drvdata = info;
struct etm_config *config = &drvdata->config;
struct coresight_device *csdev = drvdata->csdev;
@@ -567,6 +579,15 @@ static void etm_disable_hw(void *info)
"cpu: %d disable smp call done\n", drvdata->cpu);
}
+static void etm_disable_sysfs_smp_call(void *info)
+{
+ struct etm_drvdata *drvdata = info;
+
+ etm_disable_hw(drvdata);
+
+ coresight_set_mode(drvdata->csdev, CS_MODE_DISABLED);
+}
+
static void etm_disable_perf(struct coresight_device *csdev)
{
struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
@@ -588,6 +609,8 @@ static void etm_disable_perf(struct coresight_device *csdev)
CS_LOCK(drvdata->csa.base);
+ coresight_set_mode(drvdata->csdev, CS_MODE_DISABLED);
+
/*
* perf will release trace ids when _free_aux()
* is called at the end of the session
@@ -612,7 +635,8 @@ static void etm_disable_sysfs(struct coresight_device *csdev)
* Executing etm_disable_hw on the cpu whose ETM is being disabled
* ensures that register writes occur when cpu is powered.
*/
- smp_call_function_single(drvdata->cpu, etm_disable_hw, drvdata, 1);
+ smp_call_function_single(drvdata->cpu, etm_disable_sysfs_smp_call,
+ drvdata, 1);
spin_unlock(&drvdata->spinlock);
cpus_read_unlock();
@@ -652,9 +676,6 @@ static void etm_disable(struct coresight_device *csdev,
WARN_ON_ONCE(mode);
return;
}
-
- if (mode)
- coresight_set_mode(csdev, CS_MODE_DISABLED);
}
static const struct coresight_ops_source etm_source_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 255/614] coresight: etm4x: Correct polling IDLE bit
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 254/614] coresight: etm3x: " Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 256/614] coresight: etm4x: Add context synchronization before enabling trace Greg Kroah-Hartman
` (372 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yeoreum Yun, Mike Leach, James Clark,
Leo Yan, Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 4dc4e22f9536341255f5de6047977a80ff47eaef ]
Since commit 4ff6039ffb79 ("coresight-etm4x: add isb() before reading
the TRCSTATR"), the code has incorrectly been polling the PMSTABLE bit
instead of the IDLE bit.
This commit corrects the typo.
Fixes: 4ff6039ffb79 ("coresight-etm4x: add isb() before reading the TRCSTATR")
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-4-f55553b6c8b3@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 1324b40d54210..c562f82985192 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -1924,7 +1924,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
state->trcpdcr = etm4x_read32(csa, TRCPDCR);
/* wait for TRCSTATR.IDLE to go up */
- if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1)) {
+ if (etm4x_wait_status(csa, TRCSTATR_IDLE_BIT, 1)) {
dev_err(etm_dev,
"timeout while waiting for Idle Trace Status\n");
etm4_os_unlock(drvdata);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 256/614] coresight: etm4x: Add context synchronization before enabling trace
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 255/614] coresight: etm4x: Correct polling IDLE bit Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 257/614] coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF Greg Kroah-Hartman
` (371 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Leach, Yeoreun Yun, James Clark,
Leo Yan, Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 64eb04ae545294e105ad91714dc3167a0b660731 ]
According to the software usage PKLXF in Arm ARM (ARM DDI 0487 L.a), a
Context synchronization event is required before enabling the trace
unit.
An ISB is added to meet this requirement, particularly for guarding the
operations in the flow:
etm4x_allow_trace()
`> kvm_tracing_set_el1_configuration()
`> write_sysreg_s(trfcr_while_in_guest, SYS_TRFCR_EL12)
Improved the barrier comments to provide more accurate information.
Fixes: 1ab3bb9df5e3 ("coresight: etm4x: Add necessary synchronization for sysreg access")
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Reviewed-by: Yeoreun Yun <yeoreum.yun@arm.com>
Tested-by: James Clark <james.clark@linaro.org>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-5-f55553b6c8b3@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../coresight/coresight-etm4x-core.c | 27 ++++++++++++++++---
1 file changed, 23 insertions(+), 4 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index c562f82985192..5e707d082537a 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -446,10 +446,24 @@ static int etm4_enable_trace_unit(struct etmv4_drvdata *drvdata)
etm4x_relaxed_write32(csa, TRCRSR_TA, TRCRSR);
etm4x_allow_trace(drvdata);
+
+ /*
+ * According to software usage PKLXF in Arm ARM (ARM DDI 0487 L.a),
+ * execute a Context synchronization event to guarantee the trace unit
+ * will observe the new values of the System registers.
+ */
+ if (!csa->io_mem)
+ isb();
+
/* Enable the trace unit */
etm4x_relaxed_write32(csa, 1, TRCPRGCTLR);
- /* Synchronize the register updates for sysreg access */
+ /*
+ * As recommended by section 4.3.7 ("Synchronization when using system
+ * instructions to progrom the trace unit") of ARM IHI 0064H.b, the
+ * self-hosted trace analyzer must perform a Context synchronization
+ * event between writing to the TRCPRGCTLR and reading the TRCSTATR.
+ */
if (!csa->io_mem)
isb();
@@ -931,11 +945,16 @@ static void etm4_disable_trace_unit(struct etmv4_drvdata *drvdata)
*/
etm4x_prohibit_trace(drvdata);
/*
- * Make sure everything completes before disabling, as recommended
- * by section 7.3.77 ("TRCVICTLR, ViewInst Main Control Register,
- * SSTATUS") of ARM IHI 0064D
+ * Prevent being speculative at the point of disabling the trace unit,
+ * as recommended by section 7.3.77 ("TRCVICTLR, ViewInst Main Control
+ * Register, SSTATUS") of ARM IHI 0064D
*/
dsb(sy);
+ /*
+ * According to software usage VKHHY in Arm ARM (ARM DDI 0487 L.a),
+ * execute a Context synchronization event to guarantee no new
+ * program-flow trace is generated.
+ */
isb();
/* Trace synchronization barrier, is a nop if not supported */
tsb_csync();
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 257/614] coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 256/614] coresight: etm4x: Add context synchronization before enabling trace Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 258/614] perf tools: Fix missing feature check for inherit + SAMPLE_READ Greg Kroah-Hartman
` (370 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Leach, James Clark, Yeoreum Yun,
Leo Yan, Suzuki K Poulose, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 1fdc2cd347a7bc58acacb6144404ee892cea6c2e ]
If a CPU supports FEAT_TRF, as described in the section K5.5 "Context
switching", Arm ARM (ARM DDI 0487 L.a), it defines a flow to prohibit
program-flow trace, execute a TSB CSYNC instruction for flushing,
followed by clearing TRCPRGCTLR.EN bit.
To restore the state, the reverse sequence is required.
This differs from the procedure described in the section 3.4.1 "The
procedure when powering down the PE" of ARM IHI0064H.b, which involves
the OS Lock to prevent external debugger accesses and implicitly
disables trace.
To be compatible with different ETM versions, explicitly control trace
unit using etm4_disable_trace_unit() and etm4_enable_trace_unit()
during CPU idle to comply with FEAT_TRF.
As a result, the save states for TRFCR_ELx and trcprgctlr are redundant,
remove them.
Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states")
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Tested-by: James Clark <james.clark@linaro.org>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20251111-arm_coresight_power_management_fix-v6-6-f55553b6c8b3@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-etm4x-core.c | 14 +++++++-------
drivers/hwtracing/coresight/coresight-etm4x.h | 3 ---
2 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 5e707d082537a..fdda924a2c711 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -1858,9 +1858,11 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
goto out;
}
+ if (!drvdata->paused)
+ etm4_disable_trace_unit(drvdata);
+
state = drvdata->save_state;
- state->trcprgctlr = etm4x_read32(csa, TRCPRGCTLR);
if (drvdata->nr_pe)
state->trcprocselr = etm4x_read32(csa, TRCPROCSELR);
state->trcconfigr = etm4x_read32(csa, TRCCONFIGR);
@@ -1970,9 +1972,6 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)
{
int ret = 0;
- /* Save the TRFCR irrespective of whether the ETM is ON */
- if (drvdata->trfcr)
- drvdata->save_trfcr = read_trfcr();
/*
* Save and restore the ETM Trace registers only if
* the ETM is active.
@@ -1994,7 +1993,6 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
etm4_cs_unlock(drvdata, csa);
etm4x_relaxed_write32(csa, state->trcclaimset, TRCCLAIMSET);
- etm4x_relaxed_write32(csa, state->trcprgctlr, TRCPRGCTLR);
if (drvdata->nr_pe)
etm4x_relaxed_write32(csa, state->trcprocselr, TRCPROCSELR);
etm4x_relaxed_write32(csa, state->trcconfigr, TRCCONFIGR);
@@ -2079,13 +2077,15 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
/* Unlock the OS lock to re-enable trace and external debug access */
etm4_os_unlock(drvdata);
+
+ if (!drvdata->paused)
+ etm4_enable_trace_unit(drvdata);
+
etm4_cs_lock(drvdata, csa);
}
static void etm4_cpu_restore(struct etmv4_drvdata *drvdata)
{
- if (drvdata->trfcr)
- write_trfcr(drvdata->save_trfcr);
if (drvdata->state_needs_restore)
__etm4_cpu_restore(drvdata);
}
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 13ec9ecef46f5..b8796b4271025 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -866,7 +866,6 @@ struct etmv4_config {
* struct etm4_save_state - state to be preserved when ETM is without power
*/
struct etmv4_save_state {
- u32 trcprgctlr;
u32 trcprocselr;
u32 trcconfigr;
u32 trcauxctlr;
@@ -980,7 +979,6 @@ struct etmv4_save_state {
* at runtime, due to the additional setting of TRFCR_CX when
* in EL2. Otherwise, 0.
* @config: structure holding configuration parameters.
- * @save_trfcr: Saved TRFCR_EL1 register during a CPU PM event.
* @save_state: State to be preserved across power loss
* @state_needs_restore: True when there is context to restore after PM exit
* @skip_power_up: Indicates if an implementation can skip powering up
@@ -1037,7 +1035,6 @@ struct etmv4_drvdata {
bool lpoverride;
u64 trfcr;
struct etmv4_config config;
- u64 save_trfcr;
struct etmv4_save_state *save_state;
bool state_needs_restore;
bool skip_power_up;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 258/614] perf tools: Fix missing feature check for inherit + SAMPLE_READ
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 257/614] coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 259/614] drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features Greg Kroah-Hartman
` (369 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin, Chen, Zide
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 367377f45c0b568882567f797b7b18b263505be7 ]
It should also have PERF_SAMPLE_TID to enable inherit and PERF_SAMPLE_READ
on recent kernels. Not having _TID makes the feature check wrongly detect
the inherit and _READ support.
It was reported that the following command failed due to the error in
the missing feature check on Intel SPR machines.
$ perf record -e '{cpu/mem-loads-aux/S,cpu/mem-loads,ldlat=3/PS}' -- ls
Error:
Failure to open event 'cpu/mem-loads,ldlat=3/PS' on PMU 'cpu' which will be removed.
Invalid event (cpu/mem-loads,ldlat=3/PS) in per-thread mode, enable system wide with '-a'.
Reviewed-by: Ian Rogers <irogers@google.com>
Fixes: 3b193a57baf15c468 ("perf tools: Detect missing kernel features properly")
Reported-and-tested-by: Chen, Zide <zide.chen@intel.com>
Closes: https://lore.kernel.org/lkml/20251022220802.1335131-1-zide.chen@intel.com/
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/evsel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 56ebefd075f2e..9df9818e37013 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -2473,7 +2473,7 @@ static bool evsel__detect_missing_features(struct evsel *evsel, struct perf_cpu
/* Please add new feature detection here. */
attr.inherit = true;
- attr.sample_type = PERF_SAMPLE_READ;
+ attr.sample_type = PERF_SAMPLE_READ | PERF_SAMPLE_TID;
if (has_attr_feature(&attr, /*flags=*/0))
goto found;
perf_missing_features.inherit_sample_read = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 259/614] drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 258/614] perf tools: Fix missing feature check for inherit + SAMPLE_READ Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 260/614] drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Greg Kroah-Hartman
` (368 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Walle, Devarsh Thakkar,
Tomi Valkeinen, Jayesh Choudhary, Swamil Jain, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <j-choudhary@ti.com>
[ Upstream commit 527e132573dfa793818a536b18eec49598a6f6f5 ]
The TIDSS hardware does not have independent maximum or minimum pixel
clock limits for each video port. Instead, these limits are determined
by the SoC's clock architecture. Previously, this constraint was
modeled using the 'max_pclk_khz' and 'min_pclk_khz' fields in
'dispc_features', but this approach is static and does not account for
the dynamic behavior of PLLs.
This patch removes the 'max_pclk_khz' and 'min_pclk_khz' fields from
'dispc_features'. The correct way to check if a requested mode's pixel
clock is supported is by using 'clk_round_rate()' in the 'mode_valid()'
hook. If the best frequency match for the mode clock falls within the
supported tolerance, it is approved. TIDSS supports a 5% pixel clock
tolerance, which is now reflected in the validation logic.
This change allows existing DSS-compatible drivers to be reused across
SoCs that only differ in their pixel clock characteristics. The
validation uses 'clk_round_rate()' for each mode, which may introduce
additional delay (about 3.5 ms for 30 modes), but this is generally
negligible. Users desiring faster validation may bypass these calls
selectively, for example, checking only the highest resolution mode,
as shown here[1].
[1]: https://lore.kernel.org/all/20250704094851.182131-3-j-choudhary@ti.com/
Tested-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
Signed-off-by: Swamil Jain <s-jain1@ti.com>
Link: https://patch.msgid.link/20251104151422.307162-2-s-jain1@ti.com
[Tomi: dropped 'inline' from check_pixel_clock]
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Stable-dep-of: 86db652fc22f ("drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_dispc.c | 86 +++++++++++------------------
drivers/gpu/drm/tidss/tidss_dispc.h | 3 -
2 files changed, 31 insertions(+), 58 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
index 7c8c15a5c39b3..55259b8e87510 100644
--- a/drivers/gpu/drm/tidss/tidss_dispc.c
+++ b/drivers/gpu/drm/tidss/tidss_dispc.c
@@ -57,12 +57,6 @@ static const u16 tidss_k2g_common_regs[DISPC_COMMON_REG_TABLE_LEN] = {
};
const struct dispc_features dispc_k2g_feats = {
- .min_pclk_khz = 4375,
-
- .max_pclk_khz = {
- [DISPC_VP_DPI] = 150000,
- },
-
/*
* XXX According TRM the RGB input buffer width up to 2560 should
* work on 3 taps, but in practice it only works up to 1280.
@@ -145,11 +139,6 @@ static const u16 tidss_am65x_common_regs[DISPC_COMMON_REG_TABLE_LEN] = {
};
const struct dispc_features dispc_am65x_feats = {
- .max_pclk_khz = {
- [DISPC_VP_DPI] = 165000,
- [DISPC_VP_OLDI_AM65X] = 165000,
- },
-
.scaling = {
.in_width_max_5tap_rgb = 1280,
.in_width_max_3tap_rgb = 2560,
@@ -245,11 +234,6 @@ static const u16 tidss_j721e_common_regs[DISPC_COMMON_REG_TABLE_LEN] = {
};
const struct dispc_features dispc_j721e_feats = {
- .max_pclk_khz = {
- [DISPC_VP_DPI] = 170000,
- [DISPC_VP_INTERNAL] = 600000,
- },
-
.scaling = {
.in_width_max_5tap_rgb = 2048,
.in_width_max_3tap_rgb = 4096,
@@ -316,11 +300,6 @@ const struct dispc_features dispc_j721e_feats = {
};
const struct dispc_features dispc_am625_feats = {
- .max_pclk_khz = {
- [DISPC_VP_DPI] = 165000,
- [DISPC_VP_INTERNAL] = 170000,
- },
-
.scaling = {
.in_width_max_5tap_rgb = 1280,
.in_width_max_3tap_rgb = 2560,
@@ -377,15 +356,6 @@ const struct dispc_features dispc_am625_feats = {
};
const struct dispc_features dispc_am62a7_feats = {
- /*
- * if the code reaches dispc_mode_valid with VP1,
- * it should return MODE_BAD.
- */
- .max_pclk_khz = {
- [DISPC_VP_TIED_OFF] = 0,
- [DISPC_VP_DPI] = 165000,
- },
-
.scaling = {
.in_width_max_5tap_rgb = 1280,
.in_width_max_3tap_rgb = 2560,
@@ -442,10 +412,6 @@ const struct dispc_features dispc_am62a7_feats = {
};
const struct dispc_features dispc_am62l_feats = {
- .max_pclk_khz = {
- [DISPC_VP_DPI] = 165000,
- },
-
.subrev = DISPC_AM62L,
.common = "common",
@@ -1331,33 +1297,54 @@ static void dispc_vp_set_default_color(struct dispc_device *dispc,
DISPC_OVR_DEFAULT_COLOR2, (v >> 32) & 0xffff);
}
+/*
+ * Calculate the percentage difference between the requested pixel clock rate
+ * and the effective rate resulting from calculating the clock divider value.
+ */
+unsigned int dispc_pclk_diff(unsigned long rate, unsigned long real_rate)
+{
+ int r = rate / 100, rr = real_rate / 100;
+
+ return (unsigned int)(abs(((rr - r) * 100) / r));
+}
+
+static int check_pixel_clock(struct dispc_device *dispc, u32 hw_videoport,
+ unsigned long clock)
+{
+ unsigned long round_clock;
+
+ round_clock = clk_round_rate(dispc->vp_clk[hw_videoport], clock);
+ /*
+ * To keep the check consistent with dispc_vp_set_clk_rate(), we
+ * use the same 5% check here.
+ */
+ if (dispc_pclk_diff(clock, round_clock) > 5)
+ return -EINVAL;
+
+ return 0;
+}
+
enum drm_mode_status dispc_vp_mode_valid(struct dispc_device *dispc,
u32 hw_videoport,
const struct drm_display_mode *mode)
{
u32 hsw, hfp, hbp, vsw, vfp, vbp;
enum dispc_vp_bus_type bus_type;
- int max_pclk;
bus_type = dispc->feat->vp_bus_type[hw_videoport];
- max_pclk = dispc->feat->max_pclk_khz[bus_type];
-
- if (WARN_ON(max_pclk == 0))
+ if (WARN_ON(bus_type == DISPC_VP_TIED_OFF))
return MODE_BAD;
- if (mode->clock < dispc->feat->min_pclk_khz)
- return MODE_CLOCK_LOW;
-
- if (mode->clock > max_pclk)
- return MODE_CLOCK_HIGH;
-
if (mode->hdisplay > 4096)
return MODE_BAD;
if (mode->vdisplay > 4096)
return MODE_BAD;
+ if (check_pixel_clock(dispc, hw_videoport, mode->clock * 1000))
+ return MODE_CLOCK_RANGE;
+
/* TODO: add interlace support */
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
return MODE_NO_INTERLACE;
@@ -1421,17 +1408,6 @@ void dispc_vp_disable_clk(struct dispc_device *dispc, u32 hw_videoport)
clk_disable_unprepare(dispc->vp_clk[hw_videoport]);
}
-/*
- * Calculate the percentage difference between the requested pixel clock rate
- * and the effective rate resulting from calculating the clock divider value.
- */
-unsigned int dispc_pclk_diff(unsigned long rate, unsigned long real_rate)
-{
- int r = rate / 100, rr = real_rate / 100;
-
- return (unsigned int)(abs(((rr - r) * 100) / r));
-}
-
int dispc_vp_set_clk_rate(struct dispc_device *dispc, u32 hw_videoport,
unsigned long rate)
{
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.h b/drivers/gpu/drm/tidss/tidss_dispc.h
index 60c1b400eb893..42279312dcc1b 100644
--- a/drivers/gpu/drm/tidss/tidss_dispc.h
+++ b/drivers/gpu/drm/tidss/tidss_dispc.h
@@ -77,9 +77,6 @@ enum dispc_dss_subrevision {
};
struct dispc_features {
- int min_pclk_khz;
- int max_pclk_khz[DISPC_VP_MAX_BUS_TYPE];
-
struct dispc_features_scaling scaling;
enum dispc_dss_subrevision subrev;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 260/614] drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 259/614] drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 261/614] clk: renesas: r9a09g077: Propagate rate changes to parent clocks Greg Kroah-Hartman
` (367 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Walle, Devarsh Thakkar,
Tomi Valkeinen, Jayesh Choudhary, Swamil Jain, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jayesh Choudhary <j-choudhary@ti.com>
[ Upstream commit 86db652fc22f5674ffe3b1f7c91c397c69d26d94 ]
After integrating OLDI support[0], it is necessary to identify which VP
instances use OLDI, since the OLDI driver owns the video port clock
(as a serial clock). Clock operations on these VPs must be delegated to
the OLDI driver, not handled by the TIDSS driver. This issue also
emerged in upstream discussions when DSI-related clock management was
attempted in the TIDSS driver[1].
To address this, add an 'is_ext_vp_clk' array to the 'tidss_device'
structure, marking a VP as 'true' during 'tidss_oldi_init()' and as
'false' during 'tidss_oldi_deinit()'. TIDSS then uses 'is_ext_vp_clk'
to skip clock validation checks in 'dispc_vp_mode_valid()' for VPs
under OLDI control.
Since OLDI uses the DSS VP clock directly as a serial interface and
manages its own rate, mode validation should be implemented in the OLDI
bridge's 'mode_valid' hook. This patch adds that logic, ensuring proper
delegation and avoiding spurious clock handling in the TIDSS driver.
[0]: https://lore.kernel.org/all/20250528122544.817829-1-aradhya.bhatia@linux.dev/
[1]: https://lore.kernel.org/all/DA6TT575Z82D.3MPK8HG5GRL8U@kernel.org/
Fixes: 7246e0929945 ("drm/tidss: Add OLDI bridge support")
Tested-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
Signed-off-by: Swamil Jain <s-jain1@ti.com>
Link: https://patch.msgid.link/20251104151422.307162-3-s-jain1@ti.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patch.msgid.link/ffd5ebe03391b3c01e616c0c844a4b8ddecede36.1762513240.git.jani.nikula@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_dispc.c | 7 +++++++
drivers/gpu/drm/tidss/tidss_drv.h | 2 ++
drivers/gpu/drm/tidss/tidss_oldi.c | 22 ++++++++++++++++++++++
3 files changed, 31 insertions(+)
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
index 55259b8e87510..6bf1171d0bc2d 100644
--- a/drivers/gpu/drm/tidss/tidss_dispc.c
+++ b/drivers/gpu/drm/tidss/tidss_dispc.c
@@ -1313,6 +1313,13 @@ static int check_pixel_clock(struct dispc_device *dispc, u32 hw_videoport,
{
unsigned long round_clock;
+ /*
+ * For VP's with external clocking, clock operations must be
+ * delegated to respective driver, so we skip the check here.
+ */
+ if (dispc->tidss->is_ext_vp_clk[hw_videoport])
+ return 0;
+
round_clock = clk_round_rate(dispc->vp_clk[hw_videoport], clock);
/*
* To keep the check consistent with dispc_vp_set_clk_rate(), we
diff --git a/drivers/gpu/drm/tidss/tidss_drv.h b/drivers/gpu/drm/tidss/tidss_drv.h
index 84454a4855d11..e1c1f41d8b4be 100644
--- a/drivers/gpu/drm/tidss/tidss_drv.h
+++ b/drivers/gpu/drm/tidss/tidss_drv.h
@@ -24,6 +24,8 @@ struct tidss_device {
const struct dispc_features *feat;
struct dispc_device *dispc;
+ bool is_ext_vp_clk[TIDSS_MAX_PORTS];
+
unsigned int num_crtcs;
struct drm_crtc *crtcs[TIDSS_MAX_PORTS];
diff --git a/drivers/gpu/drm/tidss/tidss_oldi.c b/drivers/gpu/drm/tidss/tidss_oldi.c
index 7688251beba28..17c535bfa0576 100644
--- a/drivers/gpu/drm/tidss/tidss_oldi.c
+++ b/drivers/gpu/drm/tidss/tidss_oldi.c
@@ -309,6 +309,25 @@ static u32 *tidss_oldi_atomic_get_input_bus_fmts(struct drm_bridge *bridge,
return input_fmts;
}
+static enum drm_mode_status
+tidss_oldi_mode_valid(struct drm_bridge *bridge,
+ const struct drm_display_info *info,
+ const struct drm_display_mode *mode)
+{
+ struct tidss_oldi *oldi = drm_bridge_to_tidss_oldi(bridge);
+ unsigned long round_clock;
+
+ round_clock = clk_round_rate(oldi->serial, mode->clock * 7 * 1000);
+ /*
+ * To keep the check consistent with dispc_vp_set_clk_rate(),
+ * we use the same 5% check here.
+ */
+ if (dispc_pclk_diff(mode->clock * 7 * 1000, round_clock) > 5)
+ return -EINVAL;
+
+ return 0;
+}
+
static const struct drm_bridge_funcs tidss_oldi_bridge_funcs = {
.attach = tidss_oldi_bridge_attach,
.atomic_pre_enable = tidss_oldi_atomic_pre_enable,
@@ -317,6 +336,7 @@ static const struct drm_bridge_funcs tidss_oldi_bridge_funcs = {
.atomic_duplicate_state = drm_atomic_helper_bridge_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_bridge_destroy_state,
.atomic_reset = drm_atomic_helper_bridge_reset,
+ .mode_valid = tidss_oldi_mode_valid,
};
static int get_oldi_mode(struct device_node *oldi_tx, int *companion_instance)
@@ -430,6 +450,7 @@ void tidss_oldi_deinit(struct tidss_device *tidss)
for (int i = 0; i < tidss->num_oldis; i++) {
if (tidss->oldis[i]) {
drm_bridge_remove(&tidss->oldis[i]->bridge);
+ tidss->is_ext_vp_clk[tidss->oldis[i]->parent_vp] = false;
tidss->oldis[i] = NULL;
}
}
@@ -580,6 +601,7 @@ int tidss_oldi_init(struct tidss_device *tidss)
oldi->bridge.timings = &default_tidss_oldi_timings;
tidss->oldis[tidss->num_oldis++] = oldi;
+ tidss->is_ext_vp_clk[oldi->parent_vp] = true;
oldi->tidss = tidss;
drm_bridge_add(&oldi->bridge);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 261/614] clk: renesas: r9a09g077: Propagate rate changes to parent clocks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 260/614] drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 262/614] clk: renesas: r9a06g032: Fix memory leak in error path Greg Kroah-Hartman
` (366 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 145dfd70b9c70e5bc03494a7ce8fa3748ac01af3 ]
Add the CLK_SET_RATE_PARENT flag to divider clock registration so that rate
changes can propagate to parent clocks when needed. This allows the CPG
divider clocks to request rate adjustments from their parent, ensuring
correct frequency scaling and improved flexibility in clock rate selection.
Fixes: 065fe720eec6e ("clk: renesas: Add support for R9A09G077 SoC")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251028165127.991351-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/r9a09g077-cpg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/renesas/r9a09g077-cpg.c b/drivers/clk/renesas/r9a09g077-cpg.c
index af3ef6d58c87c..d12975418a568 100644
--- a/drivers/clk/renesas/r9a09g077-cpg.c
+++ b/drivers/clk/renesas/r9a09g077-cpg.c
@@ -217,7 +217,7 @@ r9a09g077_cpg_div_clk_register(struct device *dev,
if (core->dtable)
clk_hw = clk_hw_register_divider_table(dev, core->name,
- parent_name, 0,
+ parent_name, CLK_SET_RATE_PARENT,
addr,
GET_SHIFT(core->conf),
GET_WIDTH(core->conf),
@@ -226,7 +226,7 @@ r9a09g077_cpg_div_clk_register(struct device *dev,
&pub->rmw_lock);
else
clk_hw = clk_hw_register_divider(dev, core->name,
- parent_name, 0,
+ parent_name, CLK_SET_RATE_PARENT,
addr,
GET_SHIFT(core->conf),
GET_WIDTH(core->conf),
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 262/614] clk: renesas: r9a06g032: Fix memory leak in error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 261/614] clk: renesas: r9a09g077: Propagate rate changes to parent clocks Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 263/614] lib/vsprintf: Check pointer before dereferencing in time_and_date() Greg Kroah-Hartman
` (365 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit f8def051bbcf8677f64701e9699bf6d11e2780cd ]
The current code uses of_iomap() to map registers but never calls
iounmap() on any error path after the mapping. This causes a memory
leak when probe fails after successful ioremap, for example when
of_clk_add_provider() or r9a06g032_add_clk_domain() fails.
Replace of_iomap() with devm_of_iomap() to automatically unmap the
region on probe failure. Update the error check accordingly to use
IS_ERR() and PTR_ERR() since devm_of_iomap() returns ERR_PTR on error.
Fixes: 4c3d88526eba ("clk: renesas: Renesas R9A06G032 clock driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251030061603.1954-1-vulab@iscas.ac.cn
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/renesas/r9a06g032-clocks.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
index dcda19318b2a9..0f5c91b5dfa99 100644
--- a/drivers/clk/renesas/r9a06g032-clocks.c
+++ b/drivers/clk/renesas/r9a06g032-clocks.c
@@ -1333,9 +1333,9 @@ static int __init r9a06g032_clocks_probe(struct platform_device *pdev)
if (IS_ERR(mclk))
return PTR_ERR(mclk);
- clocks->reg = of_iomap(np, 0);
- if (WARN_ON(!clocks->reg))
- return -ENOMEM;
+ clocks->reg = devm_of_iomap(dev, np, 0, NULL);
+ if (IS_ERR(clocks->reg))
+ return PTR_ERR(clocks->reg);
r9a06g032_init_h2mode(clocks);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 263/614] lib/vsprintf: Check pointer before dereferencing in time_and_date()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 262/614] clk: renesas: r9a06g032: Fix memory leak in error path Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 264/614] ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() Greg Kroah-Hartman
` (364 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Petr Mladek,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 372a12bd5df0199aa234eaf8ef31ed7ecd61d40f ]
The pointer may be invalid when gets to the printf(). In particular
the time_and_date() dereferencing it in some cases without checking.
Move the check from rtc_str() to time_and_date() to cover all cases.
Fixes: 7daac5b2fdf8 ("lib/vsprintf: Print time64_t in human readable format")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Link: https://patch.msgid.link/20251110132118.4113976-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/vsprintf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index eb0cb11d0d126..a356965c1d734 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1928,9 +1928,6 @@ char *rtc_str(char *buf, char *end, const struct rtc_time *tm,
bool found = true;
int count = 2;
- if (check_pointer(&buf, end, tm, spec))
- return buf;
-
switch (fmt[count]) {
case 'd':
have_t = false;
@@ -1996,6 +1993,9 @@ static noinline_for_stack
char *time_and_date(char *buf, char *end, void *ptr, struct printf_spec spec,
const char *fmt)
{
+ if (check_pointer(&buf, end, ptr, spec))
+ return buf;
+
switch (fmt[1]) {
case 'R':
return rtc_str(buf, end, (const struct rtc_time *)ptr, spec, fmt);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 264/614] ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 263/614] lib/vsprintf: Check pointer before dereferencing in time_and_date() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 265/614] ocfs2: use correct endian in ocfs2_dinode_has_extents Greg Kroah-Hartman
` (363 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov,
syzbot+727d161855d11d81e411, Joseph Qi, Mark Fasheh, Joel Becker,
Junxiao Bi, Changwei Ge, Jun Piao, Andrew Morton, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 8a7d58845fae061c62b50bc5eeb9bae4a1dedc3d ]
In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just
to avoid crashing the whole kernel due to a filesystem corruption.
Fixes: 8f603e567aa7 ("Ocfs2/move_extents: move a range of extent.")
Link: https://lkml.kernel.org/r/20251009102349.181126-2-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Closes: https://syzkaller.appspot.com/bug?extid=727d161855d11d81e411
Reported-by: syzbot+727d161855d11d81e411@syzkaller.appspotmail.com
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/move_extents.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 10923bf7c8b84..26e150c5f25eb 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -98,7 +98,13 @@ static int __ocfs2_move_extent(handle_t *handle,
rec = &el->l_recs[index];
- BUG_ON(ext_flags != rec->e_flags);
+ if (ext_flags != rec->e_flags) {
+ ret = ocfs2_error(inode->i_sb,
+ "Inode %llu has corrupted extent %d with flags 0x%x at cpos %u\n",
+ (unsigned long long)ino, index, rec->e_flags, cpos);
+ goto out;
+ }
+
/*
* after moving/defraging to new location, the extent is not going
* to be refcounted anymore.
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 265/614] ocfs2: use correct endian in ocfs2_dinode_has_extents
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 264/614] ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 266/614] ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() Greg Kroah-Hartman
` (362 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Heming Zhao, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Andrew Morton,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit c9dff86eb78a4b6b02b1e407993c946ccaf9bfb4 ]
Fields in ocfs2_dinode is little endian, covert to host endian when
checking those contents.
Link: https://lkml.kernel.org/r/20251025123218.3997866-1-joseph.qi@linux.alibaba.com
Fixes: fdbb6cd96ed5 ("ocfs2: correct l_next_free_rec in online check")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/inode.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index fcc89856ab95b..0a0a96054bfec 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -201,13 +201,15 @@ struct inode *ocfs2_iget(struct ocfs2_super *osb, u64 blkno, unsigned flags,
static int ocfs2_dinode_has_extents(struct ocfs2_dinode *di)
{
/* inodes flagged with other stuff in id2 */
- if (di->i_flags & (OCFS2_SUPER_BLOCK_FL | OCFS2_LOCAL_ALLOC_FL |
- OCFS2_CHAIN_FL | OCFS2_DEALLOC_FL))
+ if (le32_to_cpu(di->i_flags) &
+ (OCFS2_SUPER_BLOCK_FL | OCFS2_LOCAL_ALLOC_FL | OCFS2_CHAIN_FL |
+ OCFS2_DEALLOC_FL))
return 0;
/* i_flags doesn't indicate when id2 is a fast symlink */
- if (S_ISLNK(di->i_mode) && di->i_size && di->i_clusters == 0)
+ if (S_ISLNK(le16_to_cpu(di->i_mode)) && le64_to_cpu(di->i_size) &&
+ !le32_to_cpu(di->i_clusters))
return 0;
- if (di->i_dyn_features & OCFS2_INLINE_DATA_FL)
+ if (le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL)
return 0;
return 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 266/614] ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 265/614] ocfs2: use correct endian in ocfs2_dinode_has_extents Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 267/614] scsi: qla2xxx: Clear cmds after chip reset Greg Kroah-Hartman
` (361 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Sakari Ailus,
Rafael J. Wysocki, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 593ee49222a0d751062fd9a5e4a963ade4ec028a ]
acpi_fwnode_graph_parse_endpoint() calls fwnode_get_parent() to obtain the
parent fwnode but returns without calling fwnode_handle_put() on it. This
potentially leads to a fwnode refcount leak and prevents the parent node
from being released properly.
Call fwnode_handle_put() on the parent fwnode before returning to prevent
the leak from occurring.
Fixes: 3b27d00e7b6d ("device property: Move fwnode graph ops to firmware specific locations")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20251111075000.1828-1-vulab@iscas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/property.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 43d5e457814e1..b12057baaae7b 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1714,6 +1714,7 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
if (fwnode_property_read_u32(fwnode, "reg", &endpoint->id))
fwnode_property_read_u32(fwnode, "endpoint", &endpoint->id);
+ fwnode_handle_put(port_fwnode);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 267/614] scsi: qla2xxx: Clear cmds after chip reset
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 266/614] ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 268/614] scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls Greg Kroah-Hartman
` (360 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Bogdanov, Tony Battersby,
Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Battersby <tonyb@cybernetics.com>
[ Upstream commit d46c69a087aa3d1513f7a78f871b80251ea0c1ae ]
Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling
and host reset handling") caused two problems:
1. Commands sent to FW, after chip reset got stuck and never freed as FW
is not going to respond to them anymore.
2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a
("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
attempted to fix this, but introduced another bug under different
circumstances when two different CPUs were racing to call
qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in
dma_unmap_sg_attrs().
So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and
partially revert "scsi: qla2xxx: target: Fix offline port handling and
host reset handling" at __qla2x00_abort_all_cmds.
Fixes: aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling")
Fixes: 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands")
Co-developed-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Link: https://patch.msgid.link/0e7e5d26-e7a0-42d1-8235-40eeb27f3e98@cybernetics.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_os.c | 20 ++++++++++++++++++--
drivers/scsi/qla2xxx/qla_target.c | 5 +----
drivers/scsi/qla2xxx/qla_target.h | 1 +
3 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 5ffd945866527..70a579cf9c3fd 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1881,10 +1881,26 @@ __qla2x00_abort_all_cmds(struct qla_qpair *qp, int res)
continue;
}
cmd = (struct qla_tgt_cmd *)sp;
- cmd->aborted = 1;
+
+ if (cmd->sg_mapped)
+ qlt_unmap_sg(vha, cmd);
+
+ if (cmd->state == QLA_TGT_STATE_NEED_DATA) {
+ cmd->aborted = 1;
+ cmd->write_data_transferred = 0;
+ cmd->state = QLA_TGT_STATE_DATA_IN;
+ ha->tgt.tgt_ops->handle_data(cmd);
+ } else {
+ ha->tgt.tgt_ops->free_cmd(cmd);
+ }
break;
case TYPE_TGT_TMCMD:
- /* Skip task management functions. */
+ /*
+ * Currently, only ABTS response gets on the
+ * outstanding_cmds[]
+ */
+ ha->tgt.tgt_ops->free_mcmd(
+ (struct qla_tgt_mgmt_cmd *) sp);
break;
default:
break;
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 1e81582085e38..4c6aff59fe3fb 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2443,7 +2443,7 @@ static int qlt_pci_map_calc_cnt(struct qla_tgt_prm *prm)
return -1;
}
-static void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
+void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
{
struct qla_hw_data *ha;
struct qla_qpair *qpair;
@@ -3773,9 +3773,6 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
spin_lock_irqsave(&cmd->cmd_lock, flags);
if (cmd->aborted) {
- if (cmd->sg_mapped)
- qlt_unmap_sg(vha, cmd);
-
spin_unlock_irqrestore(&cmd->cmd_lock, flags);
/*
* It's normal to see 2 calls in this path:
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 15a59c125c532..c483966d0a847 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -1058,6 +1058,7 @@ extern int qlt_abort_cmd(struct qla_tgt_cmd *);
extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
+extern void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd);
extern void qlt_async_event(uint16_t, struct scsi_qla_host *, uint16_t *);
extern void qlt_enable_vha(struct scsi_qla_host *);
extern void qlt_vport_create(struct scsi_qla_host *, struct qla_hw_data *);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 268/614] scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 267/614] scsi: qla2xxx: Clear cmds after chip reset Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 269/614] leds: netxbig: Fix GPIO descriptor leak in error paths Greg Kroah-Hartman
` (359 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Martin K. Petersen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit acd194d9b5bac419e04968ffa44351afabb50bac ]
The driver calls ioport_map() to map I/O ports in sim710_probe_common()
but never calls ioport_unmap() to release the mapping. This causes
resource leaks in both the error path when request_irq() fails and in
the normal device removal path via sim710_device_remove().
Add ioport_unmap() calls in the out_release error path and in
sim710_device_remove().
Fixes: 56fece20086e ("[PATCH] finally fix 53c700 to use the generic iomem infrastructure")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251029032555.1476-1-vulab@iscas.ac.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/sim710.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/sim710.c b/drivers/scsi/sim710.c
index e519df68d603d..70c75ab1453a1 100644
--- a/drivers/scsi/sim710.c
+++ b/drivers/scsi/sim710.c
@@ -133,6 +133,7 @@ static int sim710_probe_common(struct device *dev, unsigned long base_addr,
out_put_host:
scsi_host_put(host);
out_release:
+ ioport_unmap(hostdata->base);
release_region(base_addr, 64);
out_free:
kfree(hostdata);
@@ -148,6 +149,7 @@ static int sim710_device_remove(struct device *dev)
scsi_remove_host(host);
NCR_700_release(host);
+ ioport_unmap(hostdata->base);
kfree(hostdata);
free_irq(host->irq, host);
release_region(host->base, 64);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 269/614] leds: netxbig: Fix GPIO descriptor leak in error paths
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 268/614] scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 270/614] arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors Greg Kroah-Hartman
` (358 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markus Elfring, Haotian Zhang,
Lee Jones, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 03865dd8af52eb16c38062df2ed30a91b604780e ]
The function netxbig_gpio_ext_get() acquires GPIO descriptors but
fails to release them when errors occur mid-way through initialization.
The cleanup callback registered by devm_add_action_or_reset() only
runs on success, leaving acquired GPIOs leaked on error paths.
Add goto-based error handling to release all acquired GPIOs before
returning errors.
Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
Suggested-by: Markus Elfring <Markus.Elfring@web.de>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251031021620.781-1-vulab@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/leds-netxbig.c | 36 ++++++++++++++++++++++++++----------
1 file changed, 26 insertions(+), 10 deletions(-)
diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index e95287416ef87..99df46f2d9f52 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -364,6 +364,9 @@ static int netxbig_gpio_ext_get(struct device *dev,
if (!addr)
return -ENOMEM;
+ gpio_ext->addr = addr;
+ gpio_ext->num_addr = 0;
+
/*
* We cannot use devm_ managed resources with these GPIO descriptors
* since they are associated with the "GPIO extension device" which
@@ -375,45 +378,58 @@ static int netxbig_gpio_ext_get(struct device *dev,
gpiod = gpiod_get_index(gpio_ext_dev, "addr", i,
GPIOD_OUT_LOW);
if (IS_ERR(gpiod))
- return PTR_ERR(gpiod);
+ goto err_set_code;
gpiod_set_consumer_name(gpiod, "GPIO extension addr");
addr[i] = gpiod;
+ gpio_ext->num_addr++;
}
- gpio_ext->addr = addr;
- gpio_ext->num_addr = num_addr;
ret = gpiod_count(gpio_ext_dev, "data");
if (ret < 0) {
dev_err(dev,
"Failed to count GPIOs in DT property data-gpios\n");
- return ret;
+ goto err_free_addr;
}
num_data = ret;
data = devm_kcalloc(dev, num_data, sizeof(*data), GFP_KERNEL);
- if (!data)
- return -ENOMEM;
+ if (!data) {
+ ret = -ENOMEM;
+ goto err_free_addr;
+ }
+
+ gpio_ext->data = data;
+ gpio_ext->num_data = 0;
for (i = 0; i < num_data; i++) {
gpiod = gpiod_get_index(gpio_ext_dev, "data", i,
GPIOD_OUT_LOW);
if (IS_ERR(gpiod))
- return PTR_ERR(gpiod);
+ goto err_free_data;
gpiod_set_consumer_name(gpiod, "GPIO extension data");
data[i] = gpiod;
+ gpio_ext->num_data++;
}
- gpio_ext->data = data;
- gpio_ext->num_data = num_data;
gpiod = gpiod_get(gpio_ext_dev, "enable", GPIOD_OUT_LOW);
if (IS_ERR(gpiod)) {
dev_err(dev,
"Failed to get GPIO from DT property enable-gpio\n");
- return PTR_ERR(gpiod);
+ goto err_free_data;
}
gpiod_set_consumer_name(gpiod, "GPIO extension enable");
gpio_ext->enable = gpiod;
return devm_add_action_or_reset(dev, netxbig_gpio_ext_remove, gpio_ext);
+
+err_free_data:
+ for (i = 0; i < gpio_ext->num_data; i++)
+ gpiod_put(gpio_ext->data[i]);
+err_set_code:
+ ret = PTR_ERR(gpiod);
+err_free_addr:
+ for (i = 0; i < gpio_ext->num_addr; i++)
+ gpiod_put(gpio_ext->addr[i]);
+ return ret;
}
static int netxbig_leds_get_of_pdata(struct device *dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 270/614] arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 269/614] leds: netxbig: Fix GPIO descriptor leak in error paths Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 271/614] accel/amdxdna: Clear mailbox interrupt register during channel creation Greg Kroah-Hartman
` (357 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, Ryan Roberts,
Kevin Brodsky, Chaitanya S Prakash, Linu Cherian,
Anshuman Khandual, Catalin Marinas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya S Prakash <chaitanyas.prakash@arm.com>
[ Upstream commit bfc184cb1ba7226b21ab26f0b220581895c5ac9e ]
arch_add_memory() is used to hotplug memory into a system but as a part
of its implementation it calls __create_pgd_mapping(), which uses
pgtable_alloc() in order to build intermediate page tables. As this path
was initally only used during early boot pgtable_alloc() is designed to
BUG_ON() on failure. However, in the event that memory hotplug is
attempted when the system's memory is extremely tight and the allocation
were to fail, it would lead to panicking the system, which is not
desirable. Hence update __create_pgd_mapping and all it's callers to be
non void and propagate -ENOMEM on allocation failure to allow system to
fail gracefully.
But during early boot if there is an allocation failure, we want the
system to panic, hence create a wrapper around __create_pgd_mapping()
called early_create_pgd_mapping() which is designed to panic, if ret
is non zero value. All the init calls are updated to use this wrapper
rather than the modified __create_pgd_mapping() to restore
functionality.
Fixes: 4ab215061554 ("arm64: Add memory hotplug support")
Reviewed-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Chaitanya S Prakash <chaitanyas.prakash@arm.com>
Signed-off-by: Linu Cherian <linu.cherian@arm.com>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/mmu.c | 214 ++++++++++++++++++++++++++++----------------
1 file changed, 136 insertions(+), 78 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 2ba01dc8ef822..aeb6fb25a951a 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -49,6 +49,8 @@
#define NO_CONT_MAPPINGS BIT(1)
#define NO_EXEC_MAPPINGS BIT(2) /* assumes FEAT_HPDS is not used */
+#define INVALID_PHYS_ADDR (-1ULL)
+
DEFINE_STATIC_KEY_FALSE(arm64_ptdump_lock_key);
u64 kimage_voffset __ro_after_init;
@@ -194,11 +196,11 @@ static void init_pte(pte_t *ptep, unsigned long addr, unsigned long end,
} while (ptep++, addr += PAGE_SIZE, addr != end);
}
-static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
- unsigned long end, phys_addr_t phys,
- pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type),
- int flags)
+static int alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
+ unsigned long end, phys_addr_t phys,
+ pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
{
unsigned long next;
pmd_t pmd = READ_ONCE(*pmdp);
@@ -213,6 +215,8 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
pmdval |= PMD_TABLE_PXN;
BUG_ON(!pgtable_alloc);
pte_phys = pgtable_alloc(TABLE_PTE);
+ if (pte_phys == INVALID_PHYS_ADDR)
+ return -ENOMEM;
ptep = pte_set_fixmap(pte_phys);
init_clear_pgtable(ptep);
ptep += pte_index(addr);
@@ -244,11 +248,13 @@ static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
* walker.
*/
pte_clear_fixmap();
+
+ return 0;
}
-static void init_pmd(pmd_t *pmdp, unsigned long addr, unsigned long end,
- phys_addr_t phys, pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type), int flags)
+static int init_pmd(pmd_t *pmdp, unsigned long addr, unsigned long end,
+ phys_addr_t phys, pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type), int flags)
{
unsigned long next;
@@ -269,22 +275,29 @@ static void init_pmd(pmd_t *pmdp, unsigned long addr, unsigned long end,
BUG_ON(!pgattr_change_is_safe(pmd_val(old_pmd),
READ_ONCE(pmd_val(*pmdp))));
} else {
- alloc_init_cont_pte(pmdp, addr, next, phys, prot,
- pgtable_alloc, flags);
+ int ret;
+
+ ret = alloc_init_cont_pte(pmdp, addr, next, phys, prot,
+ pgtable_alloc, flags);
+ if (ret)
+ return ret;
BUG_ON(pmd_val(old_pmd) != 0 &&
pmd_val(old_pmd) != READ_ONCE(pmd_val(*pmdp)));
}
phys += next - addr;
} while (pmdp++, addr = next, addr != end);
+
+ return 0;
}
-static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
- unsigned long end, phys_addr_t phys,
- pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type),
- int flags)
+static int alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
+ unsigned long end, phys_addr_t phys,
+ pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
{
+ int ret;
unsigned long next;
pud_t pud = READ_ONCE(*pudp);
pmd_t *pmdp;
@@ -301,6 +314,8 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
pudval |= PUD_TABLE_PXN;
BUG_ON(!pgtable_alloc);
pmd_phys = pgtable_alloc(TABLE_PMD);
+ if (pmd_phys == INVALID_PHYS_ADDR)
+ return -ENOMEM;
pmdp = pmd_set_fixmap(pmd_phys);
init_clear_pgtable(pmdp);
pmdp += pmd_index(addr);
@@ -320,20 +335,26 @@ static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
(flags & NO_CONT_MAPPINGS) == 0)
__prot = __pgprot(pgprot_val(prot) | PTE_CONT);
- init_pmd(pmdp, addr, next, phys, __prot, pgtable_alloc, flags);
+ ret = init_pmd(pmdp, addr, next, phys, __prot, pgtable_alloc, flags);
+ if (ret)
+ goto out;
pmdp += pmd_index(next) - pmd_index(addr);
phys += next - addr;
} while (addr = next, addr != end);
+out:
pmd_clear_fixmap();
+
+ return ret;
}
-static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
- phys_addr_t phys, pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type),
- int flags)
+static int alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
+ phys_addr_t phys, pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
{
+ int ret = 0;
unsigned long next;
p4d_t p4d = READ_ONCE(*p4dp);
pud_t *pudp;
@@ -346,6 +367,8 @@ static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
p4dval |= P4D_TABLE_PXN;
BUG_ON(!pgtable_alloc);
pud_phys = pgtable_alloc(TABLE_PUD);
+ if (pud_phys == INVALID_PHYS_ADDR)
+ return -ENOMEM;
pudp = pud_set_fixmap(pud_phys);
init_clear_pgtable(pudp);
pudp += pud_index(addr);
@@ -375,8 +398,10 @@ static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
BUG_ON(!pgattr_change_is_safe(pud_val(old_pud),
READ_ONCE(pud_val(*pudp))));
} else {
- alloc_init_cont_pmd(pudp, addr, next, phys, prot,
- pgtable_alloc, flags);
+ ret = alloc_init_cont_pmd(pudp, addr, next, phys, prot,
+ pgtable_alloc, flags);
+ if (ret)
+ goto out;
BUG_ON(pud_val(old_pud) != 0 &&
pud_val(old_pud) != READ_ONCE(pud_val(*pudp)));
@@ -384,14 +409,18 @@ static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end,
phys += next - addr;
} while (pudp++, addr = next, addr != end);
+out:
pud_clear_fixmap();
+
+ return ret;
}
-static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end,
- phys_addr_t phys, pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type),
- int flags)
+static int alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end,
+ phys_addr_t phys, pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
{
+ int ret;
unsigned long next;
pgd_t pgd = READ_ONCE(*pgdp);
p4d_t *p4dp;
@@ -404,6 +433,8 @@ static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end,
pgdval |= PGD_TABLE_PXN;
BUG_ON(!pgtable_alloc);
p4d_phys = pgtable_alloc(TABLE_P4D);
+ if (p4d_phys == INVALID_PHYS_ADDR)
+ return -ENOMEM;
p4dp = p4d_set_fixmap(p4d_phys);
init_clear_pgtable(p4dp);
p4dp += p4d_index(addr);
@@ -418,8 +449,10 @@ static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end,
next = p4d_addr_end(addr, end);
- alloc_init_pud(p4dp, addr, next, phys, prot,
- pgtable_alloc, flags);
+ ret = alloc_init_pud(p4dp, addr, next, phys, prot,
+ pgtable_alloc, flags);
+ if (ret)
+ goto out;
BUG_ON(p4d_val(old_p4d) != 0 &&
p4d_val(old_p4d) != READ_ONCE(p4d_val(*p4dp)));
@@ -427,15 +460,19 @@ static void alloc_init_p4d(pgd_t *pgdp, unsigned long addr, unsigned long end,
phys += next - addr;
} while (p4dp++, addr = next, addr != end);
+out:
p4d_clear_fixmap();
+
+ return ret;
}
-static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys,
- unsigned long virt, phys_addr_t size,
- pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type),
- int flags)
+static int __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys,
+ unsigned long virt, phys_addr_t size,
+ pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
{
+ int ret;
unsigned long addr, end, next;
pgd_t *pgdp = pgd_offset_pgd(pgdir, virt);
@@ -444,7 +481,7 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys,
* within a page, we cannot map the region as the caller expects.
*/
if (WARN_ON((phys ^ virt) & ~PAGE_MASK))
- return;
+ return -EINVAL;
phys &= PAGE_MASK;
addr = virt & PAGE_MASK;
@@ -452,25 +489,45 @@ static void __create_pgd_mapping_locked(pgd_t *pgdir, phys_addr_t phys,
do {
next = pgd_addr_end(addr, end);
- alloc_init_p4d(pgdp, addr, next, phys, prot, pgtable_alloc,
- flags);
+ ret = alloc_init_p4d(pgdp, addr, next, phys, prot, pgtable_alloc,
+ flags);
+ if (ret)
+ return ret;
phys += next - addr;
} while (pgdp++, addr = next, addr != end);
+
+ return 0;
}
-static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
- unsigned long virt, phys_addr_t size,
- pgprot_t prot,
- phys_addr_t (*pgtable_alloc)(enum pgtable_type),
- int flags)
+static int __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
+ unsigned long virt, phys_addr_t size,
+ pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
{
+ int ret;
+
mutex_lock(&fixmap_lock);
- __create_pgd_mapping_locked(pgdir, phys, virt, size, prot,
- pgtable_alloc, flags);
+ ret = __create_pgd_mapping_locked(pgdir, phys, virt, size, prot,
+ pgtable_alloc, flags);
mutex_unlock(&fixmap_lock);
+
+ return ret;
}
-#define INVALID_PHYS_ADDR (-1ULL)
+static void early_create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
+ unsigned long virt, phys_addr_t size,
+ pgprot_t prot,
+ phys_addr_t (*pgtable_alloc)(enum pgtable_type),
+ int flags)
+{
+ int ret;
+
+ ret = __create_pgd_mapping(pgdir, phys, virt, size, prot, pgtable_alloc,
+ flags);
+ if (ret)
+ panic("Failed to create page tables\n");
+}
static phys_addr_t __pgd_pgtable_alloc(struct mm_struct *mm, gfp_t gfp,
enum pgtable_type pgtable_type)
@@ -511,21 +568,13 @@ try_pgd_pgtable_alloc_init_mm(enum pgtable_type pgtable_type, gfp_t gfp)
static phys_addr_t __maybe_unused
pgd_pgtable_alloc_init_mm(enum pgtable_type pgtable_type)
{
- phys_addr_t pa;
-
- pa = __pgd_pgtable_alloc(&init_mm, GFP_PGTABLE_KERNEL, pgtable_type);
- BUG_ON(pa == INVALID_PHYS_ADDR);
- return pa;
+ return __pgd_pgtable_alloc(&init_mm, GFP_PGTABLE_KERNEL, pgtable_type);
}
static phys_addr_t
pgd_pgtable_alloc_special_mm(enum pgtable_type pgtable_type)
{
- phys_addr_t pa;
-
- pa = __pgd_pgtable_alloc(NULL, GFP_PGTABLE_KERNEL, pgtable_type);
- BUG_ON(pa == INVALID_PHYS_ADDR);
- return pa;
+ return __pgd_pgtable_alloc(NULL, GFP_PGTABLE_KERNEL, pgtable_type);
}
static void split_contpte(pte_t *ptep)
@@ -935,8 +984,8 @@ void __init create_mapping_noalloc(phys_addr_t phys, unsigned long virt,
&phys, virt);
return;
}
- __create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL,
- NO_CONT_MAPPINGS);
+ early_create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL,
+ NO_CONT_MAPPINGS);
}
void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
@@ -950,8 +999,8 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
if (page_mappings_only)
flags = NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS;
- __create_pgd_mapping(mm->pgd, phys, virt, size, prot,
- pgd_pgtable_alloc_special_mm, flags);
+ early_create_pgd_mapping(mm->pgd, phys, virt, size, prot,
+ pgd_pgtable_alloc_special_mm, flags);
}
static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
@@ -963,8 +1012,8 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
return;
}
- __create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL,
- NO_CONT_MAPPINGS);
+ early_create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL,
+ NO_CONT_MAPPINGS);
/* flush the TLBs after updating live kernel mappings */
flush_tlb_kernel_range(virt, virt + size);
@@ -973,8 +1022,8 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
static void __init __map_memblock(pgd_t *pgdp, phys_addr_t start,
phys_addr_t end, pgprot_t prot, int flags)
{
- __create_pgd_mapping(pgdp, start, __phys_to_virt(start), end - start,
- prot, early_pgtable_alloc, flags);
+ early_create_pgd_mapping(pgdp, start, __phys_to_virt(start), end - start,
+ prot, early_pgtable_alloc, flags);
}
void __init mark_linear_text_alias_ro(void)
@@ -1207,6 +1256,8 @@ static int __init __kpti_install_ng_mappings(void *__unused)
remap_fn = (void *)__pa_symbol(idmap_kpti_install_ng_mappings);
if (!cpu) {
+ int ret;
+
alloc = __get_free_pages(GFP_ATOMIC | __GFP_ZERO, order);
kpti_ng_temp_pgd = (pgd_t *)(alloc + (levels - 1) * PAGE_SIZE);
kpti_ng_temp_alloc = kpti_ng_temp_pgd_pa = __pa(kpti_ng_temp_pgd);
@@ -1227,9 +1278,11 @@ static int __init __kpti_install_ng_mappings(void *__unused)
// covers the PTE[] page itself, the remaining entries are free
// to be used as a ad-hoc fixmap.
//
- __create_pgd_mapping_locked(kpti_ng_temp_pgd, __pa(alloc),
- KPTI_NG_TEMP_VA, PAGE_SIZE, PAGE_KERNEL,
- kpti_ng_pgd_alloc, 0);
+ ret = __create_pgd_mapping_locked(kpti_ng_temp_pgd, __pa(alloc),
+ KPTI_NG_TEMP_VA, PAGE_SIZE, PAGE_KERNEL,
+ kpti_ng_pgd_alloc, 0);
+ if (ret)
+ panic("Failed to create page tables\n");
}
cpu_install_idmap();
@@ -1282,9 +1335,9 @@ static int __init map_entry_trampoline(void)
/* Map only the text into the trampoline page table */
memset(tramp_pg_dir, 0, PGD_SIZE);
- __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS,
- entry_tramp_text_size(), prot,
- pgd_pgtable_alloc_init_mm, NO_BLOCK_MAPPINGS);
+ early_create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS,
+ entry_tramp_text_size(), prot,
+ pgd_pgtable_alloc_init_mm, NO_BLOCK_MAPPINGS);
/* Map both the text and data into the kernel page table */
for (i = 0; i < DIV_ROUND_UP(entry_tramp_text_size(), PAGE_SIZE); i++)
@@ -1926,23 +1979,28 @@ int arch_add_memory(int nid, u64 start, u64 size,
if (force_pte_mapping())
flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS;
- __create_pgd_mapping(swapper_pg_dir, start, __phys_to_virt(start),
- size, params->pgprot, pgd_pgtable_alloc_init_mm,
- flags);
+ ret = __create_pgd_mapping(swapper_pg_dir, start, __phys_to_virt(start),
+ size, params->pgprot, pgd_pgtable_alloc_init_mm,
+ flags);
+ if (ret)
+ goto err;
memblock_clear_nomap(start, size);
ret = __add_pages(nid, start >> PAGE_SHIFT, size >> PAGE_SHIFT,
params);
if (ret)
- __remove_pgd_mapping(swapper_pg_dir,
- __phys_to_virt(start), size);
- else {
- /* Address of hotplugged memory can be smaller */
- max_pfn = max(max_pfn, PFN_UP(start + size));
- max_low_pfn = max_pfn;
- }
+ goto err;
+
+ /* Address of hotplugged memory can be smaller */
+ max_pfn = max(max_pfn, PFN_UP(start + size));
+ max_low_pfn = max_pfn;
+
+ return 0;
+err:
+ __remove_pgd_mapping(swapper_pg_dir,
+ __phys_to_virt(start), size);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 271/614] accel/amdxdna: Clear mailbox interrupt register during channel creation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 270/614] arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 272/614] accel/amdxdna: Fix deadlock between context destroy and job timeout Greg Kroah-Hartman
` (356 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Falkowski, Lizhi Hou,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit 6ff9385c07aa311f01f87307e6256231be7d8675 ]
The mailbox interrupt register is not always cleared when a mailbox channel
is created. This can leave stale interrupt states from previous operations.
Fix this by explicitly clearing the interrupt register in the mailbox
channel creation function.
Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox")
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251107181115.1293158-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/amdxdna_mailbox.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/accel/amdxdna/amdxdna_mailbox.c b/drivers/accel/amdxdna/amdxdna_mailbox.c
index da1ac89bb78f1..6634a4d5717ff 100644
--- a/drivers/accel/amdxdna/amdxdna_mailbox.c
+++ b/drivers/accel/amdxdna/amdxdna_mailbox.c
@@ -513,6 +513,7 @@ xdna_mailbox_create_channel(struct mailbox *mb,
}
mb_chann->bad_state = false;
+ mailbox_reg_write(mb_chann, mb_chann->iohub_int_addr, 0);
MB_DBG(mb_chann, "Mailbox channel created (irq: %d)", mb_chann->msix_irq);
return mb_chann;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 272/614] accel/amdxdna: Fix deadlock between context destroy and job timeout
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 271/614] accel/amdxdna: Clear mailbox interrupt register during channel creation Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 273/614] bpf: Free special fields when update [lru_,]percpu_hash maps Greg Kroah-Hartman
` (355 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Falkowski, Lizhi Hou,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Hou <lizhi.hou@amd.com>
[ Upstream commit ca2583412306ceda9304a7c4302fd9efbf43e963 ]
Hardware context destroy function holds dev_lock while waiting for all jobs
to complete. The timeout job also needs to acquire dev_lock, this leads to
a deadlock.
Fix the issue by temporarily releasing dev_lock before waiting for all
jobs to finish, and reacquiring it afterward.
Fixes: 4fd6ca90fc7f ("accel/amdxdna: Refactor hardware context destroy routine")
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251107181050.1293125-1-lizhi.hou@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/accel/amdxdna/aie2_ctx.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
index 2e479a8d86c31..75246c481fa50 100644
--- a/drivers/accel/amdxdna/aie2_ctx.c
+++ b/drivers/accel/amdxdna/aie2_ctx.c
@@ -681,17 +681,19 @@ void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx)
ndev->hwctx_num--;
XDNA_DBG(xdna, "%s sequence number %lld", hwctx->name, hwctx->priv->seq);
- drm_sched_entity_destroy(&hwctx->priv->entity);
-
aie2_hwctx_wait_for_idle(hwctx);
/* Request fw to destroy hwctx and cancel the rest pending requests */
aie2_release_resource(hwctx);
+ mutex_unlock(&xdna->dev_lock);
+ drm_sched_entity_destroy(&hwctx->priv->entity);
+
/* Wait for all submitted jobs to be completed or canceled */
wait_event(hwctx->priv->job_free_wq,
atomic64_read(&hwctx->job_submit_cnt) ==
atomic64_read(&hwctx->job_free_cnt));
+ mutex_lock(&xdna->dev_lock);
drm_sched_fini(&hwctx->priv->sched);
aie2_ctx_syncobj_destroy(hwctx);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 273/614] bpf: Free special fields when update [lru_,]percpu_hash maps
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 272/614] accel/amdxdna: Fix deadlock between context destroy and job timeout Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 274/614] PCI: keystone: Exit ks_pcie_probe() for invalid mode Greg Kroah-Hartman
` (354 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Hwang, Yonghong Song,
Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit 6af6e49a76c9af7d42eb923703e7648cb2bf401a ]
As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing
calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the
memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the
map gets freed.
Fix this by calling 'bpf_obj_free_fields()' after
'copy_map_value[,_long]()' in 'pcpu_copy_value()'.
Fixes: 65334e64a493 ("bpf: Support kptrs in percpu hashmap and percpu LRU hashmap")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20251105151407.12723-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/hashtab.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index c2fcd0cd51e51..e7721f0776c72 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -947,15 +947,21 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
void *value, bool onallcpus)
{
+ void *ptr;
+
if (!onallcpus) {
/* copy true value_size bytes */
- copy_map_value(&htab->map, this_cpu_ptr(pptr), value);
+ ptr = this_cpu_ptr(pptr);
+ copy_map_value(&htab->map, ptr, value);
+ bpf_obj_free_fields(htab->map.record, ptr);
} else {
u32 size = round_up(htab->map.value_size, 8);
int off = 0, cpu;
for_each_possible_cpu(cpu) {
- copy_map_value_long(&htab->map, per_cpu_ptr(pptr, cpu), value + off);
+ ptr = per_cpu_ptr(pptr, cpu);
+ copy_map_value_long(&htab->map, ptr, value + off);
+ bpf_obj_free_fields(htab->map.record, ptr);
off += size;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 274/614] PCI: keystone: Exit ks_pcie_probe() for invalid mode
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 273/614] bpf: Free special fields when update [lru_,]percpu_hash maps Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 275/614] soc: renesas: r9a09g056-sys: Populate max_register Greg Kroah-Hartman
` (353 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli,
Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <s-vadapalli@ti.com>
[ Upstream commit 95d9c3f0e4546eaec0977f3b387549a8463cd49f ]
Commit under Fixes introduced support for PCIe EP mode on AM654x platforms.
When the mode happens to be either "DW_PCIE_RC_TYPE" or "DW_PCIE_EP_TYPE",
the PCIe Controller is configured accordingly. However, when the mode is
neither of them, an error message is displayed, but the driver probe
succeeds. Since this "invalid" mode is not associated with a functional
PCIe Controller, the probe should fail.
Fix the behavior by exiting "ks_pcie_probe()" with the return value of
"-EINVAL" in addition to displaying the existing error message when the
mode is invalid.
Fixes: 23284ad677a9 ("PCI: keystone: Add support for PCIe EP in AM654x Platforms")
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251029080547.1253757-4-s-vadapalli@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-keystone.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index eb00aa3807220..25b8193ffbcf1 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1337,6 +1337,8 @@ static int ks_pcie_probe(struct platform_device *pdev)
break;
default:
dev_err(dev, "INVALID device type %d\n", mode);
+ ret = -EINVAL;
+ goto err_get_sync;
}
ks_pcie_enable_error_irq(ks_pcie);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 275/614] soc: renesas: r9a09g056-sys: Populate max_register
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 274/614] PCI: keystone: Exit ks_pcie_probe() for invalid mode Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 276/614] soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config Greg Kroah-Hartman
` (352 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit 4ff787433ba6d564b00334b4bfd6350f5b6f4bb3 ]
Populate max_register to avoid external aborts.
Fixes: 2da2740fb9c8 ("soc: renesas: rz-sysc: Add syscon/regmap support")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251105070526.264445-2-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/renesas/r9a09g056-sys.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/soc/renesas/r9a09g056-sys.c b/drivers/soc/renesas/r9a09g056-sys.c
index 3ad1422eba36e..16b4e433c3373 100644
--- a/drivers/soc/renesas/r9a09g056-sys.c
+++ b/drivers/soc/renesas/r9a09g056-sys.c
@@ -72,4 +72,5 @@ static const struct rz_sysc_soc_id_init_data rzv2n_sys_soc_id_init_data __initco
const struct rz_sysc_init_data rzv2n_sys_init_data = {
.soc_id_init_data = &rzv2n_sys_soc_id_init_data,
+ .max_register = 0x170c,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 276/614] soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 275/614] soc: renesas: r9a09g056-sys: Populate max_register Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 277/614] arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A Greg Kroah-Hartman
` (351 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Geert Uytterhoeven,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit c432180a7d95081353a96fd6d5bd75b0fc8a27c3 ]
Not all system controller registers are accessible from Linux. Accessing
such registers generates synchronous external abort. Populate the
readable_reg and writeable_reg members of the regmap config to inform the
regmap core which registers can be accessed. The list will need to be
updated whenever new system controller functionality is exported through
regmap.
Fixes: 2da2740fb9c8 ("soc: renesas: rz-sysc: Add syscon/regmap support")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20251105070526.264445-3-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/renesas/r9a08g045-sysc.c | 69 ++++++++++++++++++
drivers/soc/renesas/r9a09g047-sys.c | 79 +++++++++++++++++++++
drivers/soc/renesas/r9a09g056-sys.c | 68 ++++++++++++++++++
drivers/soc/renesas/r9a09g057-sys.c | 101 +++++++++++++++++++++++++++
drivers/soc/renesas/rz-sysc.c | 2 +
drivers/soc/renesas/rz-sysc.h | 4 ++
6 files changed, 323 insertions(+)
diff --git a/drivers/soc/renesas/r9a08g045-sysc.c b/drivers/soc/renesas/r9a08g045-sysc.c
index 0504d4e687616..03d653d5cde55 100644
--- a/drivers/soc/renesas/r9a08g045-sysc.c
+++ b/drivers/soc/renesas/r9a08g045-sysc.c
@@ -6,10 +6,29 @@
*/
#include <linux/bits.h>
+#include <linux/device.h>
#include <linux/init.h>
#include "rz-sysc.h"
+#define SYS_XSPI_MAP_STAADD_CS0 0x348
+#define SYS_XSPI_MAP_ENDADD_CS0 0x34c
+#define SYS_XSPI_MAP_STAADD_CS1 0x350
+#define SYS_XSPI_MAP_ENDADD_CS1 0x354
+#define SYS_GETH0_CFG 0x380
+#define SYS_GETH1_CFG 0x390
+#define SYS_PCIE_CFG 0x3a0
+#define SYS_PCIE_MON 0x3a4
+#define SYS_PCIE_ERR_MON 0x3ac
+#define SYS_PCIE_PHY 0x3b4
+#define SYS_I2C0_CFG 0x400
+#define SYS_I2C1_CFG 0x410
+#define SYS_I2C2_CFG 0x420
+#define SYS_I2C3_CFG 0x430
+#define SYS_I3C_CFG 0x440
+#define SYS_USB_PWRRDY 0xd70
+#define SYS_PCIE_RST_RSM_B 0xd74
+
static const struct rz_sysc_soc_id_init_data rzg3s_sysc_soc_id_init_data __initconst = {
.family = "RZ/G3S",
.id = 0x85e0447,
@@ -18,7 +37,57 @@ static const struct rz_sysc_soc_id_init_data rzg3s_sysc_soc_id_init_data __initc
.specific_id_mask = GENMASK(27, 0),
};
+static bool rzg3s_regmap_readable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_XSPI_MAP_STAADD_CS0:
+ case SYS_XSPI_MAP_ENDADD_CS0:
+ case SYS_XSPI_MAP_STAADD_CS1:
+ case SYS_XSPI_MAP_ENDADD_CS1:
+ case SYS_GETH0_CFG:
+ case SYS_GETH1_CFG:
+ case SYS_PCIE_CFG:
+ case SYS_PCIE_MON:
+ case SYS_PCIE_ERR_MON:
+ case SYS_PCIE_PHY:
+ case SYS_I2C0_CFG:
+ case SYS_I2C1_CFG:
+ case SYS_I2C2_CFG:
+ case SYS_I2C3_CFG:
+ case SYS_I3C_CFG:
+ case SYS_USB_PWRRDY:
+ case SYS_PCIE_RST_RSM_B:
+ return true;
+ default:
+ return false;
+ }
+}
+
+static bool rzg3s_regmap_writeable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_XSPI_MAP_STAADD_CS0:
+ case SYS_XSPI_MAP_ENDADD_CS0:
+ case SYS_XSPI_MAP_STAADD_CS1:
+ case SYS_XSPI_MAP_ENDADD_CS1:
+ case SYS_PCIE_CFG:
+ case SYS_PCIE_PHY:
+ case SYS_I2C0_CFG:
+ case SYS_I2C1_CFG:
+ case SYS_I2C2_CFG:
+ case SYS_I2C3_CFG:
+ case SYS_I3C_CFG:
+ case SYS_USB_PWRRDY:
+ case SYS_PCIE_RST_RSM_B:
+ return true;
+ default:
+ return false;
+ }
+}
+
const struct rz_sysc_init_data rzg3s_sysc_init_data __initconst = {
.soc_id_init_data = &rzg3s_sysc_soc_id_init_data,
+ .readable_reg = rzg3s_regmap_readable_reg,
+ .writeable_reg = rzg3s_regmap_writeable_reg,
.max_register = 0xe20,
};
diff --git a/drivers/soc/renesas/r9a09g047-sys.c b/drivers/soc/renesas/r9a09g047-sys.c
index 2e8426c030504..e413b0eff9bfd 100644
--- a/drivers/soc/renesas/r9a09g047-sys.c
+++ b/drivers/soc/renesas/r9a09g047-sys.c
@@ -29,6 +29,27 @@
#define SYS_LSI_PRR_CA55_DIS BIT(8)
#define SYS_LSI_PRR_NPU_DIS BIT(1)
+#define SYS_LSI_OTPTSU1TRMVAL0 0x330
+#define SYS_LSI_OTPTSU1TRMVAL1 0x334
+#define SYS_SPI_STAADDCS0 0x900
+#define SYS_SPI_ENDADDCS0 0x904
+#define SYS_SPI_STAADDCS1 0x908
+#define SYS_SPI_ENDADDCS1 0x90c
+#define SYS_VSP_CLK 0xe00
+#define SYS_GBETH0_CFG 0xf00
+#define SYS_GBETH1_CFG 0xf04
+#define SYS_PCIE_INTX_CH0 0x1000
+#define SYS_PCIE_MSI1_CH0 0x1004
+#define SYS_PCIE_MSI2_CH0 0x1008
+#define SYS_PCIE_MSI3_CH0 0x100c
+#define SYS_PCIE_MSI4_CH0 0x1010
+#define SYS_PCIE_MSI5_CH0 0x1014
+#define SYS_PCIE_PME_CH0 0x1018
+#define SYS_PCIE_ACK_CH0 0x101c
+#define SYS_PCIE_MISC_CH0 0x1020
+#define SYS_PCIE_MODE_CH0 0x1024
+#define SYS_ADC_CFG 0x1600
+
static void rzg3e_sys_print_id(struct device *dev,
void __iomem *sysc_base,
struct soc_device_attribute *soc_dev_attr)
@@ -62,7 +83,65 @@ static const struct rz_sysc_soc_id_init_data rzg3e_sys_soc_id_init_data __initco
.print_id = rzg3e_sys_print_id,
};
+static bool rzg3e_regmap_readable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_LSI_OTPTSU1TRMVAL0:
+ case SYS_LSI_OTPTSU1TRMVAL1:
+ case SYS_SPI_STAADDCS0:
+ case SYS_SPI_ENDADDCS0:
+ case SYS_SPI_STAADDCS1:
+ case SYS_SPI_ENDADDCS1:
+ case SYS_VSP_CLK:
+ case SYS_GBETH0_CFG:
+ case SYS_GBETH1_CFG:
+ case SYS_PCIE_INTX_CH0:
+ case SYS_PCIE_MSI1_CH0:
+ case SYS_PCIE_MSI2_CH0:
+ case SYS_PCIE_MSI3_CH0:
+ case SYS_PCIE_MSI4_CH0:
+ case SYS_PCIE_MSI5_CH0:
+ case SYS_PCIE_PME_CH0:
+ case SYS_PCIE_ACK_CH0:
+ case SYS_PCIE_MISC_CH0:
+ case SYS_PCIE_MODE_CH0:
+ case SYS_ADC_CFG:
+ return true;
+ default:
+ return false;
+ }
+}
+
+static bool rzg3e_regmap_writeable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_SPI_STAADDCS0:
+ case SYS_SPI_ENDADDCS0:
+ case SYS_SPI_STAADDCS1:
+ case SYS_SPI_ENDADDCS1:
+ case SYS_VSP_CLK:
+ case SYS_GBETH0_CFG:
+ case SYS_GBETH1_CFG:
+ case SYS_PCIE_INTX_CH0:
+ case SYS_PCIE_MSI1_CH0:
+ case SYS_PCIE_MSI2_CH0:
+ case SYS_PCIE_MSI3_CH0:
+ case SYS_PCIE_MSI4_CH0:
+ case SYS_PCIE_MSI5_CH0:
+ case SYS_PCIE_PME_CH0:
+ case SYS_PCIE_ACK_CH0:
+ case SYS_PCIE_MISC_CH0:
+ case SYS_PCIE_MODE_CH0:
+ case SYS_ADC_CFG:
+ return true;
+ default:
+ return false;
+ }
+}
+
const struct rz_sysc_init_data rzg3e_sys_init_data = {
.soc_id_init_data = &rzg3e_sys_soc_id_init_data,
+ .readable_reg = rzg3e_regmap_readable_reg,
+ .writeable_reg = rzg3e_regmap_writeable_reg,
.max_register = 0x170c,
};
diff --git a/drivers/soc/renesas/r9a09g056-sys.c b/drivers/soc/renesas/r9a09g056-sys.c
index 16b4e433c3373..42f5eff291fd1 100644
--- a/drivers/soc/renesas/r9a09g056-sys.c
+++ b/drivers/soc/renesas/r9a09g056-sys.c
@@ -34,6 +34,24 @@
#define SYS_RZV2N_FEATURE_C55 BIT(1)
#define SYS_RZV2N_FEATURE_SEC BIT(2)
+#define SYS_LSI_OTPTSU0TRMVAL0 0x320
+#define SYS_LSI_OTPTSU0TRMVAL1 0x324
+#define SYS_LSI_OTPTSU1TRMVAL0 0x330
+#define SYS_LSI_OTPTSU1TRMVAL1 0x334
+#define SYS_GBETH0_CFG 0xf00
+#define SYS_GBETH1_CFG 0xf04
+#define SYS_PCIE_INTX_CH0 0x1000
+#define SYS_PCIE_MSI1_CH0 0x1004
+#define SYS_PCIE_MSI2_CH0 0x1008
+#define SYS_PCIE_MSI3_CH0 0x100c
+#define SYS_PCIE_MSI4_CH0 0x1010
+#define SYS_PCIE_MSI5_CH0 0x1014
+#define SYS_PCIE_PME_CH0 0x1018
+#define SYS_PCIE_ACK_CH0 0x101c
+#define SYS_PCIE_MISC_CH0 0x1020
+#define SYS_PCIE_MODE_CH0 0x1024
+#define SYS_ADC_CFG 0x1600
+
static void rzv2n_sys_print_id(struct device *dev,
void __iomem *sysc_base,
struct soc_device_attribute *soc_dev_attr)
@@ -70,7 +88,57 @@ static const struct rz_sysc_soc_id_init_data rzv2n_sys_soc_id_init_data __initco
.print_id = rzv2n_sys_print_id,
};
+static bool rzv2n_regmap_readable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_LSI_OTPTSU0TRMVAL0:
+ case SYS_LSI_OTPTSU0TRMVAL1:
+ case SYS_LSI_OTPTSU1TRMVAL0:
+ case SYS_LSI_OTPTSU1TRMVAL1:
+ case SYS_GBETH0_CFG:
+ case SYS_GBETH1_CFG:
+ case SYS_PCIE_INTX_CH0:
+ case SYS_PCIE_MSI1_CH0:
+ case SYS_PCIE_MSI2_CH0:
+ case SYS_PCIE_MSI3_CH0:
+ case SYS_PCIE_MSI4_CH0:
+ case SYS_PCIE_MSI5_CH0:
+ case SYS_PCIE_PME_CH0:
+ case SYS_PCIE_ACK_CH0:
+ case SYS_PCIE_MISC_CH0:
+ case SYS_PCIE_MODE_CH0:
+ case SYS_ADC_CFG:
+ return true;
+ default:
+ return false;
+ }
+}
+
+static bool rzv2n_regmap_writeable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_GBETH0_CFG:
+ case SYS_GBETH1_CFG:
+ case SYS_PCIE_INTX_CH0:
+ case SYS_PCIE_MSI1_CH0:
+ case SYS_PCIE_MSI2_CH0:
+ case SYS_PCIE_MSI3_CH0:
+ case SYS_PCIE_MSI4_CH0:
+ case SYS_PCIE_MSI5_CH0:
+ case SYS_PCIE_PME_CH0:
+ case SYS_PCIE_ACK_CH0:
+ case SYS_PCIE_MISC_CH0:
+ case SYS_PCIE_MODE_CH0:
+ case SYS_ADC_CFG:
+ return true;
+ default:
+ return false;
+ }
+}
+
const struct rz_sysc_init_data rzv2n_sys_init_data = {
.soc_id_init_data = &rzv2n_sys_soc_id_init_data,
+ .readable_reg = rzv2n_regmap_readable_reg,
+ .writeable_reg = rzv2n_regmap_writeable_reg,
.max_register = 0x170c,
};
diff --git a/drivers/soc/renesas/r9a09g057-sys.c b/drivers/soc/renesas/r9a09g057-sys.c
index e3390e7c7fe51..827c718ac7c54 100644
--- a/drivers/soc/renesas/r9a09g057-sys.c
+++ b/drivers/soc/renesas/r9a09g057-sys.c
@@ -29,6 +29,35 @@
#define SYS_LSI_PRR_GPU_DIS BIT(0)
#define SYS_LSI_PRR_ISP_DIS BIT(4)
+#define SYS_LSI_OTPTSU0TRMVAL0 0x320
+#define SYS_LSI_OTPTSU0TRMVAL1 0x324
+#define SYS_LSI_OTPTSU1TRMVAL0 0x330
+#define SYS_LSI_OTPTSU1TRMVAL1 0x334
+#define SYS_GBETH0_CFG 0xf00
+#define SYS_GBETH1_CFG 0xf04
+#define SYS_PCIE_INTX_CH0 0x1000
+#define SYS_PCIE_MSI1_CH0 0x1004
+#define SYS_PCIE_MSI2_CH0 0x1008
+#define SYS_PCIE_MSI3_CH0 0x100c
+#define SYS_PCIE_MSI4_CH0 0x1010
+#define SYS_PCIE_MSI5_CH0 0x1014
+#define SYS_PCIE_PME_CH0 0x1018
+#define SYS_PCIE_ACK_CH0 0x101c
+#define SYS_PCIE_MISC_CH0 0x1020
+#define SYS_PCIE_MODE_CH0 0x1024
+#define SYS_PCIE_INTX_CH1 0x1030
+#define SYS_PCIE_MSI1_CH1 0x1034
+#define SYS_PCIE_MSI2_CH1 0x1038
+#define SYS_PCIE_MSI3_CH1 0x103c
+#define SYS_PCIE_MSI4_CH1 0x1040
+#define SYS_PCIE_MSI5_CH1 0x1044
+#define SYS_PCIE_PME_CH1 0x1048
+#define SYS_PCIE_ACK_CH1 0x104c
+#define SYS_PCIE_MISC_CH1 0x1050
+#define SYS_PCIE_MODE_CH1 0x1054
+#define SYS_PCIE_MODE 0x1060
+#define SYS_ADC_CFG 0x1600
+
static void rzv2h_sys_print_id(struct device *dev,
void __iomem *sysc_base,
struct soc_device_attribute *soc_dev_attr)
@@ -62,7 +91,79 @@ static const struct rz_sysc_soc_id_init_data rzv2h_sys_soc_id_init_data __initco
.print_id = rzv2h_sys_print_id,
};
+static bool rzv2h_regmap_readable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_LSI_OTPTSU0TRMVAL0:
+ case SYS_LSI_OTPTSU0TRMVAL1:
+ case SYS_LSI_OTPTSU1TRMVAL0:
+ case SYS_LSI_OTPTSU1TRMVAL1:
+ case SYS_GBETH0_CFG:
+ case SYS_GBETH1_CFG:
+ case SYS_PCIE_INTX_CH0:
+ case SYS_PCIE_MSI1_CH0:
+ case SYS_PCIE_MSI2_CH0:
+ case SYS_PCIE_MSI3_CH0:
+ case SYS_PCIE_MSI4_CH0:
+ case SYS_PCIE_MSI5_CH0:
+ case SYS_PCIE_PME_CH0:
+ case SYS_PCIE_ACK_CH0:
+ case SYS_PCIE_MISC_CH0:
+ case SYS_PCIE_MODE_CH0:
+ case SYS_PCIE_INTX_CH1:
+ case SYS_PCIE_MSI1_CH1:
+ case SYS_PCIE_MSI2_CH1:
+ case SYS_PCIE_MSI3_CH1:
+ case SYS_PCIE_MSI4_CH1:
+ case SYS_PCIE_MSI5_CH1:
+ case SYS_PCIE_PME_CH1:
+ case SYS_PCIE_ACK_CH1:
+ case SYS_PCIE_MISC_CH1:
+ case SYS_PCIE_MODE_CH1:
+ case SYS_PCIE_MODE:
+ case SYS_ADC_CFG:
+ return true;
+ default:
+ return false;
+ }
+}
+
+static bool rzv2h_regmap_writeable_reg(struct device *dev, unsigned int reg)
+{
+ switch (reg) {
+ case SYS_GBETH0_CFG:
+ case SYS_GBETH1_CFG:
+ case SYS_PCIE_INTX_CH0:
+ case SYS_PCIE_MSI1_CH0:
+ case SYS_PCIE_MSI2_CH0:
+ case SYS_PCIE_MSI3_CH0:
+ case SYS_PCIE_MSI4_CH0:
+ case SYS_PCIE_MSI5_CH0:
+ case SYS_PCIE_PME_CH0:
+ case SYS_PCIE_ACK_CH0:
+ case SYS_PCIE_MISC_CH0:
+ case SYS_PCIE_MODE_CH0:
+ case SYS_PCIE_INTX_CH1:
+ case SYS_PCIE_MSI1_CH1:
+ case SYS_PCIE_MSI2_CH1:
+ case SYS_PCIE_MSI3_CH1:
+ case SYS_PCIE_MSI4_CH1:
+ case SYS_PCIE_MSI5_CH1:
+ case SYS_PCIE_PME_CH1:
+ case SYS_PCIE_ACK_CH1:
+ case SYS_PCIE_MISC_CH1:
+ case SYS_PCIE_MODE_CH1:
+ case SYS_PCIE_MODE:
+ case SYS_ADC_CFG:
+ return true;
+ default:
+ return false;
+ }
+}
+
const struct rz_sysc_init_data rzv2h_sys_init_data = {
.soc_id_init_data = &rzv2h_sys_soc_id_init_data,
+ .readable_reg = rzv2h_regmap_readable_reg,
+ .writeable_reg = rzv2h_regmap_writeable_reg,
.max_register = 0x170c,
};
diff --git a/drivers/soc/renesas/rz-sysc.c b/drivers/soc/renesas/rz-sysc.c
index 9f79e299e6f41..19c1e666279b7 100644
--- a/drivers/soc/renesas/rz-sysc.c
+++ b/drivers/soc/renesas/rz-sysc.c
@@ -140,6 +140,8 @@ static int rz_sysc_probe(struct platform_device *pdev)
regmap_cfg->val_bits = 32;
regmap_cfg->fast_io = true;
regmap_cfg->max_register = data->max_register;
+ regmap_cfg->readable_reg = data->readable_reg;
+ regmap_cfg->writeable_reg = data->writeable_reg;
regmap = devm_regmap_init_mmio(dev, sysc->base, regmap_cfg);
if (IS_ERR(regmap))
diff --git a/drivers/soc/renesas/rz-sysc.h b/drivers/soc/renesas/rz-sysc.h
index 8eec355d5d562..88929bf21cb11 100644
--- a/drivers/soc/renesas/rz-sysc.h
+++ b/drivers/soc/renesas/rz-sysc.h
@@ -34,10 +34,14 @@ struct rz_sysc_soc_id_init_data {
/**
* struct rz_sysc_init_data - RZ SYSC initialization data
* @soc_id_init_data: RZ SYSC SoC ID initialization data
+ * @writeable_reg: Regmap writeable register check function
+ * @readable_reg: Regmap readable register check function
* @max_register: Maximum SYSC register offset to be used by the regmap config
*/
struct rz_sysc_init_data {
const struct rz_sysc_soc_id_init_data *soc_id_init_data;
+ bool (*writeable_reg)(struct device *dev, unsigned int reg);
+ bool (*readable_reg)(struct device *dev, unsigned int reg);
u32 max_register;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 277/614] arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 276/614] soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 278/614] arm64: dts: rockchip: Add eeprom vcc-supply for " Greg Kroah-Hartman
` (350 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, FUKAUMI Naoki, Heiko Stuebner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <naoki@radxa.com>
[ Upstream commit 92e6e0b0e595afdda6296c760551ad3ffe9d5231 ]
The BL24C16 EEPROM chip found on Radxa ROCK 5A is connected to the
i2c0 bus, [1] so move the eeprom node from the i2c2 bus to the i2c0
bus.
[1] Link: https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.19
Fixes: 89c880808cff8 ("arm64: dts: rockchip: add I2C EEPROM to rock-5a")
Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://patch.msgid.link/20251112035133.28753-2-naoki@radxa.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
index 19a08f7794e67..428c6f0232a34 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
@@ -228,6 +228,12 @@ regulator-state-mem {
regulator-off-in-suspend;
};
};
+
+ eeprom: eeprom@50 {
+ compatible = "belling,bl24c16a", "atmel,24c16";
+ reg = <0x50>;
+ pagesize = <16>;
+ };
};
&i2c2 {
@@ -249,12 +255,6 @@ regulator-state-mem {
regulator-off-in-suspend;
};
};
-
- eeprom: eeprom@50 {
- compatible = "belling,bl24c16a", "atmel,24c16";
- reg = <0x50>;
- pagesize = <16>;
- };
};
&i2c3 {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 278/614] arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 277/614] arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 279/614] arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C Greg Kroah-Hartman
` (349 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, FUKAUMI Naoki, Heiko Stuebner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <naoki@radxa.com>
[ Upstream commit 3069ff1930aa71e125874c780ffaa6caeda5800a ]
The VCC supply for the BL24C16 EEPROM chip found on Radxa ROCK 5A is
vcc_3v3_pmu, which is routed to vcc_3v3_s3 via a zero-ohm resistor. [1]
Describe this supply.
[1] https://dl.radxa.com/rock5/5a/docs/hw/radxa_rock5a_V1.1_sch.pdf p.4, p.19
Fixes: 89c880808cff8 ("arm64: dts: rockchip: add I2C EEPROM to rock-5a")
Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://patch.msgid.link/20251112035133.28753-3-naoki@radxa.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
index 428c6f0232a34..041a0fff22ccb 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts
@@ -233,6 +233,7 @@ eeprom: eeprom@50 {
compatible = "belling,bl24c16a", "atmel,24c16";
reg = <0x50>;
pagesize = <16>;
+ vcc-supply = <&vcc_3v3_pmu>;
};
};
@@ -600,7 +601,7 @@ regulator-state-mem {
};
};
- vcc_3v3_s3: dcdc-reg8 {
+ vcc_3v3_pmu: vcc_3v3_s3: dcdc-reg8 {
regulator-name = "vcc_3v3_s3";
regulator-always-on;
regulator-boot-on;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 279/614] arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 278/614] arm64: dts: rockchip: Add eeprom vcc-supply for " Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS) Greg Kroah-Hartman
` (348 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, FUKAUMI Naoki, Heiko Stuebner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: FUKAUMI Naoki <naoki@radxa.com>
[ Upstream commit 260316d35cf8f8606c5ed7a349cc92e1e71d8150 ]
The VCC supply for the BL24C16 EEPROM chip found on Radxa ROCK 3C is
vcca1v8_pmu. [1] Describe this supply.
[1] https://dl.radxa.com/rock3/docs/hw/3c/v1400/radxa_rock_3c_v1400_schematic.pdf p.13
Fixes: ee219017ddb50 ("arm64: dts: rockchip: Add Radxa ROCK 3C")
Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://patch.msgid.link/20251112035133.28753-4-naoki@radxa.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts b/arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts
index 6224d72813e59..80ac40555e023 100644
--- a/arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts
@@ -466,6 +466,7 @@ eeprom: eeprom@50 {
compatible = "belling,bl24c16a", "atmel,24c16";
reg = <0x50>;
pagesize = <16>;
+ vcc-supply = <&vcca1v8_pmu>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 279/614] arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-18 6:16 ` Jiri Slaby
2025-12-16 11:10 ` [PATCH 6.18 281/614] crypto: iaa - Fix incorrect return value in save_iaa_wq() Greg Kroah-Hartman
` (347 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Richter, Ian Rogers,
Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit c1932fb85af8e51ac9f6bd9947145b06c716106e ]
The instructions event is now provided in json meaning the has_event
test always succeeds. Switch to using non-legacy event names in the
affected metrics.
Reported-by: Thomas Richter <tmricht@linux.ibm.com>
Closes: https://lore.kernel.org/linux-perf-users/3e80f453-f015-4f4f-93d3-8df6bb6b3c95@linux.ibm.com/
Fixes: 0012e0fa221b ("perf jevents: Add legacy-hardware and legacy-cache json")
Signed-off-by: Ian Rogers <irogers@google.com>
Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/pmu-events/arch/s390/cf_z16/transaction.json | 8 ++++----
tools/perf/pmu-events/arch/s390/cf_z17/transaction.json | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/tools/perf/pmu-events/arch/s390/cf_z16/transaction.json b/tools/perf/pmu-events/arch/s390/cf_z16/transaction.json
index 3ab1d3a6638c4..57b785307a85f 100644
--- a/tools/perf/pmu-events/arch/s390/cf_z16/transaction.json
+++ b/tools/perf/pmu-events/arch/s390/cf_z16/transaction.json
@@ -7,17 +7,17 @@
{
"BriefDescription": "Cycles per Instruction",
"MetricName": "cpi",
- "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(CPU_CYCLES) else 0"
},
{
"BriefDescription": "Problem State Instruction Ratio",
"MetricName": "prbstate",
- "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(PROBLEM_STATE_INSTRUCTIONS) else 0"
},
{
"BriefDescription": "Level One Miss per 100 Instructions",
"MetricName": "l1mp",
- "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(L1I_DIR_WRITES) else 0"
},
{
"BriefDescription": "Percentage sourced from Level 2 cache",
@@ -52,7 +52,7 @@
{
"BriefDescription": "Estimated Instruction Complexity CPI infinite Level 1",
"MetricName": "est_cpi",
- "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(CPU_CYCLES) else 0"
},
{
"BriefDescription": "Estimated Sourcing Cycles per Level 1 Miss",
diff --git a/tools/perf/pmu-events/arch/s390/cf_z17/transaction.json b/tools/perf/pmu-events/arch/s390/cf_z17/transaction.json
index 74df533c8b6fa..7ded6a5a76c0f 100644
--- a/tools/perf/pmu-events/arch/s390/cf_z17/transaction.json
+++ b/tools/perf/pmu-events/arch/s390/cf_z17/transaction.json
@@ -7,17 +7,17 @@
{
"BriefDescription": "Cycles per Instruction",
"MetricName": "cpi",
- "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "CPU_CYCLES / INSTRUCTIONS if has_event(CPU_CYCLES) else 0"
},
{
"BriefDescription": "Problem State Instruction Ratio",
"MetricName": "prbstate",
- "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "(PROBLEM_STATE_INSTRUCTIONS / INSTRUCTIONS) * 100 if has_event(PROBLEM_STATE_INSTRUCTIONS) else 0"
},
{
"BriefDescription": "Level One Miss per 100 Instructions",
"MetricName": "l1mp",
- "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "((L1I_DIR_WRITES + L1D_DIR_WRITES) / INSTRUCTIONS) * 100 if has_event(L1I_DIR_WRITES) else 0"
},
{
"BriefDescription": "Percentage sourced from Level 2 cache",
@@ -52,7 +52,7 @@
{
"BriefDescription": "Estimated Instruction Complexity CPI infinite Level 1",
"MetricName": "est_cpi",
- "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(INSTRUCTIONS) else 0"
+ "MetricExpr": "(CPU_CYCLES / INSTRUCTIONS) - (L1C_TLB2_MISSES / INSTRUCTIONS) if has_event(L1C_TLB2_MISSES) else 0"
},
{
"BriefDescription": "Estimated Sourcing Cycles per Level 1 Miss",
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 281/614] crypto: iaa - Fix incorrect return value in save_iaa_wq()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS) Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 282/614] s390/fpu: Fix false-positive kmsan report in fpu_vstl() Greg Kroah-Hartman
` (346 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zilin Guan, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 76ce17f6f7f78ab79b9741388bdb4dafa985b4e9 ]
The save_iaa_wq() function unconditionally returns 0, even when an error
is encountered. This prevents the error code from being propagated to the
caller.
Fix this by returning the 'ret' variable, which holds the actual status
of the operations within the function.
Fixes: ea7a5cbb43696 ("crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/intel/iaa/iaa_crypto_main.c b/drivers/crypto/intel/iaa/iaa_crypto_main.c
index 23f585219fb4b..d0058757b0000 100644
--- a/drivers/crypto/intel/iaa/iaa_crypto_main.c
+++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c
@@ -805,7 +805,7 @@ static int save_iaa_wq(struct idxd_wq *wq)
if (!cpus_per_iaa)
cpus_per_iaa = 1;
out:
- return 0;
+ return ret;
}
static void remove_iaa_wq(struct idxd_wq *wq)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 282/614] s390/fpu: Fix false-positive kmsan report in fpu_vstl()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 281/614] crypto: iaa - Fix incorrect return value in save_iaa_wq() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 283/614] pwm: Simplify printf to emit chip->npwm in $debugfs/pwm Greg Kroah-Hartman
` (345 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksei Nikiforov, Heiko Carstens,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
[ Upstream commit 14e4e4175b64dd9216b522f6ece8af6997d063b2 ]
A false-positive kmsan report is detected when running ping command.
An inline assembly instruction 'vstl' can write varied amount of bytes
depending on value of 'index' argument. If 'index' > 0, 'vstl' writes
at least 2 bytes.
clang generates kmsan write helper call depending on inline assembly
constraints. Constraints are evaluated compile-time, but value of
'index' argument is known only at runtime.
clang currently generates call to __msan_instrument_asm_store with 1 byte
as size. Manually call kmsan function to indicate correct amount of bytes
written and fix false-positive report.
This change fixes following kmsan reports:
[ 36.563119] =====================================================
[ 36.563594] BUG: KMSAN: uninit-value in virtqueue_add+0x35c6/0x7c70
[ 36.563852] virtqueue_add+0x35c6/0x7c70
[ 36.564016] virtqueue_add_outbuf+0xa0/0xb0
[ 36.564266] start_xmit+0x288c/0x4a20
[ 36.564460] dev_hard_start_xmit+0x302/0x900
[ 36.564649] sch_direct_xmit+0x340/0xea0
[ 36.564894] __dev_queue_xmit+0x2e94/0x59b0
[ 36.565058] neigh_resolve_output+0x936/0xb40
[ 36.565278] __neigh_update+0x2f66/0x3a60
[ 36.565499] neigh_update+0x52/0x60
[ 36.565683] arp_process+0x1588/0x2de0
[ 36.565916] NF_HOOK+0x1da/0x240
[ 36.566087] arp_rcv+0x3e4/0x6e0
[ 36.566306] __netif_receive_skb_list_core+0x1374/0x15a0
[ 36.566527] netif_receive_skb_list_internal+0x1116/0x17d0
[ 36.566710] napi_complete_done+0x376/0x740
[ 36.566918] virtnet_poll+0x1bae/0x2910
[ 36.567130] __napi_poll+0xf4/0x830
[ 36.567294] net_rx_action+0x97c/0x1ed0
[ 36.567556] handle_softirqs+0x306/0xe10
[ 36.567731] irq_exit_rcu+0x14c/0x2e0
[ 36.567910] do_io_irq+0xd4/0x120
[ 36.568139] io_int_handler+0xc2/0xe8
[ 36.568299] arch_cpu_idle+0xb0/0xc0
[ 36.568540] arch_cpu_idle+0x76/0xc0
[ 36.568726] default_idle_call+0x40/0x70
[ 36.568953] do_idle+0x1d6/0x390
[ 36.569486] cpu_startup_entry+0x9a/0xb0
[ 36.569745] rest_init+0x1ea/0x290
[ 36.570029] start_kernel+0x95e/0xb90
[ 36.570348] startup_continue+0x2e/0x40
[ 36.570703]
[ 36.570798] Uninit was created at:
[ 36.571002] kmem_cache_alloc_node_noprof+0x9e8/0x10e0
[ 36.571261] kmalloc_reserve+0x12a/0x470
[ 36.571553] __alloc_skb+0x310/0x860
[ 36.571844] __ip_append_data+0x483e/0x6a30
[ 36.572170] ip_append_data+0x11c/0x1e0
[ 36.572477] raw_sendmsg+0x1c8c/0x2180
[ 36.572818] inet_sendmsg+0xe6/0x190
[ 36.573142] __sys_sendto+0x55e/0x8e0
[ 36.573392] __s390x_sys_socketcall+0x19ae/0x2ba0
[ 36.573571] __do_syscall+0x12e/0x240
[ 36.573823] system_call+0x6e/0x90
[ 36.573976]
[ 36.574017] Byte 35 of 98 is uninitialized
[ 36.574082] Memory access of size 98 starts at 0000000007aa0012
[ 36.574218]
[ 36.574325] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G B N 6.17.0-dirty #16 NONE
[ 36.574541] Tainted: [B]=BAD_PAGE, [N]=TEST
[ 36.574617] Hardware name: IBM 3931 A01 703 (KVM/Linux)
[ 36.574755] =====================================================
[ 63.532541] =====================================================
[ 63.533639] BUG: KMSAN: uninit-value in virtqueue_add+0x35c6/0x7c70
[ 63.533989] virtqueue_add+0x35c6/0x7c70
[ 63.534940] virtqueue_add_outbuf+0xa0/0xb0
[ 63.535861] start_xmit+0x288c/0x4a20
[ 63.536708] dev_hard_start_xmit+0x302/0x900
[ 63.537020] sch_direct_xmit+0x340/0xea0
[ 63.537997] __dev_queue_xmit+0x2e94/0x59b0
[ 63.538819] neigh_resolve_output+0x936/0xb40
[ 63.539793] ip_finish_output2+0x1ee2/0x2200
[ 63.540784] __ip_finish_output+0x272/0x7a0
[ 63.541765] ip_finish_output+0x4e/0x5e0
[ 63.542791] ip_output+0x166/0x410
[ 63.543771] ip_push_pending_frames+0x1a2/0x470
[ 63.544753] raw_sendmsg+0x1f06/0x2180
[ 63.545033] inet_sendmsg+0xe6/0x190
[ 63.546006] __sys_sendto+0x55e/0x8e0
[ 63.546859] __s390x_sys_socketcall+0x19ae/0x2ba0
[ 63.547730] __do_syscall+0x12e/0x240
[ 63.548019] system_call+0x6e/0x90
[ 63.548989]
[ 63.549779] Uninit was created at:
[ 63.550691] kmem_cache_alloc_node_noprof+0x9e8/0x10e0
[ 63.550975] kmalloc_reserve+0x12a/0x470
[ 63.551969] __alloc_skb+0x310/0x860
[ 63.552949] __ip_append_data+0x483e/0x6a30
[ 63.553902] ip_append_data+0x11c/0x1e0
[ 63.554912] raw_sendmsg+0x1c8c/0x2180
[ 63.556719] inet_sendmsg+0xe6/0x190
[ 63.557534] __sys_sendto+0x55e/0x8e0
[ 63.557875] __s390x_sys_socketcall+0x19ae/0x2ba0
[ 63.558869] __do_syscall+0x12e/0x240
[ 63.559832] system_call+0x6e/0x90
[ 63.560780]
[ 63.560972] Byte 35 of 98 is uninitialized
[ 63.561741] Memory access of size 98 starts at 0000000005704312
[ 63.561950]
[ 63.562824] CPU: 3 UID: 0 PID: 192 Comm: ping Tainted: G B N 6.17.0-dirty #16 NONE
[ 63.563868] Tainted: [B]=BAD_PAGE, [N]=TEST
[ 63.564751] Hardware name: IBM 3931 A01 703 (KVM/Linux)
[ 63.564986] =====================================================
Fixes: dcd3e1de9d17 ("s390/checksum: provide csum_partial_copy_nocheck()")
Signed-off-by: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/include/asm/fpu-insn.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/s390/include/asm/fpu-insn.h b/arch/s390/include/asm/fpu-insn.h
index e99f8bca8e08c..96727f3bd0dce 100644
--- a/arch/s390/include/asm/fpu-insn.h
+++ b/arch/s390/include/asm/fpu-insn.h
@@ -12,6 +12,7 @@
#ifndef __ASSEMBLER__
#include <linux/instrumented.h>
+#include <linux/kmsan.h>
#include <asm/asm-extable.h>
asm(".include \"asm/fpu-insn-asm.h\"\n");
@@ -393,6 +394,7 @@ static __always_inline void fpu_vstl(u8 v1, u32 index, const void *vxr)
: [vxr] "=Q" (*(u8 *)vxr)
: [index] "d" (index), [v1] "I" (v1)
: "memory");
+ kmsan_unpoison_memory(vxr, size);
}
#else /* CONFIG_CC_HAS_ASM_AOR_FORMAT_FLAGS */
@@ -409,6 +411,7 @@ static __always_inline void fpu_vstl(u8 v1, u32 index, const void *vxr)
: [vxr] "=R" (*(u8 *)vxr)
: [index] "d" (index), [v1] "I" (v1)
: "memory", "1");
+ kmsan_unpoison_memory(vxr, size);
}
#endif /* CONFIG_CC_HAS_ASM_AOR_FORMAT_FLAGS */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 283/614] pwm: Simplify printf to emit chip->npwm in $debugfs/pwm
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 282/614] s390/fpu: Fix false-positive kmsan report in fpu_vstl() Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 284/614] pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id Greg Kroah-Hartman
` (344 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Uwe Kleine-König, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 3cf8e55894b51c14f8500cae5e68ed48b1b0f3fd ]
Instead of caring to correctly pluralize "PWM device(s)" using
(chip->npwm != 1) ? "s" : ""
or
str_plural(chip->npwm)
just simplify the format to not need a plural-s.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20250926165702.321514-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Stable-dep-of: 5f7ff902e7f3 ("pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index ea2ccf42e8144..5b75f4a084967 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -2696,11 +2696,10 @@ static int pwm_seq_show(struct seq_file *s, void *v)
{
struct pwm_chip *chip = v;
- seq_printf(s, "%s%d: %s/%s, %d PWM device%s\n",
+ seq_printf(s, "%s%d: %s/%s, npwm: %d\n",
(char *)s->private, chip->id,
pwmchip_parent(chip)->bus ? pwmchip_parent(chip)->bus->name : "no-bus",
- dev_name(pwmchip_parent(chip)), chip->npwm,
- (chip->npwm != 1) ? "s" : "");
+ dev_name(pwmchip_parent(chip)), chip->npwm);
pwm_dbg_show(chip, s);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 284/614] pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 283/614] pwm: Simplify printf to emit chip->npwm in $debugfs/pwm Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 285/614] arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Greg Kroah-Hartman
` (343 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Uwe Kleine-König, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit 5f7ff902e7f324c10f2b64c5ba2e5e2d0bc4e07e ]
%u is the right conversion specifier to emit an unsigned int value.
Fixes: 62099abf67a2 ("pwm: Add debugfs interface")
Fixes: 0360a4873372 ("pwm: Mention PWM chip ID in /sys/kernel/debug/pwm")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20251006133525.2457171-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index 5b75f4a084967..7dd1cf2ba4025 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -2696,7 +2696,7 @@ static int pwm_seq_show(struct seq_file *s, void *v)
{
struct pwm_chip *chip = v;
- seq_printf(s, "%s%d: %s/%s, npwm: %d\n",
+ seq_printf(s, "%s%u: %s/%s, npwm: %u\n",
(char *)s->private, chip->id,
pwmchip_parent(chip)->bus ? pwmchip_parent(chip)->bus->name : "no-bus",
dev_name(pwmchip_parent(chip)), chip->npwm);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 285/614] arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 284/614] pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 286/614] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype Greg Kroah-Hartman
` (342 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Praveen Talari, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <praveen.talari@oss.qualcomm.com>
[ Upstream commit 9c92d36b0b1ea8b2a19dbe0416434f3491dbfaaf ]
For BT use cases, pins are configured with pull-up state in sleep state
to avoid noise. If IRQ type is configured as level high and the GPIO line
is also in a high state, it causes continuous interrupt assertions leading
to an IRQ storm when wakeup irq enables at system suspend/runtime suspend.
Switching to edge-triggered interrupt (IRQ_TYPE_EDGE_FALLING) resolves
this by only triggering on state transitions (high-to-low) rather than
maintaining sensitivity to the static level state, effectively preventing
the continuous interrupt condition and eliminating the wakeup IRQ storm.
Fixes: 9380e0a1d449 ("arm64: dts: qcom: qrb2210-rb1: add Bluetooth support")
Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20251110101043.2108414-2-praveen.talari@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
index 67ba508e92ba1..3eedfb2cf4799 100644
--- a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
+++ b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
@@ -649,7 +649,7 @@ key_volp_n: key-volp-n-state {
&uart3 {
/delete-property/ interrupts;
interrupts-extended = <&intc GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>,
- <&tlmm 11 IRQ_TYPE_LEVEL_HIGH>;
+ <&tlmm 11 IRQ_TYPE_EDGE_FALLING>;
pinctrl-0 = <&uart3_default>;
pinctrl-1 = <&uart3_sleep>;
pinctrl-names = "default", "sleep";
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 286/614] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 285/614] arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 287/614] ps3disk: use memcpy_{from,to}_bvec index Greg Kroah-Hartman
` (341 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Konrad Dybcio,
Jessica Zhang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit d9792823d18ff9895eaf5769a29a54804f24bc25 ]
The commit a106ed98af68 ("drm/msm/dpu: use devres-managed allocation for
HW blocks") dropped all dpu_hw_foo_destroy() functions, but the
prototype for dpu_hw_dsc_destroy() was omitted. Drop it now to clean up
the header.
Fixes: a106ed98af68 ("drm/msm/dpu: use devres-managed allocation for HW blocks")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Jessica Zhang <jesszhan0024@gmail.com>
Patchwork: https://patchwork.freedesktop.org/patch/683697/
Link: https://lore.kernel.org/r/20251027-dpu-drop-dsc-destroy-v1-1-968128de4bf6@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h
index b7013c9822d23..cc7cc6f6f7cda 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h
@@ -71,12 +71,6 @@ struct dpu_hw_dsc *dpu_hw_dsc_init_1_2(struct drm_device *dev,
const struct dpu_dsc_cfg *cfg,
void __iomem *addr);
-/**
- * dpu_hw_dsc_destroy - destroys dsc driver context
- * @dsc: Pointer to dsc driver context returned by dpu_hw_dsc_init
- */
-void dpu_hw_dsc_destroy(struct dpu_hw_dsc *dsc);
-
static inline struct dpu_hw_dsc *to_dpu_hw_dsc(struct dpu_hw_blk *hw)
{
return container_of(hw, struct dpu_hw_dsc, base);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 287/614] ps3disk: use memcpy_{from,to}_bvec index
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 286/614] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 288/614] soc/tegra: fuse: speedo-tegra210: Update speedo IDs Greg Kroah-Hartman
` (340 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, René Rebe, Christoph Hellwig,
Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rene Rebe <rene@exactco.de>
[ Upstream commit 79bd8c9814a273fa7ba43399e1c07adec3fc95db ]
With 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec) converting
ps3disk to new bvec helpers, incrementing the offset was accidently
lost, corrupting consecutive buffers. Restore index for non-corrupted
data transfers.
Fixes: 6e0a48552b8c (ps3disk: use memcpy_{from,to}_bvec)
Signed-off-by: René Rebe <rene@exactco.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ps3disk.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
index dc9e4a14b8854..8892f218a8147 100644
--- a/drivers/block/ps3disk.c
+++ b/drivers/block/ps3disk.c
@@ -85,10 +85,14 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,
struct bio_vec bvec;
rq_for_each_segment(bvec, req, iter) {
+ dev_dbg(&dev->sbd.core, "%s:%u: %u sectors from %llu\n",
+ __func__, __LINE__, bio_sectors(iter.bio),
+ iter.bio->bi_iter.bi_sector);
if (gather)
memcpy_from_bvec(dev->bounce_buf + offset, &bvec);
else
memcpy_to_bvec(&bvec, dev->bounce_buf + offset);
+ offset += bvec.bv_len;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 288/614] soc/tegra: fuse: speedo-tegra210: Update speedo IDs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 287/614] ps3disk: use memcpy_{from,to}_bvec index Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 289/614] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
` (339 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaron Kling, Thierry Reding,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Kling <webgeek1234@gmail.com>
[ Upstream commit ce27c9c2129679551c4e5fe71c1c5d42fff399c2 ]
Existing code only sets CPU and GPU speedo IDs 0 and 1. The CPU DVFS
code supports 11 IDs and nouveau supports 5. This aligns with what the
downstream vendor kernel supports. Align SKUs with the downstream list.
The Tegra210 CVB tables were added in the first referenced fixes commit.
Since then, all Tegra210 SoCs have tried to scale to 1.9 GHz, when the
supported devkits are only supposed to scale to 1.5 or 1.7 GHZ.
Overclocking should not be the default state.
Fixes: 2b2dbc2f94e5 ("clk: tegra: dfll: add CVB tables for Tegra210")
Fixes: 579db6e5d9b8 ("arm64: tegra: Enable DFLL support on Jetson Nano")
Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/tegra/fuse/speedo-tegra210.c | 62 ++++++++++++++++--------
1 file changed, 43 insertions(+), 19 deletions(-)
diff --git a/drivers/soc/tegra/fuse/speedo-tegra210.c b/drivers/soc/tegra/fuse/speedo-tegra210.c
index 695d0b7f9a8ab..a8cc363297723 100644
--- a/drivers/soc/tegra/fuse/speedo-tegra210.c
+++ b/drivers/soc/tegra/fuse/speedo-tegra210.c
@@ -65,27 +65,51 @@ static void __init rev_sku_to_speedo_ids(struct tegra_sku_info *sku_info,
sku_info->gpu_speedo_id = 0;
*threshold = THRESHOLD_INDEX_0;
- switch (sku) {
- case 0x00: /* Engineering SKU */
- case 0x01: /* Engineering SKU */
- case 0x07:
- case 0x17:
- case 0x27:
- if (speedo_rev >= 2)
+ if (sku_info->revision >= TEGRA_REVISION_A02) {
+ switch (sku) {
+ case 0x00: /* Engineering SKU */
+ case 0x01: /* Engineering SKU */
+ case 0x13:
+ sku_info->cpu_speedo_id = 5;
+ sku_info->gpu_speedo_id = 2;
+ break;
+
+ case 0x07:
+ case 0x17:
+ case 0x1F:
+ sku_info->cpu_speedo_id = 7;
+ sku_info->gpu_speedo_id = 2;
+ break;
+
+ case 0x27:
+ sku_info->cpu_speedo_id = 1;
+ sku_info->gpu_speedo_id = 2;
+ break;
+
+ case 0x83:
+ sku_info->cpu_speedo_id = 3;
+ sku_info->gpu_speedo_id = 3;
+ break;
+
+ case 0x87:
+ sku_info->cpu_speedo_id = 2;
sku_info->gpu_speedo_id = 1;
- break;
-
- case 0x13:
- if (speedo_rev >= 2)
- sku_info->gpu_speedo_id = 1;
-
- sku_info->cpu_speedo_id = 1;
- break;
-
- default:
+ break;
+
+ case 0x8F:
+ sku_info->cpu_speedo_id = 9;
+ sku_info->gpu_speedo_id = 2;
+ break;
+
+ default:
+ pr_err("Tegra210: unknown revision 2 or newer SKU %#04x\n", sku);
+ /* Using the default for the error case */
+ break;
+ }
+ } else if (sku == 0x00 || sku == 0x01 || sku == 0x07 || sku == 0x13 || sku == 0x17) {
+ sku_info->gpu_speedo_id = 1;
+ } else {
pr_err("Tegra210: unknown SKU %#04x\n", sku);
- /* Using the default for the error case */
- break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 289/614] PCI: Prevent resource tree corruption when BAR resize fails
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 288/614] soc/tegra: fuse: speedo-tegra210: Update speedo IDs Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 290/614] kbuild: dont enable CC_CAN_LINK if the dummy program generates warnings Greg Kroah-Hartman
` (338 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Richter, Alex Bennée,
Ilpo Järvinen, Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 91c4c89db41499eea1b29c56655f79c3bae66e93 ]
pbus_reassign_bridge_resources() saves bridge windows into the saved
list before attempting to adjust resource assignments to perform a BAR
resize operation. If resource adjustments cannot be completed fully,
rollback is attempted by restoring the resource from the saved list.
The rollback, however, does not check whether the resources it restores were
assigned by the partial resize attempt. If restore changes addresses of the
resource, it can result in corrupting the resource tree.
An example of a corrupted resource tree with overlapping addresses:
6200000000000-6203fbfffffff : pciex@620c3c0000000
6200000000000-6203fbff0ffff : PCI Bus 0030:01
6200020000000-62000207fffff : 0030:01:00.0
6200000000000-6203fbff0ffff : PCI Bus 0030:02
A resource that are assigned into the resource tree must remain
unchanged. Thus, release such a resource before attempting to restore
and claim it back.
For simplicity, always do the release and claim back for the resource
even in the cases where it is restored to the same address range.
Note: this fix may "break" some cases where devices "worked" because
the resource tree corruption allowed address space double counting to
fit more resource than what can now be assigned without double
counting. The upcoming changes to BAR resizing should address those
scenarios (to the extent possible).
Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs")
Reported-by: Simon Richter <Simon.Richter@hogyros.de>
Link: https://lore.kernel.org/linux-pci/67840a16-99b4-4d8c-9b5c-4721ab0970a2@hogyros.de/
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Link: https://lore.kernel.org/linux-pci/874irqop6b.fsf@draig.linaro.org/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org> # AVA, AMD GPU
Link: https://patch.msgid.link/20251113162628.5946-2-ilpo.jarvinen@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/setup-bus.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 3645f392a9fd3..5ba878f15db35 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2504,6 +2504,11 @@ int pbus_reassign_bridge_resources(struct pci_bus *bus, struct resource *res)
bridge = dev_res->dev;
i = pci_resource_num(bridge, res);
+ if (res->parent) {
+ release_child_resources(res);
+ pci_release_resource(bridge, i);
+ }
+
restore_dev_resource(dev_res);
pci_claim_resource(bridge, i);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 290/614] kbuild: dont enable CC_CAN_LINK if the dummy program generates warnings
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 289/614] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 291/614] bpf: Prevent nesting overflow in bpf_try_get_buffers Greg Kroah-Hartman
` (337 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Nicolas Schier, Nathan Chancellor, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit d81d9d389b9b73acd68f300c8889c7fa1acd4977 ]
It is possible that the kernel toolchain generates warnings when used
together with the system toolchain. This happens for example when the
older kernel toolchain does not handle new versions of sframe debug
information. While these warnings where ignored during the evaluation
of CC_CAN_LINK, together with CONFIG_WERROR the actual userprog build
will later fail.
Example warning:
.../x86_64-linux/13.2.0/../../../../x86_64-linux/bin/ld:
error in /lib/../lib64/crt1.o(.sframe); no .sframe will be created
collect2: error: ld returned 1 exit status
Make sure that the very simple example program does not generate
warnings already to avoid breaking the userprog compilations.
Fixes: ec4a3992bc0b ("kbuild: respect CONFIG_WERROR for linker and assembler")
Fixes: 3f0ff4cc6ffb ("kbuild: respect CONFIG_WERROR for userprogs")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20251114-kbuild-userprogs-bits-v3-1-4dee0d74d439@linutronix.de
Signed-off-by: Nicolas Schier <nsc@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/cc-can-link.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/cc-can-link.sh b/scripts/cc-can-link.sh
index 6efcead319898..e67fd8d7b6841 100755
--- a/scripts/cc-can-link.sh
+++ b/scripts/cc-can-link.sh
@@ -1,7 +1,7 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
-cat << "END" | $@ -x c - -o /dev/null >/dev/null 2>&1
+cat << "END" | $@ -Werror -Wl,--fatal-warnings -x c - -o /dev/null >/dev/null 2>&1
#include <stdio.h>
int main(void)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 291/614] bpf: Prevent nesting overflow in bpf_try_get_buffers
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 290/614] kbuild: dont enable CC_CAN_LINK if the dummy program generates warnings Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 292/614] bpf: Handle return value of ftrace_set_filter_ip in register_fentry Greg Kroah-Hartman
` (336 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b0cff308140f79a9c4cb,
Yonghong Song, Sebastian Andrzej Siewior, Sahil Chandna,
Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sahil Chandna <chandna.sahil@gmail.com>
[ Upstream commit c1da3df7191f1b4df9256bcd30d78f78201e1d17 ]
bpf_try_get_buffers() returns one of multiple per-CPU buffers based on a
per-CPU nesting counter. This mechanism expects that buffers are not
endlessly acquired before being returned. migrate_disable() ensures that a
task remains on the same CPU, but it does not prevent the task from being
preempted by another task on that CPU.
Without disabled preemption, a task may be preempted while holding a
buffer, allowing another task to run on same CPU and acquire an
additional buffer. Several such preemptions can cause the per-CPU
nest counter to exceed MAX_BPRINTF_NEST_LEVEL and trigger the warning in
bpf_try_get_buffers(). Adding preempt_disable()/preempt_enable() around
buffer acquisition and release prevents this task preemption and
preserves the intended bounded nesting behavior.
Reported-by: syzbot+b0cff308140f79a9c4cb@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68f6a4c8.050a0220.1be48.0011.GAE@google.com/
Fixes: 4223bf833c849 ("bpf: Remove preempt_disable in bpf_try_get_buffers")
Suggested-by: Yonghong Song <yonghong.song@linux.dev>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Sahil Chandna <chandna.sahil@gmail.com>
Link: https://lore.kernel.org/r/20251114064922.11650-1-chandna.sahil@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/helpers.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index e4007fea49091..81ef159ef89bd 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -777,9 +777,11 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
{
int nest_level;
+ preempt_disable();
nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
this_cpu_dec(bpf_bprintf_nest_level);
+ preempt_enable();
return -EBUSY;
}
*bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);
@@ -792,6 +794,7 @@ void bpf_put_buffers(void)
if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
return;
this_cpu_dec(bpf_bprintf_nest_level);
+ preempt_enable();
}
void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 292/614] bpf: Handle return value of ftrace_set_filter_ip in register_fentry
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 291/614] bpf: Prevent nesting overflow in bpf_try_get_buffers Greg Kroah-Hartman
@ 2025-12-16 11:10 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 293/614] selftests/bpf: Fix failure paths in send_signal test Greg Kroah-Hartman
` (335 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong, Song Liu,
Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <menglong8.dong@gmail.com>
[ Upstream commit fea3f5e83c5cd80a76d97343023a2f2e6bd862bf ]
The error that returned by ftrace_set_filter_ip() in register_fentry() is
not handled properly. Just fix it.
Fixes: 00963a2e75a8 ("bpf: Support bpf_trampoline on functions with IPMODIFY (e.g. livepatch)")
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20251110120705.1553694-1-dongml2@chinatelecom.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/trampoline.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index f2cb0b0970933..04104397c432e 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -220,7 +220,9 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
}
if (tr->func.ftrace_managed) {
- ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 1);
+ ret = ftrace_set_filter_ip(tr->fops, (unsigned long)ip, 0, 1);
+ if (ret)
+ return ret;
ret = register_ftrace_direct(tr->fops, (long)new_addr);
} else {
ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 293/614] selftests/bpf: Fix failure paths in send_signal test
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2025-12-16 11:10 ` [PATCH 6.18 292/614] bpf: Handle return value of ftrace_set_filter_ip in register_fentry Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 294/614] bpf: Check skb->transport_header is set in bpf_skb_check_mtu Greg Kroah-Hartman
` (334 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexei Starovoitov, Andrii Nakryiko,
Eduard Zingerman, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <ast@kernel.org>
[ Upstream commit c13339039891dbdfa6c1972f0483bd07f610b776 ]
When test_send_signal_kern__open_and_load() fails parent closes the
pipe which cases ASSERT_EQ(read(pipe_p2c...)) to fail, but child
continues and enters infinite loop, while parent is stuck in wait(NULL).
Other error paths have similar issue, so kill the child before waiting on it.
The bug was discovered while compiling all of selftests with -O1 instead of -O2
which caused progs/test_send_signal_kern.c to fail to load.
Fixes: ab8b7f0cb358 ("tools/bpf: Add self tests for bpf_send_signal_thread()")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20251113171153.2583-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/send_signal.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/send_signal.c b/tools/testing/selftests/bpf/prog_tests/send_signal.c
index 1702aa592c2c2..7ac4d5a488aa5 100644
--- a/tools/testing/selftests/bpf/prog_tests/send_signal.c
+++ b/tools/testing/selftests/bpf/prog_tests/send_signal.c
@@ -206,6 +206,11 @@ static void test_send_signal_common(struct perf_event_attr *attr,
skel_open_load_failure:
close(pipe_c2p[0]);
close(pipe_p2c[1]);
+ /*
+ * Child is either about to exit cleanly or stuck in case of errors.
+ * Nudge it to exit.
+ */
+ kill(pid, SIGKILL);
wait(NULL);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 294/614] bpf: Check skb->transport_header is set in bpf_skb_check_mtu
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 293/614] selftests/bpf: Fix failure paths in send_signal test Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 295/614] mshv: Fix deposit memory in MSHV_ROOT_HVCALL Greg Kroah-Hartman
` (333 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesper Dangaard Brouer, Kaiyan Mei,
Yinhao Hu, Martin KaFai Lau, Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <martin.lau@kernel.org>
[ Upstream commit d946f3c98328171fa50ddb908593cf833587f725 ]
The bpf_skb_check_mtu helper needs to use skb->transport_header when
the BPF_MTU_CHK_SEGS flag is used:
bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)
The transport_header is not always set. There is a WARN_ON_ONCE
report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set +
bpf_prog_test_run is used:
WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071
skb_gso_validate_network_len
bpf_skb_check_mtu
bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch
bpf_test_run
bpf_prog_test_run_skb
For a normal ingress skb (not test_run), skb_reset_transport_header
is performed but there is plan to avoid setting it as described in
commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").
This patch fixes the bpf helper by checking
skb_transport_header_was_set(). The check is done just before
skb->transport_header is used, to avoid breaking the existing bpf prog.
The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.
Fixes: 34b2021cc616 ("bpf: Add BPF-helper for MTU checking")
Cc: Jesper Dangaard Brouer <hawk@kernel.org>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20251112232331.1566074-1-martin.lau@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 1efec0d70d783..df6ce85e48dcd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6429,9 +6429,12 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb,
*/
if (skb_is_gso(skb)) {
ret = BPF_MTU_CHK_RET_SUCCESS;
- if (flags & BPF_MTU_CHK_SEGS &&
- !skb_gso_validate_network_len(skb, mtu))
- ret = BPF_MTU_CHK_RET_SEGS_TOOBIG;
+ if (flags & BPF_MTU_CHK_SEGS) {
+ if (!skb_transport_header_was_set(skb))
+ return -EINVAL;
+ if (!skb_gso_validate_network_len(skb, mtu))
+ ret = BPF_MTU_CHK_RET_SEGS_TOOBIG;
+ }
}
out:
*mtu_len = mtu;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 295/614] mshv: Fix deposit memory in MSHV_ROOT_HVCALL
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 294/614] bpf: Check skb->transport_header is set in bpf_skb_check_mtu Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 296/614] mshv: Fix create memory region overlap check Greg Kroah-Hartman
` (332 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Das Neves, Michael Kelley,
Wei Liu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Das Neves <nunodasneves@linux.microsoft.com>
[ Upstream commit 4cc1aa469cd6b714adc958547a4866247bfd60a9 ]
When the MSHV_ROOT_HVCALL ioctl is executing a hypercall, and gets
HV_STATUS_INSUFFICIENT_MEMORY, it deposits memory and then returns
-EAGAIN to userspace. The expectation is that the VMM will retry.
However, some VMM code in the wild doesn't do this and simply fails.
Rather than force the VMM to retry, change the ioctl to deposit
memory on demand and immediately retry the hypercall as is done with
all the other hypercall helper functions.
In addition to making the ioctl easier to use, removing the need for
multiple syscalls improves performance.
There is a complication: unlike the other hypercall helper functions,
in MSHV_ROOT_HVCALL the input is opaque to the kernel. This is
problematic for rep hypercalls, because the next part of the input
list can't be copied on each loop after depositing pages (this was
the original reason for returning -EAGAIN in this case).
Introduce hv_do_rep_hypercall_ex(), which adds a 'rep_start'
parameter. This solves the issue, allowing the deposit loop in
MSHV_ROOT_HVCALL to restart a rep hypercall after depositing pages
partway through.
Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hv/mshv_root_main.c | 58 ++++++++++++++++++----------------
include/asm-generic/mshyperv.h | 17 ++++++++--
2 files changed, 44 insertions(+), 31 deletions(-)
diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index e3b2bd417c464..5156b8b0a39f4 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -159,6 +159,7 @@ static int mshv_ioctl_passthru_hvcall(struct mshv_partition *partition,
unsigned int pages_order;
void *input_pg = NULL;
void *output_pg = NULL;
+ u16 reps_completed;
if (copy_from_user(&args, user_args, sizeof(args)))
return -EFAULT;
@@ -210,41 +211,42 @@ static int mshv_ioctl_passthru_hvcall(struct mshv_partition *partition,
*/
*(u64 *)input_pg = partition->pt_id;
- if (args.reps)
- status = hv_do_rep_hypercall(args.code, args.reps, 0,
- input_pg, output_pg);
- else
- status = hv_do_hypercall(args.code, input_pg, output_pg);
-
- if (hv_result(status) == HV_STATUS_CALL_PENDING) {
- if (is_async) {
- mshv_async_hvcall_handler(partition, &status);
- } else { /* Paranoia check. This shouldn't happen! */
- ret = -EBADFD;
- goto free_pages_out;
+ reps_completed = 0;
+ do {
+ if (args.reps) {
+ status = hv_do_rep_hypercall_ex(args.code, args.reps,
+ 0, reps_completed,
+ input_pg, output_pg);
+ reps_completed = hv_repcomp(status);
+ } else {
+ status = hv_do_hypercall(args.code, input_pg, output_pg);
}
- }
- if (hv_result(status) == HV_STATUS_INSUFFICIENT_MEMORY) {
- ret = hv_call_deposit_pages(NUMA_NO_NODE, partition->pt_id, 1);
- if (!ret)
- ret = -EAGAIN;
- } else if (!hv_result_success(status)) {
- ret = hv_result_to_errno(status);
- }
+ if (hv_result(status) == HV_STATUS_CALL_PENDING) {
+ if (is_async) {
+ mshv_async_hvcall_handler(partition, &status);
+ } else { /* Paranoia check. This shouldn't happen! */
+ ret = -EBADFD;
+ goto free_pages_out;
+ }
+ }
+
+ if (hv_result_success(status))
+ break;
+
+ if (hv_result(status) != HV_STATUS_INSUFFICIENT_MEMORY)
+ ret = hv_result_to_errno(status);
+ else
+ ret = hv_call_deposit_pages(NUMA_NO_NODE,
+ partition->pt_id, 1);
+ } while (!ret);
- /*
- * Always return the status and output data regardless of result.
- * The VMM may need it to determine how to proceed. E.g. the status may
- * contain the number of reps completed if a rep hypercall partially
- * succeeded.
- */
args.status = hv_result(status);
- args.reps = args.reps ? hv_repcomp(status) : 0;
+ args.reps = reps_completed;
if (copy_to_user(user_args, &args, sizeof(args)))
ret = -EFAULT;
- if (output_pg &&
+ if (!ret && output_pg &&
copy_to_user((void __user *)args.out_ptr, output_pg, args.out_sz))
ret = -EFAULT;
diff --git a/include/asm-generic/mshyperv.h b/include/asm-generic/mshyperv.h
index 64ba6bc807d98..b89c7e3a20474 100644
--- a/include/asm-generic/mshyperv.h
+++ b/include/asm-generic/mshyperv.h
@@ -124,10 +124,12 @@ static inline unsigned int hv_repcomp(u64 status)
/*
* Rep hypercalls. Callers of this functions are supposed to ensure that
- * rep_count and varhead_size comply with Hyper-V hypercall definition.
+ * rep_count, varhead_size, and rep_start comply with Hyper-V hypercall
+ * definition.
*/
-static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size,
- void *input, void *output)
+static inline u64 hv_do_rep_hypercall_ex(u16 code, u16 rep_count,
+ u16 varhead_size, u16 rep_start,
+ void *input, void *output)
{
u64 control = code;
u64 status;
@@ -135,6 +137,7 @@ static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size,
control |= (u64)varhead_size << HV_HYPERCALL_VARHEAD_OFFSET;
control |= (u64)rep_count << HV_HYPERCALL_REP_COMP_OFFSET;
+ control |= (u64)rep_start << HV_HYPERCALL_REP_START_OFFSET;
do {
status = hv_do_hypercall(control, input, output);
@@ -152,6 +155,14 @@ static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size,
return status;
}
+/* For the typical case where rep_start is 0 */
+static inline u64 hv_do_rep_hypercall(u16 code, u16 rep_count, u16 varhead_size,
+ void *input, void *output)
+{
+ return hv_do_rep_hypercall_ex(code, rep_count, varhead_size, 0,
+ input, output);
+}
+
/* Generate the guest OS identifier as described in the Hyper-V TLFS */
static inline u64 hv_generate_guest_id(u64 kernel_version)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 296/614] mshv: Fix create memory region overlap check
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 295/614] mshv: Fix deposit memory in MSHV_ROOT_HVCALL Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 297/614] watchdog: wdat_wdt: Fix ACPI table leak in probe function Greg Kroah-Hartman
` (331 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Kelley, Nuno Das Neves,
Wei Liu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Das Neves <nunodasneves@linux.microsoft.com>
[ Upstream commit ba9eb9b86d232854e983203dc2fb1ba18e316681 ]
The current check is incorrect; it only checks if the beginning or end
of a region is within an existing region. This doesn't account for
userspace specifying a region that begins before and ends after an
existing region.
Change the logic to a range intersection check against gfns and uaddrs
for each region.
Remove mshv_partition_region_by_uaddr() as it is no longer used.
Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Reported-by: Michael Kelley <mhklinux@outlook.com>
Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB41575BE0406D3AB22E1D7DB5D4C2A@SN6PR02MB4157.namprd02.prod.outlook.com/
Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hv/mshv_root_main.c | 31 +++++++++++--------------------
1 file changed, 11 insertions(+), 20 deletions(-)
diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index 5156b8b0a39f4..4e04bef544379 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -1174,21 +1174,6 @@ mshv_partition_region_by_gfn(struct mshv_partition *partition, u64 gfn)
return NULL;
}
-static struct mshv_mem_region *
-mshv_partition_region_by_uaddr(struct mshv_partition *partition, u64 uaddr)
-{
- struct mshv_mem_region *region;
-
- hlist_for_each_entry(region, &partition->pt_mem_regions, hnode) {
- if (uaddr >= region->start_uaddr &&
- uaddr < region->start_uaddr +
- (region->nr_pages << HV_HYP_PAGE_SHIFT))
- return region;
- }
-
- return NULL;
-}
-
/*
* NB: caller checks and makes sure mem->size is page aligned
* Returns: 0 with regionpp updated on success, or -errno
@@ -1198,15 +1183,21 @@ static int mshv_partition_create_region(struct mshv_partition *partition,
struct mshv_mem_region **regionpp,
bool is_mmio)
{
- struct mshv_mem_region *region;
+ struct mshv_mem_region *region, *rg;
u64 nr_pages = HVPFN_DOWN(mem->size);
/* Reject overlapping regions */
- if (mshv_partition_region_by_gfn(partition, mem->guest_pfn) ||
- mshv_partition_region_by_gfn(partition, mem->guest_pfn + nr_pages - 1) ||
- mshv_partition_region_by_uaddr(partition, mem->userspace_addr) ||
- mshv_partition_region_by_uaddr(partition, mem->userspace_addr + mem->size - 1))
+ hlist_for_each_entry(rg, &partition->pt_mem_regions, hnode) {
+ u64 rg_size = rg->nr_pages << HV_HYP_PAGE_SHIFT;
+
+ if ((mem->guest_pfn + nr_pages <= rg->start_gfn ||
+ rg->start_gfn + rg->nr_pages <= mem->guest_pfn) &&
+ (mem->userspace_addr + mem->size <= rg->start_uaddr ||
+ rg->start_uaddr + rg_size <= mem->userspace_addr))
+ continue;
+
return -EEXIST;
+ }
region = vzalloc(sizeof(*region) + sizeof(struct page *) * nr_pages);
if (!region)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 297/614] watchdog: wdat_wdt: Fix ACPI table leak in probe function
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 296/614] mshv: Fix create memory region overlap check Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 298/614] watchdog: starfive: Fix resource leak in probe error path Greg Kroah-Hartman
` (330 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Haotian Zhang,
Wim Van Sebroeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 25c0b472eab8379683d4eef681185c104bed8ffd ]
wdat_wdt_probe() calls acpi_get_table() to obtain the WDAT ACPI table but
never calls acpi_put_table() on any paths. This causes a permanent ACPI
table memory leak.
Add a single cleanup path which calls acpi_put_table() to ensure
the ACPI table is always released.
Fixes: 058dfc767008 ("ACPI / watchdog: Add support for WDAT hardware watchdog")
Suggested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/wdat_wdt.c | 64 +++++++++++++++++++++++++------------
1 file changed, 43 insertions(+), 21 deletions(-)
diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c
index 650fdc7996e1c..dd3c2d69c9df1 100644
--- a/drivers/watchdog/wdat_wdt.c
+++ b/drivers/watchdog/wdat_wdt.c
@@ -326,19 +326,27 @@ static int wdat_wdt_probe(struct platform_device *pdev)
return -ENODEV;
wdat = devm_kzalloc(dev, sizeof(*wdat), GFP_KERNEL);
- if (!wdat)
- return -ENOMEM;
+ if (!wdat) {
+ ret = -ENOMEM;
+ goto out_put_table;
+ }
regs = devm_kcalloc(dev, pdev->num_resources, sizeof(*regs),
GFP_KERNEL);
- if (!regs)
- return -ENOMEM;
+ if (!regs) {
+ ret = -ENOMEM;
+ goto out_put_table;
+ }
/* WDAT specification wants to have >= 1ms period */
- if (tbl->timer_period < 1)
- return -EINVAL;
- if (tbl->min_count > tbl->max_count)
- return -EINVAL;
+ if (tbl->timer_period < 1) {
+ ret = -EINVAL;
+ goto out_put_table;
+ }
+ if (tbl->min_count > tbl->max_count) {
+ ret = -EINVAL;
+ goto out_put_table;
+ }
wdat->period = tbl->timer_period;
wdat->wdd.min_timeout = DIV_ROUND_UP(wdat->period * tbl->min_count, 1000);
@@ -355,15 +363,20 @@ static int wdat_wdt_probe(struct platform_device *pdev)
res = &pdev->resource[i];
if (resource_type(res) == IORESOURCE_MEM) {
reg = devm_ioremap_resource(dev, res);
- if (IS_ERR(reg))
- return PTR_ERR(reg);
+ if (IS_ERR(reg)) {
+ ret = PTR_ERR(reg);
+ goto out_put_table;
+ }
} else if (resource_type(res) == IORESOURCE_IO) {
reg = devm_ioport_map(dev, res->start, 1);
- if (!reg)
- return -ENOMEM;
+ if (!reg) {
+ ret = -ENOMEM;
+ goto out_put_table;
+ }
} else {
dev_err(dev, "Unsupported resource\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto out_put_table;
}
regs[i] = reg;
@@ -385,8 +398,10 @@ static int wdat_wdt_probe(struct platform_device *pdev)
}
instr = devm_kzalloc(dev, sizeof(*instr), GFP_KERNEL);
- if (!instr)
- return -ENOMEM;
+ if (!instr) {
+ ret = -ENOMEM;
+ goto out_put_table;
+ }
INIT_LIST_HEAD(&instr->node);
instr->entry = entries[i];
@@ -417,7 +432,8 @@ static int wdat_wdt_probe(struct platform_device *pdev)
if (!instr->reg) {
dev_err(dev, "I/O resource not found\n");
- return -EINVAL;
+ ret = -EINVAL;
+ goto out_put_table;
}
instructions = wdat->instructions[action];
@@ -425,8 +441,10 @@ static int wdat_wdt_probe(struct platform_device *pdev)
instructions = devm_kzalloc(dev,
sizeof(*instructions),
GFP_KERNEL);
- if (!instructions)
- return -ENOMEM;
+ if (!instructions) {
+ ret = -ENOMEM;
+ goto out_put_table;
+ }
INIT_LIST_HEAD(instructions);
wdat->instructions[action] = instructions;
@@ -443,7 +461,7 @@ static int wdat_wdt_probe(struct platform_device *pdev)
ret = wdat_wdt_enable_reboot(wdat);
if (ret)
- return ret;
+ goto out_put_table;
platform_set_drvdata(pdev, wdat);
@@ -460,12 +478,16 @@ static int wdat_wdt_probe(struct platform_device *pdev)
ret = wdat_wdt_set_timeout(&wdat->wdd, timeout);
if (ret)
- return ret;
+ goto out_put_table;
watchdog_set_nowayout(&wdat->wdd, nowayout);
watchdog_stop_on_reboot(&wdat->wdd);
watchdog_stop_on_unregister(&wdat->wdd);
- return devm_watchdog_register_device(dev, &wdat->wdd);
+ ret = devm_watchdog_register_device(dev, &wdat->wdd);
+
+out_put_table:
+ acpi_put_table((struct acpi_table_header *)tbl);
+ return ret;
}
static int wdat_wdt_suspend_noirq(struct device *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 298/614] watchdog: starfive: Fix resource leak in probe error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 297/614] watchdog: wdat_wdt: Fix ACPI table leak in probe function Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 299/614] iio: core: add missing mutex_destroy in iio_dev_release() Greg Kroah-Hartman
` (329 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Wim Van Sebroeck,
Guenter Roeck, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 5bcc5786a0cfa9249ccbe539833040a6285d0de3 ]
If pm_runtime_put_sync() fails after watchdog_register_device()
succeeds, the probe function jumps to err_exit without
unregistering the watchdog device. This leaves the watchdog
registered in the subsystem while the driver fails to load,
resulting in a resource leak.
Add a new error label err_unregister_wdt to properly unregister
the watchdog device.
Fixes: 8bc22a2f1bf0 ("watchdog: starfive: Check pm_runtime_enabled() before decrementing usage counter")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/starfive-wdt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/starfive-wdt.c b/drivers/watchdog/starfive-wdt.c
index 355918d62f63d..ed71d3960a0f2 100644
--- a/drivers/watchdog/starfive-wdt.c
+++ b/drivers/watchdog/starfive-wdt.c
@@ -500,12 +500,14 @@ static int starfive_wdt_probe(struct platform_device *pdev)
if (pm_runtime_enabled(&pdev->dev)) {
ret = pm_runtime_put_sync(&pdev->dev);
if (ret)
- goto err_exit;
+ goto err_unregister_wdt;
}
}
return 0;
+err_unregister_wdt:
+ watchdog_unregister_device(&wdt->wdd);
err_exit:
starfive_wdt_disable_clock(wdt);
pm_runtime_disable(&pdev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 299/614] iio: core: add missing mutex_destroy in iio_dev_release()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 298/614] watchdog: starfive: Fix resource leak in probe error path Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 300/614] iio: core: Clean up device correctly on iio_device_alloc() failure Greg Kroah-Hartman
` (328 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Nuno Sá,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit f5d203467a31798191365efeb16cd619d2c8f23a ]
Add missing mutex_destroy() call in iio_dev_release() to properly
clean up the mutex initialized in iio_device_alloc(). Ensure proper
resource cleanup and follows kernel practices.
Found by code review.
While at it, create a lockdep key before mutex initialisation.
This will help with converting it to the better API in the future.
Fixes: 847ec80bbaa7 ("Staging: IIO: core support for device registration and management")
Fixes: ac917a81117c ("staging:iio:core set the iio_dev.info pointer to null on unregister under lock.")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/industrialio-core.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 88c3d585a1bd0..93d6e5b101cf1 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -1654,6 +1654,9 @@ static void iio_dev_release(struct device *device)
iio_device_detach_buffers(indio_dev);
+ mutex_destroy(&iio_dev_opaque->info_exist_lock);
+ mutex_destroy(&iio_dev_opaque->mlock);
+
lockdep_unregister_key(&iio_dev_opaque->mlock_key);
ida_free(&iio_ida, iio_dev_opaque->id);
@@ -1698,8 +1701,7 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)
indio_dev->dev.type = &iio_device_type;
indio_dev->dev.bus = &iio_bus_type;
device_initialize(&indio_dev->dev);
- mutex_init(&iio_dev_opaque->mlock);
- mutex_init(&iio_dev_opaque->info_exist_lock);
+
INIT_LIST_HEAD(&iio_dev_opaque->channel_attr_list);
iio_dev_opaque->id = ida_alloc(&iio_ida, GFP_KERNEL);
@@ -1722,6 +1724,9 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)
lockdep_register_key(&iio_dev_opaque->mlock_key);
lockdep_set_class(&iio_dev_opaque->mlock, &iio_dev_opaque->mlock_key);
+ mutex_init(&iio_dev_opaque->mlock);
+ mutex_init(&iio_dev_opaque->info_exist_lock);
+
return indio_dev;
}
EXPORT_SYMBOL(iio_device_alloc);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 300/614] iio: core: Clean up device correctly on iio_device_alloc() failure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 299/614] iio: core: add missing mutex_destroy in iio_dev_release() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 301/614] fuse_ctl_add_conn(): fix nlink breakage in case of early failure Greg Kroah-Hartman
` (327 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Nuno Sá,
Jonathan Cameron, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit b0e6871415b25f5e84a79621834e3d0c9d4627a6 ]
Once we called device_initialize() we have to call put_device()
on it. Refactor the code to make it in the right order.
Fixes: fe6f45f6ba22 ("iio: core: check return value when calling dev_set_name()")
Fixes: 847ec80bbaa7 ("Staging: IIO: core support for device registration and management")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/industrialio-core.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 93d6e5b101cf1..5d2f35cf18bc3 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -1697,11 +1697,6 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)
ACCESS_PRIVATE(indio_dev, priv) = (char *)iio_dev_opaque +
ALIGN(sizeof(*iio_dev_opaque), IIO_DMA_MINALIGN);
- indio_dev->dev.parent = parent;
- indio_dev->dev.type = &iio_device_type;
- indio_dev->dev.bus = &iio_bus_type;
- device_initialize(&indio_dev->dev);
-
INIT_LIST_HEAD(&iio_dev_opaque->channel_attr_list);
iio_dev_opaque->id = ida_alloc(&iio_ida, GFP_KERNEL);
@@ -1727,6 +1722,11 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv)
mutex_init(&iio_dev_opaque->mlock);
mutex_init(&iio_dev_opaque->info_exist_lock);
+ indio_dev->dev.parent = parent;
+ indio_dev->dev.type = &iio_device_type;
+ indio_dev->dev.bus = &iio_bus_type;
+ device_initialize(&indio_dev->dev);
+
return indio_dev;
}
EXPORT_SYMBOL(iio_device_alloc);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 301/614] fuse_ctl_add_conn(): fix nlink breakage in case of early failure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 300/614] iio: core: Clean up device correctly on iio_device_alloc() failure Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 302/614] tracefs: fix a leak in eventfs_create_events_dir() Greg Kroah-Hartman
` (326 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miklos Szeredi, Al Viro, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit c460192aae197df1b4db1dca493c35ad529f1b64 ]
fuse_ctl_remove_conn() used to decrement the link count of root
manually; that got subsumed by simple_recursive_removal(), but
in case when subdirectory creation has failed the latter won't
get called.
Just move the modification of parent's link count into
fuse_ctl_add_dentry() to keep the things simple. Allows to
get rid of the nlink argument as well...
Fixes: fcaac5b42768 "fuse_ctl: use simple_recursive_removal()"
Acked-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/fuse/control.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index bb407705603c2..5247df896c5d0 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -205,8 +205,7 @@ static const struct file_operations fuse_conn_congestion_threshold_ops = {
static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
struct fuse_conn *fc,
- const char *name,
- int mode, int nlink,
+ const char *name, int mode,
const struct inode_operations *iop,
const struct file_operations *fop)
{
@@ -232,7 +231,10 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
if (iop)
inode->i_op = iop;
inode->i_fop = fop;
- set_nlink(inode, nlink);
+ if (S_ISDIR(mode)) {
+ inc_nlink(d_inode(parent));
+ inc_nlink(inode);
+ }
inode->i_private = fc;
d_add(dentry, inode);
@@ -252,22 +254,21 @@ int fuse_ctl_add_conn(struct fuse_conn *fc)
return 0;
parent = fuse_control_sb->s_root;
- inc_nlink(d_inode(parent));
sprintf(name, "%u", fc->dev);
- parent = fuse_ctl_add_dentry(parent, fc, name, S_IFDIR | 0500, 2,
+ parent = fuse_ctl_add_dentry(parent, fc, name, S_IFDIR | 0500,
&simple_dir_inode_operations,
&simple_dir_operations);
if (!parent)
goto err;
- if (!fuse_ctl_add_dentry(parent, fc, "waiting", S_IFREG | 0400, 1,
+ if (!fuse_ctl_add_dentry(parent, fc, "waiting", S_IFREG | 0400,
NULL, &fuse_ctl_waiting_ops) ||
- !fuse_ctl_add_dentry(parent, fc, "abort", S_IFREG | 0200, 1,
+ !fuse_ctl_add_dentry(parent, fc, "abort", S_IFREG | 0200,
NULL, &fuse_ctl_abort_ops) ||
!fuse_ctl_add_dentry(parent, fc, "max_background", S_IFREG | 0600,
- 1, NULL, &fuse_conn_max_background_ops) ||
+ NULL, &fuse_conn_max_background_ops) ||
!fuse_ctl_add_dentry(parent, fc, "congestion_threshold",
- S_IFREG | 0600, 1, NULL,
+ S_IFREG | 0600, NULL,
&fuse_conn_congestion_threshold_ops))
goto err;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 302/614] tracefs: fix a leak in eventfs_create_events_dir()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 301/614] fuse_ctl_add_conn(): fix nlink breakage in case of early failure Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 303/614] NFSD/blocklayout: Fix minlength check in proc_layoutget Greg Kroah-Hartman
` (325 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Rostedt (Google), Al Viro,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 798a401660a151633cb171738a72a8f1efb9b0b4 ]
If we have LOCKDOWN_TRACEFS, the function bails out - *after*
having locked the parent directory and without bothering to
undo that. Just check it before tracefs_start_creating()...
Fixes: e24709454c45 "tracefs/eventfs: Add missing lockdown checks"
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/tracefs/event_inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 8705c77a9e75a..93c231601c8e2 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -757,7 +757,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
const struct eventfs_entry *entries,
int size, void *data)
{
- struct dentry *dentry = tracefs_start_creating(name, parent);
+ struct dentry *dentry;
struct eventfs_root_inode *rei;
struct eventfs_inode *ei;
struct tracefs_inode *ti;
@@ -768,6 +768,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
if (security_locked_down(LOCKDOWN_TRACEFS))
return NULL;
+ dentry = tracefs_start_creating(name, parent);
if (IS_ERR(dentry))
return ERR_CAST(dentry);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 303/614] NFSD/blocklayout: Fix minlength check in proc_layoutget
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 302/614] tracefs: fix a leak in eventfs_create_events_dir() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 304/614] arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Greg Kroah-Hartman
` (324 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Bashirov, Christoph Hellwig,
Chuck Lever, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Bashirov <sergeybashirov@gmail.com>
[ Upstream commit 3524b021b0ec620a76c89aee78e9d4b4130fb711 ]
The extent returned by the file system may have a smaller offset than
the segment offset requested by the client. In this case, the minimum
segment length must be checked against the requested range. Otherwise,
the client may not be able to continue the read/write operation.
Fixes: 8650b8a05850 ("nfsd: pNFS block layout driver")
Signed-off-by: Sergey Bashirov <sergeybashirov@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/blocklayout.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c
index fde5539cf6a69..425648565ab2d 100644
--- a/fs/nfsd/blocklayout.c
+++ b/fs/nfsd/blocklayout.c
@@ -23,6 +23,7 @@ nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
{
struct nfsd4_layout_seg *seg = &args->lg_seg;
struct super_block *sb = inode->i_sb;
+ u64 length;
u32 block_size = i_blocksize(inode);
struct pnfs_block_extent *bex;
struct iomap iomap;
@@ -56,7 +57,8 @@ nfsd4_block_proc_layoutget(struct svc_rqst *rqstp, struct inode *inode,
goto out_error;
}
- if (iomap.length < args->lg_minlength) {
+ length = iomap.offset + iomap.length - seg->offset;
+ if (length < args->lg_minlength) {
dprintk("pnfsd: extent smaller than minlength\n");
goto out_layoutunavailable;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 304/614] arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 303/614] NFSD/blocklayout: Fix minlength check in proc_layoutget Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 305/614] arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Greg Kroah-Hartman
` (323 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markus Niebel, Alexander Stein,
Shawn Guo, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Niebel <Markus.Niebel@ew.tq-group.com>
[ Upstream commit 046cb64923e8c05a8fb656baffcd8c3fc67fb688 ]
tpm4grp will be overwritten. Fix node name
Fixes: 91d1ff322c47 ("arm64: dt: imx95: Add TQMa95xxSA")
Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi b/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi
index 180124cc5bce1..c3bb61ea67961 100644
--- a/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi
@@ -617,7 +617,7 @@ pinctrl_tpm4: tpm4grp {
fsl,pins = <IMX95_PAD_GPIO_IO05__TPM4_CH0 0x51e>;
};
- pinctrl_tpm5: tpm4grp {
+ pinctrl_tpm5: tpm5grp {
fsl,pins = <IMX95_PAD_GPIO_IO06__TPM5_CH0 0x51e>;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 305/614] arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 304/614] arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 306/614] block/blk-throttle: Fix throttle slice time for SSDs Greg Kroah-Hartman
` (322 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Stein, Shawn Guo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 461be3802562b2d41250b40868310579a32f32c1 ]
66 MHz is the maximum FlexPI clock frequency in normal/overdrive mode
when RXCLKSRC = 0 (Default)
Fixes: 91d1ff322c47 ("arm64: dt: imx95: Add TQMa95xxSA")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi b/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi
index c3bb61ea67961..16c40d11d3b5d 100644
--- a/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi
@@ -115,7 +115,7 @@ &flexspi1 {
flash0: flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
- spi-max-frequency = <80000000>;
+ spi-max-frequency = <66000000>;
spi-tx-bus-width = <4>;
spi-rx-bus-width = <4>;
vcc-supply = <®_1v8>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 306/614] block/blk-throttle: Fix throttle slice time for SSDs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 305/614] arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 307/614] drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() Greg Kroah-Hartman
` (321 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Tejun Heo, Guenter Roeck,
Khazhismel Kumykov, Yu Kuai, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit f76581f9f1d29e32e120b0242974ba266e79de58 ]
Commit d61fcfa4bb18 ("blk-throttle: choose a small throtl_slice for SSD")
introduced device type specific throttle slices if BLK_DEV_THROTTLING_LOW
was enabled. Commit bf20ab538c81 ("blk-throttle: remove
CONFIG_BLK_DEV_THROTTLING_LOW") removed support for BLK_DEV_THROTTLING_LOW,
but left the device type specific throttle slices in place. This
effectively changed throttling behavior on systems with SSD which now use
a different and non-configurable slice time compared to non-SSD devices.
Practical impact is that throughput tests with low configured throttle
values (65536 bps) experience less than expected throughput on SSDs,
presumably due to rounding errors associated with the small throttle slice
time used for those devices. The same tests pass when setting the throttle
values to 65536 * 4 = 262144 bps.
The original code sets the throttle slice time to DFL_THROTL_SLICE_HD if
CONFIG_BLK_DEV_THROTTLING_LOW is disabled. Restore that code to fix the
problem. With that, DFL_THROTL_SLICE_SSD is no longer necessary. Revert to
the original code and re-introduce DFL_THROTL_SLICE to replace both
DFL_THROTL_SLICE_HD and DFL_THROTL_SLICE_SSD. This effectively reverts
commit d61fcfa4bb18 ("blk-throttle: choose a small throtl_slice for SSD").
While at it, also remove MAX_THROTL_SLICE since it is not used anymore.
Fixes: bf20ab538c81 ("blk-throttle: remove CONFIG_BLK_DEV_THROTTLING_LOW")
Cc: Yu Kuai <yukuai@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
Reviewed-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-throttle.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 2c5b64b1a724a..c19d052a8f2f1 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -22,9 +22,7 @@
#define THROTL_QUANTUM 32
/* Throttling is performed over a slice and after that slice is renewed */
-#define DFL_THROTL_SLICE_HD (HZ / 10)
-#define DFL_THROTL_SLICE_SSD (HZ / 50)
-#define MAX_THROTL_SLICE (HZ)
+#define DFL_THROTL_SLICE (HZ / 10)
/* A workqueue to queue throttle related work */
static struct workqueue_struct *kthrotld_workqueue;
@@ -1341,10 +1339,7 @@ static int blk_throtl_init(struct gendisk *disk)
goto out;
}
- if (blk_queue_nonrot(q))
- td->throtl_slice = DFL_THROTL_SLICE_SSD;
- else
- td->throtl_slice = DFL_THROTL_SLICE_HD;
+ td->throtl_slice = DFL_THROTL_SLICE;
td->track_bio_latency = !queue_is_mq(q);
if (!td->track_bio_latency)
blk_stat_enable_accounting(q);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 307/614] drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 306/614] block/blk-throttle: Fix throttle slice time for SSDs Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 308/614] drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Greg Kroah-Hartman
` (320 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huiwen He, Rob Clark, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <hehuiwen@kylinos.cn>
[ Upstream commit 3099e0247e3217e1b39c1c61766e06ec3d13835f ]
crashstate_get_vm_logs() did not check the return value of
kmalloc_array(). In low-memory situations, kmalloc_array() may return
NULL, leading to a NULL pointer dereference when the function later
accesses state->vm_logs.
Fix this by checking the return value of kmalloc_array() and setting
state->nr_vm_logs to 0 if allocation fails.
Fixes: 9edc52967cc7 ("drm/msm: Add VM logging for VM_BIND updates")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Patchwork: https://patchwork.freedesktop.org/patch/687555/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_gpu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 17759abc46d7d..e23f70fbc8cb2 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -348,6 +348,10 @@ static void crashstate_get_vm_logs(struct msm_gpu_state *state, struct msm_gem_v
state->vm_logs = kmalloc_array(
state->nr_vm_logs, sizeof(vm->log[0]), GFP_KERNEL);
+ if (!state->vm_logs) {
+ state->nr_vm_logs = 0;
+ }
+
for (int i = 0; i < state->nr_vm_logs; i++) {
int idx = (i + first) & vm_log_mask;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 308/614] drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 307/614] drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 309/614] drm/msm/a2xx: stop over-complaining about the legacy firmware Greg Kroah-Hartman
` (319 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Huiwen He, Rob Clark, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <hehuiwen@kylinos.cn>
[ Upstream commit 3065e6a4d3594b42dae6176b3e2c0c3563cf94b8 ]
The crashstate_get_bos() function allocates memory for `state->bos`
using kcalloc(), but the vmbind path does not check for allocation
failure before dereferencing it in the following drm_gpuvm_for_each_va()
loop. This could lead to a NULL pointer dereference if memory allocation
fails.
Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check
on state->bos, similar to the safety check in the non-vmbind path.
Fixes: af9aa6f316b3d ("drm/msm: Crashdump support for sparse")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Patchwork: https://patchwork.freedesktop.org/patch/687556/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_gpu.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index e23f70fbc8cb2..dd0605fe1243d 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -287,16 +287,17 @@ static void crashstate_get_bos(struct msm_gpu_state *state, struct msm_gem_submi
state->bos = kcalloc(cnt, sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
- drm_gpuvm_for_each_va (vma, submit->vm) {
- bool dump = rd_full || (vma->flags & MSM_VMA_DUMP);
+ if (state->bos)
+ drm_gpuvm_for_each_va(vma, submit->vm) {
+ bool dump = rd_full || (vma->flags & MSM_VMA_DUMP);
- /* Skip MAP_NULL/PRR VMAs: */
- if (!vma->gem.obj)
- continue;
+ /* Skip MAP_NULL/PRR VMAs: */
+ if (!vma->gem.obj)
+ continue;
- msm_gpu_crashstate_get_bo(state, vma->gem.obj, vma->va.addr,
- dump, vma->gem.offset, vma->va.range);
- }
+ msm_gpu_crashstate_get_bo(state, vma->gem.obj, vma->va.addr,
+ dump, vma->gem.offset, vma->va.range);
+ }
drm_exec_fini(&exec);
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 309/614] drm/msm/a2xx: stop over-complaining about the legacy firmware
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 308/614] drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 310/614] PCI: stm32: Fix LTSSM EP race with start link Greg Kroah-Hartman
` (318 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Rob Clark,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit a3a22373fce576560757f5616eb48dbf85891d9c ]
If the rootfs have a legacy A200 firmware, currently the driver will
complain each time the hw is reinited (which can happen a lot). E.g.
with GL testsuite the hw is reinited after each test, spamming the
console.
Make sure that the message is printed only once: when we detect the
firmware that doesn't support protection.
Fixes: 302295070d3c ("drm/msm/a2xx: support loading legacy (iMX) firmware")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/688098/
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
index ec38db45d8a36..963c0f669ee50 100644
--- a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
@@ -234,7 +234,7 @@ static int a2xx_hw_init(struct msm_gpu *gpu)
* word (0x20xxxx for A200, 0x220xxx for A220, 0x225xxx for A225).
* Older firmware files, which lack protection support, have 0 instead.
*/
- if (ptr[1] == 0) {
+ if (ptr[1] == 0 && !a2xx_gpu->protection_disabled) {
dev_warn(gpu->dev->dev,
"Legacy firmware detected, disabling protection support\n");
a2xx_gpu->protection_disabled = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 310/614] PCI: stm32: Fix LTSSM EP race with start link
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 309/614] drm/msm/a2xx: stop over-complaining about the legacy firmware Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 311/614] PCI: stm32: Fix EP page_size alignment Greg Kroah-Hartman
` (317 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Bruel,
Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <christian.bruel@foss.st.com>
[ Upstream commit fa81d6099007728cae39c6f937d83903bbddab5e ]
If the host has deasserted PERST# and started link training before the link
is started on EP side, enabling LTSSM before the endpoint registers are
initialized in the perst_irq handler results in probing incorrect values.
Thus, wait for the PERST# level-triggered interrupt to start link training
at the end of initialization and cleanup the stm32_pcie_[start stop]_link
functions.
Fixes: 151f3d29baf4 ("PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25")
Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
[mani: added fixes tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: wrap line]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251114-perst_ep-v1-1-e7976317a890@foss.st.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-stm32-ep.c | 39 +++++-----------------
1 file changed, 8 insertions(+), 31 deletions(-)
diff --git a/drivers/pci/controller/dwc/pcie-stm32-ep.c b/drivers/pci/controller/dwc/pcie-stm32-ep.c
index 3400c7cd2d88a..faa6433a784f3 100644
--- a/drivers/pci/controller/dwc/pcie-stm32-ep.c
+++ b/drivers/pci/controller/dwc/pcie-stm32-ep.c
@@ -37,36 +37,9 @@ static void stm32_pcie_ep_init(struct dw_pcie_ep *ep)
dw_pcie_ep_reset_bar(pci, bar);
}
-static int stm32_pcie_enable_link(struct dw_pcie *pci)
-{
- struct stm32_pcie *stm32_pcie = to_stm32_pcie(pci);
-
- regmap_update_bits(stm32_pcie->regmap, SYSCFG_PCIECR,
- STM32MP25_PCIECR_LTSSM_EN,
- STM32MP25_PCIECR_LTSSM_EN);
-
- return dw_pcie_wait_for_link(pci);
-}
-
-static void stm32_pcie_disable_link(struct dw_pcie *pci)
-{
- struct stm32_pcie *stm32_pcie = to_stm32_pcie(pci);
-
- regmap_update_bits(stm32_pcie->regmap, SYSCFG_PCIECR, STM32MP25_PCIECR_LTSSM_EN, 0);
-}
-
static int stm32_pcie_start_link(struct dw_pcie *pci)
{
struct stm32_pcie *stm32_pcie = to_stm32_pcie(pci);
- int ret;
-
- dev_dbg(pci->dev, "Enable link\n");
-
- ret = stm32_pcie_enable_link(pci);
- if (ret) {
- dev_err(pci->dev, "PCIe cannot establish link: %d\n", ret);
- return ret;
- }
enable_irq(stm32_pcie->perst_irq);
@@ -77,11 +50,7 @@ static void stm32_pcie_stop_link(struct dw_pcie *pci)
{
struct stm32_pcie *stm32_pcie = to_stm32_pcie(pci);
- dev_dbg(pci->dev, "Disable link\n");
-
disable_irq(stm32_pcie->perst_irq);
-
- stm32_pcie_disable_link(pci);
}
static int stm32_pcie_raise_irq(struct dw_pcie_ep *ep, u8 func_no,
@@ -152,6 +121,9 @@ static void stm32_pcie_perst_assert(struct dw_pcie *pci)
dev_dbg(dev, "PERST asserted by host\n");
+ regmap_update_bits(stm32_pcie->regmap, SYSCFG_PCIECR,
+ STM32MP25_PCIECR_LTSSM_EN, 0);
+
pci_epc_deinit_notify(ep->epc);
stm32_pcie_disable_resources(stm32_pcie);
@@ -192,6 +164,11 @@ static void stm32_pcie_perst_deassert(struct dw_pcie *pci)
pci_epc_init_notify(ep->epc);
+ /* Enable link training */
+ regmap_update_bits(stm32_pcie->regmap, SYSCFG_PCIECR,
+ STM32MP25_PCIECR_LTSSM_EN,
+ STM32MP25_PCIECR_LTSSM_EN);
+
return;
err_disable_resources:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 311/614] PCI: stm32: Fix EP page_size alignment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 310/614] PCI: stm32: Fix LTSSM EP race with start link Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 312/614] wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() Greg Kroah-Hartman
` (316 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Bruel,
Manivannan Sadhasivam, Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <christian.bruel@foss.st.com>
[ Upstream commit ff529a9307a03ec03ed9751da053b57149300053 ]
pci_epc_mem_alloc_addr() allocates a CPU address from the ATU window phys
base and a page number. Set the ep->page_size so the resulting CPU address
is correctly aligned with the ATU required alignment.
Fixes: 151f3d29baf4 ("PCI: stm32-ep: Add PCIe Endpoint support for STM32MP25")
Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
[mani: added fixes tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251114-atu_align_ep-v1-1-88da5366fa04@foss.st.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-stm32-ep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/dwc/pcie-stm32-ep.c b/drivers/pci/controller/dwc/pcie-stm32-ep.c
index faa6433a784f3..7d48038d576d9 100644
--- a/drivers/pci/controller/dwc/pcie-stm32-ep.c
+++ b/drivers/pci/controller/dwc/pcie-stm32-ep.c
@@ -214,6 +214,8 @@ static int stm32_add_pcie_ep(struct stm32_pcie *stm32_pcie,
ep->ops = &stm32_pcie_ep_ops;
+ ep->page_size = stm32_pcie_epc_features.align;
+
ret = dw_pcie_ep_init(ep);
if (ret) {
dev_err(dev, "Failed to initialize ep: %d\n", ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 312/614] wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 311/614] PCI: stm32: Fix EP page_size alignment Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 313/614] net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay Greg Kroah-Hartman
` (315 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Ping-Ke Shih,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 9b5b9c042b30befc5b37e4539ace95af70843473 ]
In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA
allocations in a loop. When an allocation fails, the previously
successful allocations are not freed on exit.
Fix that by jumping to err_free_rings label on error, which calls
rtl8180_free_rx_ring() to free the allocations. Remove the free of
rx_ring in rtl8180_init_rx_ring() error path, and set the freed
priv->rx_buf entry to null, to avoid double free.
Fixes: f653211197f3 ("Add rtl8180 wireless driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251114094527.79842-1-nihaal@cse.iitm.ac.in
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
index 2905baea62390..070c0431c4821 100644
--- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c
@@ -1023,9 +1023,6 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)
dma_addr_t *mapping;
entry = priv->rx_ring + priv->rx_ring_sz*i;
if (!skb) {
- dma_free_coherent(&priv->pdev->dev,
- priv->rx_ring_sz * 32,
- priv->rx_ring, priv->rx_ring_dma);
wiphy_err(dev->wiphy, "Cannot allocate RX skb\n");
return -ENOMEM;
}
@@ -1037,9 +1034,7 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev)
if (dma_mapping_error(&priv->pdev->dev, *mapping)) {
kfree_skb(skb);
- dma_free_coherent(&priv->pdev->dev,
- priv->rx_ring_sz * 32,
- priv->rx_ring, priv->rx_ring_dma);
+ priv->rx_buf[i] = NULL;
wiphy_err(dev->wiphy, "Cannot map DMA for RX skb\n");
return -ENOMEM;
}
@@ -1130,7 +1125,7 @@ static int rtl8180_start(struct ieee80211_hw *dev)
ret = rtl8180_init_rx_ring(dev);
if (ret)
- return ret;
+ goto err_free_rings;
for (i = 0; i < (dev->queues + 1); i++)
if ((ret = rtl8180_init_tx_ring(dev, i, 16)))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 313/614] net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 312/614] wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 314/614] net: stmmac: dwmac-sophgo: Add phy interface filter Greg Kroah-Hartman
` (314 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Russell King (Oracle), Inochi Amaoto,
Maxime Chevallier, Simon Horman, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit 24afd7827efb7c69adfc41835390470e3eec4740 ]
The "phy-mode" property of devicetree indicates whether the PCB has
delay now, which means the mac needs to modify the PHY mode based
on whether there is an internal delay in the mac.
This modification is similar for many ethernet drivers. To simplify
code, define the helper phy_fix_phy_mode_for_mac_delays(speed, mac_txid,
mac_rxid) to fix PHY mode based on whether mac adds internal delay.
Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk>
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251114003805.494387-3-inochiama@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: db37c6e510de ("net: stmmac: dwmac-sophgo: Add phy interface filter")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/phy-core.c | 43 ++++++++++++++++++++++++++++++++++++++
include/linux/phy.h | 3 +++
2 files changed, 46 insertions(+)
diff --git a/drivers/net/phy/phy-core.c b/drivers/net/phy/phy-core.c
index 605ca20ae192d..0c63e6ba2cb0c 100644
--- a/drivers/net/phy/phy-core.c
+++ b/drivers/net/phy/phy-core.c
@@ -101,6 +101,49 @@ const char *phy_rate_matching_to_str(int rate_matching)
}
EXPORT_SYMBOL_GPL(phy_rate_matching_to_str);
+/**
+ * phy_fix_phy_mode_for_mac_delays - Convenience function for fixing PHY
+ * mode based on whether mac adds internal delay
+ *
+ * @interface: The current interface mode of the port
+ * @mac_txid: True if the mac adds internal tx delay
+ * @mac_rxid: True if the mac adds internal rx delay
+ *
+ * Return: fixed PHY mode, or PHY_INTERFACE_MODE_NA if the interface can
+ * not apply the internal delay
+ */
+phy_interface_t phy_fix_phy_mode_for_mac_delays(phy_interface_t interface,
+ bool mac_txid, bool mac_rxid)
+{
+ if (!phy_interface_mode_is_rgmii(interface))
+ return interface;
+
+ if (mac_txid && mac_rxid) {
+ if (interface == PHY_INTERFACE_MODE_RGMII_ID)
+ return PHY_INTERFACE_MODE_RGMII;
+ return PHY_INTERFACE_MODE_NA;
+ }
+
+ if (mac_txid) {
+ if (interface == PHY_INTERFACE_MODE_RGMII_ID)
+ return PHY_INTERFACE_MODE_RGMII_RXID;
+ if (interface == PHY_INTERFACE_MODE_RGMII_TXID)
+ return PHY_INTERFACE_MODE_RGMII;
+ return PHY_INTERFACE_MODE_NA;
+ }
+
+ if (mac_rxid) {
+ if (interface == PHY_INTERFACE_MODE_RGMII_ID)
+ return PHY_INTERFACE_MODE_RGMII_TXID;
+ if (interface == PHY_INTERFACE_MODE_RGMII_RXID)
+ return PHY_INTERFACE_MODE_RGMII;
+ return PHY_INTERFACE_MODE_NA;
+ }
+
+ return interface;
+}
+EXPORT_SYMBOL_GPL(phy_fix_phy_mode_for_mac_delays);
+
/**
* phy_interface_num_ports - Return the number of links that can be carried by
* a given MAC-PHY physical link. Returns 0 if this is
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 3c7634482356e..0bc00a4cceb24 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -1813,6 +1813,9 @@ static inline bool phy_is_pseudo_fixed_link(struct phy_device *phydev)
return phydev->is_pseudo_fixed_link;
}
+phy_interface_t phy_fix_phy_mode_for_mac_delays(phy_interface_t interface,
+ bool mac_txid, bool mac_rxid);
+
int phy_save_page(struct phy_device *phydev);
int phy_select_page(struct phy_device *phydev, int page);
int phy_restore_page(struct phy_device *phydev, int oldpage, int ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 314/614] net: stmmac: dwmac-sophgo: Add phy interface filter
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 313/614] net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 315/614] bpf: Fix invalid prog->stats access when update_effective_progs fails Greg Kroah-Hartman
` (313 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Inochi Amaoto, Han Gao, Andrew Lunn,
Simon Horman, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inochi Amaoto <inochiama@gmail.com>
[ Upstream commit db37c6e510deabc9b0ee27c08f1c5aaa19f2e8ef ]
As the SG2042 has an internal rx delay, the delay should be removed
when initializing the mac, otherwise the phy will be misconfigurated.
Fixes: 543009e2d4cd ("net: stmmac: dwmac-sophgo: Add support for Sophgo SG2042 SoC")
Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Tested-by: Han Gao <rabenda.cn@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251114003805.494387-4-inochiama@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 ++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c
index 3b7947a7a7ba7..fcdda2401968b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c
@@ -7,11 +7,16 @@
#include <linux/clk.h>
#include <linux/module.h>
+#include <linux/property.h>
#include <linux/mod_devicetable.h>
#include <linux/platform_device.h>
#include "stmmac_platform.h"
+struct sophgo_dwmac_data {
+ bool has_internal_rx_delay;
+};
+
static int sophgo_sg2044_dwmac_init(struct platform_device *pdev,
struct plat_stmmacenet_data *plat_dat,
struct stmmac_resources *stmmac_res)
@@ -32,6 +37,7 @@ static int sophgo_sg2044_dwmac_init(struct platform_device *pdev,
static int sophgo_dwmac_probe(struct platform_device *pdev)
{
struct plat_stmmacenet_data *plat_dat;
+ const struct sophgo_dwmac_data *data;
struct stmmac_resources stmmac_res;
struct device *dev = &pdev->dev;
int ret;
@@ -50,11 +56,23 @@ static int sophgo_dwmac_probe(struct platform_device *pdev)
if (ret)
return ret;
+ data = device_get_match_data(&pdev->dev);
+ if (data && data->has_internal_rx_delay) {
+ plat_dat->phy_interface = phy_fix_phy_mode_for_mac_delays(plat_dat->phy_interface,
+ false, true);
+ if (plat_dat->phy_interface == PHY_INTERFACE_MODE_NA)
+ return -EINVAL;
+ }
+
return stmmac_dvr_probe(dev, plat_dat, &stmmac_res);
}
+static const struct sophgo_dwmac_data sg2042_dwmac_data = {
+ .has_internal_rx_delay = true,
+};
+
static const struct of_device_id sophgo_dwmac_match[] = {
- { .compatible = "sophgo,sg2042-dwmac" },
+ { .compatible = "sophgo,sg2042-dwmac", .data = &sg2042_dwmac_data },
{ .compatible = "sophgo,sg2044-dwmac" },
{ /* sentinel */ }
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 315/614] bpf: Fix invalid prog->stats access when update_effective_progs fails
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 314/614] net: stmmac: dwmac-sophgo: Add phy interface filter Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 316/614] powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit Greg Kroah-Hartman
` (312 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pu Lehui, Alexei Starovoitov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 7dc211c1159d991db609bdf4b0fb9033c04adcbc ]
Syzkaller triggers an invalid memory access issue following fault
injection in update_effective_progs. The issue can be described as
follows:
__cgroup_bpf_detach
update_effective_progs
compute_effective_progs
bpf_prog_array_alloc <-- fault inject
purge_effective_progs
/* change to dummy_bpf_prog */
array->items[index] = &dummy_bpf_prog.prog
---softirq start---
__do_softirq
...
__cgroup_bpf_run_filter_skb
__bpf_prog_run_save_cb
bpf_prog_run
stats = this_cpu_ptr(prog->stats)
/* invalid memory access */
flags = u64_stats_update_begin_irqsave(&stats->syncp)
---softirq end---
static_branch_dec(&cgroup_bpf_enabled_key[atype])
The reason is that fault injection caused update_effective_progs to fail
and then changed the original prog into dummy_bpf_prog.prog in
purge_effective_progs. Then a softirq came, and accessing the members of
dummy_bpf_prog.prog in the softirq triggers invalid mem access.
To fix it, skip updating stats when stats is NULL.
Fixes: 492ecee892c2 ("bpf: enable program stats")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Link: https://lore.kernel.org/r/20251115102343.2200727-1-pulehui@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/filter.h | 12 +++++++-----
kernel/bpf/syscall.c | 3 +++
2 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 973233b82dc1f..569de3b14279a 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -712,11 +712,13 @@ static __always_inline u32 __bpf_prog_run(const struct bpf_prog *prog,
ret = dfunc(ctx, prog->insnsi, prog->bpf_func);
duration = sched_clock() - start;
- stats = this_cpu_ptr(prog->stats);
- flags = u64_stats_update_begin_irqsave(&stats->syncp);
- u64_stats_inc(&stats->cnt);
- u64_stats_add(&stats->nsecs, duration);
- u64_stats_update_end_irqrestore(&stats->syncp, flags);
+ if (likely(prog->stats)) {
+ stats = this_cpu_ptr(prog->stats);
+ flags = u64_stats_update_begin_irqsave(&stats->syncp);
+ u64_stats_inc(&stats->cnt);
+ u64_stats_add(&stats->nsecs, duration);
+ u64_stats_update_end_irqrestore(&stats->syncp, flags);
+ }
} else {
ret = dfunc(ctx, prog->insnsi, prog->bpf_func);
}
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8a129746bd6cc..15f9afdbfc275 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2462,6 +2462,9 @@ void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog)
struct bpf_prog_stats *stats;
unsigned int flags;
+ if (unlikely(!prog->stats))
+ return;
+
stats = this_cpu_ptr(prog->stats);
flags = u64_stats_update_begin_irqsave(&stats->syncp);
u64_stats_inc(&stats->misses);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 316/614] powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 315/614] bpf: Fix invalid prog->stats access when update_effective_progs fails Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 317/614] powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Greg Kroah-Hartman
` (311 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM),
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
[ Upstream commit 17b45ccf09882e0c808ad2cf62acdc90ad968746 ]
When HV=0 & IR/DR=0, the Hash MMU is said to be in Virtual Real
Addressing Mode during early boot. During this, we should ensure that
memory region allocations for stress_hpt_struct should happen from
within RMA region as otherwise the boot might get stuck while doing
memset of this region.
History behind why do we have RMA region limitation is better explained
in these 2 patches [1] & [2]. This patch ensures that memset to
stress_hpt_struct during early boot does not cross ppc64_rma_size
boundary.
[1]: https://lore.kernel.org/all/20190710052018.14628-1-sjitindarsingh@gmail.com/
[2]: https://lore.kernel.org/all/87wp54usvj.fsf@linux.vnet.ibm.com/
Fixes: 6b34a099faa12 ("powerpc/64s/hash: add stress_hpt kernel boot option to increase hash faults")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/ada1173933ea7617a994d6ee3e54ced8797339fc.1761834163.git.ritesh.list@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/mm/book3s64/hash_utils.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c
index 3aee3af614af8..c99be1286d517 100644
--- a/arch/powerpc/mm/book3s64/hash_utils.c
+++ b/arch/powerpc/mm/book3s64/hash_utils.c
@@ -1302,11 +1302,14 @@ static void __init htab_initialize(void)
unsigned long table;
unsigned long pteg_count;
unsigned long prot;
- phys_addr_t base = 0, size = 0, end;
+ phys_addr_t base = 0, size = 0, end, limit = MEMBLOCK_ALLOC_ANYWHERE;
u64 i;
DBG(" -> htab_initialize()\n");
+ if (firmware_has_feature(FW_FEATURE_LPAR))
+ limit = ppc64_rma_size;
+
if (mmu_has_feature(MMU_FTR_1T_SEGMENT)) {
mmu_kernel_ssize = MMU_SEGSIZE_1T;
mmu_highuser_ssize = MMU_SEGSIZE_1T;
@@ -1322,7 +1325,7 @@ static void __init htab_initialize(void)
// Too early to use nr_cpu_ids, so use NR_CPUS
tmp = memblock_phys_alloc_range(sizeof(struct stress_hpt_struct) * NR_CPUS,
__alignof__(struct stress_hpt_struct),
- 0, MEMBLOCK_ALLOC_ANYWHERE);
+ MEMBLOCK_LOW_LIMIT, limit);
memset((void *)tmp, 0xff, sizeof(struct stress_hpt_struct) * NR_CPUS);
stress_hpt_struct = __va(tmp);
@@ -1356,11 +1359,10 @@ static void __init htab_initialize(void)
mmu_hash_ops.hpte_clear_all();
#endif
} else {
- unsigned long limit = MEMBLOCK_ALLOC_ANYWHERE;
table = memblock_phys_alloc_range(htab_size_bytes,
htab_size_bytes,
- 0, limit);
+ MEMBLOCK_LOW_LIMIT, limit);
if (!table)
panic("ERROR: Failed to allocate %pa bytes below %pa\n",
&htab_size_bytes, &limit);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 317/614] powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 316/614] powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 318/614] net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Greg Kroah-Hartman
` (310 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM),
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
[ Upstream commit eae40a6da63faa9fb63ff61f8fa2b3b57da78a84 ]
HPTE format was changed since Power9 (ISA 3.0) onwards. While dumping
kernel hash page tables, nothing gets printed on powernv P9+. This patch
utilizes the helpers added in the patch tagged as fixes, to convert new
format to old format and dump the hptes. This fix is only needed for
native_find() (powernv), since pseries continues to work fine with the
old format.
Fixes: 6b243fcfb5f1e ("powerpc/64: Simplify adaptation to new ISA v3.00 HPTE format")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/4c2bb9e5b3cfbc0dd80b61b67cdd3ccfc632684c.1761834163.git.ritesh.list@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/mm/ptdump/hashpagetable.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/powerpc/mm/ptdump/hashpagetable.c b/arch/powerpc/mm/ptdump/hashpagetable.c
index a6baa6166d940..671d0dc00c6d0 100644
--- a/arch/powerpc/mm/ptdump/hashpagetable.c
+++ b/arch/powerpc/mm/ptdump/hashpagetable.c
@@ -216,6 +216,8 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64
vpn = hpt_vpn(ea, vsid, ssize);
hash = hpt_hash(vpn, shift, ssize);
want_v = hpte_encode_avpn(vpn, psize, ssize);
+ if (cpu_has_feature(CPU_FTR_ARCH_300))
+ want_v = hpte_old_to_new_v(want_v);
/* to check in the secondary hash table, we invert the hash */
if (!primary)
@@ -229,6 +231,10 @@ static int native_find(unsigned long ea, int psize, bool primary, u64 *v, u64
/* HPTE matches */
*v = be64_to_cpu(hptep->v);
*r = be64_to_cpu(hptep->r);
+ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+ *v = hpte_new_to_old_v(*v, *r);
+ *r = hpte_new_to_old_r(*r);
+ }
return 0;
}
++hpte_group;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 318/614] net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 317/614] powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 319/614] fs/ntfs3: out1 also needs to put mi Greg Kroah-Hartman
` (309 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Maxime Chevallier,
Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
[ Upstream commit d9db25723677c3741a0cf3643f7f7429fc983921 ]
When the "rx-vlan-filter" feature is enabled on a network device, the 8021q
module automatically adds a VLAN 0 hardware filter when the device is
brought administratively up.
For stmmac, this causes vlan_add_hw_rx_fltr() to create a new entry for
VID 0 in the mac_device_info->vlan_filter array, in the following format:
VLAN_TAG_DATA_ETV | VLAN_TAG_DATA_VEN | vid
Here, VLAN_TAG_DATA_VEN indicates that the hardware filter is enabled for
that VID.
However, on the delete path, vlan_del_hw_rx_fltr() searches the vlan_filter
array by VID only, without verifying whether a VLAN entry is enabled. As a
result, when the 8021q module attempts to remove VLAN 0, the function may
mistakenly match a zero-initialized slot rather than the actual VLAN 0
entry, causing incorrect deletions and leaving stale entries in the
hardware table.
Fix this by verifying that the VLAN entry's enable bit (VLAN_TAG_DATA_VEN)
is set before matching and deleting by VID. This ensures only active VLAN
entries are removed and avoids leaving stale entries in the VLAN filter
table, particularly for VLAN ID 0.
Fixes: ed64639bc1e08 ("net: stmmac: Add support for VLAN Rx filtering")
Signed-off-by: Ovidiu Panait <ovidiu.panait.rb@renesas.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20251113112721.70500-2-ovidiu.panait.rb@renesas.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c
index ff02a79c00d4f..b18404dd5a8be 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c
@@ -122,7 +122,8 @@ static int vlan_del_hw_rx_fltr(struct net_device *dev,
/* Extended Rx VLAN Filter Enable */
for (i = 0; i < hw->num_vlan; i++) {
- if ((hw->vlan_filter[i] & VLAN_TAG_DATA_VID) == vid) {
+ if ((hw->vlan_filter[i] & VLAN_TAG_DATA_VEN) &&
+ ((hw->vlan_filter[i] & VLAN_TAG_DATA_VID) == vid)) {
ret = vlan_write_filter(dev, hw, i, 0);
if (!ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 319/614] fs/ntfs3: out1 also needs to put mi
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 318/614] net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 320/614] fs/ntfs3: Prevent memory leaks in add sub record Greg Kroah-Hartman
` (308 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edward Adam Davis,
Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit 4d78d1173a653acdaf7500a32b8dc530ca4ad075 ]
After ntfs_look_free_mft() executes successfully, all subsequent code
that fails to execute must put mi.
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/frecord.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 8f9fe1d7a6908..a557e3ec0d4c4 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -1015,9 +1015,9 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le,
out2:
ni_remove_mi(ni, mi);
- mi_put(mi);
out1:
+ mi_put(mi);
ntfs_mark_rec_free(sbi, rno, is_mft);
out:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 320/614] fs/ntfs3: Prevent memory leaks in add sub record
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 319/614] fs/ntfs3: out1 also needs to put mi Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 321/614] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Greg Kroah-Hartman
` (307 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3932ccb896e06f7414c9,
Edward Adam Davis, Konstantin Komarov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit ccc4e86d1c24260c18ae94541198c3711c140da6 ]
If a rb node with the same ino already exists in the rb tree, the newly
alloced mft_inode in ni_add_subrecord() will not have its memory cleaned
up, which leads to the memory leak issue reported by syzbot.
The best option to avoid this issue is to put the newly alloced mft node
when a rb node with the same ino already exists in the rb tree and return
the rb node found in the rb tree to the parent layer.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888110bef280 (size 128):
backtrace (crc 126a088f):
ni_add_subrecord+0x31/0x180 fs/ntfs3/frecord.c:317
ntfs_look_free_mft+0xf0/0x790 fs/ntfs3/fsntfs.c:715
BUG: memory leak
unreferenced object 0xffff888109093400 (size 1024):
backtrace (crc 7197c55e):
mi_init+0x2b/0x50 fs/ntfs3/record.c:105
mi_format_new+0x40/0x220 fs/ntfs3/record.c:422
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Reported-by: syzbot+3932ccb896e06f7414c9@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/frecord.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index a557e3ec0d4c4..e5a005d216f31 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -325,8 +325,10 @@ bool ni_add_subrecord(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi)
mi_get_ref(&ni->mi, &m->mrec->parent_ref);
- ni_add_mi(ni, m);
- *mi = m;
+ *mi = ni_ins_mi(ni, &ni->mi_tree, m->rno, &m->node);
+ if (*mi != m)
+ mi_put(m);
+
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 321/614] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 320/614] fs/ntfs3: Prevent memory leaks in add sub record Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 322/614] drm/msm/a6xx: Flush LRZ cache before PT switch Greg Kroah-Hartman
` (306 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno, Jay Liu,
Chun-Kuang Hu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Liu <jay.liu@mediatek.com>
[ Upstream commit 20ac36b71c53b8c36c6903b5ca87c75226700a97 ]
if matrixbit is 11,
The range of color matrix is from 0 to (BIT(12) - 1).
Values from 0 to (BIT(11) - 1) represent positive numbers,
values from BIT(11) to (BIT(12) - 1) represent negative numbers.
For example, -1 need converted to 8191.
so convert S31.32 to HW Q2.11 format by drm_color_ctm_s31_32_to_qm_n,
and set int_bits to 2.
Fixes: 738ed4156fba ("drm/mediatek: Add matrix_bits private data for ccorr")
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Jay Liu <jay.liu@mediatek.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20250921055416.25588-2-jay.liu@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +----------------------
1 file changed, 1 insertion(+), 22 deletions(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ccorr.c b/drivers/gpu/drm/mediatek/mtk_disp_ccorr.c
index 10d60d2c2a568..6d7bf4afa78d3 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ccorr.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ccorr.c
@@ -80,27 +80,6 @@ void mtk_ccorr_stop(struct device *dev)
writel_relaxed(0x0, ccorr->regs + DISP_CCORR_EN);
}
-/* Converts a DRM S31.32 value to the HW S1.n format. */
-static u16 mtk_ctm_s31_32_to_s1_n(u64 in, u32 n)
-{
- u16 r;
-
- /* Sign bit. */
- r = in & BIT_ULL(63) ? BIT(n + 1) : 0;
-
- if ((in & GENMASK_ULL(62, 33)) > 0) {
- /* identity value 0x100000000 -> 0x400(mt8183), */
- /* identity value 0x100000000 -> 0x800(mt8192), */
- /* if bigger this, set it to max 0x7ff. */
- r |= GENMASK(n, 0);
- } else {
- /* take the n+1 most important bits. */
- r |= (in >> (32 - n)) & GENMASK(n, 0);
- }
-
- return r;
-}
-
void mtk_ccorr_ctm_set(struct device *dev, struct drm_crtc_state *state)
{
struct mtk_disp_ccorr *ccorr = dev_get_drvdata(dev);
@@ -119,7 +98,7 @@ void mtk_ccorr_ctm_set(struct device *dev, struct drm_crtc_state *state)
input = ctm->matrix;
for (i = 0; i < ARRAY_SIZE(coeffs); i++)
- coeffs[i] = mtk_ctm_s31_32_to_s1_n(input[i], matrix_bits);
+ coeffs[i] = drm_color_ctm_s31_32_to_qm_n(input[i], 2, matrix_bits);
mtk_ddp_write(cmdq_pkt, coeffs[0] << 16 | coeffs[1],
&ccorr->cmdq_reg, ccorr->regs, DISP_CCORR_COEF_0);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 322/614] drm/msm/a6xx: Flush LRZ cache before PT switch
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 321/614] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 323/614] drm/msm/a6xx: Fix the gemnoc workaround Greg Kroah-Hartman
` (305 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Akhil P Oommen,
Rob Clark, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
[ Upstream commit 180349b8407f3b268b2ceac0e590b8199e043081 ]
As per the recommendation, A7x and newer GPUs should flush the LRZ cache
before switching the pagetable. Update a6xx_set_pagetable() to do this.
While we are at it, sync both BV and BR before issuing a
CP_RESET_CONTEXT_STATE command, to match the downstream sequence.
Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/688995/
Message-ID: <20251118-kaana-gpu-support-v4-2-86eeb8e93fb6@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index b8f8ae940b55f..6f7ed07670b12 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -224,7 +224,7 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
OUT_RING(ring, submit->seqno - 1);
OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
- OUT_RING(ring, CP_SET_THREAD_BOTH);
+ OUT_RING(ring, CP_THREAD_CONTROL_0_SYNC_THREADS | CP_SET_THREAD_BOTH);
/* Reset state used to synchronize BR and BV */
OUT_PKT7(ring, CP_RESET_CONTEXT_STATE, 1);
@@ -235,7 +235,13 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
CP_RESET_CONTEXT_STATE_0_RESET_GLOBAL_LOCAL_TS);
OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
- OUT_RING(ring, CP_SET_THREAD_BR);
+ OUT_RING(ring, CP_THREAD_CONTROL_0_SYNC_THREADS | CP_SET_THREAD_BOTH);
+
+ OUT_PKT7(ring, CP_EVENT_WRITE, 1);
+ OUT_RING(ring, LRZ_FLUSH);
+
+ OUT_PKT7(ring, CP_THREAD_CONTROL, 1);
+ OUT_RING(ring, CP_THREAD_CONTROL_0_SYNC_THREADS | CP_SET_THREAD_BR);
}
if (!sysprof) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 323/614] drm/msm/a6xx: Fix the gemnoc workaround
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 322/614] drm/msm/a6xx: Flush LRZ cache before PT switch Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 324/614] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Greg Kroah-Hartman
` (304 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Akhil P Oommen,
Rob Clark, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
[ Upstream commit ff7a6de043fce21ea5891311746b16121b385c59 ]
Correct the register offset and enable this workaround for all A7x
and newer GPUs to match the recommendation. Also, downstream does this
w/a after moving the fence to allow mode. So do the same.
Fixes: dbfbb376b50c ("drm/msm/a6xx: Add A621 support")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/688997/
Message-ID: <20251118-kaana-gpu-support-v4-3-86eeb8e93fb6@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 4e6dc16e4a4c4..605bb55de8d52 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -485,8 +485,9 @@ static void a6xx_gemnoc_workaround(struct a6xx_gmu *gmu)
* in the power down sequence not being fully executed. That in turn can
* prevent CX_GDSC from collapsing. Assert Qactive to avoid this.
*/
- if (adreno_is_a621(adreno_gpu) || adreno_is_7c3(adreno_gpu))
- gmu_write(gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, BIT(0));
+ if (adreno_is_a7xx(adreno_gpu) || (adreno_is_a621(adreno_gpu) ||
+ adreno_is_7c3(adreno_gpu)))
+ gmu_write(gmu, REG_A6XX_GPU_GMU_CX_GMU_CX_FALNEXT_INTF, BIT(0));
}
/* Let the GMU know that we are about to go into slumber */
@@ -522,10 +523,9 @@ static int a6xx_gmu_notify_slumber(struct a6xx_gmu *gmu)
}
out:
- a6xx_gemnoc_workaround(gmu);
-
/* Put fence into allow mode */
gmu_write(gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0);
+ a6xx_gemnoc_workaround(gmu);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 324/614] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 323/614] drm/msm/a6xx: Fix the gemnoc workaround Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 325/614] spi: sophgo: Fix incorrect use of bus width value macros Greg Kroah-Hartman
` (303 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Akhil P Oommen,
Rob Clark, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
[ Upstream commit ca04ce7a2f22652fdf6489fa7e02e7d2c08698f4 ]
Current logic assumes that the voltage corners in both MxG and MxA are
always same. This is not true for recent targets. So, rework the rpmh init
sequence to probe and calculate the votes with the respective rails, ie,
GX rails should use MxG as secondary rail and Cx rail should use MxA as
the secondary rail.
Fixes: d6225e0cd096 ("drm/msm/adreno: Add support for X185 GPU")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/689014/
Message-ID: <20251118-kaana-gpu-support-v4-12-86eeb8e93fb6@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 605bb55de8d52..21a3f9b0ab4c2 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -1492,13 +1492,14 @@ static unsigned int a6xx_gmu_get_arc_level(struct device *dev,
}
static int a6xx_gmu_rpmh_arc_votes_init(struct device *dev, u32 *votes,
- unsigned long *freqs, int freqs_count, const char *id)
+ unsigned long *freqs, int freqs_count,
+ const char *pri_id, const char *sec_id)
{
int i, j;
const u16 *pri, *sec;
size_t pri_count, sec_count;
- pri = cmd_db_read_aux_data(id, &pri_count);
+ pri = cmd_db_read_aux_data(pri_id, &pri_count);
if (IS_ERR(pri))
return PTR_ERR(pri);
/*
@@ -1509,13 +1510,7 @@ static int a6xx_gmu_rpmh_arc_votes_init(struct device *dev, u32 *votes,
if (!pri_count)
return -EINVAL;
- /*
- * Some targets have a separate gfx mxc rail. So try to read that first and then fall back
- * to regular mx rail if it is missing
- */
- sec = cmd_db_read_aux_data("gmxc.lvl", &sec_count);
- if (IS_ERR(sec) && sec != ERR_PTR(-EPROBE_DEFER))
- sec = cmd_db_read_aux_data("mx.lvl", &sec_count);
+ sec = cmd_db_read_aux_data(sec_id, &sec_count);
if (IS_ERR(sec))
return PTR_ERR(sec);
@@ -1583,15 +1578,24 @@ static int a6xx_gmu_rpmh_votes_init(struct a6xx_gmu *gmu)
struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
const struct a6xx_info *info = adreno_gpu->info->a6xx;
struct msm_gpu *gpu = &adreno_gpu->base;
+ const char *sec_id;
+ const u16 *gmxc;
int ret;
+ gmxc = cmd_db_read_aux_data("gmxc.lvl", NULL);
+ if (gmxc == ERR_PTR(-EPROBE_DEFER))
+ return -EPROBE_DEFER;
+
+ /* If GMxC is present, prefer that as secondary rail for GX votes */
+ sec_id = IS_ERR_OR_NULL(gmxc) ? "mx.lvl" : "gmxc.lvl";
+
/* Build the GX votes */
ret = a6xx_gmu_rpmh_arc_votes_init(&gpu->pdev->dev, gmu->gx_arc_votes,
- gmu->gpu_freqs, gmu->nr_gpu_freqs, "gfx.lvl");
+ gmu->gpu_freqs, gmu->nr_gpu_freqs, "gfx.lvl", sec_id);
/* Build the CX votes */
ret |= a6xx_gmu_rpmh_arc_votes_init(gmu->dev, gmu->cx_arc_votes,
- gmu->gmu_freqs, gmu->nr_gmu_freqs, "cx.lvl");
+ gmu->gmu_freqs, gmu->nr_gmu_freqs, "cx.lvl", "mx.lvl");
/* Build the interconnect votes */
if (info->bcms && gmu->nr_gpu_bws > 1)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 325/614] spi: sophgo: Fix incorrect use of bus width value macros
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 324/614] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 326/614] ipv6: clear RA flags when adding a static route Greg Kroah-Hartman
` (302 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Longbin Li, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longbin Li <looong.bin@gmail.com>
[ Upstream commit d9813cd23d5a7b254cc1b1c1ea042634d8da62e6 ]
The previous code initialized the 'reg' value with specific bus-width
values (BUS_WIDTH_2_BIT and BUS_WIDTH_4_BIT), which introduces ambiguity.
Replace them with BUS_WIDTH_MASK to express the intention clearly.
Fixes: de16c322eefb ("spi: sophgo: add SG2044 SPI NOR controller driver")
Signed-off-by: Longbin Li <looong.bin@gmail.com>
Link: https://patch.msgid.link/20251117090559.78288-1-looong.bin@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sg2044-nor.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-sg2044-nor.c b/drivers/spi/spi-sg2044-nor.c
index af48b1fcda930..37f1cfe10be46 100644
--- a/drivers/spi/spi-sg2044-nor.c
+++ b/drivers/spi/spi-sg2044-nor.c
@@ -42,6 +42,7 @@
#define SPIFMC_TRAN_CSR_TRAN_MODE_RX BIT(0)
#define SPIFMC_TRAN_CSR_TRAN_MODE_TX BIT(1)
#define SPIFMC_TRAN_CSR_FAST_MODE BIT(3)
+#define SPIFMC_TRAN_CSR_BUS_WIDTH_MASK GENMASK(5, 4)
#define SPIFMC_TRAN_CSR_BUS_WIDTH_1_BIT (0x00 << 4)
#define SPIFMC_TRAN_CSR_BUS_WIDTH_2_BIT (0x01 << 4)
#define SPIFMC_TRAN_CSR_BUS_WIDTH_4_BIT (0x02 << 4)
@@ -122,8 +123,7 @@ static u32 sg2044_spifmc_init_reg(struct sg2044_spifmc *spifmc)
reg = readl(spifmc->io_base + SPIFMC_TRAN_CSR);
reg &= ~(SPIFMC_TRAN_CSR_TRAN_MODE_MASK |
SPIFMC_TRAN_CSR_FAST_MODE |
- SPIFMC_TRAN_CSR_BUS_WIDTH_2_BIT |
- SPIFMC_TRAN_CSR_BUS_WIDTH_4_BIT |
+ SPIFMC_TRAN_CSR_BUS_WIDTH_MASK |
SPIFMC_TRAN_CSR_DMA_EN |
SPIFMC_TRAN_CSR_ADDR_BYTES_MASK |
SPIFMC_TRAN_CSR_WITH_CMD |
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 326/614] ipv6: clear RA flags when adding a static route
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 325/614] spi: sophgo: Fix incorrect use of bus width value macros Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 327/614] perf arm_spe: Fix memset subclass in operation Greg Kroah-Hartman
` (301 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Garri Djavadyan,
Fernando Fernandez Mancera, David Ahern, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit f72514b3c5698e4b900b25345e09f9ed33123de6 ]
When an IPv6 Router Advertisement (RA) is received for a prefix, the
kernel creates the corresponding on-link route with flags RTF_ADDRCONF
and RTF_PREFIX_RT configured and RTF_EXPIRES if lifetime is set.
If later a user configures a static IPv6 address on the same prefix the
kernel clears the RTF_EXPIRES flag but it doesn't clear the RTF_ADDRCONF
and RTF_PREFIX_RT. When the next RA for that prefix is received, the
kernel sees the route as RA-learned and wrongly configures back the
lifetime. This is problematic because if the route expires, the static
address won't have the corresponding on-link route.
This fix clears the RTF_ADDRCONF and RTF_PREFIX_RT flags preventing that
the lifetime is configured when the next RA arrives. If the static
address is deleted, the route becomes RA-learned again.
Fixes: 14ef37b6d00e ("ipv6: fix route lookup in addrconf_prefix_rcv()")
Reported-by: Garri Djavadyan <g.djavadyan@gmail.com>
Closes: https://lore.kernel.org/netdev/ba807d39aca5b4dcf395cc11dca61a130a52cfd3.camel@gmail.com/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20251115095939.6967-1-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_fib.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 02c16909f6182..2111af022d946 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1138,6 +1138,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
fib6_set_expires(iter, rt->expires);
fib6_add_gc_list(iter);
}
+ if (!(rt->fib6_flags & (RTF_ADDRCONF | RTF_PREFIX_RT))) {
+ iter->fib6_flags &= ~RTF_ADDRCONF;
+ iter->fib6_flags &= ~RTF_PREFIX_RT;
+ }
if (rt->fib6_pmtu)
fib6_metric_set(iter, RTAX_MTU,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 327/614] perf arm_spe: Fix memset subclass in operation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 326/614] ipv6: clear RA flags when adding a static route Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 328/614] pwm: bcm2835: Make sure the channel is enabled after pwm_request() Greg Kroah-Hartman
` (300 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leo Yan, Ian Rogers, James Clark,
Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Yan <leo.yan@arm.com>
[ Upstream commit 33e1fffea492b7158a168914dc0da6aedf78d08e ]
The operation subclass is extracted from bits [7..1] of the payload.
Since bit [0] is not parsed, there is no chance to match the memset type
(0x25). As a result, the memset payload is never parsed successfully.
Instead of extracting a unified bit field, change to extract the
specific bits for each operation subclass.
Fixes: 34fb60400e32 ("perf arm-spe: Add raw decoding for SPEv1.3 MTE and MOPS load/store")
Signed-off-by: Leo Yan <leo.yan@arm.com>
Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../arm-spe-decoder/arm-spe-pkt-decoder.c | 25 ++++++-------------
.../arm-spe-decoder/arm-spe-pkt-decoder.h | 15 ++++++-----
2 files changed, 14 insertions(+), 26 deletions(-)
diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c
index 80561630253dd..1a1ffe50ee73a 100644
--- a/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c
+++ b/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.c
@@ -371,31 +371,20 @@ static int arm_spe_pkt_desc_op_type(const struct arm_spe_pkt *packet,
arm_spe_pkt_out_string(&err, &buf, &buf_len, " AR");
}
- switch (SPE_OP_PKT_LDST_SUBCLASS_GET(payload)) {
- case SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP:
+ if (SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " SIMD-FP");
- break;
- case SPE_OP_PKT_LDST_SUBCLASS_GP_REG:
+ else if (SPE_OP_PKT_LDST_SUBCLASS_GP_REG(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " GP-REG");
- break;
- case SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG:
+ else if (SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " UNSPEC-REG");
- break;
- case SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG:
+ else if (SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " NV-SYSREG");
- break;
- case SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG:
+ else if (SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " MTE-TAG");
- break;
- case SPE_OP_PKT_LDST_SUBCLASS_MEMCPY:
+ else if (SPE_OP_PKT_LDST_SUBCLASS_MEMCPY(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " MEMCPY");
- break;
- case SPE_OP_PKT_LDST_SUBCLASS_MEMSET:
+ else if (SPE_OP_PKT_LDST_SUBCLASS_MEMSET(payload))
arm_spe_pkt_out_string(&err, &buf, &buf_len, " MEMSET");
- break;
- default:
- break;
- }
if (SPE_OP_PKT_IS_LDST_SVE(payload)) {
/* SVE effective vector length */
diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h
index d00c2481712dc..75e355fe3438c 100644
--- a/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h
+++ b/tools/perf/util/arm-spe-decoder/arm-spe-pkt-decoder.h
@@ -125,14 +125,13 @@ enum arm_spe_events {
#define SPE_OP_PKT_IS_OTHER_SVE_OP(v) (((v) & (BIT(7) | BIT(3) | BIT(0))) == 0x8)
-#define SPE_OP_PKT_LDST_SUBCLASS_GET(v) ((v) & GENMASK_ULL(7, 1))
-#define SPE_OP_PKT_LDST_SUBCLASS_GP_REG 0x0
-#define SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP 0x4
-#define SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG 0x10
-#define SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG 0x30
-#define SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG 0x14
-#define SPE_OP_PKT_LDST_SUBCLASS_MEMCPY 0x20
-#define SPE_OP_PKT_LDST_SUBCLASS_MEMSET 0x25
+#define SPE_OP_PKT_LDST_SUBCLASS_GP_REG(v) (((v) & GENMASK_ULL(7, 1)) == 0x0)
+#define SPE_OP_PKT_LDST_SUBCLASS_SIMD_FP(v) (((v) & GENMASK_ULL(7, 1)) == 0x4)
+#define SPE_OP_PKT_LDST_SUBCLASS_UNSPEC_REG(v) (((v) & GENMASK_ULL(7, 1)) == 0x10)
+#define SPE_OP_PKT_LDST_SUBCLASS_NV_SYSREG(v) (((v) & GENMASK_ULL(7, 1)) == 0x30)
+#define SPE_OP_PKT_LDST_SUBCLASS_MTE_TAG(v) (((v) & GENMASK_ULL(7, 1)) == 0x14)
+#define SPE_OP_PKT_LDST_SUBCLASS_MEMCPY(v) (((v) & GENMASK_ULL(7, 1)) == 0x20)
+#define SPE_OP_PKT_LDST_SUBCLASS_MEMSET(v) (((v) & GENMASK_ULL(7, 0)) == 0x25)
#define SPE_OP_PKT_IS_LDST_ATOMIC(v) (((v) & (GENMASK_ULL(7, 5) | BIT(1))) == 0x2)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 328/614] pwm: bcm2835: Make sure the channel is enabled after pwm_request()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 327/614] perf arm_spe: Fix memset subclass in operation Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 329/614] scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify Greg Kroah-Hartman
` (299 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Florian Fainelli, Uwe Kleine-König, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit cda323dbda76600bf9761970d58517648f0de67d ]
The .free callback cleared among others the enable bit PWENx in the
control register. When the PWM is requested later again this bit isn't
restored but the core assumes the PWM is enabled and thus skips a
request to configure the same state as before.
To fix that don't touch the hardware configuration in .free(). For
symmetry also drop .request() and configure the mode completely in
.apply().
Fixes: e5a06dc5ac1f ("pwm: Add BCM2835 PWM driver")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251118174303.1761577-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-bcm2835.c | 28 +++-------------------------
1 file changed, 3 insertions(+), 25 deletions(-)
diff --git a/drivers/pwm/pwm-bcm2835.c b/drivers/pwm/pwm-bcm2835.c
index 578e95e0296c6..532903da521fd 100644
--- a/drivers/pwm/pwm-bcm2835.c
+++ b/drivers/pwm/pwm-bcm2835.c
@@ -34,29 +34,6 @@ static inline struct bcm2835_pwm *to_bcm2835_pwm(struct pwm_chip *chip)
return pwmchip_get_drvdata(chip);
}
-static int bcm2835_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
-{
- struct bcm2835_pwm *pc = to_bcm2835_pwm(chip);
- u32 value;
-
- value = readl(pc->base + PWM_CONTROL);
- value &= ~(PWM_CONTROL_MASK << PWM_CONTROL_SHIFT(pwm->hwpwm));
- value |= (PWM_MODE << PWM_CONTROL_SHIFT(pwm->hwpwm));
- writel(value, pc->base + PWM_CONTROL);
-
- return 0;
-}
-
-static void bcm2835_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
-{
- struct bcm2835_pwm *pc = to_bcm2835_pwm(chip);
- u32 value;
-
- value = readl(pc->base + PWM_CONTROL);
- value &= ~(PWM_CONTROL_MASK << PWM_CONTROL_SHIFT(pwm->hwpwm));
- writel(value, pc->base + PWM_CONTROL);
-}
-
static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
const struct pwm_state *state)
{
@@ -102,6 +79,9 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
/* set polarity */
val = readl(pc->base + PWM_CONTROL);
+ val &= ~(PWM_CONTROL_MASK << PWM_CONTROL_SHIFT(pwm->hwpwm));
+ val |= PWM_MODE << PWM_CONTROL_SHIFT(pwm->hwpwm);
+
if (state->polarity == PWM_POLARITY_NORMAL)
val &= ~(PWM_POLARITY << PWM_CONTROL_SHIFT(pwm->hwpwm));
else
@@ -119,8 +99,6 @@ static int bcm2835_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
}
static const struct pwm_ops bcm2835_pwm_ops = {
- .request = bcm2835_pwm_request,
- .free = bcm2835_pwm_free,
.apply = bcm2835_pwm_apply,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 329/614] scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 328/614] pwm: bcm2835: Make sure the channel is enabled after pwm_request() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 330/614] scsi: qla2xxx: Fix improper freeing of purex item Greg Kroah-Hartman
` (298 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Lin, Martin K. Petersen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit b0ee72db9132bd19b1b80152b35e0cf6a6cbd9f2 ]
This fixes the dme-reset failed when doing recovery. Because device
reset is not enough, we could occasionally see the error below:
ufshcd-rockchip 2a2d0000.ufs: uic cmd 0x14 with arg3 0x0 completion timeout
ufshcd-rockchip 2a2d0000.ufs: dme-reset: error code -110
ufshcd-rockchip 2a2d0000.ufs: DME_RESET failed
ufshcd-rockchip 2a2d0000.ufs: ufshcd_host_reset_and_restore: Host init failed -110
Fix this by resetting the controller on PRE_CHANGE stage of hce enable
notify.
Fixes: d3cbe455d6eb ("scsi: ufs: rockchip: Initial support for UFS")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/1763009575-237552-1-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-rockchip.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/ufs/host/ufs-rockchip.c b/drivers/ufs/host/ufs-rockchip.c
index 8754085dd0ccf..8cecb28cdce41 100644
--- a/drivers/ufs/host/ufs-rockchip.c
+++ b/drivers/ufs/host/ufs-rockchip.c
@@ -20,9 +20,17 @@
#include "ufshcd-pltfrm.h"
#include "ufs-rockchip.h"
+static void ufs_rockchip_controller_reset(struct ufs_rockchip_host *host)
+{
+ reset_control_assert(host->rst);
+ udelay(1);
+ reset_control_deassert(host->rst);
+}
+
static int ufs_rockchip_hce_enable_notify(struct ufs_hba *hba,
enum ufs_notify_change_status status)
{
+ struct ufs_rockchip_host *host = ufshcd_get_variant(hba);
int err = 0;
if (status == POST_CHANGE) {
@@ -37,6 +45,9 @@ static int ufs_rockchip_hce_enable_notify(struct ufs_hba *hba,
return ufshcd_vops_phy_initialization(hba);
}
+ /* PRE_CHANGE */
+ ufs_rockchip_controller_reset(host);
+
return 0;
}
@@ -156,9 +167,7 @@ static int ufs_rockchip_common_init(struct ufs_hba *hba)
return dev_err_probe(dev, PTR_ERR(host->rst),
"failed to get reset control\n");
- reset_control_assert(host->rst);
- udelay(1);
- reset_control_deassert(host->rst);
+ ufs_rockchip_controller_reset(host);
host->ref_out_clk = devm_clk_get_enabled(dev, "ref_out");
if (IS_ERR(host->ref_out_clk))
@@ -282,9 +291,7 @@ static int ufs_rockchip_runtime_resume(struct device *dev)
return err;
}
- reset_control_assert(host->rst);
- udelay(1);
- reset_control_deassert(host->rst);
+ ufs_rockchip_controller_reset(host);
return ufshcd_runtime_resume(dev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 330/614] scsi: qla2xxx: Fix improper freeing of purex item
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 329/614] scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 331/614] net: phy: realtek: create rtl8211f_config_rgmii_delay() Greg Kroah-Hartman
` (297 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Himanshu Madhani,
Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 78b1a242fe612a755f2158fd206ee6bb577d18ca ]
In qla2xxx_process_purls_iocb(), an item is allocated via
qla27xx_copy_multiple_pkt(), which internally calls
qla24xx_alloc_purex_item().
The qla24xx_alloc_purex_item() function may return a pre-allocated item
from a per-adapter pool for small allocations, instead of dynamically
allocating memory with kzalloc().
An error handling path in qla2xxx_process_purls_iocb() incorrectly uses
kfree() to release the item. If the item was from the pre-allocated
pool, calling kfree() on it is a bug that can lead to memory corruption.
Fix this by using the correct deallocation function,
qla24xx_free_purex_item(), which properly handles both dynamically
allocated and pre-allocated items.
Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
Link: https://patch.msgid.link/20251113151246.762510-1-zilin@seu.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 316594aa40cc5..42eb65a62f1f3 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -1292,7 +1292,7 @@ void qla2xxx_process_purls_iocb(void **pkt, struct rsp_que **rsp)
a.reason = FCNVME_RJT_RC_LOGIC;
a.explanation = FCNVME_RJT_EXP_NONE;
xmt_reject = true;
- kfree(item);
+ qla24xx_free_purex_item(item);
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 331/614] net: phy: realtek: create rtl8211f_config_rgmii_delay()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 330/614] scsi: qla2xxx: Fix improper freeing of purex item Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 332/614] iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD Greg Kroah-Hartman
` (296 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Andrew Lunn,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 8e982441ba601d982dd0739972115d85ae01d99b ]
The control flow in rtl8211f_config_init() has some pitfalls which were
probably unintended. Specifically it has an early return:
switch (phydev->interface) {
...
default: /* the rest of the modes imply leaving delay as is. */
return 0;
}
which exits the entire config_init() function. This means it also skips
doing things such as disabling CLKOUT or disabling PHY-mode EEE.
For the RTL8211FS, which uses PHY_INTERFACE_MODE_SGMII, this might be a
problem. However, I don't know that it is, so there is no Fixes: tag.
The issue was observed through code inspection.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20251117234033.345679-2-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/realtek/realtek_main.c | 65 +++++++++++++++-----------
1 file changed, 39 insertions(+), 26 deletions(-)
diff --git a/drivers/net/phy/realtek/realtek_main.c b/drivers/net/phy/realtek/realtek_main.c
index 16a347084293e..b26f4d1c6bbfa 100644
--- a/drivers/net/phy/realtek/realtek_main.c
+++ b/drivers/net/phy/realtek/realtek_main.c
@@ -560,22 +560,11 @@ static int rtl8211c_config_init(struct phy_device *phydev)
CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER);
}
-static int rtl8211f_config_init(struct phy_device *phydev)
+static int rtl8211f_config_rgmii_delay(struct phy_device *phydev)
{
- struct rtl821x_priv *priv = phydev->priv;
- struct device *dev = &phydev->mdio.dev;
u16 val_txdly, val_rxdly;
int ret;
- ret = phy_modify_paged_changed(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR1,
- RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
- priv->phycr1);
- if (ret < 0) {
- dev_err(dev, "aldps mode configuration failed: %pe\n",
- ERR_PTR(ret));
- return ret;
- }
-
switch (phydev->interface) {
case PHY_INTERFACE_MODE_RGMII:
val_txdly = 0;
@@ -605,34 +594,58 @@ static int rtl8211f_config_init(struct phy_device *phydev)
RTL8211F_TXCR, RTL8211F_TX_DELAY,
val_txdly);
if (ret < 0) {
- dev_err(dev, "Failed to update the TX delay register\n");
+ phydev_err(phydev, "Failed to update the TX delay register: %pe\n",
+ ERR_PTR(ret));
return ret;
} else if (ret) {
- dev_dbg(dev,
- "%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
- str_enable_disable(val_txdly));
+ phydev_dbg(phydev,
+ "%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
+ str_enable_disable(val_txdly));
} else {
- dev_dbg(dev,
- "2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
- str_enabled_disabled(val_txdly));
+ phydev_dbg(phydev,
+ "2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
+ str_enabled_disabled(val_txdly));
}
ret = phy_modify_paged_changed(phydev, RTL8211F_RGMII_PAGE,
RTL8211F_RXCR, RTL8211F_RX_DELAY,
val_rxdly);
if (ret < 0) {
- dev_err(dev, "Failed to update the RX delay register\n");
+ phydev_err(phydev, "Failed to update the RX delay register: %pe\n",
+ ERR_PTR(ret));
return ret;
} else if (ret) {
- dev_dbg(dev,
- "%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
- str_enable_disable(val_rxdly));
+ phydev_dbg(phydev,
+ "%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
+ str_enable_disable(val_rxdly));
} else {
- dev_dbg(dev,
- "2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
- str_enabled_disabled(val_rxdly));
+ phydev_dbg(phydev,
+ "2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
+ str_enabled_disabled(val_rxdly));
}
+ return 0;
+}
+
+static int rtl8211f_config_init(struct phy_device *phydev)
+{
+ struct rtl821x_priv *priv = phydev->priv;
+ struct device *dev = &phydev->mdio.dev;
+ int ret;
+
+ ret = phy_modify_paged_changed(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR1,
+ RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
+ priv->phycr1);
+ if (ret < 0) {
+ dev_err(dev, "aldps mode configuration failed: %pe\n",
+ ERR_PTR(ret));
+ return ret;
+ }
+
+ ret = rtl8211f_config_rgmii_delay(phydev);
+ if (ret)
+ return ret;
+
if (!priv->has_phycr2)
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 332/614] iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 331/614] net: phy: realtek: create rtl8211f_config_rgmii_delay() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 333/614] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Greg Kroah-Hartman
` (295 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vineeth Pillai (Google), Lu Baolu,
Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
[ Upstream commit cb3db5a39e2a6b6396df1780d39a250f649d2e3a ]
INTEL_IOMMU_FLOPPY_WA workaround was introduced to create direct mappings
for first 16MB for floppy devices as the floppy drivers were not using
dma apis. We need not do this direct map if floppy driver is not
enabled.
INTEL_IOMMU_FLOPPY_WA is generally not a good idea. Iommu will be
mapping pages in this address range while kernel would also be
allocating from this range(mostly on memory stress). A misbehaving
device using this domain will have access to the pages that the
kernel might be actively using. We noticed this while running a test
that was trying to figure out if any pages used by kernel is in iommu
page tables.
This patch reduces the scope of the above issue by disabling the
workaround when floppy driver is not enabled. But we would still need to
fix the floppy driver to use dma apis so that we need not do direct map
without reserving the pages. Or the other option is to reserve this
memory range in firmware so that kernel will not use the pages.
Fixes: d850c2ee5fe2 ("iommu/vt-d: Expose ISA direct mapping region via iommu_get_resv_regions")
Fixes: 49a0429e53f2 ("Intel IOMMU: Iommu floppy workaround")
Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
Link: https://lore.kernel.org/r/20251002161625.1155133-1-vineeth@bitbyteword.org
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/Kconfig b/drivers/iommu/intel/Kconfig
index f2f538c706503..17a91f881b2e9 100644
--- a/drivers/iommu/intel/Kconfig
+++ b/drivers/iommu/intel/Kconfig
@@ -66,7 +66,7 @@ config INTEL_IOMMU_DEFAULT_ON
config INTEL_IOMMU_FLOPPY_WA
def_bool y
- depends on X86
+ depends on X86 && BLK_DEV_FD
help
Floppy disk drivers are known to bypass DMA API calls
thereby failing to work when IOMMU is enabled. This
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 333/614] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 332/614] iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 334/614] wifi: mac80211: fix CMAC functions not handling errors Greg Kroah-Hartman
` (294 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aashish Sharma, Lu Baolu,
Joerg Roedel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aashish Sharma <aashish@aashishsharma.net>
[ Upstream commit 6b38a108eeb3936b21643191db535a35dd7c890b ]
Invalidation hint (ih) in the function 'qi_desc_iotlb' is initialized
to zero and never used. It is embedded in the 0th bit of the 'addr'
parameter. Get the correct 'ih' value from there.
Fixes: f701c9f36bcb ("iommu/vt-d: Factor out invalidation descriptor composition")
Signed-off-by: Aashish Sharma <aashish@aashishsharma.net>
Link: https://lore.kernel.org/r/20251009010903.1323979-1-aashish@aashishsharma.net
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
index 3056583d7f56b..dcc5466d35f93 100644
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -1097,7 +1097,7 @@ static inline void qi_desc_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
struct qi_desc *desc)
{
u8 dw = 0, dr = 0;
- int ih = 0;
+ int ih = addr & 1;
if (cap_write_drain(iommu->cap))
dw = 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 334/614] wifi: mac80211: fix CMAC functions not handling errors
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 333/614] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 335/614] tools/rtla: Fix unassigned nr_cpus Greg Kroah-Hartman
` (293 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chien Wong, Johannes Berg,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chien Wong <m@xv97.com>
[ Upstream commit 353cda30d30e5dc7cacf8de5d2546724708ae3bb ]
The called hash functions could fail thus we should check return values.
Fixes: 26717828b75d ("mac80211: aes-cmac: switch to shash CMAC driver")
Signed-off-by: Chien Wong <m@xv97.com>
Link: https://patch.msgid.link/20251113140511.48658-2-m@xv97.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/aes_cmac.c | 63 +++++++++++++++++++++++++++++------------
net/mac80211/aes_cmac.h | 8 +++---
net/mac80211/wpa.c | 20 +++++++------
3 files changed, 61 insertions(+), 30 deletions(-)
diff --git a/net/mac80211/aes_cmac.c b/net/mac80211/aes_cmac.c
index 48c04f89de20a..65989c7dfc680 100644
--- a/net/mac80211/aes_cmac.c
+++ b/net/mac80211/aes_cmac.c
@@ -22,50 +22,77 @@
static const u8 zero[CMAC_TLEN_256];
-void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
- const u8 *data, size_t data_len, u8 *mic)
+int ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
+ const u8 *data, size_t data_len, u8 *mic)
{
+ int err;
SHASH_DESC_ON_STACK(desc, tfm);
u8 out[AES_BLOCK_SIZE];
const __le16 *fc;
desc->tfm = tfm;
- crypto_shash_init(desc);
- crypto_shash_update(desc, aad, AAD_LEN);
+ err = crypto_shash_init(desc);
+ if (err)
+ return err;
+ err = crypto_shash_update(desc, aad, AAD_LEN);
+ if (err)
+ return err;
fc = (const __le16 *)aad;
if (ieee80211_is_beacon(*fc)) {
/* mask Timestamp field to zero */
- crypto_shash_update(desc, zero, 8);
- crypto_shash_update(desc, data + 8, data_len - 8 - CMAC_TLEN);
+ err = crypto_shash_update(desc, zero, 8);
+ if (err)
+ return err;
+ err = crypto_shash_update(desc, data + 8,
+ data_len - 8 - CMAC_TLEN);
+ if (err)
+ return err;
} else {
- crypto_shash_update(desc, data, data_len - CMAC_TLEN);
+ err = crypto_shash_update(desc, data,
+ data_len - CMAC_TLEN);
+ if (err)
+ return err;
}
- crypto_shash_finup(desc, zero, CMAC_TLEN, out);
-
+ err = crypto_shash_finup(desc, zero, CMAC_TLEN, out);
+ if (err)
+ return err;
memcpy(mic, out, CMAC_TLEN);
+
+ return 0;
}
-void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
- const u8 *data, size_t data_len, u8 *mic)
+int ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
+ const u8 *data, size_t data_len, u8 *mic)
{
+ int err;
SHASH_DESC_ON_STACK(desc, tfm);
const __le16 *fc;
desc->tfm = tfm;
- crypto_shash_init(desc);
- crypto_shash_update(desc, aad, AAD_LEN);
+ err = crypto_shash_init(desc);
+ if (err)
+ return err;
+ err = crypto_shash_update(desc, aad, AAD_LEN);
+ if (err)
+ return err;
fc = (const __le16 *)aad;
if (ieee80211_is_beacon(*fc)) {
/* mask Timestamp field to zero */
- crypto_shash_update(desc, zero, 8);
- crypto_shash_update(desc, data + 8,
- data_len - 8 - CMAC_TLEN_256);
+ err = crypto_shash_update(desc, zero, 8);
+ if (err)
+ return err;
+ err = crypto_shash_update(desc, data + 8,
+ data_len - 8 - CMAC_TLEN_256);
+ if (err)
+ return err;
} else {
- crypto_shash_update(desc, data, data_len - CMAC_TLEN_256);
+ err = crypto_shash_update(desc, data, data_len - CMAC_TLEN_256);
+ if (err)
+ return err;
}
- crypto_shash_finup(desc, zero, CMAC_TLEN_256, mic);
+ return crypto_shash_finup(desc, zero, CMAC_TLEN_256, mic);
}
struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
diff --git a/net/mac80211/aes_cmac.h b/net/mac80211/aes_cmac.h
index 76817446fb838..f74150542142a 100644
--- a/net/mac80211/aes_cmac.h
+++ b/net/mac80211/aes_cmac.h
@@ -11,10 +11,10 @@
struct crypto_shash *ieee80211_aes_cmac_key_setup(const u8 key[],
size_t key_len);
-void ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
- const u8 *data, size_t data_len, u8 *mic);
-void ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
- const u8 *data, size_t data_len, u8 *mic);
+int ieee80211_aes_cmac(struct crypto_shash *tfm, const u8 *aad,
+ const u8 *data, size_t data_len, u8 *mic);
+int ieee80211_aes_cmac_256(struct crypto_shash *tfm, const u8 *aad,
+ const u8 *data, size_t data_len, u8 *mic);
void ieee80211_aes_cmac_key_free(struct crypto_shash *tfm);
#endif /* AES_CMAC_H */
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 40d5d9e484791..bb0fa505cdcae 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -869,8 +869,9 @@ ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
/*
* MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
*/
- ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
- skb->data + 24, skb->len - 24, mmie->mic);
+ if (ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
+ skb->data + 24, skb->len - 24, mmie->mic))
+ return TX_DROP;
return TX_CONTINUE;
}
@@ -916,8 +917,9 @@ ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
/* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
*/
- ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
- skb->data + 24, skb->len - 24, mmie->mic);
+ if (ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
+ skb->data + 24, skb->len - 24, mmie->mic))
+ return TX_DROP;
return TX_CONTINUE;
}
@@ -956,8 +958,9 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
if (!(status->flag & RX_FLAG_DECRYPTED)) {
/* hardware didn't decrypt/verify MIC */
bip_aad(skb, aad);
- ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
- skb->data + 24, skb->len - 24, mic);
+ if (ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
+ skb->data + 24, skb->len - 24, mic))
+ return RX_DROP_U_DECRYPT_FAIL;
if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
key->u.aes_cmac.icverrors++;
return RX_DROP_U_MIC_FAIL;
@@ -1006,8 +1009,9 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
if (!(status->flag & RX_FLAG_DECRYPTED)) {
/* hardware didn't decrypt/verify MIC */
bip_aad(skb, aad);
- ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
- skb->data + 24, skb->len - 24, mic);
+ if (ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
+ skb->data + 24, skb->len - 24, mic))
+ return RX_DROP_U_DECRYPT_FAIL;
if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
key->u.aes_cmac.icverrors++;
return RX_DROP_U_MIC_FAIL;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 335/614] tools/rtla: Fix unassigned nr_cpus
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 334/614] wifi: mac80211: fix CMAC functions not handling errors Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 336/614] tools/rtla: Fix --on-threshold always triggering Greg Kroah-Hartman
` (292 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Costa Shulyupin, Tomas Glozar,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Costa Shulyupin <costa.shul@redhat.com>
[ Upstream commit b4275b23010df719ec6508ddbc84951dcd24adce ]
In recently introduced timerlat_free(),
the variable 'nr_cpus' is not assigned.
Assign it with sysconf(_SC_NPROCESSORS_CONF) as done elsewhere.
Remove the culprit: -Wno-maybe-uninitialized. The rest of the
code is clean.
Signed-off-by: Costa Shulyupin <costa.shul@redhat.com>
Reviewed-by: Tomas Glozar <tglozar@redhat.com>
Fixes: 2f3172f9dd58 ("tools/rtla: Consolidate code between osnoise/timerlat and hist/top")
Link: https://lore.kernel.org/r/20251002170846.437888-1-costa.shul@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/rtla/Makefile.rtla | 2 +-
tools/tracing/rtla/src/timerlat.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/tracing/rtla/Makefile.rtla b/tools/tracing/rtla/Makefile.rtla
index 08c1b40883d3a..1743d91829d46 100644
--- a/tools/tracing/rtla/Makefile.rtla
+++ b/tools/tracing/rtla/Makefile.rtla
@@ -18,7 +18,7 @@ export CC AR STRIP PKG_CONFIG LD_SO_CONF_PATH LDCONFIG
FOPTS := -flto=auto -ffat-lto-objects -fexceptions -fstack-protector-strong \
-fasynchronous-unwind-tables -fstack-clash-protection
WOPTS := -O -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 \
- -Wp,-D_GLIBCXX_ASSERTIONS -Wno-maybe-uninitialized
+ -Wp,-D_GLIBCXX_ASSERTIONS
ifeq ($(CC),clang)
FOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(FOPTS))
diff --git a/tools/tracing/rtla/src/timerlat.c b/tools/tracing/rtla/src/timerlat.c
index b692128741279..11ad447a8dd78 100644
--- a/tools/tracing/rtla/src/timerlat.c
+++ b/tools/tracing/rtla/src/timerlat.c
@@ -215,7 +215,8 @@ void timerlat_analyze(struct osnoise_tool *tool, bool stopped)
void timerlat_free(struct osnoise_tool *tool)
{
struct timerlat_params *params = to_timerlat_params(tool->params);
- int nr_cpus, i;
+ int nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
+ int i;
timerlat_aa_destroy();
if (dma_latency_fd >= 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 336/614] tools/rtla: Fix --on-threshold always triggering
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 335/614] tools/rtla: Fix unassigned nr_cpus Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 337/614] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path Greg Kroah-Hartman
` (291 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Crystal Wood, Wander Lairson Costa,
Tomas Glozar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
[ Upstream commit 417bd0d502f90a2e785e7299dae4f248b5ac0292 ]
Commit 8d933d5c89e8 ("rtla/timerlat: Add continue action") moved the
code performing on-threshold actions (enabled through --on-threshold
option) to inside the RTLA main loop.
The condition in the loop does not check whether the threshold was
actually exceeded or if stop tracing was requested by the user through
SIGINT or duration. This leads to a bug where on-threshold actions are
always performed, even when the threshold was not hit.
(BPF mode is not affected, since it uses a different condition in the
while loop.)
Add a condition that checks for !stop_tracing before executing the
actions. Also, fix incorrect brackets in hist_main_loop to match the
semantics of top_main_loop.
Fixes: 8d933d5c89e8 ("rtla/timerlat: Add continue action")
Fixes: 2f3172f9dd58 ("tools/rtla: Consolidate code between osnoise/timerlat and hist/top")
Reviewed-by: Crystal Wood <crwood@redhat.com>
Reviewed-by: Wander Lairson Costa <wander@redhat.com>
Link: https://lore.kernel.org/r/20251007095341.186923-1-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/rtla/src/common.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/tools/tracing/rtla/src/common.c b/tools/tracing/rtla/src/common.c
index 2e6e3dac1897f..b197037fc58b3 100644
--- a/tools/tracing/rtla/src/common.c
+++ b/tools/tracing/rtla/src/common.c
@@ -268,6 +268,10 @@ int top_main_loop(struct osnoise_tool *tool)
tool->ops->print_stats(tool);
if (osnoise_trace_is_off(tool, record)) {
+ if (stop_tracing)
+ /* stop tracing requested, do not perform actions */
+ return 0;
+
actions_perform(¶ms->threshold_actions);
if (!params->threshold_actions.continue_flag)
@@ -315,20 +319,22 @@ int hist_main_loop(struct osnoise_tool *tool)
}
if (osnoise_trace_is_off(tool, tool->record)) {
+ if (stop_tracing)
+ /* stop tracing requested, do not perform actions */
+ break;
+
actions_perform(¶ms->threshold_actions);
- if (!params->threshold_actions.continue_flag) {
+ if (!params->threshold_actions.continue_flag)
/* continue flag not set, break */
break;
- /* continue action reached, re-enable tracing */
- if (tool->record)
- trace_instance_start(&tool->record->trace);
- if (tool->aa)
- trace_instance_start(&tool->aa->trace);
- trace_instance_start(&tool->trace);
- }
- break;
+ /* continue action reached, re-enable tracing */
+ if (tool->record)
+ trace_instance_start(&tool->record->trace);
+ if (tool->aa)
+ trace_instance_start(&tool->aa->trace);
+ trace_instance_start(&tool->trace);
}
/* is there still any user-threads ? */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 337/614] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 336/614] tools/rtla: Fix --on-threshold always triggering Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 338/614] mfd: mt6358-irq: " Greg Kroah-Hartman
` (290 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit b4b1bd1f330fdd13706382be6c90ce9f58cee3f5 ]
If devm_request_threaded_irq() fails after irq_domain_create_linear()
succeeds in mt6397_irq_init(), the function returns without removing
the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful
irq_domain_create_linear() to properly release the IRQ domain.
Fixes: a4872e80ce7d ("mfd: mt6397: Extract IRQ related code from core driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251118121500.605-1-vulab@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/mt6397-irq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/mt6397-irq.c b/drivers/mfd/mt6397-irq.c
index 0e463026c5a91..5d2e5459f7444 100644
--- a/drivers/mfd/mt6397-irq.c
+++ b/drivers/mfd/mt6397-irq.c
@@ -229,6 +229,7 @@ int mt6397_irq_init(struct mt6397_chip *chip)
if (ret) {
dev_err(chip->dev, "failed to register irq=%d; err: %d\n",
chip->irq, ret);
+ irq_domain_remove(chip->irq_domain);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 338/614] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 337/614] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 339/614] of/fdt: Consolidate duplicate code into helper functions Greg Kroah-Hartman
` (289 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Lee Jones,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 384bd58bf7095e4c4c8fcdbcede316ef342c630c ]
If devm_request_threaded_irq() fails after irq_domain_add_linear()
succeeds in mt6358_irq_init(), the function returns without removing
the created IRQ domain, leading to a resource leak.
Call irq_domain_remove() in the error path after a successful
irq_domain_add_linear() to properly release the IRQ domain.
Fixes: 2b91c28f2abd ("mfd: Add support for the MediaTek MT6358 PMIC")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251118121427.583-1-vulab@iscas.ac.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/mt6358-irq.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/mt6358-irq.c b/drivers/mfd/mt6358-irq.c
index f467b00d23660..74cf208430440 100644
--- a/drivers/mfd/mt6358-irq.c
+++ b/drivers/mfd/mt6358-irq.c
@@ -285,6 +285,7 @@ int mt6358_irq_init(struct mt6397_chip *chip)
if (ret) {
dev_err(chip->dev, "Failed to register IRQ=%d, ret=%d\n",
chip->irq, ret);
+ irq_domain_remove(chip->irq_domain);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 339/614] of/fdt: Consolidate duplicate code into helper functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 338/614] mfd: mt6358-irq: " Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 340/614] of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr() Greg Kroah-Hartman
` (288 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuntao Wang, Rob Herring (Arm),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <yuntao.wang@linux.dev>
[ Upstream commit 8278cb72c60399f6dc6300c409879fb4c7291513 ]
Currently, there are many pieces of nearly identical code scattered across
different places. Consolidate the duplicate code into helper functions to
improve maintainability and reduce the likelihood of errors.
Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Link: https://patch.msgid.link/20251115134753.179931-2-yuntao.wang@linux.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Stable-dep-of: bec5f6092bc1 ("of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/fdt.c | 41 +++++++++++++++++++++++++++++++++++++++++
include/linux/of_fdt.h | 9 +++++++++
2 files changed, 50 insertions(+)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 0edd639898a63..0c18bdefbbeea 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -625,6 +625,47 @@ const void *__init of_get_flat_dt_prop(unsigned long node, const char *name,
return fdt_getprop(initial_boot_params, node, name, size);
}
+const __be32 *__init of_flat_dt_get_addr_size_prop(unsigned long node,
+ const char *name,
+ int *entries)
+{
+ const __be32 *prop;
+ int len, elen = (dt_root_addr_cells + dt_root_size_cells) * sizeof(__be32);
+
+ prop = of_get_flat_dt_prop(node, name, &len);
+ if (!prop || len % elen) {
+ *entries = 0;
+ return NULL;
+ }
+
+ *entries = len / elen;
+ return prop;
+}
+
+bool __init of_flat_dt_get_addr_size(unsigned long node, const char *name,
+ u64 *addr, u64 *size)
+{
+ const __be32 *prop;
+ int entries;
+
+ prop = of_flat_dt_get_addr_size_prop(node, name, &entries);
+ if (!prop || entries != 1)
+ return false;
+
+ of_flat_dt_read_addr_size(prop, 0, addr, size);
+ return true;
+}
+
+void __init of_flat_dt_read_addr_size(const __be32 *prop, int entry_index,
+ u64 *addr, u64 *size)
+{
+ int entry_cells = dt_root_addr_cells + dt_root_size_cells;
+ prop += entry_cells * entry_index;
+
+ *addr = dt_mem_next_cell(dt_root_addr_cells, &prop);
+ *size = dt_mem_next_cell(dt_root_size_cells, &prop);
+}
+
/**
* of_fdt_is_compatible - Return true if given node from the given blob has
* compat in its compatible list
diff --git a/include/linux/of_fdt.h b/include/linux/of_fdt.h
index b8d6c0c208760..51dadbaa3d63a 100644
--- a/include/linux/of_fdt.h
+++ b/include/linux/of_fdt.h
@@ -55,6 +55,15 @@ extern int of_get_flat_dt_subnode_by_name(unsigned long node,
const char *uname);
extern const void *of_get_flat_dt_prop(unsigned long node, const char *name,
int *size);
+
+extern const __be32 *of_flat_dt_get_addr_size_prop(unsigned long node,
+ const char *name,
+ int *entries);
+extern bool of_flat_dt_get_addr_size(unsigned long node, const char *name,
+ u64 *addr, u64 *size);
+extern void of_flat_dt_read_addr_size(const __be32 *prop, int entry_index,
+ u64 *addr, u64 *size);
+
extern int of_flat_dt_is_compatible(unsigned long node, const char *name);
extern unsigned long of_get_flat_dt_root(void);
extern uint32_t of_get_flat_dt_phandle(unsigned long node);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 340/614] of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 339/614] of/fdt: Consolidate duplicate code into helper functions Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 341/614] of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range() Greg Kroah-Hartman
` (287 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuntao Wang, Rob Herring (Arm),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <yuntao.wang@linux.dev>
[ Upstream commit bec5f6092bc1328895992ff02b862ba34b45a0b7 ]
The len value is in bytes, while `dt_root_addr_cells + dt_root_size_cells`
is in cells (4 bytes per cell). Comparing them directly is incorrect.
Use a helper function to simplify the code and address this issue.
Fixes: f7e7ce93aac1 ("of: fdt: Add generic support for handling elf core headers property")
Fixes: e62aaeac426ab1dd ("arm64: kdump: provide /proc/vmcore file")
Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Link: https://patch.msgid.link/20251115134753.179931-3-yuntao.wang@linux.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/fdt.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 0c18bdefbbeea..b45f60dccd7cf 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -853,21 +853,15 @@ static void __init early_init_dt_check_for_initrd(unsigned long node)
*/
static void __init early_init_dt_check_for_elfcorehdr(unsigned long node)
{
- const __be32 *prop;
- int len;
-
if (!IS_ENABLED(CONFIG_CRASH_DUMP))
return;
pr_debug("Looking for elfcorehdr property... ");
- prop = of_get_flat_dt_prop(node, "linux,elfcorehdr", &len);
- if (!prop || (len < (dt_root_addr_cells + dt_root_size_cells)))
+ if (!of_flat_dt_get_addr_size(node, "linux,elfcorehdr",
+ &elfcorehdr_addr, &elfcorehdr_size))
return;
- elfcorehdr_addr = dt_mem_next_cell(dt_root_addr_cells, &prop);
- elfcorehdr_size = dt_mem_next_cell(dt_root_size_cells, &prop);
-
pr_debug("elfcorehdr_start=0x%llx elfcorehdr_size=0x%llx\n",
elfcorehdr_addr, elfcorehdr_size);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 341/614] of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 340/614] of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 342/614] of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Greg Kroah-Hartman
` (286 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuntao Wang, Rob Herring (Arm),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <yuntao.wang@linux.dev>
[ Upstream commit 463942de13cd30fad5dba709f708483eab7efc2c ]
The len value is in bytes, while `dt_root_addr_cells + dt_root_size_cells`
is in cells (4 bytes per cell). Modulo calculation between them is
incorrect, the units must be converted first.
Use helper functions to simplify the code and fix this issue.
Fixes: fb319e77a0e7 ("of: fdt: Add memory for devices by DT property "linux,usable-memory-range"")
Fixes: 2af2b50acf9b9c38 ("of: fdt: Add generic support for handling usable memory range property")
Fixes: 8f579b1c4e347b23 ("arm64: limit memory regions based on DT property, usable-memory-range")
Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Link: https://patch.msgid.link/20251115134753.179931-4-yuntao.wang@linux.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/fdt.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index b45f60dccd7cf..ea37ba694bcd7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -884,8 +884,9 @@ static unsigned long chosen_node_offset = -FDT_ERR_NOTFOUND;
void __init early_init_dt_check_for_usable_mem_range(void)
{
struct memblock_region rgn[MAX_USABLE_RANGES] = {0};
- const __be32 *prop, *endp;
+ const __be32 *prop;
int len, i;
+ u64 base, size;
unsigned long node = chosen_node_offset;
if ((long)node < 0)
@@ -893,14 +894,17 @@ void __init early_init_dt_check_for_usable_mem_range(void)
pr_debug("Looking for usable-memory-range property... ");
- prop = of_get_flat_dt_prop(node, "linux,usable-memory-range", &len);
- if (!prop || (len % (dt_root_addr_cells + dt_root_size_cells)))
+ prop = of_flat_dt_get_addr_size_prop(node, "linux,usable-memory-range",
+ &len);
+ if (!prop)
return;
- endp = prop + (len / sizeof(__be32));
- for (i = 0; i < MAX_USABLE_RANGES && prop < endp; i++) {
- rgn[i].base = dt_mem_next_cell(dt_root_addr_cells, &prop);
- rgn[i].size = dt_mem_next_cell(dt_root_size_cells, &prop);
+ len = min(len, MAX_USABLE_RANGES);
+
+ for (i = 0; i < len; i++) {
+ of_flat_dt_read_addr_size(prop, i, &base, &size);
+ rgn[i].base = base;
+ rgn[i].size = size;
pr_debug("cap_mem_regions[%d]: base=%pa, size=%pa\n",
i, &rgn[i].base, &rgn[i].size);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 342/614] of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 341/614] of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 343/614] leds: rgb: leds-qcom-lpg: Dont enable TRILED when configuring PWM Greg Kroah-Hartman
` (285 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuntao Wang, Rob Herring (Arm),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Wang <yuntao.wang@linux.dev>
[ Upstream commit c85da64ce2c36bba469f6feede9ca768f0361741 ]
When reading the fdt_size value, the argument passed to dt_mem_next_cell()
is dt_root_addr_cells, but it should be dt_root_size_cells.
The same issue occurs when reading the scratch_size value.
Use a helper function to simplify the code and fix these issues.
Fixes: 274cdcb1c004 ("arm64: add KHO support")
Signed-off-by: Yuntao Wang <yuntao.wang@linux.dev>
Link: https://patch.msgid.link/20251115134753.179931-5-yuntao.wang@linux.dev
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/fdt.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index ea37ba694bcd7..fdaee4906836f 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -922,26 +922,18 @@ static void __init early_init_dt_check_kho(void)
{
unsigned long node = chosen_node_offset;
u64 fdt_start, fdt_size, scratch_start, scratch_size;
- const __be32 *p;
- int l;
if (!IS_ENABLED(CONFIG_KEXEC_HANDOVER) || (long)node < 0)
return;
- p = of_get_flat_dt_prop(node, "linux,kho-fdt", &l);
- if (l != (dt_root_addr_cells + dt_root_size_cells) * sizeof(__be32))
+ if (!of_flat_dt_get_addr_size(node, "linux,kho-fdt",
+ &fdt_start, &fdt_size))
return;
- fdt_start = dt_mem_next_cell(dt_root_addr_cells, &p);
- fdt_size = dt_mem_next_cell(dt_root_addr_cells, &p);
-
- p = of_get_flat_dt_prop(node, "linux,kho-scratch", &l);
- if (l != (dt_root_addr_cells + dt_root_size_cells) * sizeof(__be32))
+ if (!of_flat_dt_get_addr_size(node, "linux,kho-scratch",
+ &scratch_start, &scratch_size))
return;
- scratch_start = dt_mem_next_cell(dt_root_addr_cells, &p);
- scratch_size = dt_mem_next_cell(dt_root_addr_cells, &p);
-
kho_populate(fdt_start, fdt_size, scratch_start, scratch_size);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 343/614] leds: rgb: leds-qcom-lpg: Dont enable TRILED when configuring PWM
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 342/614] of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 344/614] phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() Greg Kroah-Hartman
` (284 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fenglin Wu, Bjorn Andersson,
Lee Jones, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
[ Upstream commit 072cd5f458d76b9e15d89ebdaea8b5cb1312eeef ]
The PWM signal from the LPG channel can be routed to PMIC GPIOs with
proper GPIO configuration, and it is not necessary to enable the
TRILED channel in that case. This also applies to the LPG channels
that mapped to TRILED channels. Additionally, enabling the TRILED
channel unnecessarily would cause a voltage increase in its power
supply. Hence remove it.
Fixes: 24e2d05d1b68 ("leds: Add driver for Qualcomm LPG")
Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Link: https://patch.msgid.link/20251119-lpg_triled_fix-v3-2-84b6dbdc774a@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/rgb/leds-qcom-lpg.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c
index 4f2a178e3d265..e197f548cddb0 100644
--- a/drivers/leds/rgb/leds-qcom-lpg.c
+++ b/drivers/leds/rgb/leds-qcom-lpg.c
@@ -2,7 +2,7 @@
/*
* Copyright (c) 2017-2022 Linaro Ltd
* Copyright (c) 2010-2012, The Linux Foundation. All rights reserved.
- * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
*/
#include <linux/bits.h>
#include <linux/bitfield.h>
@@ -1247,8 +1247,6 @@ static int lpg_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
lpg_apply(chan);
- triled_set(lpg, chan->triled_mask, chan->enabled ? chan->triled_mask : 0);
-
out_unlock:
mutex_unlock(&lpg->lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 344/614] phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 343/614] leds: rgb: leds-qcom-lpg: Dont enable TRILED when configuring PWM Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 345/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 Greg Kroah-Hartman
` (283 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Biju Das,
Geert Uytterhoeven, Wolfram Sang, Claudiu Beznea, Vinod Koul,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 662bb179d3381c7c069e44bb177396bcaee31cc8 ]
If an error occurs after the reset_control_deassert(),
reset_control_assert() must be called, as already done in the remove
function.
Use devm_add_action_or_reset() to add the missing call and simplify the
.remove() function accordingly.
While at it, drop struct rcar_gen3_chan::rstc as it is not used aymore.
[claudiu.beznea: removed "struct reset_control *rstc = data;" from
rcar_gen3_reset_assert(), dropped struct rcar_gen3_chan::rstc]
Fixes: 4eae16375357 ("phy: renesas: rcar-gen3-usb2: Add support to initialize the bus")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20251023135810.1688415-3-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
index 3f6b480e10922..a38ead7c8055d 100644
--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
@@ -134,7 +134,6 @@ struct rcar_gen3_chan {
struct extcon_dev *extcon;
struct rcar_gen3_phy rphys[NUM_OF_PHYS];
struct regulator *vbus;
- struct reset_control *rstc;
struct work_struct work;
spinlock_t lock; /* protects access to hardware and driver data structure. */
enum usb_dr_mode dr_mode;
@@ -771,21 +770,31 @@ static enum usb_dr_mode rcar_gen3_get_dr_mode(struct device_node *np)
return candidate;
}
+static void rcar_gen3_reset_assert(void *data)
+{
+ reset_control_assert(data);
+}
+
static int rcar_gen3_phy_usb2_init_bus(struct rcar_gen3_chan *channel)
{
struct device *dev = channel->dev;
+ struct reset_control *rstc;
int ret;
u32 val;
- channel->rstc = devm_reset_control_array_get_shared(dev);
- if (IS_ERR(channel->rstc))
- return PTR_ERR(channel->rstc);
+ rstc = devm_reset_control_array_get_shared(dev);
+ if (IS_ERR(rstc))
+ return PTR_ERR(rstc);
ret = pm_runtime_resume_and_get(dev);
if (ret)
return ret;
- ret = reset_control_deassert(channel->rstc);
+ ret = reset_control_deassert(rstc);
+ if (ret)
+ goto rpm_put;
+
+ ret = devm_add_action_or_reset(dev, rcar_gen3_reset_assert, rstc);
if (ret)
goto rpm_put;
@@ -924,7 +933,6 @@ static void rcar_gen3_phy_usb2_remove(struct platform_device *pdev)
if (channel->is_otg_channel)
device_remove_file(&pdev->dev, &dev_attr_role);
- reset_control_assert(channel->rstc);
pm_runtime_disable(&pdev->dev);
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 345/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 344/614] phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 346/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 Greg Kroah-Hartman
` (282 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Lin, Neil Armstrong,
Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit a2a18e5da64f8da306fa97c397b4c739ea776f37 ]
When PCIe link enters L1 PM substates, the PHY will turn off its
PLL for power-saving. However, it turns off the PLL too fast which
leads the PHY to be broken. According to the PHY document, we need
to delay PLL turnoff time.
Fixes: bbcca4fac873 ("phy: rockchip: naneng-combphy: Add RK3528 support")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/1763459526-35004-1-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
index a3ef19807b9ef..e303bec8a996f 100644
--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
@@ -21,6 +21,9 @@
#define REF_CLOCK_100MHz (100 * HZ_PER_MHZ)
/* RK3528 COMBO PHY REG */
+#define RK3528_PHYREG5 0x14
+#define RK3528_PHYREG5_GATE_TX_PCK_SEL BIT(3)
+#define RK3528_PHYREG5_GATE_TX_PCK_DLY_PLL_OFF BIT(3)
#define RK3528_PHYREG6 0x18
#define RK3528_PHYREG6_PLL_KVCO GENMASK(12, 10)
#define RK3528_PHYREG6_PLL_KVCO_VALUE 0x2
@@ -504,6 +507,10 @@ static int rk3528_combphy_cfg(struct rockchip_combphy_priv *priv)
case REF_CLOCK_100MHz:
rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_clk_100m, true);
if (priv->type == PHY_TYPE_PCIE) {
+ /* Gate_tx_pck_sel length select for L1ss support */
+ rockchip_combphy_updatel(priv, RK3528_PHYREG5_GATE_TX_PCK_SEL,
+ RK3528_PHYREG5_GATE_TX_PCK_DLY_PLL_OFF, RK3528_PHYREG5);
+
/* PLL KVCO tuning fine */
val = FIELD_PREP(RK3528_PHYREG6_PLL_KVCO, RK3528_PHYREG6_PLL_KVCO_VALUE);
rockchip_combphy_updatel(priv, RK3528_PHYREG6_PLL_KVCO, val,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 346/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 345/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 347/614] phy: freescale: Initialize priv->lock Greg Kroah-Hartman
` (281 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Lin, Neil Armstrong,
Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit be866e68966d20bcc4a73708093d577176f99c0c ]
When PCIe link enters L1 PM substates, the PHY will turn off its
PLL for power-saving. However, it turns off the PLL too fast which
leads the PHY to be broken. According to the PHY document, we need
to delay PLL turnoff time.
Fixes: f13bff25161b ("phy: rockchip-naneng-combo: Support rk3562")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/1763459526-35004-2-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
index e303bec8a996f..7f8fc8e6d4890 100644
--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
@@ -106,6 +106,10 @@
#define RK3568_PHYREG18 0x44
#define RK3568_PHYREG18_PLL_LOOP 0x32
+#define RK3568_PHYREG30 0x74
+#define RK3568_PHYREG30_GATE_TX_PCK_SEL BIT(7)
+#define RK3568_PHYREG30_GATE_TX_PCK_DLY_PLL_OFF BIT(7)
+
#define RK3568_PHYREG32 0x7C
#define RK3568_PHYREG32_SSC_MASK GENMASK(7, 4)
#define RK3568_PHYREG32_SSC_DIR_MASK GENMASK(5, 4)
@@ -664,6 +668,10 @@ static int rk3562_combphy_cfg(struct rockchip_combphy_priv *priv)
case REF_CLOCK_100MHz:
rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_clk_100m, true);
if (priv->type == PHY_TYPE_PCIE) {
+ /* Gate_tx_pck_sel length select for L1ss support */
+ rockchip_combphy_updatel(priv, RK3568_PHYREG30_GATE_TX_PCK_SEL,
+ RK3568_PHYREG30_GATE_TX_PCK_DLY_PLL_OFF,
+ RK3568_PHYREG30);
/* PLL KVCO tuning fine */
val = FIELD_PREP(RK3568_PHYREG33_PLL_KVCO_MASK,
RK3568_PHYREG33_PLL_KVCO_VALUE);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 347/614] phy: freescale: Initialize priv->lock
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 346/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 348/614] phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode Greg Kroah-Hartman
` (280 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaolei Wang, Frank Li,
Neil Armstrong, Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit 95e5905698983df94069e185f9eb3c67c7cf75d5 ]
Initialize priv->lock to fix the following warning.
WARNING: CPU: 0 PID: 12 at kernel/locking/mutex.c:577 __mutex_lock+0x70c/0x8b8
Modules linked in:
Hardware name: Freescale i.MX8QM MEK (DT)
Call trace:
__mutex_lock+0x70c/0x8b8 (P)
mutex_lock_nested+0x24/0x30
imx_hsio_power_on+0x4c/0x764
phy_power_on+0x7c/0x12c
imx_pcie_host_init+0x1d0/0x4d4
dw_pcie_host_init+0x188/0x4b0
imx_pcie_probe+0x324/0x6f4
platform_probe+0x5c/0x98
really_probe+0xbc/0x29c
__driver_probe_device+0x78/0x12c
driver_probe_device+0xd8/0x160
__device_attach_driver+0xb8/0x138
bus_for_each_drv+0x84/0xe4
__device_attach_async_helper+0xb8/0xdc
async_run_entry_fn+0x34/0xe0
process_one_work+0x220/0x694
worker_thread+0x1c0/0x36c
kthread+0x14c/0x224
Fixes: 82c56b6dd24f ("phy: freescale: imx8qm-hsio: Add i.MX8QM HSIO PHY driver support")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20250925013806.569658-1-xiaolei.wang@windriver.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/freescale/phy-fsl-imx8qm-hsio.c b/drivers/phy/freescale/phy-fsl-imx8qm-hsio.c
index 5dca93cd325c8..977d21d753a59 100644
--- a/drivers/phy/freescale/phy-fsl-imx8qm-hsio.c
+++ b/drivers/phy/freescale/phy-fsl-imx8qm-hsio.c
@@ -533,7 +533,7 @@ static struct phy *imx_hsio_xlate(struct device *dev,
static int imx_hsio_probe(struct platform_device *pdev)
{
- int i;
+ int i, ret;
void __iomem *off;
struct device *dev = &pdev->dev;
struct device_node *np = dev->of_node;
@@ -545,6 +545,9 @@ static int imx_hsio_probe(struct platform_device *pdev)
return -ENOMEM;
priv->dev = &pdev->dev;
priv->drvdata = of_device_get_match_data(dev);
+ ret = devm_mutex_init(dev, &priv->lock);
+ if (ret)
+ return ret;
/* Get HSIO configuration mode */
if (of_property_read_string(np, "fsl,hsio-cfg", &priv->hsio_cfg))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 348/614] phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 347/614] phy: freescale: Initialize priv->lock Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 349/614] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth Greg Kroah-Hartman
` (279 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Yan, Cristian Ciocaltea,
Neil Armstrong, Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 72126e9623e1696ea83c77ef6d0306a6263bdd6b ]
When making use of the clock provider functionality, the output clock
does normally match the TMDS character rate, which is what the PHY PLL
gets configured to.
However, this is only applicable for default color depth of 8 bpc. For
higher depths, the output clock is further divided by the hardware
according to the formula:
output_clock_rate = tmds_char_rate * 8 / bpc
Since the existence of the clock divider wasn't taken into account when
support for high bpc has been introduced, make the necessary adjustments
to report the correct clock rate.
Fixes: 9d0ec51d7c22 ("phy: rockchip: samsung-hdptx: Add high color depth management")
Reported-by: Andy Yan <andy.yan@rock-chips.com>
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20251028-phy-hdptx-fixes-v1-1-ecc642a59d94@collabora.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c b/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
index 01bbf668e05ef..aee03e8655f66 100644
--- a/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
+++ b/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
@@ -1037,7 +1037,8 @@ static int rk_hdptx_ropll_tmds_cmn_config(struct rk_hdptx_phy *hdptx)
ret = rk_hdptx_post_enable_pll(hdptx);
if (!ret)
- hdptx->hw_rate = hdptx->hdmi_cfg.tmds_char_rate;
+ hdptx->hw_rate = DIV_ROUND_CLOSEST_ULL(hdptx->hdmi_cfg.tmds_char_rate * 8,
+ hdptx->hdmi_cfg.bpc);
return ret;
}
@@ -1895,19 +1896,20 @@ static long rk_hdptx_phy_clk_round_rate(struct clk_hw *hw, unsigned long rate,
* hence ensure rk_hdptx_phy_clk_set_rate() won't be invoked with
* a different rate argument.
*/
- return hdptx->hdmi_cfg.tmds_char_rate;
+ return DIV_ROUND_CLOSEST_ULL(hdptx->hdmi_cfg.tmds_char_rate * 8, hdptx->hdmi_cfg.bpc);
}
static int rk_hdptx_phy_clk_set_rate(struct clk_hw *hw, unsigned long rate,
unsigned long parent_rate)
{
struct rk_hdptx_phy *hdptx = to_rk_hdptx_phy(hw);
+ unsigned long long tmds_rate = DIV_ROUND_CLOSEST_ULL(rate * hdptx->hdmi_cfg.bpc, 8);
/* Revert any unlikely TMDS char rate change since round_rate() */
- if (hdptx->hdmi_cfg.tmds_char_rate != rate) {
- dev_warn(hdptx->dev, "Reverting unexpected rate change from %lu to %llu\n",
- rate, hdptx->hdmi_cfg.tmds_char_rate);
- hdptx->hdmi_cfg.tmds_char_rate = rate;
+ if (hdptx->hdmi_cfg.tmds_char_rate != tmds_rate) {
+ dev_warn(hdptx->dev, "Reverting unexpected rate change from %llu to %llu\n",
+ tmds_rate, hdptx->hdmi_cfg.tmds_char_rate);
+ hdptx->hdmi_cfg.tmds_char_rate = tmds_rate;
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 349/614] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 348/614] phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 350/614] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Greg Kroah-Hartman
` (278 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Algea Cao, Cristian Ciocaltea,
Neil Armstrong, Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 8daaced9f5eeb4a2c8ca08b0a8286b6a498a8387 ]
Due to its relatively low frequency, a noise stemming from the 24MHz PLL
reference clock may traverse the low-pass loop filter of ROPLL, which
could potentially generate some HDMI flash artifacts.
Reduce ROPLL loop bandwidth in an attempt to mitigate the problem.
Fixes: 553be2830c5f ("phy: rockchip: Add Samsung HDMI/eDP Combo PHY driver")
Co-developed-by: Algea Cao <algea.cao@rock-chips.com>
Signed-off-by: Algea Cao <algea.cao@rock-chips.com>
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20251028-phy-hdptx-fixes-v1-2-ecc642a59d94@collabora.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c b/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
index aee03e8655f66..8ba9b53c2309b 100644
--- a/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
+++ b/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
@@ -500,9 +500,7 @@ static const struct reg_sequence rk_hdtpx_common_cmn_init_seq[] = {
REG_SEQ0(CMN_REG(0043), 0x00),
REG_SEQ0(CMN_REG(0044), 0x46),
REG_SEQ0(CMN_REG(0045), 0x24),
- REG_SEQ0(CMN_REG(0046), 0xff),
REG_SEQ0(CMN_REG(0047), 0x00),
- REG_SEQ0(CMN_REG(0048), 0x44),
REG_SEQ0(CMN_REG(0049), 0xfa),
REG_SEQ0(CMN_REG(004a), 0x08),
REG_SEQ0(CMN_REG(004b), 0x00),
@@ -575,6 +573,8 @@ static const struct reg_sequence rk_hdtpx_tmds_cmn_init_seq[] = {
REG_SEQ0(CMN_REG(0034), 0x00),
REG_SEQ0(CMN_REG(003d), 0x40),
REG_SEQ0(CMN_REG(0042), 0x78),
+ REG_SEQ0(CMN_REG(0046), 0xdd),
+ REG_SEQ0(CMN_REG(0048), 0x11),
REG_SEQ0(CMN_REG(004e), 0x34),
REG_SEQ0(CMN_REG(005c), 0x25),
REG_SEQ0(CMN_REG(005e), 0x4f),
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 350/614] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 349/614] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 351/614] ASoC: SDCA: Fix missing dash in HIDE DisCo property Greg Kroah-Hartman
` (277 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Algea Cao, Cristian Ciocaltea,
Neil Armstrong, Vinod Koul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 51023cf6cc5db3423dea6620746d9087e336e024 ]
Fixup PHY deskew FIFO to prevent the phase of D2 lane going ahead of
other lanes. It's worth noting this might only happen when dealing with
HDMI 2.0 rates.
Fixes: 553be2830c5f ("phy: rockchip: Add Samsung HDMI/eDP Combo PHY driver")
Co-developed-by: Algea Cao <algea.cao@rock-chips.com>
Signed-off-by: Algea Cao <algea.cao@rock-chips.com>
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20251028-phy-hdptx-fixes-v1-3-ecc642a59d94@collabora.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c b/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
index 8ba9b53c2309b..29de2f7bdae8a 100644
--- a/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
+++ b/drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
@@ -668,13 +668,9 @@ static const struct reg_sequence rk_hdtpx_common_lane_init_seq[] = {
static const struct reg_sequence rk_hdtpx_tmds_lane_init_seq[] = {
REG_SEQ0(LANE_REG(0312), 0x00),
- REG_SEQ0(LANE_REG(031e), 0x00),
REG_SEQ0(LANE_REG(0412), 0x00),
- REG_SEQ0(LANE_REG(041e), 0x00),
REG_SEQ0(LANE_REG(0512), 0x00),
- REG_SEQ0(LANE_REG(051e), 0x00),
REG_SEQ0(LANE_REG(0612), 0x00),
- REG_SEQ0(LANE_REG(061e), 0x08),
REG_SEQ0(LANE_REG(0303), 0x2f),
REG_SEQ0(LANE_REG(0403), 0x2f),
REG_SEQ0(LANE_REG(0503), 0x2f),
@@ -687,6 +683,11 @@ static const struct reg_sequence rk_hdtpx_tmds_lane_init_seq[] = {
REG_SEQ0(LANE_REG(0406), 0x1c),
REG_SEQ0(LANE_REG(0506), 0x1c),
REG_SEQ0(LANE_REG(0606), 0x1c),
+ /* Keep Inter-Pair Skew in the limits */
+ REG_SEQ0(LANE_REG(031e), 0x02),
+ REG_SEQ0(LANE_REG(041e), 0x02),
+ REG_SEQ0(LANE_REG(051e), 0x02),
+ REG_SEQ0(LANE_REG(061e), 0x0a),
};
static struct tx_drv_ctrl tx_drv_ctrl_rbr[4][4] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 351/614] ASoC: SDCA: Fix missing dash in HIDE DisCo property
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 350/614] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 352/614] selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names Greg Kroah-Hartman
` (276 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bard Liao, Maciej Strozek,
Peter Ujfalusi, Richard Fitzgerald, Charles Keepax, Vinod Koul,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit 3508311f2e1c872b645f13c6fd52840418089d41 ]
The property name is "mipi-sdca-RxUMP-ownership-transition-max-delay",
with a dash between max and delay. Add the missing dash.
Fixes: 13ef21dffe76 ("ASoC: SDCA: add support for HIDE entity properties and HID descriptor/report")
Tested-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Tested-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20251120153023.2105663-3-ckeepax@opensource.cirrus.com
Reviewed-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sdca/sdca_functions.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c
index 0ccb6775f4de3..19b12564f822e 100644
--- a/sound/soc/sdca/sdca_functions.c
+++ b/sound/soc/sdca/sdca_functions.c
@@ -1263,7 +1263,7 @@ find_sdca_entity_hide(struct device *dev, struct fwnode_handle *function_node,
unsigned char *report_desc = NULL;
ret = fwnode_property_read_u32(entity_node,
- "mipi-sdca-RxUMP-ownership-transition-maxdelay", &delay);
+ "mipi-sdca-RxUMP-ownership-transition-max-delay", &delay);
if (!ret)
hide->max_delay = delay;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 352/614] selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 351/614] ASoC: SDCA: Fix missing dash in HIDE DisCo property Greg Kroah-Hartman
@ 2025-12-16 11:11 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 353/614] net: phy: adin1100: Fix software power-down ready condition Greg Kroah-Hartman
` (275 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Bobrowski, Martin KaFai Lau,
Song Liu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <mattbobrowski@google.com>
[ Upstream commit d088da904223e8f5e19c6d156cf372d5baec1a7c ]
subtest_kmem_cache_iter_check_slabinfo() fundamentally compares slab
cache names parsed out from /proc/slabinfo against those stored within
struct kmem_cache_result. The current problem is that the slab cache
name within struct kmem_cache_result is stored within a bounded
fixed-length array (sized to SLAB_NAME_MAX(32)), whereas the name
parsed out from /proc/slabinfo is not. Meaning, using ASSERT_STREQ()
can certainly lead to test failures, particularly when dealing with
slab cache names that are longer than SLAB_NAME_MAX(32)
bytes. Notably, kmem_cache_create() allows callers to create slab
caches with somewhat arbitrarily sized names via its __name identifier
argument, so exceeding the SLAB_NAME_MAX(32) limit that is in place
now can certainly happen.
Make subtest_kmem_cache_iter_check_slabinfo() more reliable by only
checking up to sizeof(struct kmem_cache_result.name) - 1 using
ASSERT_STRNEQ().
Fixes: a496d0cdc84d ("selftests/bpf: Add a test for kmem_cache_iter")
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Link: https://patch.msgid.link/20251118073734.4188710-1-mattbobrowski@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
index 1de14b111931a..6e35e13c20220 100644
--- a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
+++ b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
@@ -57,7 +57,8 @@ static void subtest_kmem_cache_iter_check_slabinfo(struct kmem_cache_iter *skel)
if (!ASSERT_OK(ret, "kmem_cache_lookup"))
break;
- ASSERT_STREQ(r.name, name, "kmem_cache_name");
+ ASSERT_STRNEQ(r.name, name, sizeof(r.name) - 1,
+ "kmem_cache_name");
ASSERT_EQ(r.obj_size, objsize, "kmem_cache_objsize");
seen++;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 353/614] net: phy: adin1100: Fix software power-down ready condition
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2025-12-16 11:11 ` [PATCH 6.18 352/614] selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated Greg Kroah-Hartman
` (274 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Dahl,
Russell King (Oracle), Nuno Sá, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Dahl <ada@thorsis.com>
[ Upstream commit bccaf1fe08f2c9f96f6bc38391d41e67f6bf38e3 ]
Value CRSM_SFT_PD written to Software Power-Down Control Register
(CRSM_SFT_PD_CNTRL) is 0x01 and therefor different to value
CRSM_SFT_PD_RDY (0x02) read from System Status Register (CRSM_STAT) for
confirmation powerdown has been reached.
The condition could have only worked when disabling powerdown
(both 0x00), but never when enabling it (0x01 != 0x02).
Result is a timeout, like so:
$ ifdown eth0
macb f802c000.ethernet eth0: Link is Down
ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110
ADIN1100 f802c000.ethernet-ffffffff:01: adin_set_powerdown_mode failed: -110
Fixes: 7eaf9132996a ("net: phy: adin1100: Add initial support for ADIN1100 industrial PHY")
Signed-off-by: Alexander Dahl <ada@thorsis.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Link: https://patch.msgid.link/20251119124737.280939-2-ada@thorsis.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/adin1100.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/phy/adin1100.c b/drivers/net/phy/adin1100.c
index bd7a47a903aca..10b796c2daee7 100644
--- a/drivers/net/phy/adin1100.c
+++ b/drivers/net/phy/adin1100.c
@@ -201,7 +201,7 @@ static int adin_set_powerdown_mode(struct phy_device *phydev, bool en)
return ret;
return phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1, ADIN_CRSM_STAT, ret,
- (ret & ADIN_CRSM_SFT_PD_RDY) == val,
+ !!(ret & ADIN_CRSM_SFT_PD_RDY) == en,
1000, 30000, true);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 353/614] net: phy: adin1100: Fix software power-down ready condition Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-29 7:32 ` 答复: " chenridong
2025-12-16 11:12 ` [PATCH 6.18 355/614] clk: spacemit: Set clk_hw_onecell_data::num before using flex array Greg Kroah-Hartman
` (273 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Ridong, Waiman Long, Tejun Heo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <chenridong@huawei.com>
[ Upstream commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 ]
Currently, the check for whether a partition is populated does not
account for tasks in the cpuset of attaching. This is a corner case
that can leave a task stuck in a partition with no effective CPUs.
The race condition occurs as follows:
cpu0 cpu1
//cpuset A with cpu N
migrate task p to A
cpuset_can_attach
// with effective cpus
// check ok
// cpuset_mutex is not held // clear cpuset.cpus.exclusive
// making effective cpus empty
update_exclusive_cpumask
// tasks_nocpu_error check ok
// empty effective cpus, partition valid
cpuset_attach
...
// task p stays in A, with non-effective cpus.
To fix this issue, this patch introduces cs_is_populated, which considers
tasks in the attaching cpuset. This new helper is used in validate_change
and partition_is_populated.
Fixes: e2d59900d936 ("cgroup/cpuset: Allow no-task partition to have empty cpuset.cpus.effective")
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cpuset.c | 35 +++++++++++++++++++++++++++--------
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 52468d2c178a3..4dcd633fd6df5 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -352,6 +352,15 @@ static inline bool is_in_v2_mode(void)
(cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
}
+static inline bool cpuset_is_populated(struct cpuset *cs)
+{
+ lockdep_assert_held(&cpuset_mutex);
+
+ /* Cpusets in the process of attaching should be considered as populated */
+ return cgroup_is_populated(cs->css.cgroup) ||
+ cs->attach_in_progress;
+}
+
/**
* partition_is_populated - check if partition has tasks
* @cs: partition root to be checked
@@ -364,21 +373,31 @@ static inline bool is_in_v2_mode(void)
static inline bool partition_is_populated(struct cpuset *cs,
struct cpuset *excluded_child)
{
- struct cgroup_subsys_state *css;
- struct cpuset *child;
+ struct cpuset *cp;
+ struct cgroup_subsys_state *pos_css;
- if (cs->css.cgroup->nr_populated_csets)
+ /*
+ * We cannot call cs_is_populated(cs) directly, as
+ * nr_populated_domain_children may include populated
+ * csets from descendants that are partitions.
+ */
+ if (cs->css.cgroup->nr_populated_csets ||
+ cs->attach_in_progress)
return true;
if (!excluded_child && !cs->nr_subparts)
return cgroup_is_populated(cs->css.cgroup);
rcu_read_lock();
- cpuset_for_each_child(child, css, cs) {
- if (child == excluded_child)
+ cpuset_for_each_descendant_pre(cp, pos_css, cs) {
+ if (cp == cs || cp == excluded_child)
continue;
- if (is_partition_valid(child))
+
+ if (is_partition_valid(cp)) {
+ pos_css = css_rightmost_descendant(pos_css);
continue;
- if (cgroup_is_populated(child->css.cgroup)) {
+ }
+
+ if (cpuset_is_populated(cp)) {
rcu_read_unlock();
return true;
}
@@ -663,7 +682,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
* be changed to have empty cpus_allowed or mems_allowed.
*/
ret = -ENOSPC;
- if ((cgroup_is_populated(cur->css.cgroup) || cur->attach_in_progress)) {
+ if (cpuset_is_populated(cur)) {
if (!cpumask_empty(cur->cpus_allowed) &&
cpumask_empty(trial->cpus_allowed))
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 355/614] clk: spacemit: Set clk_hw_onecell_data::num before using flex array
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 356/614] wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Greg Kroah-Hartman
` (272 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yanko Kaneti, Charles Mirabile,
Alex Elder, Troy Mitchell, Yixun Lan, Stephen Boyd, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Mirabile <cmirabil@redhat.com>
[ Upstream commit 23b2d2fb136959fd0a8e309c70be83d9b8841c7e ]
When booting with KASAN enabled the following splat is
encountered during probe of the k1 clock driver:
UBSAN: array-index-out-of-bounds in drivers/clk/spacemit/ccu-k1.c:1044:16
index 0 is out of range for type 'clk_hw *[*]'
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc5+ #1 PREEMPT(lazy)
Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2022.10spacemit 10/01/2022
Call Trace:
[<ffffffff8002b628>] dump_backtrace+0x28/0x38
[<ffffffff800027d2>] show_stack+0x3a/0x50
[<ffffffff800220c2>] dump_stack_lvl+0x5a/0x80
[<ffffffff80022100>] dump_stack+0x18/0x20
[<ffffffff800164b8>] ubsan_epilogue+0x10/0x48
[<ffffffff8099034e>] __ubsan_handle_out_of_bounds+0xa6/0xa8
[<ffffffff80acbfa6>] k1_ccu_probe+0x37e/0x420
[<ffffffff80b79e6e>] platform_probe+0x56/0x98
[<ffffffff80b76a7e>] really_probe+0x9e/0x350
[<ffffffff80b76db0>] __driver_probe_device+0x80/0x138
[<ffffffff80b76f52>] driver_probe_device+0x3a/0xd0
[<ffffffff80b771c4>] __driver_attach+0xac/0x1b8
[<ffffffff80b742fc>] bus_for_each_dev+0x6c/0xc8
[<ffffffff80b76296>] driver_attach+0x26/0x38
[<ffffffff80b759ae>] bus_add_driver+0x13e/0x268
[<ffffffff80b7836a>] driver_register+0x52/0x100
[<ffffffff80b79a78>] __platform_driver_register+0x28/0x38
[<ffffffff814585da>] k1_ccu_driver_init+0x22/0x38
[<ffffffff80023a8a>] do_one_initcall+0x62/0x2a0
[<ffffffff81401c60>] do_initcalls+0x170/0x1a8
[<ffffffff81401e7a>] kernel_init_freeable+0x16a/0x1e0
[<ffffffff811f7534>] kernel_init+0x2c/0x180
[<ffffffff80025f56>] ret_from_fork_kernel+0x16/0x1d8
[<ffffffff81205336>] ret_from_fork_kernel_asm+0x16/0x18
---[ end trace ]---
This is bogus and is simply a result of KASAN consulting the
`.num` member of the struct for bounds information (as it should
due to `__counted_by`) and finding 0 set by kzalloc() because it
has not been initialized before the loop that fills in the array.
The easy fix is to just move the line that sets `num` to before
the loop that fills the array so that KASAN has the information
it needs to accurately conclude that the access is valid.
Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC")
Tested-by: Yanko Kaneti <yaneti@declera.com>
Signed-off-by: Charles Mirabile <cmirabil@redhat.com>
Reviewed-by: Alex Elder <elder@riscstar.com>
Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Yixun Lan <dlan@gentoo.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/spacemit/ccu-k1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/spacemit/ccu-k1.c b/drivers/clk/spacemit/ccu-k1.c
index f5a9fe6ba1859..4761bc1e3b6e6 100644
--- a/drivers/clk/spacemit/ccu-k1.c
+++ b/drivers/clk/spacemit/ccu-k1.c
@@ -1018,6 +1018,8 @@ static int spacemit_ccu_register(struct device *dev,
if (!clk_data)
return -ENOMEM;
+ clk_data->num = data->num;
+
for (i = 0; i < data->num; i++) {
struct clk_hw *hw = data->hws[i];
struct ccu_common *common;
@@ -1044,8 +1046,6 @@ static int spacemit_ccu_register(struct device *dev,
clk_data->hws[i] = hw;
}
- clk_data->num = data->num;
-
ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_onecell_get, clk_data);
if (ret)
dev_err(dev, "failed to add clock hardware provider (%d)\n", ret);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 356/614] wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 355/614] clk: spacemit: Set clk_hw_onecell_data::num before using flex array Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 357/614] RAS: Report all ARM processor CPER information to userspace Greg Kroah-Hartman
` (271 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Ping-Ke Shih,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit b647d2574e4583c2e3b0ab35568f60c88e910840 ]
The rtl8187_rx_cb() calculates the rx descriptor header address
by subtracting its size from the skb tail pointer.
However, it does not validate if the received packet
(skb->len from urb->actual_length) is large enough to contain this
header.
If a truncated packet is received, this will lead to a buffer
underflow, reading memory before the start of the skb data area,
and causing a kernel panic.
Add length checks for both rtl8187 and rtl8187b descriptor headers
before attempting to access them, dropping the packet cleanly if the
check fails.
Fixes: 6f7853f3cbe4 ("rtl8187: change rtl8187_dev.c to support RTL8187B (part 2)")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251118013258.1789949-2-eeodqql09@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../wireless/realtek/rtl818x/rtl8187/dev.c | 27 +++++++++++++------
1 file changed, 19 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
index 0c5c66401daa6..7aa2da0cd63cc 100644
--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
@@ -338,14 +338,16 @@ static void rtl8187_rx_cb(struct urb *urb)
spin_unlock_irqrestore(&priv->rx_queue.lock, f);
skb_put(skb, urb->actual_length);
- if (unlikely(urb->status)) {
- dev_kfree_skb_irq(skb);
- return;
- }
+ if (unlikely(urb->status))
+ goto free_skb;
if (!priv->is_rtl8187b) {
- struct rtl8187_rx_hdr *hdr =
- (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
+ struct rtl8187_rx_hdr *hdr;
+
+ if (skb->len < sizeof(struct rtl8187_rx_hdr))
+ goto free_skb;
+
+ hdr = (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
flags = le32_to_cpu(hdr->flags);
/* As with the RTL8187B below, the AGC is used to calculate
* signal strength. In this case, the scaling
@@ -355,8 +357,12 @@ static void rtl8187_rx_cb(struct urb *urb)
rx_status.antenna = (hdr->signal >> 7) & 1;
rx_status.mactime = le64_to_cpu(hdr->mac_time);
} else {
- struct rtl8187b_rx_hdr *hdr =
- (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
+ struct rtl8187b_rx_hdr *hdr;
+
+ if (skb->len < sizeof(struct rtl8187b_rx_hdr))
+ goto free_skb;
+
+ hdr = (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
/* The Realtek datasheet for the RTL8187B shows that the RX
* header contains the following quantities: signal quality,
* RSSI, AGC, the received power in dB, and the measured SNR.
@@ -409,6 +415,11 @@ static void rtl8187_rx_cb(struct urb *urb)
skb_unlink(skb, &priv->rx_queue);
dev_kfree_skb_irq(skb);
}
+ return;
+
+free_skb:
+ dev_kfree_skb_irq(skb);
+ return;
}
static int rtl8187_init_urbs(struct ieee80211_hw *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 357/614] RAS: Report all ARM processor CPER information to userspace
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 356/614] wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 358/614] rtla/tests: Extend action tests to 5s Greg Kroah-Hartman
` (270 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Tian, Shengwei Luo,
Mauro Carvalho Chehab, Jonathan Cameron, Shiju Jose,
Borislav Petkov (AMD), Ard Biesheuvel, Sasha Levin,
Daniel Ferguson
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Tian <jason@os.amperecomputing.com>
[ Upstream commit 05954511b73e748d0370549ad9dd9cd95297d97a ]
The ARM processor CPER record was added in UEFI v2.6 and remained
unchanged up to v2.10.
Yet, the original arm_event trace code added by
e9279e83ad1f ("trace, ras: add ARM processor error trace event")
is incomplete, as it only traces some fields of UAPI 2.6 table N.16, not
exporting any information from tables N.17 to N.29 of the record.
This is not enough for the user to be able to figure out what has
exactly happened or to take appropriate action.
According to the UEFI v2.9 specification chapter N2.4.4, the ARM
processor error section includes:
- several (ERR_INFO_NUM) ARM processor error information structures
(Tables N.17 to N.20);
- several (CONTEXT_INFO_NUM) ARM processor context information
structures (Tables N.21 to N.29);
- several vendor specific error information structures. The
size is given by Section Length minus the size of the other
fields.
In addition, it also exports two fields that are parsed by the GHES
driver when firmware reports it, e.g.:
- error severity
- CPU logical index
Report all of these information to userspace via a the ARM tracepoint so
that userspace can properly record the error and take decisions related
to CPU core isolation according to error severity and other info.
The updated ARM trace event now contains the following fields:
====================================== =============================
UEFI field on table N.16 ARM Processor trace fields
====================================== =============================
Validation handled when filling data for
affinity MPIDR and running
state.
ERR_INFO_NUM pei_len
CONTEXT_INFO_NUM ctx_len
Section Length indirectly reported by
pei_len, ctx_len and oem_len
Error affinity level affinity
MPIDR_EL1 mpidr
MIDR_EL1 midr
Running State running_state
PSCI State psci_state
Processor Error Information Structure pei_err - count at pei_len
Processor Context ctx_err- count at ctx_len
Vendor Specific Error Info oem - count at oem_len
====================================== =============================
It should be noted that decoding of tables N.17 to N.29, if needed, will
be handled in userspace. That gives more flexibility, as there won't be
any need to flood the kernel with micro-architecture specific error
decoding.
Also, decoding the other fields require a complex logic, and should be
done for each of the several values inside the record field. So, let
userspace daemons like rasdaemon decode them, parsing such tables and
having vendor-specific micro-architecture-specific decoders.
[mchehab: modified description, solved merge conflicts and fixed coding style]
Signed-off-by: Jason Tian <jason@os.amperecomputing.com>
Co-developed-by: Shengwei Luo <luoshengwei@huawei.com>
Signed-off-by: Shengwei Luo <luoshengwei@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Daniel Ferguson <danielf@os.amperecomputing.com> # rebased
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Tested-by: Shiju Jose <shiju.jose@huawei.com>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Fixes: e9279e83ad1f ("trace, ras: add ARM processor error trace event")
Link: https://uefi.org/specs/UEFI/2.10/Apx_N_Common_Platform_Error_Record.html#arm-processor-error-section
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 11 ++++-----
drivers/ras/ras.c | 40 ++++++++++++++++++++++++++++++--
include/linux/ras.h | 16 ++++++++++---
include/ras/ras_event.h | 49 ++++++++++++++++++++++++++++++++++++----
4 files changed, 99 insertions(+), 17 deletions(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 97ee19f2cae06..7d2466b515046 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -552,7 +552,7 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,
}
static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
- int sev, bool sync)
+ int sev, bool sync)
{
struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
int flags = sync ? MF_ACTION_REQUIRED : 0;
@@ -560,9 +560,8 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
int sec_sev, i;
char *p;
- log_arm_hw_error(err);
-
sec_sev = ghes_severity(gdata->error_severity);
+ log_arm_hw_error(err, sec_sev);
if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE)
return false;
@@ -895,11 +894,9 @@ static void ghes_do_proc(struct ghes *ghes,
arch_apei_report_mem_error(sev, mem_err);
queued = ghes_handle_memory_failure(gdata, sev, sync);
- }
- else if (guid_equal(sec_type, &CPER_SEC_PCIE)) {
+ } else if (guid_equal(sec_type, &CPER_SEC_PCIE)) {
ghes_handle_aer(gdata);
- }
- else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) {
+ } else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) {
queued = ghes_handle_arm_hw_error(gdata, sev, sync);
} else if (guid_equal(sec_type, &CPER_SEC_CXL_PROT_ERR)) {
struct cxl_cper_sec_prot_err *prot_err = acpi_hest_get_payload(gdata);
diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c
index ac0e132ccc3eb..2a5b5a9fdcb36 100644
--- a/drivers/ras/ras.c
+++ b/drivers/ras/ras.c
@@ -53,9 +53,45 @@ void log_non_standard_event(const guid_t *sec_type, const guid_t *fru_id,
}
EXPORT_SYMBOL_GPL(log_non_standard_event);
-void log_arm_hw_error(struct cper_sec_proc_arm *err)
+void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev)
{
- trace_arm_event(err);
+ struct cper_arm_err_info *err_info;
+ struct cper_arm_ctx_info *ctx_info;
+ u8 *ven_err_data;
+ u32 ctx_len = 0;
+ int n, sz, cpu;
+ s32 vsei_len;
+ u32 pei_len;
+ u8 *pei_err, *ctx_err;
+
+ pei_len = sizeof(struct cper_arm_err_info) * err->err_info_num;
+ pei_err = (u8 *)(err + 1);
+
+ err_info = (struct cper_arm_err_info *)(err + 1);
+ ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num);
+ ctx_err = (u8 *)ctx_info;
+
+ for (n = 0; n < err->context_info_num; n++) {
+ sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size;
+ ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz);
+ ctx_len += sz;
+ }
+
+ vsei_len = err->section_length - (sizeof(struct cper_sec_proc_arm) + pei_len + ctx_len);
+ if (vsei_len < 0) {
+ pr_warn(FW_BUG "section length: %d\n", err->section_length);
+ pr_warn(FW_BUG "section length is too small\n");
+ pr_warn(FW_BUG "firmware-generated error record is incorrect\n");
+ vsei_len = 0;
+ }
+ ven_err_data = (u8 *)ctx_info;
+
+ cpu = GET_LOGICAL_INDEX(err->mpidr);
+ if (cpu < 0)
+ cpu = -1;
+
+ trace_arm_event(err, pei_err, pei_len, ctx_err, ctx_len,
+ ven_err_data, (u32)vsei_len, sev, cpu);
}
static int __init ras_init(void)
diff --git a/include/linux/ras.h b/include/linux/ras.h
index a64182bc72ad3..468941bfe855f 100644
--- a/include/linux/ras.h
+++ b/include/linux/ras.h
@@ -24,8 +24,7 @@ int __init parse_cec_param(char *str);
void log_non_standard_event(const guid_t *sec_type,
const guid_t *fru_id, const char *fru_text,
const u8 sev, const u8 *err, const u32 len);
-void log_arm_hw_error(struct cper_sec_proc_arm *err);
-
+void log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev);
#else
static inline void
log_non_standard_event(const guid_t *sec_type,
@@ -33,7 +32,7 @@ log_non_standard_event(const guid_t *sec_type,
const u8 sev, const u8 *err, const u32 len)
{ return; }
static inline void
-log_arm_hw_error(struct cper_sec_proc_arm *err) { return; }
+log_arm_hw_error(struct cper_sec_proc_arm *err, const u8 sev) { return; }
#endif
struct atl_err {
@@ -53,4 +52,15 @@ static inline unsigned long
amd_convert_umc_mca_addr_to_sys_addr(struct atl_err *err) { return -EINVAL; }
#endif /* CONFIG_AMD_ATL */
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+#include <asm/smp_plat.h>
+/*
+ * Include ARM-specific SMP header which provides a function mapping mpidr to
+ * CPU logical index.
+ */
+#define GET_LOGICAL_INDEX(mpidr) get_logical_index(mpidr & MPIDR_HWID_BITMASK)
+#else
+#define GET_LOGICAL_INDEX(mpidr) -EINVAL
+#endif /* CONFIG_ARM || CONFIG_ARM64 */
+
#endif /* __RAS_H__ */
diff --git a/include/ras/ras_event.h b/include/ras/ras_event.h
index c8cd0f00c8454..c9f0b1018bcce 100644
--- a/include/ras/ras_event.h
+++ b/include/ras/ras_event.h
@@ -168,11 +168,25 @@ TRACE_EVENT(mc_event,
* This event is generated when hardware detects an ARM processor error
* has occurred. UEFI 2.6 spec section N.2.4.4.
*/
+#define APEIL "ARM Processor Err Info data len"
+#define APEID "ARM Processor Err Info raw data"
+#define APECIL "ARM Processor Err Context Info data len"
+#define APECID "ARM Processor Err Context Info raw data"
+#define VSEIL "Vendor Specific Err Info data len"
+#define VSEID "Vendor Specific Err Info raw data"
TRACE_EVENT(arm_event,
- TP_PROTO(const struct cper_sec_proc_arm *proc),
+ TP_PROTO(const struct cper_sec_proc_arm *proc,
+ const u8 *pei_err,
+ const u32 pei_len,
+ const u8 *ctx_err,
+ const u32 ctx_len,
+ const u8 *oem,
+ const u32 oem_len,
+ u8 sev,
+ int cpu),
- TP_ARGS(proc),
+ TP_ARGS(proc, pei_err, pei_len, ctx_err, ctx_len, oem, oem_len, sev, cpu),
TP_STRUCT__entry(
__field(u64, mpidr)
@@ -180,6 +194,14 @@ TRACE_EVENT(arm_event,
__field(u32, running_state)
__field(u32, psci_state)
__field(u8, affinity)
+ __field(u32, pei_len)
+ __dynamic_array(u8, pei_buf, pei_len)
+ __field(u32, ctx_len)
+ __dynamic_array(u8, ctx_buf, ctx_len)
+ __field(u32, oem_len)
+ __dynamic_array(u8, oem_buf, oem_len)
+ __field(u8, sev)
+ __field(int, cpu)
),
TP_fast_assign(
@@ -199,12 +221,29 @@ TRACE_EVENT(arm_event,
__entry->running_state = ~0;
__entry->psci_state = ~0;
}
+ __entry->pei_len = pei_len;
+ memcpy(__get_dynamic_array(pei_buf), pei_err, pei_len);
+ __entry->ctx_len = ctx_len;
+ memcpy(__get_dynamic_array(ctx_buf), ctx_err, ctx_len);
+ __entry->oem_len = oem_len;
+ memcpy(__get_dynamic_array(oem_buf), oem, oem_len);
+ __entry->sev = sev;
+ __entry->cpu = cpu;
),
- TP_printk("affinity level: %d; MPIDR: %016llx; MIDR: %016llx; "
- "running state: %d; PSCI state: %d",
+ TP_printk("cpu: %d; error: %d; affinity level: %d; MPIDR: %016llx; MIDR: %016llx; "
+ "running state: %d; PSCI state: %d; "
+ "%s: %d; %s: %s; %s: %d; %s: %s; %s: %d; %s: %s",
+ __entry->cpu,
+ __entry->sev,
__entry->affinity, __entry->mpidr, __entry->midr,
- __entry->running_state, __entry->psci_state)
+ __entry->running_state, __entry->psci_state,
+ APEIL, __entry->pei_len, APEID,
+ __print_hex(__get_dynamic_array(pei_buf), __entry->pei_len),
+ APECIL, __entry->ctx_len, APECID,
+ __print_hex(__get_dynamic_array(ctx_buf), __entry->ctx_len),
+ VSEIL, __entry->oem_len, VSEID,
+ __print_hex(__get_dynamic_array(oem_buf), __entry->oem_len))
);
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 358/614] rtla/tests: Extend action tests to 5s
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 357/614] RAS: Report all ARM processor CPER information to userspace Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 359/614] rtla/tests: Fix osnoise test calling timerlat Greg Kroah-Hartman
` (269 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wander Lairson Costa, Tomas Glozar,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
[ Upstream commit d649e9f04cb0224817dac8190461ef1674e32b37 ]
In non-BPF mode, it takes up to 1 second for RTLA to notice that tracing
has been stopped. That means that action tests cannot have a 1 second
duration, as the SIGALRM will be racing with the threshold overflow.
Previously, non-BPF mode actions were buggy and always executed
the action, even when stopping on duration or SIGINT, preventing
this issue from manifesting. Now that this has been fixed, the tests
have become flaky, and this has to be adjusted.
Fixes: 4e26f84abfbb ("rtla/tests: Add tests for actions")
Fixes: 05b7e10687c6 ("tools/rtla: Add remaining support for osnoise actions")
Reviewed-by: Wander Lairson Costa <wander@redhat.com>
Link: https://lore.kernel.org/r/20251007095341.186923-2-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/rtla/tests/osnoise.t | 4 ++--
tools/tracing/rtla/tests/timerlat.t | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/tracing/rtla/tests/osnoise.t b/tools/tracing/rtla/tests/osnoise.t
index e3c89d45a6bb0..08196443fef16 100644
--- a/tools/tracing/rtla/tests/osnoise.t
+++ b/tools/tracing/rtla/tests/osnoise.t
@@ -39,9 +39,9 @@ check "hist stop at failed action" \
check "top stop at failed action" \
"timerlat top -T 2 --on-threshold shell,command='echo -n abc; false' --on-threshold shell,command='echo -n defgh'" 2 "^abc" "defgh"
check "hist with continue" \
- "osnoise hist -S 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
+ "osnoise hist -S 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
check "top with continue" \
- "osnoise top -q -S 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
+ "osnoise top -q -S 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
check "hist with trace output at end" \
"osnoise hist -d 1s --on-end trace" 0 "^ Saving trace to osnoise_trace.txt$"
check "top with trace output at end" \
diff --git a/tools/tracing/rtla/tests/timerlat.t b/tools/tracing/rtla/tests/timerlat.t
index b5d1e7260a9be..b550a6ae24456 100644
--- a/tools/tracing/rtla/tests/timerlat.t
+++ b/tools/tracing/rtla/tests/timerlat.t
@@ -60,9 +60,9 @@ check "hist stop at failed action" \
check "top stop at failed action" \
"timerlat top -T 2 --on-threshold shell,command='echo -n 1; false' --on-threshold shell,command='echo -n 2'" 2 "^1ALL"
check "hist with continue" \
- "timerlat hist -T 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
+ "timerlat hist -T 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
check "top with continue" \
- "timerlat top -q -T 2 -d 1s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
+ "timerlat top -q -T 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
check "hist with trace output at end" \
"timerlat hist -d 1s --on-end trace" 0 "^ Saving trace to timerlat_trace.txt$"
check "top with trace output at end" \
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 359/614] rtla/tests: Fix osnoise test calling timerlat
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 358/614] rtla/tests: Extend action tests to 5s Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 360/614] rtla: Fix -a overriding -t argument Greg Kroah-Hartman
` (268 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wander Lairson Costa, Tomas Glozar,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
[ Upstream commit 34c170ae5c3036ef879567a37409a2859e327342 ]
osnoise test "top stop at failed action" is calling timerlat instead of
osnoise by mistake.
Fix it so that it calls the correct RTLA subcommand.
Fixes: 05b7e10687c6 ("tools/rtla: Add remaining support for osnoise actions")
Reviewed-by: Wander Lairson Costa <wander@redhat.com>
Link: https://lore.kernel.org/r/20251007095341.186923-3-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/rtla/tests/osnoise.t | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/tracing/rtla/tests/osnoise.t b/tools/tracing/rtla/tests/osnoise.t
index 08196443fef16..3963346089207 100644
--- a/tools/tracing/rtla/tests/osnoise.t
+++ b/tools/tracing/rtla/tests/osnoise.t
@@ -37,7 +37,7 @@ check "multiple actions" \
check "hist stop at failed action" \
"osnoise hist -S 2 --on-threshold shell,command='echo -n 1; false' --on-threshold shell,command='echo -n 2'" 2 "^1# RTLA osnoise histogram$"
check "top stop at failed action" \
- "timerlat top -T 2 --on-threshold shell,command='echo -n abc; false' --on-threshold shell,command='echo -n defgh'" 2 "^abc" "defgh"
+ "osnoise top -S 2 --on-threshold shell,command='echo -n abc; false' --on-threshold shell,command='echo -n defgh'" 2 "^abc" "defgh"
check "hist with continue" \
"osnoise hist -S 2 -d 5s --on-threshold shell,command='echo TestOutput' --on-threshold continue" 0 "^TestOutput$"
check "top with continue" \
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 360/614] rtla: Fix -a overriding -t argument
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 359/614] rtla/tests: Fix osnoise test calling timerlat Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 361/614] ima: Handle error code returned by ima_filter_rule_match() Greg Kroah-Hartman
` (267 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ivan Pravdin, Tomas Glozar,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <ipravdin.official@gmail.com>
[ Upstream commit ddb6e42494e5c48c17e64f29b7674b9add486a19 ]
When running rtla as
`rtla <timerlat|osnoise> <top|hist> -t custom_file.txt -a 100`
-a options override trace output filename specified by -t option.
Running the command above will create <timerlat|osnoise>_trace.txt file
instead of custom_file.txt. Fix this by making sure that -a option does
not override trace output filename even if it's passed after trace
output filename is specified.
Fixes: 173a3b014827 ("rtla/timerlat: Add the automatic trace option")
Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
Reviewed-by: Tomas Glozar <tglozar@redhat.com>
Link: https://lore.kernel.org/r/b6ae60424050b2c1c8709e18759adead6012b971.1762186418.git.ipravdin.official@gmail.com
[ use capital letter in subject, as required by tracing subsystem ]
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/tracing/rtla/src/osnoise_hist.c | 3 ++-
tools/tracing/rtla/src/osnoise_top.c | 3 ++-
tools/tracing/rtla/src/timerlat_hist.c | 3 ++-
tools/tracing/rtla/src/timerlat_top.c | 3 ++-
4 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/tools/tracing/rtla/src/osnoise_hist.c b/tools/tracing/rtla/src/osnoise_hist.c
index dffb6d0a98d7d..d22feb4d6cc9d 100644
--- a/tools/tracing/rtla/src/osnoise_hist.c
+++ b/tools/tracing/rtla/src/osnoise_hist.c
@@ -557,7 +557,8 @@ static struct common_params
params->threshold = 1;
/* set trace */
- trace_output = "osnoise_trace.txt";
+ if (!trace_output)
+ trace_output = "osnoise_trace.txt";
break;
case 'b':
diff --git a/tools/tracing/rtla/src/osnoise_top.c b/tools/tracing/rtla/src/osnoise_top.c
index 95418f7ecc961..a8d31030c4122 100644
--- a/tools/tracing/rtla/src/osnoise_top.c
+++ b/tools/tracing/rtla/src/osnoise_top.c
@@ -397,7 +397,8 @@ struct common_params *osnoise_top_parse_args(int argc, char **argv)
params->threshold = 1;
/* set trace */
- trace_output = "osnoise_trace.txt";
+ if (!trace_output)
+ trace_output = "osnoise_trace.txt";
break;
case 'c':
diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c
index 606c1688057b2..3d56df3d5fa0d 100644
--- a/tools/tracing/rtla/src/timerlat_hist.c
+++ b/tools/tracing/rtla/src/timerlat_hist.c
@@ -878,7 +878,8 @@ static struct common_params
params->print_stack = auto_thresh;
/* set trace */
- trace_output = "timerlat_trace.txt";
+ if (!trace_output)
+ trace_output = "timerlat_trace.txt";
break;
case 'c':
diff --git a/tools/tracing/rtla/src/timerlat_top.c b/tools/tracing/rtla/src/timerlat_top.c
index fc479a0dcb597..6cc9a3607c665 100644
--- a/tools/tracing/rtla/src/timerlat_top.c
+++ b/tools/tracing/rtla/src/timerlat_top.c
@@ -628,7 +628,8 @@ static struct common_params
params->print_stack = auto_thresh;
/* set trace */
- trace_output = "timerlat_trace.txt";
+ if (!trace_output)
+ trace_output = "timerlat_trace.txt";
break;
case '5':
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 361/614] ima: Handle error code returned by ima_filter_rule_match()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 360/614] rtla: Fix -a overriding -t argument Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 362/614] usb: chaoskey: fix locking for O_NONBLOCK Greg Kroah-Hartman
` (266 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhao Yipeng, Roberto Sassu,
Mimi Zohar, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Yipeng <zhaoyipeng5@huawei.com>
[ Upstream commit 738c9738e690f5cea24a3ad6fd2d9a323cf614f6 ]
In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to
the rule being NULL, the function incorrectly skips the 'if (!rc)' check
and sets 'result = true'. The LSM rule is considered a match, causing
extra files to be measured by IMA.
This issue can be reproduced in the following scenario:
After unloading the SELinux policy module via 'semodule -d', if an IMA
measurement is triggered before ima_lsm_rules is updated,
in ima_match_rules(), the first call to ima_filter_rule_match() returns
-ESTALE. This causes the code to enter the 'if (rc == -ESTALE &&
!rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In
ima_lsm_copy_rule(), since the SELinux module has been removed, the rule
becomes NULL, and the second call to ima_filter_rule_match() returns
-ENOENT. This bypasses the 'if (!rc)' check and results in a false match.
Call trace:
selinux_audit_rule_match+0x310/0x3b8
security_audit_rule_match+0x60/0xa0
ima_match_rules+0x2e4/0x4a0
ima_match_policy+0x9c/0x1e8
ima_get_action+0x48/0x60
process_measurement+0xf8/0xa98
ima_bprm_check+0x98/0xd8
security_bprm_check+0x5c/0x78
search_binary_handler+0x6c/0x318
exec_binprm+0x58/0x1b8
bprm_execve+0xb8/0x130
do_execveat_common.isra.0+0x1a8/0x258
__arm64_sys_execve+0x48/0x68
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x44/0x200
el0t_64_sync_handler+0x100/0x130
el0t_64_sync+0x3c8/0x3d0
Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error
codes like -ENOENT do not bypass the check and accidentally result in a
successful match.
Fixes: 4af4662fa4a9d ("integrity: IMA policy")
Signed-off-by: Zhao Yipeng <zhaoyipeng5@huawei.com>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/ima/ima_policy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 128fab8979308..db6d55af5a80b 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -674,7 +674,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
goto retry;
}
}
- if (!rc) {
+ if (rc <= 0) {
result = false;
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 362/614] usb: chaoskey: fix locking for O_NONBLOCK
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 361/614] ima: Handle error code returned by ima_filter_rule_match() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 363/614] usb: dwc2: fix hang during shutdown if set as peripheral Greg Kroah-Hartman
` (265 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit a2fa8a12e6bc9d89c0505b8dd7ae38ec173d25de ]
A failure to take a lock with O_NONBLOCK needs to result
in -EAGAIN. Change it.
Fixes: 66e3e591891da ("usb: Add driver for Altus Metrum ChaosKey device (v2)")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20251030093918.2248104-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/misc/chaoskey.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
index 225863321dc47..45cff32656c6e 100644
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -444,9 +444,19 @@ static ssize_t chaoskey_read(struct file *file,
goto bail;
mutex_unlock(&dev->rng_lock);
- result = mutex_lock_interruptible(&dev->lock);
- if (result)
- goto bail;
+ if (file->f_flags & O_NONBLOCK) {
+ result = mutex_trylock(&dev->lock);
+ if (result == 0) {
+ result = -EAGAIN;
+ goto bail;
+ } else {
+ result = 0;
+ }
+ } else {
+ result = mutex_lock_interruptible(&dev->lock);
+ if (result)
+ goto bail;
+ }
if (dev->valid == dev->used) {
result = _chaoskey_fill(dev);
if (result < 0) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 363/614] usb: dwc2: fix hang during shutdown if set as peripheral
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 362/614] usb: chaoskey: fix locking for O_NONBLOCK Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 364/614] usb: dwc2: fix hang during suspend " Greg Kroah-Hartman
` (264 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jisheng Zhang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <jszhang@kernel.org>
[ Upstream commit b6ebcfdcac40a27953f052e4269ce75a18825ffc ]
dwc2 on most platforms needs phy controller, clock and power supply.
All of them must be enabled/activated to properly operate. If dwc2
is configured as peripheral mode, then all the above three hardware
resources are disabled at the end of the probe:
/* Gadget code manages lowlevel hw on its own */
if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
dwc2_lowlevel_hw_disable(hsotg);
But dwc2_driver_shutdown() tries to disable the interrupts on HW IP
level. This would result in hang during shutdown if dwc2 is configured
as peripheral mode.
Fix this hang by only disable and sync irq when lowlevel hw is enabled.
Fixes: 4fdf228cdf69 ("usb: dwc2: Fix shutdown callback in platform")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20251104002503.17158-2-jszhang@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/platform.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index 3f83ecc9fc236..b07bdf16326a4 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -369,11 +369,11 @@ static void dwc2_driver_shutdown(struct platform_device *dev)
{
struct dwc2_hsotg *hsotg = platform_get_drvdata(dev);
- dwc2_disable_global_interrupts(hsotg);
- synchronize_irq(hsotg->irq);
-
- if (hsotg->ll_hw_enabled)
+ if (hsotg->ll_hw_enabled) {
+ dwc2_disable_global_interrupts(hsotg);
+ synchronize_irq(hsotg->irq);
dwc2_lowlevel_hw_disable(hsotg);
+ }
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 364/614] usb: dwc2: fix hang during suspend if set as peripheral
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 363/614] usb: dwc2: fix hang during shutdown if set as peripheral Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 365/614] usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Greg Kroah-Hartman
` (263 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jisheng Zhang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <jszhang@kernel.org>
[ Upstream commit 2b94b054ac4974ad2f89f7f7461840c851933adb ]
dwc2 on most platforms needs phy controller, clock and power supply.
All of them must be enabled/activated to properly operate. If dwc2
is configured as peripheral mode, then all the above three hardware
resources are disabled at the end of the probe:
/* Gadget code manages lowlevel hw on its own */
if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL)
dwc2_lowlevel_hw_disable(hsotg);
But the dwc2_suspend() tries to read the dwc2's reg to check whether
is_device_mode or not, this would result in hang during suspend if dwc2
is configured as peripheral mode.
Fix this hang by bypassing suspend/resume if lowlevel hw isn't
enabled.
Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platform.c")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20251104002503.17158-3-jszhang@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/dwc2/platform.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index b07bdf16326a4..ef0d730770347 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -649,9 +649,13 @@ static int dwc2_driver_probe(struct platform_device *dev)
static int __maybe_unused dwc2_suspend(struct device *dev)
{
struct dwc2_hsotg *dwc2 = dev_get_drvdata(dev);
- bool is_device_mode = dwc2_is_device_mode(dwc2);
+ bool is_device_mode;
int ret = 0;
+ if (!dwc2->ll_hw_enabled)
+ return 0;
+
+ is_device_mode = dwc2_is_device_mode(dwc2);
if (is_device_mode)
dwc2_hsotg_suspend(dwc2);
@@ -728,6 +732,9 @@ static int __maybe_unused dwc2_resume(struct device *dev)
struct dwc2_hsotg *dwc2 = dev_get_drvdata(dev);
int ret = 0;
+ if (!dwc2->ll_hw_enabled)
+ return 0;
+
if (dwc2->phy_off_for_suspend && dwc2->ll_hw_enabled) {
ret = __dwc2_lowlevel_hw_enable(dwc2);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 365/614] usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 364/614] usb: dwc2: fix hang during suspend " Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 366/614] regulator: pca9450: Fix error code in probe() Greg Kroah-Hartman
` (262 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d8fd35fa6177afa8c92b,
Gopi Krishna Menon, Andrey Konovalov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gopi Krishna Menon <krishnagopi487@gmail.com>
[ Upstream commit a5160af78be7fcf3ade6caab0a14e349560c96d7 ]
The previous commit removed the PAGE_SIZE limit on transfer length of
raw_io buffer in order to avoid any problems with emulating USB devices
whose full configuration descriptor exceeds PAGE_SIZE in length. However
this also removes the upperbound on user supplied length, allowing very
large values to be passed to the allocator.
syzbot on fuzzing the transfer length with very large value (1.81GB)
results in kmalloc() to fall back to the page allocator, which triggers
a kernel warning as the page allocator cannot handle allocations more
than MAX_PAGE_ORDER/KMALLOC_MAX_SIZE.
Since there is no limit imposed on the size of buffer for both control
and non control transfers, cap the raw_io transfer length to
KMALLOC_MAX_SIZE and return -EINVAL for larger transfer length to
prevent any warnings from the page allocator.
Fixes: 37b9dd0d114a ("usb: raw-gadget: do not limit transfer length")
Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68fc07a0.a70a0220.3bf6c6.01ab.GAE@google.com/
Signed-off-by: Gopi Krishna Menon <krishnagopi487@gmail.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://patch.msgid.link/20251028165659.50962-1-krishnagopi487@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/legacy/raw_gadget.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6c..46f343ba48b3d 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -40,6 +40,7 @@ MODULE_LICENSE("GPL");
static DEFINE_IDA(driver_id_numbers);
#define DRIVER_DRIVER_NAME_LENGTH_MAX 32
+#define USB_RAW_IO_LENGTH_MAX KMALLOC_MAX_SIZE
#define RAW_EVENT_QUEUE_SIZE 16
@@ -667,6 +668,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
return ERR_PTR(-EINVAL);
if (!usb_raw_io_flags_valid(io->flags))
return ERR_PTR(-EINVAL);
+ if (io->length > USB_RAW_IO_LENGTH_MAX)
+ return ERR_PTR(-EINVAL);
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 366/614] regulator: pca9450: Fix error code in probe()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 365/614] usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 367/614] selftests/bpf: skip test_perf_branches_hw() on unsupported platforms Greg Kroah-Hartman
` (261 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 670500b41e543c5cb09eb9f7f0e4e26c5b5fdf7e ]
Return "PTR_ERR(pca9450->sd_vsel_gpio)" instead of "ret". The "ret"
variable is success at this point.
Fixes: 3ce6f4f943dd ("regulator: pca9450: Fix control register for LDO5")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aSBqnPoBrsNB1Ale@stanley.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/pca9450-regulator.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/regulator/pca9450-regulator.c b/drivers/regulator/pca9450-regulator.c
index 4be270f4d6c35..91b96dbab328b 100644
--- a/drivers/regulator/pca9450-regulator.c
+++ b/drivers/regulator/pca9450-regulator.c
@@ -1251,10 +1251,9 @@ static int pca9450_i2c_probe(struct i2c_client *i2c)
* to this signal (if SION bit is set in IOMUX).
*/
pca9450->sd_vsel_gpio = gpiod_get_optional(&ldo5->dev, "sd-vsel", GPIOD_IN);
- if (IS_ERR(pca9450->sd_vsel_gpio)) {
- dev_err(&i2c->dev, "Failed to get SD_VSEL GPIO\n");
- return ret;
- }
+ if (IS_ERR(pca9450->sd_vsel_gpio))
+ return dev_err_probe(&i2c->dev, PTR_ERR(pca9450->sd_vsel_gpio),
+ "Failed to get SD_VSEL GPIO\n");
pca9450->sd_vsel_fixed_low =
of_property_read_bool(ldo5->dev.of_node, "nxp,sd-vsel-fixed-low");
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 367/614] selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 366/614] regulator: pca9450: Fix error code in probe() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 368/614] selftests/bpf: Improve reliability of test_perf_branches_no_hw() Greg Kroah-Hartman
` (260 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Bobrowski, Song Liu,
Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <mattbobrowski@google.com>
[ Upstream commit 27746aaf1b20172f0859546c4a3e82eca459f680 ]
Gracefully skip the test_perf_branches_hw subtest on platforms that
do not support LBR or require specialized perf event attributes
to enable branch sampling.
For example, AMD's Milan (Zen 3) supports BRS rather than traditional
LBR. This requires specific configurations (attr.type = PERF_TYPE_RAW,
attr.config = RETIRED_TAKEN_BRANCH_INSTRUCTIONS) that differ from the
generic setup used within this test. Notably, it also probably doesn't
hold much value to special case perf event configurations for selected
micro architectures.
Fixes: 67306f84ca78c ("selftests/bpf: Add bpf_read_branch_records() selftest")
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20251120142059.2836181-1-mattbobrowski@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/perf_branches.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/perf_branches.c b/tools/testing/selftests/bpf/prog_tests/perf_branches.c
index bc24f83339d64..06c7986131d96 100644
--- a/tools/testing/selftests/bpf/prog_tests/perf_branches.c
+++ b/tools/testing/selftests/bpf/prog_tests/perf_branches.c
@@ -116,11 +116,11 @@ static void test_perf_branches_hw(void)
pfd = syscall(__NR_perf_event_open, &attr, -1, 0, -1, PERF_FLAG_FD_CLOEXEC);
/*
- * Some setups don't support branch records (virtual machines, !x86),
- * so skip test in this case.
+ * Some setups don't support LBR (virtual machines, !x86, AMD Milan Zen
+ * 3 which only supports BRS), so skip test in this case.
*/
if (pfd < 0) {
- if (errno == ENOENT || errno == EOPNOTSUPP) {
+ if (errno == ENOENT || errno == EOPNOTSUPP || errno == EINVAL) {
printf("%s:SKIP:no PERF_SAMPLE_BRANCH_STACK\n",
__func__);
test__skip();
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 368/614] selftests/bpf: Improve reliability of test_perf_branches_no_hw()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 367/614] selftests/bpf: skip test_perf_branches_hw() on unsupported platforms Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 369/614] selftests/bpf: Update test_tag to use sha256 Greg Kroah-Hartman
` (259 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Bobrowski, Jiri Olsa,
Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Bobrowski <mattbobrowski@google.com>
[ Upstream commit ae24fc8a16b0481ea8c5acbc66453c49ec0431c4 ]
Currently, test_perf_branches_no_hw() relies on the busy loop within
test_perf_branches_common() being slow enough to allow at least one
perf event sample tick to occur before starting to tear down the
backing perf event BPF program. With a relatively small fixed
iteration count of 1,000,000, this is not guaranteed on modern fast
CPUs, resulting in the test run to subsequently fail with the
following:
bpf_testmod.ko is already unloaded.
Loading bpf_testmod.ko...
Successfully loaded bpf_testmod.ko.
test_perf_branches_common:PASS:test_perf_branches_load 0 nsec
test_perf_branches_common:PASS:attach_perf_event 0 nsec
test_perf_branches_common:PASS:set_affinity 0 nsec
check_good_sample:PASS:output not valid 0 nsec
check_good_sample:PASS:read_branches_size 0 nsec
check_good_sample:PASS:read_branches_stack 0 nsec
check_good_sample:PASS:read_branches_stack 0 nsec
check_good_sample:PASS:read_branches_global 0 nsec
check_good_sample:PASS:read_branches_global 0 nsec
check_good_sample:PASS:read_branches_size 0 nsec
test_perf_branches_no_hw:PASS:perf_event_open 0 nsec
test_perf_branches_common:PASS:test_perf_branches_load 0 nsec
test_perf_branches_common:PASS:attach_perf_event 0 nsec
test_perf_branches_common:PASS:set_affinity 0 nsec
check_bad_sample:FAIL:output not valid no valid sample from prog
Summary: 0/1 PASSED, 0 SKIPPED, 1 FAILED
Successfully unloaded bpf_testmod.ko.
On a modern CPU (i.e. one with a 3.5 GHz clock rate), executing 1
million increments of a volatile integer can take significantly less
than 1 millisecond. If the spin loop and detachment of the perf event
BPF program elapses before the first 1 ms sampling interval elapses,
the perf event will never end up firing. Fix this by bumping the loop
iteration counter a little within test_perf_branches_common(), along
with ensuring adding another loop termination condition which is
directly influenced by the backing perf event BPF program
executing. Notably, a concious decision was made to not adjust the
sample_freq value as that is just not a reliable way to go about
fixing the problem. It effectively still leaves the race window open.
Fixes: 67306f84ca78c ("selftests/bpf: Add bpf_read_branch_records() selftest")
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20251119143540.2911424-1-mattbobrowski@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/bpf/prog_tests/perf_branches.c | 16 ++++++++++++++--
.../selftests/bpf/progs/test_perf_branches.c | 3 +++
2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/perf_branches.c b/tools/testing/selftests/bpf/prog_tests/perf_branches.c
index 06c7986131d96..0a7ef770c487c 100644
--- a/tools/testing/selftests/bpf/prog_tests/perf_branches.c
+++ b/tools/testing/selftests/bpf/prog_tests/perf_branches.c
@@ -15,6 +15,10 @@ static void check_good_sample(struct test_perf_branches *skel)
int pbe_size = sizeof(struct perf_branch_entry);
int duration = 0;
+ if (CHECK(!skel->bss->run_cnt, "invalid run_cnt",
+ "checked sample validity before prog run"))
+ return;
+
if (CHECK(!skel->bss->valid, "output not valid",
"no valid sample from prog"))
return;
@@ -45,6 +49,10 @@ static void check_bad_sample(struct test_perf_branches *skel)
int written_stack = skel->bss->written_stack_out;
int duration = 0;
+ if (CHECK(!skel->bss->run_cnt, "invalid run_cnt",
+ "checked sample validity before prog run"))
+ return;
+
if (CHECK(!skel->bss->valid, "output not valid",
"no valid sample from prog"))
return;
@@ -83,8 +91,12 @@ static void test_perf_branches_common(int perf_fd,
err = pthread_setaffinity_np(pthread_self(), sizeof(cpu_set), &cpu_set);
if (CHECK(err, "set_affinity", "cpu #0, err %d\n", err))
goto out_destroy;
- /* spin the loop for a while (random high number) */
- for (i = 0; i < 1000000; ++i)
+
+ /* Spin the loop for a while by using a high iteration count, and by
+ * checking whether the specific run count marker has been explicitly
+ * incremented at least once by the backing perf_event BPF program.
+ */
+ for (i = 0; i < 100000000 && !*(volatile int *)&skel->bss->run_cnt; ++i)
++j;
test_perf_branches__detach(skel);
diff --git a/tools/testing/selftests/bpf/progs/test_perf_branches.c b/tools/testing/selftests/bpf/progs/test_perf_branches.c
index a1ccc831c882f..05ac9410cd68c 100644
--- a/tools/testing/selftests/bpf/progs/test_perf_branches.c
+++ b/tools/testing/selftests/bpf/progs/test_perf_branches.c
@@ -8,6 +8,7 @@
#include <bpf/bpf_tracing.h>
int valid = 0;
+int run_cnt = 0;
int required_size_out = 0;
int written_stack_out = 0;
int written_global_out = 0;
@@ -24,6 +25,8 @@ int perf_branches(void *ctx)
__u64 entries[4 * 3] = {0};
int required_size, written_stack, written_global;
+ ++run_cnt;
+
/* write to stack */
written_stack = bpf_read_branch_records(ctx, entries, sizeof(entries), 0);
/* ignore spurious events */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 369/614] selftests/bpf: Update test_tag to use sha256
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 368/614] selftests/bpf: Improve reliability of test_perf_branches_no_hw() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 370/614] bpf: properly verify tail call behavior Greg Kroah-Hartman
` (258 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xing Guo, Alexei Starovoitov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xing Guo <higuoxing@gmail.com>
[ Upstream commit b7f7d76d6e354a5acc711da37cb2829ccf40558f ]
commit 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use SHA256")
changed digest of prog_tag to SHA256 but forgot to update tests
correspondingly. Fix it.
Fixes: 603b44162325 ("bpf: Update the bpf_prog_calc_tag to use SHA256")
Signed-off-by: Xing Guo <higuoxing@gmail.com>
Link: https://lore.kernel.org/r/20251121061458.3145167-1-higuoxing@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_tag.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_tag.c b/tools/testing/selftests/bpf/test_tag.c
index 5546b05a04866..f1300047c1e0a 100644
--- a/tools/testing/selftests/bpf/test_tag.c
+++ b/tools/testing/selftests/bpf/test_tag.c
@@ -116,7 +116,7 @@ static void tag_from_alg(int insns, uint8_t *tag, uint32_t len)
static const struct sockaddr_alg alg = {
.salg_family = AF_ALG,
.salg_type = "hash",
- .salg_name = "sha1",
+ .salg_name = "sha256",
};
int fd_base, fd_alg, ret;
ssize_t size;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 370/614] bpf: properly verify tail call behavior
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 369/614] selftests/bpf: Update test_tag to use sha256 Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 371/614] crypto: starfive - Correctly handle return of sg_nents_for_len Greg Kroah-Hartman
` (257 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Teichmann, Eduard Zingerman,
Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Teichmann <martin.teichmann@xfel.eu>
[ Upstream commit e3245f8990431950d20631c72236d4e8cb2dcde8 ]
A successful ebpf tail call does not return to the caller, but to the
caller-of-the-caller, often just finishing the ebpf program altogether.
Any restrictions that the verifier needs to take into account - notably
the fact that the tail call might have modified packet pointers - are to
be checked on the caller-of-the-caller. Checking it on the caller made
the verifier refuse perfectly fine programs that would use the packet
pointers after a tail call, which is no problem as this code is only
executed if the tail call was unsuccessful, i.e. nothing happened.
This patch simulates the behavior of a tail call in the verifier. A
conditional jump to the code after the tail call is added for the case
of an unsucessful tail call, and a return to the caller is simulated for
a successful tail call.
For the successful case we assume that the tail call returns an int,
as tail calls are currently only allowed in functions that return and
int. We always assume that the tail call modified the packet pointers,
as we do not know what the tail call did.
For the unsuccessful case we know nothing happened, so we do not need to
add new constraints.
This approach also allows to check other problems that may occur with
tail calls, namely we are now able to check that precision is properly
propagated into subprograms using tail calls, as well as checking the
live slots in such a subprogram.
Fixes: 1a4607ffba35 ("bpf: consider that tail calls invalidate packet pointers")
Link: https://lore.kernel.org/bpf/20251029105828.1488347-1-martin.teichmann@xfel.eu/
Signed-off-by: Martin Teichmann <martin.teichmann@xfel.eu>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251119160355.1160932-2-martin.teichmann@xfel.eu
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 31 ++++++++++++++++++++++++++++---
1 file changed, 28 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 52c01c011c6fb..89560e455ce7b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4408,6 +4408,11 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx,
bt_reg_mask(bt));
return -EFAULT;
}
+ if (insn->src_reg == BPF_REG_0 && insn->imm == BPF_FUNC_tail_call
+ && subseq_idx - idx != 1) {
+ if (bt_subprog_enter(bt))
+ return -EFAULT;
+ }
} else if (opcode == BPF_EXIT) {
bool r0_precise;
@@ -10995,6 +11000,10 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
bool in_callback_fn;
int err;
+ err = bpf_update_live_stack(env);
+ if (err)
+ return err;
+
callee = state->frame[state->curframe];
r0 = &callee->regs[BPF_REG_0];
if (r0->type == PTR_TO_STACK) {
@@ -11912,6 +11921,25 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
env->prog->call_get_func_ip = true;
}
+ if (func_id == BPF_FUNC_tail_call) {
+ if (env->cur_state->curframe) {
+ struct bpf_verifier_state *branch;
+
+ mark_reg_scratched(env, BPF_REG_0);
+ branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false);
+ if (IS_ERR(branch))
+ return PTR_ERR(branch);
+ clear_all_pkt_pointers(env);
+ mark_reg_unknown(env, regs, BPF_REG_0);
+ err = prepare_func_exit(env, &env->insn_idx);
+ if (err)
+ return err;
+ env->insn_idx--;
+ } else {
+ changes_data = false;
+ }
+ }
+
if (changes_data)
clear_all_pkt_pointers(env);
return 0;
@@ -19810,9 +19838,6 @@ static int process_bpf_exit_full(struct bpf_verifier_env *env,
return PROCESS_BPF_EXIT;
if (env->cur_state->curframe) {
- err = bpf_update_live_stack(env);
- if (err)
- return err;
/* exit from nested function */
err = prepare_func_exit(env, &env->insn_idx);
if (err)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 371/614] crypto: starfive - Correctly handle return of sg_nents_for_len
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 370/614] bpf: properly verify tail call behavior Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 372/614] crypto: ccree " Greg Kroah-Hartman
` (256 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit e9eb52037a529fbb307c290e9951a62dd728b03d ]
The return value of sg_nents_for_len was assigned to an unsigned long
in starfive_hash_digest, causing negative error codes to be converted
to large positive integers.
Add error checking for sg_nents_for_len and return immediately on
failure to prevent potential buffer overflows.
Fixes: 7883d1b28a2b ("crypto: starfive - Add hash and HMAC support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/starfive/jh7110-hash.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/starfive/jh7110-hash.c b/drivers/crypto/starfive/jh7110-hash.c
index e6839c7bfb73a..54b7af4a7aee8 100644
--- a/drivers/crypto/starfive/jh7110-hash.c
+++ b/drivers/crypto/starfive/jh7110-hash.c
@@ -325,6 +325,7 @@ static int starfive_hash_digest(struct ahash_request *req)
struct starfive_cryp_ctx *ctx = crypto_ahash_ctx(tfm);
struct starfive_cryp_request_ctx *rctx = ahash_request_ctx(req);
struct starfive_cryp_dev *cryp = ctx->cryp;
+ int sg_len;
memset(rctx, 0, sizeof(struct starfive_cryp_request_ctx));
@@ -333,7 +334,10 @@ static int starfive_hash_digest(struct ahash_request *req)
rctx->in_sg = req->src;
rctx->blksize = crypto_tfm_alg_blocksize(crypto_ahash_tfm(tfm));
rctx->digsize = crypto_ahash_digestsize(tfm);
- rctx->in_sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);
+ sg_len = sg_nents_for_len(rctx->in_sg, rctx->total);
+ if (sg_len < 0)
+ return sg_len;
+ rctx->in_sg_len = sg_len;
ctx->rctx = rctx;
return crypto_transfer_hash_request_to_engine(cryp->engine, req);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 372/614] crypto: ccree - Correctly handle return of sg_nents_for_len
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 371/614] crypto: starfive - Correctly handle return of sg_nents_for_len Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 373/614] PM / devfreq: hisi: Fix potential UAF in OPP handling Greg Kroah-Hartman
` (255 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Herbert Xu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 8700ce07c5c6bf27afa7b59a8d9cf58d783a7d5c ]
Fix error handling in cc_map_hash_request_update where sg_nents_for_len
return value was assigned to u32, converting negative errors to large
positive values before passing to sg_copy_to_buffer.
Check sg_nents_for_len return value and propagate errors before
assigning to areq_ctx->in_nents.
Fixes: b7ec8530687a ("crypto: ccree - use std api when possible")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccree/cc_buffer_mgr.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c
index 3963bb91321fc..dc7e0cd51c259 100644
--- a/drivers/crypto/ccree/cc_buffer_mgr.c
+++ b/drivers/crypto/ccree/cc_buffer_mgr.c
@@ -1235,6 +1235,7 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
int rc = 0;
u32 dummy = 0;
u32 mapped_nents = 0;
+ int sg_nents;
dev_dbg(dev, " update params : curr_buff=%p curr_buff_cnt=0x%X nbytes=0x%X src=%p curr_index=%u\n",
curr_buff, *curr_buff_cnt, nbytes, src, areq_ctx->buff_index);
@@ -1248,7 +1249,10 @@ int cc_map_hash_request_update(struct cc_drvdata *drvdata, void *ctx,
if (total_in_len < block_size) {
dev_dbg(dev, " less than one block: curr_buff=%p *curr_buff_cnt=0x%X copy_to=%p\n",
curr_buff, *curr_buff_cnt, &curr_buff[*curr_buff_cnt]);
- areq_ctx->in_nents = sg_nents_for_len(src, nbytes);
+ sg_nents = sg_nents_for_len(src, nbytes);
+ if (sg_nents < 0)
+ return sg_nents;
+ areq_ctx->in_nents = sg_nents;
sg_copy_to_buffer(src, areq_ctx->in_nents,
&curr_buff[*curr_buff_cnt], nbytes);
*curr_buff_cnt += nbytes;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 373/614] PM / devfreq: hisi: Fix potential UAF in OPP handling
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 372/614] crypto: ccree " Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 374/614] RISC-V: KVM: Fix guest page fault within HLV* instructions Greg Kroah-Hartman
` (254 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengjie Zhang, Jie Zhan,
Chanwoo Choi, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengjie Zhang <zhangpengjie2@huawei.com>
[ Upstream commit 26dd44a40096468396b6438985d8e44e0743f64c ]
Ensure all required data is acquired before calling dev_pm_opp_put(opp)
to maintain correct resource acquisition and release order.
Fixes: 7da2fdaaa1e6 ("PM / devfreq: Add HiSilicon uncore frequency scaling driver")
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Reviewed-by: Jie Zhan <zhanjie9@hisilicon.com>
Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Link: https://patchwork.kernel.org/project/linux-pm/patch/20250915062135.748653-1-zhangpengjie2@huawei.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/devfreq/hisi_uncore_freq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/devfreq/hisi_uncore_freq.c b/drivers/devfreq/hisi_uncore_freq.c
index 96d1815059e32..c1ed70fa0a400 100644
--- a/drivers/devfreq/hisi_uncore_freq.c
+++ b/drivers/devfreq/hisi_uncore_freq.c
@@ -265,10 +265,11 @@ static int hisi_uncore_target(struct device *dev, unsigned long *freq,
dev_err(dev, "Failed to get opp for freq %lu hz\n", *freq);
return PTR_ERR(opp);
}
- dev_pm_opp_put(opp);
data = (u32)(dev_pm_opp_get_freq(opp) / HZ_PER_MHZ);
+ dev_pm_opp_put(opp);
+
return hisi_uncore_cmd_send(uncore, HUCF_PCC_CMD_SET_FREQ, &data);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 374/614] RISC-V: KVM: Fix guest page fault within HLV* instructions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 373/614] PM / devfreq: hisi: Fix potential UAF in OPP handling Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 375/614] erofs: correct FSDAX detection Greg Kroah-Hartman
` (253 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fangyu Yu, Anup Patel, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangyu Yu <fangyu.yu@linux.alibaba.com>
[ Upstream commit 974555d6e417974e63444266e495a06d06c23af5 ]
When executing HLV* instructions at the HS mode, a guest page fault
may occur when a g-stage page table migration between triggering the
virtual instruction exception and executing the HLV* instruction.
This may be a corner case, and one simpler way to handle this is to
re-execute the instruction where the virtual instruction exception
occurred, and the guest page fault will be automatically handled.
Fixes: b91f0e4cb8a3 ("RISC-V: KVM: Factor-out instruction emulation into separate sources")
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20251121133543.46822-1-fangyu.yu@linux.alibaba.com
Signed-off-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kvm/vcpu_insn.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/arch/riscv/kvm/vcpu_insn.c b/arch/riscv/kvm/vcpu_insn.c
index de1f96ea62251..4d89b94128aea 100644
--- a/arch/riscv/kvm/vcpu_insn.c
+++ b/arch/riscv/kvm/vcpu_insn.c
@@ -298,6 +298,22 @@ static int system_opcode_insn(struct kvm_vcpu *vcpu, struct kvm_run *run,
return (rc <= 0) ? rc : 1;
}
+static bool is_load_guest_page_fault(unsigned long scause)
+{
+ /**
+ * If a g-stage page fault occurs, the direct approach
+ * is to let the g-stage page fault handler handle it
+ * naturally, however, calling the g-stage page fault
+ * handler here seems rather strange.
+ * Considering this is a corner case, we can directly
+ * return to the guest and re-execute the same PC, this
+ * will trigger a g-stage page fault again and then the
+ * regular g-stage page fault handler will populate
+ * g-stage page table.
+ */
+ return (scause == EXC_LOAD_GUEST_PAGE_FAULT);
+}
+
/**
* kvm_riscv_vcpu_virtual_insn -- Handle virtual instruction trap
*
@@ -323,6 +339,8 @@ int kvm_riscv_vcpu_virtual_insn(struct kvm_vcpu *vcpu, struct kvm_run *run,
ct->sepc,
&utrap);
if (utrap.scause) {
+ if (is_load_guest_page_fault(utrap.scause))
+ return 1;
utrap.sepc = ct->sepc;
kvm_riscv_vcpu_trap_redirect(vcpu, &utrap);
return 1;
@@ -378,6 +396,8 @@ int kvm_riscv_vcpu_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run,
insn = kvm_riscv_vcpu_unpriv_read(vcpu, true, ct->sepc,
&utrap);
if (utrap.scause) {
+ if (is_load_guest_page_fault(utrap.scause))
+ return 1;
/* Redirect trap if we failed to read instruction */
utrap.sepc = ct->sepc;
kvm_riscv_vcpu_trap_redirect(vcpu, &utrap);
@@ -504,6 +524,8 @@ int kvm_riscv_vcpu_mmio_store(struct kvm_vcpu *vcpu, struct kvm_run *run,
insn = kvm_riscv_vcpu_unpriv_read(vcpu, true, ct->sepc,
&utrap);
if (utrap.scause) {
+ if (is_load_guest_page_fault(utrap.scause))
+ return 1;
/* Redirect trap if we failed to read instruction */
utrap.sepc = ct->sepc;
kvm_riscv_vcpu_trap_redirect(vcpu, &utrap);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 375/614] erofs: correct FSDAX detection
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 374/614] RISC-V: KVM: Fix guest page fault within HLV* instructions Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 376/614] erofs: limit the level of fs stacking for file-backed mounts Greg Kroah-Hartman
` (252 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuezhang Mo, Chao Yu, Gao Xiang,
Sasha Levin, syzbot+31b8fb02cb8a25bd5e78
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit ebe4f3f6eb0c10f87c58e52a8912694c14fdeda6 ]
The detection of the primary device is skipped incorrectly
if the multiple or flattened feature is enabled.
It also fixes the FSDAX misdetection for non-block extra blobs.
Fixes: c6993c4cb918 ("erofs: Fallback to normal access if DAX is not supported on extra device")
Reported-and-tested-by: syzbot+31b8fb02cb8a25bd5e78@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/691af9f6.a70a0220.3124cb.0097.GAE@google.com
Cc: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/super.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index f3f8d8c066e4e..cd8ff98c29384 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -174,15 +174,15 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
if (!erofs_is_fileio_mode(sbi)) {
dif->dax_dev = fs_dax_get_by_bdev(file_bdev(file),
&dif->dax_part_off, NULL, NULL);
- if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
- erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
- dif->path);
- clear_opt(&sbi->opt, DAX_ALWAYS);
- }
} else if (!S_ISREG(file_inode(file)->i_mode)) {
fput(file);
return -EINVAL;
}
+ if (!dif->dax_dev && test_opt(&sbi->opt, DAX_ALWAYS)) {
+ erofs_info(sb, "DAX unsupported by %s. Turning off DAX.",
+ dif->path);
+ clear_opt(&sbi->opt, DAX_ALWAYS);
+ }
dif->file = file;
}
@@ -215,13 +215,13 @@ static int erofs_scan_devices(struct super_block *sb,
ondisk_extradevs, sbi->devs->extra_devices);
return -EINVAL;
}
- if (!ondisk_extradevs) {
- if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
- erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
- clear_opt(&sbi->opt, DAX_ALWAYS);
- }
- return 0;
+
+ if (test_opt(&sbi->opt, DAX_ALWAYS) && !sbi->dif0.dax_dev) {
+ erofs_info(sb, "DAX unsupported by block device. Turning off DAX.");
+ clear_opt(&sbi->opt, DAX_ALWAYS);
}
+ if (!ondisk_extradevs)
+ return 0;
if (!sbi->devs->extra_devices && !erofs_is_fscache_mode(sb))
sbi->devs->flatdev = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 376/614] erofs: limit the level of fs stacking for file-backed mounts
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 375/614] erofs: correct FSDAX detection Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 377/614] RDMA/bnxt_re: Fix the inline size for GenP7 devices Greg Kroah-Hartman
` (251 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sheng Yong, Chao Yu, Hongbo Li,
Gao Xiang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit d53cd891f0e4311889349fff3a784dc552f814b9 ]
Otherwise, it could cause potential kernel stack overflow (e.g., EROFS
mounting itself).
Reviewed-by: Sheng Yong <shengyong1@xiaomi.com>
Fixes: fb176750266a ("erofs: add file-backed mount support")
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/erofs/super.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index cd8ff98c29384..937a215f626c1 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -639,6 +639,22 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
sbi->blkszbits = PAGE_SHIFT;
if (!sb->s_bdev) {
+ /*
+ * (File-backed mounts) EROFS claims it's safe to nest other
+ * fs contexts (including its own) due to self-controlled RO
+ * accesses/contexts and no side-effect changes that need to
+ * context save & restore so it can reuse the current thread
+ * context. However, it still needs to bump `s_stack_depth` to
+ * avoid kernel stack overflow from nested filesystems.
+ */
+ if (erofs_is_fileio_mode(sbi)) {
+ sb->s_stack_depth =
+ file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1;
+ if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+ erofs_err(sb, "maximum fs stacking depth exceeded");
+ return -ENOTBLK;
+ }
+ }
sb->s_blocksize = PAGE_SIZE;
sb->s_blocksize_bits = PAGE_SHIFT;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 377/614] RDMA/bnxt_re: Fix the inline size for GenP7 devices
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 376/614] erofs: limit the level of fs stacking for file-backed mounts Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 378/614] RDMA/bnxt_re: Pass correct flag for dma mr creation Greg Kroah-Hartman
` (250 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kashyap Desai, Kalesh AP,
Selvin Xavier, Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit 6afe40ff484a1155b71158b911c65299496e35c3 ]
Inline size supported by the device is based on the number
of SGEs supported by the adapter. Change the inline
size calculation based on that.
Fixes: de1d364c3815 ("RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters")
Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://patch.msgid.link/1763624215-10382-1-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_sp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 9ef581ed785c8..a9afac2cbb7cf 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -162,7 +162,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw)
attr->max_srq_wqes = le32_to_cpu(sb->max_srq_wr) - 1;
attr->max_srq_sges = sb->max_srq_sge;
attr->max_pkey = 1;
- attr->max_inline_data = le32_to_cpu(sb->max_inline_data);
+ attr->max_inline_data = attr->max_qp_sges * sizeof(struct sq_sge);
if (!bnxt_qplib_is_chip_gen_p7(rcfw->res->cctx))
attr->l2_db_size = (sb->l2_db_space_size + 1) *
(0x01 << RCFW_DBR_BASE_PAGE_SHIFT);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 378/614] RDMA/bnxt_re: Pass correct flag for dma mr creation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 377/614] RDMA/bnxt_re: Fix the inline size for GenP7 devices Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 379/614] crypto: ahash - Fix crypto_ahash_import with partial block data Greg Kroah-Hartman
` (249 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalesh AP, Selvin Xavier,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit a26c4c7cdb50247b8486f1caa1ea8ab5e5c37edf ]
DMA MR doesn't use the unified MR model. So the lkey passed
on to the reg_mr command to FW should contain the correct
lkey. Driver is incorrectly over writing the lkey with pdid
and firmware commands fails due to this.
Avoid passing the wrong key for cases where the unified MR
registration is not used.
Fixes: f786eebbbefa ("RDMA/bnxt_re: Avoid an extra hwrm per MR creation")
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Link: https://patch.msgid.link/1763624215-10382-2-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +++++---
drivers/infiniband/hw/bnxt_re/qplib_sp.c | 6 +++---
drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 +-
3 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 84ce3fce2826b..f19b55c13d580 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -601,7 +601,8 @@ static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd)
mr->qplib_mr.va = (u64)(unsigned long)fence->va;
mr->qplib_mr.total_size = BNXT_RE_FENCE_BYTES;
rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &mr->qplib_mr, NULL,
- BNXT_RE_FENCE_PBL_SIZE, PAGE_SIZE);
+ BNXT_RE_FENCE_PBL_SIZE, PAGE_SIZE,
+ _is_alloc_mr_unified(rdev->dev_attr->dev_cap_flags));
if (rc) {
ibdev_err(&rdev->ibdev, "Failed to register fence-MR\n");
goto fail;
@@ -4027,7 +4028,7 @@ struct ib_mr *bnxt_re_get_dma_mr(struct ib_pd *ib_pd, int mr_access_flags)
mr->qplib_mr.hwq.level = PBL_LVL_MAX;
mr->qplib_mr.total_size = -1; /* Infinte length */
rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &mr->qplib_mr, NULL, 0,
- PAGE_SIZE);
+ PAGE_SIZE, false);
if (rc)
goto fail_mr;
@@ -4257,7 +4258,8 @@ static struct ib_mr *__bnxt_re_user_reg_mr(struct ib_pd *ib_pd, u64 length, u64
umem_pgs = ib_umem_num_dma_blocks(umem, page_size);
rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &mr->qplib_mr, umem,
- umem_pgs, page_size);
+ umem_pgs, page_size,
+ _is_alloc_mr_unified(rdev->dev_attr->dev_cap_flags));
if (rc) {
ibdev_err(&rdev->ibdev, "Failed to register user MR - rc = %d\n", rc);
rc = -EIO;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index a9afac2cbb7cf..408a34df26672 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -578,7 +578,7 @@ int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
}
int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
- struct ib_umem *umem, int num_pbls, u32 buf_pg_size)
+ struct ib_umem *umem, int num_pbls, u32 buf_pg_size, bool unified_mr)
{
struct bnxt_qplib_rcfw *rcfw = res->rcfw;
struct bnxt_qplib_hwq_attr hwq_attr = {};
@@ -640,7 +640,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
req.access = (mr->access_flags & BNXT_QPLIB_MR_ACCESS_MASK);
req.va = cpu_to_le64(mr->va);
req.key = cpu_to_le32(mr->lkey);
- if (_is_alloc_mr_unified(res->dattr->dev_cap_flags))
+ if (unified_mr)
req.key = cpu_to_le32(mr->pd->id);
req.flags = cpu_to_le16(mr->flags);
req.mr_size = cpu_to_le64(mr->total_size);
@@ -651,7 +651,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
if (rc)
goto fail;
- if (_is_alloc_mr_unified(res->dattr->dev_cap_flags)) {
+ if (unified_mr) {
mr->lkey = le32_to_cpu(resp.xid);
mr->rkey = mr->lkey;
}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
index 147b5d9c03138..5a45c55c6464c 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -341,7 +341,7 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res,
int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
bool block);
int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
- struct ib_umem *umem, int num_pbls, u32 buf_pg_size);
+ struct ib_umem *umem, int num_pbls, u32 buf_pg_size, bool unified_mr);
int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr);
int bnxt_qplib_alloc_fast_reg_mr(struct bnxt_qplib_res *res,
struct bnxt_qplib_mrw *mr, int max);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 379/614] crypto: ahash - Fix crypto_ahash_import with partial block data
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 378/614] RDMA/bnxt_re: Pass correct flag for dma mr creation Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 380/614] crypto: ahash - Zero positive err value in ahash_update_finish Greg Kroah-Hartman
` (248 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, T Pratham, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit b0356b75f42fde15d4be268c5891f2cee6eb65bf ]
Restore the partial block buffer in crypto_ahash_import by copying
it. Check whether the partial block buffer exceeds the maximum
size and return -EOVERFLOW if it does.
Zero the partial block buffer in crypto_ahash_import_core.
Reported-by: T Pratham <t-pratham@ti.com>
Tested-by: T Pratham <t-pratham@ti.com>
Fixes: 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/ahash.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/crypto/ahash.c b/crypto/ahash.c
index dfb4f5476428f..819b484a1a003 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -661,6 +661,12 @@ int crypto_ahash_import_core(struct ahash_request *req, const void *in)
in);
if (crypto_ahash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
return -ENOKEY;
+ if (crypto_ahash_block_only(tfm)) {
+ unsigned int reqsize = crypto_ahash_reqsize(tfm);
+ u8 *buf = ahash_request_ctx(req);
+
+ buf[reqsize - 1] = 0;
+ }
return crypto_ahash_alg(tfm)->import_core(req, in);
}
EXPORT_SYMBOL_GPL(crypto_ahash_import_core);
@@ -674,10 +680,14 @@ int crypto_ahash_import(struct ahash_request *req, const void *in)
if (crypto_ahash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
return -ENOKEY;
if (crypto_ahash_block_only(tfm)) {
+ unsigned int plen = crypto_ahash_blocksize(tfm) + 1;
unsigned int reqsize = crypto_ahash_reqsize(tfm);
+ unsigned int ss = crypto_ahash_statesize(tfm);
u8 *buf = ahash_request_ctx(req);
- buf[reqsize - 1] = 0;
+ memcpy(buf + reqsize - plen, in + ss - plen, plen);
+ if (buf[reqsize - 1] >= plen)
+ return -EOVERFLOW;
}
return crypto_ahash_alg(tfm)->import(req, in);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 380/614] crypto: ahash - Zero positive err value in ahash_update_finish
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 379/614] crypto: ahash - Fix crypto_ahash_import with partial block data Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 381/614] ASoC: tas2781: Correct the wrong chip ID for reset variable check Greg Kroah-Hartman
` (247 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, T Pratham, Herbert Xu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit ebbdf6466b30e3b37f3b360826efd21f0633fb9e ]
The partial block length returned by a block-only driver should
not be passed up to the caller since ahash itself deals with the
partial block data.
Set err to zero in ahash_update_finish if it was positive.
Reported-by: T Pratham <t-pratham@ti.com>
Tested-by: T Pratham <t-pratham@ti.com>
Fixes: 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/ahash.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/crypto/ahash.c b/crypto/ahash.c
index 819b484a1a003..66492ae75fcfb 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -423,7 +423,11 @@ static int ahash_update_finish(struct ahash_request *req, int err)
req->nbytes += nonzero - blen;
- blen = err < 0 ? 0 : err + nonzero;
+ blen = 0;
+ if (err >= 0) {
+ blen = err + nonzero;
+ err = 0;
+ }
if (ahash_request_isvirt(req))
memcpy(buf, req->svirt + req->nbytes - blen, blen);
else
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 381/614] ASoC: tas2781: Correct the wrong chip ID for reset variable check
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 380/614] crypto: ahash - Zero positive err value in ahash_update_finish Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 382/614] ASoC: tas2781: correct the wrong period Greg Kroah-Hartman
` (246 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baojun Xu, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baojun Xu <baojun.xu@ti.com>
[ Upstream commit 34b78ddd78428e66a7f08f71763258723eae2306 ]
The new variable of reset was added for TAS58XX on TAS5825 first.
And TAS5802/5815... was added later, so this reset variable check
should be changed to lowest chip of TAS58XX.
Fixes: 53a3c6e22283 ("ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver")
Signed-off-by: Baojun Xu <baojun.xu@ti.com>
Link: https://patch.msgid.link/20251124031542.2793-1-baojun.xu@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tas2781-comlib-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/tas2781-comlib-i2c.c b/sound/soc/codecs/tas2781-comlib-i2c.c
index b3fd7350143bd..e24d56a14cfda 100644
--- a/sound/soc/codecs/tas2781-comlib-i2c.c
+++ b/sound/soc/codecs/tas2781-comlib-i2c.c
@@ -320,7 +320,7 @@ void tasdevice_reset(struct tasdevice_priv *tas_dev)
for (i = 0; i < tas_dev->ndev; i++) {
ret = tasdevice_dev_write(tas_dev, i,
TASDEVICE_REG_SWRESET,
- tas_dev->chip_id >= TAS5825 ?
+ tas_dev->chip_id >= TAS5802 ?
TAS5825_REG_SWRESET_RESET :
TASDEVICE_REG_SWRESET_RESET);
if (ret < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 382/614] ASoC: tas2781: correct the wrong period
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 381/614] ASoC: tas2781: Correct the wrong chip ID for reset variable check Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 383/614] wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Greg Kroah-Hartman
` (245 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shenghao Ding, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shenghao Ding <shenghao-ding@ti.com>
[ Upstream commit 950167a99dfd27eeaf177092908c598a31c79a7e ]
A wrong preiod at the end of the sentence was reported by one of my
customers. Their thorough code review is greatly appreciated.
Fixes: 49e2e353fb0d ("ASoC: tas2781: Add Calibration Kcontrols for Chromebook")
Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
Link: https://patch.msgid.link/20251121234427.402-1-shenghao-ding@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tas2781-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/tas2781-i2c.c b/sound/soc/codecs/tas2781-i2c.c
index 8f37aa00e62ee..a3b4d2c3b4789 100644
--- a/sound/soc/codecs/tas2781-i2c.c
+++ b/sound/soc/codecs/tas2781-i2c.c
@@ -1391,7 +1391,7 @@ static int tasdevice_create_cali_ctrls(struct tasdevice_priv *priv)
/*
* Alloc kcontrol via devm_kzalloc(), which don't manually
- * free the kcontrol。
+ * free the kcontrol.
*/
cali_ctrls = devm_kcalloc(priv->dev, nctrls,
sizeof(cali_ctrls[0]), GFP_KERNEL);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 383/614] wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 382/614] ASoC: tas2781: correct the wrong period Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 384/614] wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx Greg Kroah-Hartman
` (244 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
[ Upstream commit 79277f8ad15ec5f255ed0e1427c7a8a3e94e7f52 ]
If a link does not have an assigned channel yet, mt7996_vif_link returns
NULL. We still need to store the updated queue settings in that case, and
apply them later.
Move the location of the queue params to within struct mt7996_vif_link.
Fixes: c0df2f0caa8d ("wifi: mt76: mt7996: prepare mt7996_mcu_set_tx for MLO support")
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250929111723.52486-1-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 +++---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 5 ++++-
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 7 ++++++-
3 files changed, 13 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 581314368c5ba..b53ca702591c6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -665,8 +665,8 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
unsigned int link_id, u16 queue,
const struct ieee80211_tx_queue_params *params)
{
- struct mt7996_dev *dev = mt7996_hw_dev(hw);
- struct mt7996_vif_link *mlink = mt7996_vif_link(dev, vif, link_id);
+ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id];
static const u8 mq_to_aci[] = {
[IEEE80211_AC_VO] = 3,
[IEEE80211_AC_VI] = 2,
@@ -675,7 +675,7 @@ mt7996_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
};
/* firmware uses access class index */
- mlink->queue_params[mq_to_aci[queue]] = *params;
+ link_info->queue_params[mq_to_aci[queue]] = *params;
/* no need to update right away, we'll get BSS_CHANGED_QOS */
return 0;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 0347ee0c2dd75..afa6a43bd51e5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -3414,6 +3414,9 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,
#define WMM_PARAM_SET (WMM_AIFS_SET | WMM_CW_MIN_SET | \
WMM_CW_MAX_SET | WMM_TXOP_SET)
struct mt7996_vif_link *link = mt7996_vif_conf_link(dev, vif, link_conf);
+ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ unsigned int link_id = link_conf->link_id;
+ struct mt7996_vif_link_info *link_info = &mvif->link_info[link_id];
struct {
u8 bss_idx;
u8 __rsv[3];
@@ -3431,7 +3434,7 @@ int mt7996_mcu_set_tx(struct mt7996_dev *dev, struct ieee80211_vif *vif,
skb_put_data(skb, &hdr, sizeof(hdr));
for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
- struct ieee80211_tx_queue_params *q = &link->queue_params[ac];
+ struct ieee80211_tx_queue_params *q = &link_info->queue_params[ac];
struct edca *e;
struct tlv *tlv;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 8ec2acdb33193..718e4d4ad85f2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -253,16 +253,21 @@ struct mt7996_vif_link {
struct mt7996_sta_link msta_link;
struct mt7996_phy *phy;
- struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
struct cfg80211_bitrate_mask bitrate_mask;
u8 mld_idx;
};
+struct mt7996_vif_link_info {
+ struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
+};
+
struct mt7996_vif {
struct mt7996_vif_link deflink; /* must be first */
struct mt76_vif_data mt76;
+ struct mt7996_vif_link_info link_info[IEEE80211_MLD_MAX_NUM_LINKS];
+
u8 mld_group_idx;
u8 mld_remap_idx;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 384/614] wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 383/614] wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 385/614] wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks Greg Kroah-Hartman
` (243 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 084922069ceac4d594c06b76a80352139fd15f4d ]
Remove unnecessary link_id checks in mt7996_tx routine since if the link
identifier provided by mac80211 is unspecified the value will be
overwritten at the beginning on the function.
Fixes: f940c9b7aef6 ("wifi: mt76: mt7996: Set proper link destination address in mt7996_tx()")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20250924-mt76_tx_unnecessary-check-v1-1-e595930a5662@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index b53ca702591c6..2b52d057287a1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1339,12 +1339,10 @@ static void mt7996_tx(struct ieee80211_hw *hw,
}
if (mvif) {
- struct mt76_vif_link *mlink = &mvif->deflink.mt76;
+ struct mt76_vif_link *mlink;
- if (link_id < IEEE80211_LINK_UNSPECIFIED)
- mlink = rcu_dereference(mvif->mt76.link[link_id]);
-
- if (mlink->wcid)
+ mlink = rcu_dereference(mvif->mt76.link[link_id]);
+ if (mlink && mlink->wcid)
wcid = mlink->wcid;
if (mvif->mt76.roc_phy &&
@@ -1352,7 +1350,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
mphy = mvif->mt76.roc_phy;
if (mphy->roc_link)
wcid = mphy->roc_link->wcid;
- } else {
+ } else if (mlink) {
mphy = mt76_vif_link_phy(mlink);
}
}
@@ -1362,7 +1360,7 @@ static void mt7996_tx(struct ieee80211_hw *hw,
goto unlock;
}
- if (msta && link_id < IEEE80211_LINK_UNSPECIFIED) {
+ if (msta) {
struct mt7996_sta_link *msta_link;
msta_link = rcu_dereference(msta->link[link_id]);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 385/614] wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 384/614] wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 386/614] wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache() Greg Kroah-Hartman
` (242 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Pawlik, Matteo Croce,
Lorenzo Bianconi, Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 385aab8fccd7a8746b9f1a17f3c1e38498a14bc7 ]
MT7996 driver can use both wed and wed_hif2 devices to offload traffic
from/to the wireless NIC. In the current codebase we assume to always
use the primary wed device in wed callbacks resulting in the following
crash if the hw runs wed_hif2 (e.g. 6GHz link).
[ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a
[ 297.464928] Mem abort info:
[ 297.467722] ESR = 0x0000000096000005
[ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits
[ 297.476766] SET = 0, FnV = 0
[ 297.479809] EA = 0, S1PTW = 0
[ 297.482940] FSC = 0x05: level 1 translation fault
[ 297.487809] Data abort info:
[ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000
[ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000
[ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP
[ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0
[ 297.723908] Tainted: [O]=OOT_MODULE
[ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT)
[ 297.732857] Workqueue: nf_ft_offload_del nf_flow_rule_route_ipv6 [nf_flow_table]
[ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 297.747205] pc : mt76_wed_offload_disable+0x64/0xa0 [mt76]
[ 297.752688] lr : mtk_wed_flow_remove+0x58/0x80
[ 297.757126] sp : ffffffc080fe3ae0
[ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7
[ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00
[ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018
[ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000
[ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000
[ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da
[ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200
[ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002
[ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000
[ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8
[ 297.831686] Call trace:
[ 297.834123] mt76_wed_offload_disable+0x64/0xa0 [mt76]
[ 297.839254] mtk_wed_flow_remove+0x58/0x80
[ 297.843342] mtk_flow_offload_cmd+0x434/0x574
[ 297.847689] mtk_wed_setup_tc_block_cb+0x30/0x40
[ 297.852295] nf_flow_offload_ipv6_hook+0x7f4/0x964 [nf_flow_table]
[ 297.858466] nf_flow_rule_route_ipv6+0x438/0x4a4 [nf_flow_table]
[ 297.864463] process_one_work+0x174/0x300
[ 297.868465] worker_thread+0x278/0x430
[ 297.872204] kthread+0xd8/0xdc
[ 297.875251] ret_from_fork+0x10/0x20
[ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421)
[ 297.884901] ---[ end trace 0000000000000000 ]---
Fix the issue detecting the proper wed reference to use running wed
callabacks.
Fixes: 83eafc9251d6 ("wifi: mt76: mt7996: add wed tx support")
Tested-by: Daniel Pawlik <pawlik.dan@gmail.com>
Tested-by: Matteo Croce <teknoraver@meta.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251008-wed-fixes-v1-1-8f7678583385@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt76.h | 9 +++++++++
drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 +
drivers/net/wireless/mediatek/mt76/wed.c | 10 +++++-----
include/linux/soc/mediatek/mtk_wed.h | 1 +
4 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index e0d50b58cd012..7753afa3d883d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -1252,6 +1252,15 @@ static inline int mt76_wed_dma_setup(struct mt76_dev *dev, struct mt76_queue *q,
#define mt76_dereference(p, dev) \
rcu_dereference_protected(p, lockdep_is_held(&(dev)->mutex))
+static inline struct mt76_dev *mt76_wed_to_dev(struct mtk_wed_device *wed)
+{
+#ifdef CONFIG_NET_MEDIATEK_SOC_WED
+ if (wed->wlan.hif2)
+ return container_of(wed, struct mt76_dev, mmio.wed_hif2);
+#endif /* CONFIG_NET_MEDIATEK_SOC_WED */
+ return container_of(wed, struct mt76_dev, mmio.wed);
+}
+
static inline struct mt76_wcid *
__mt76_wcid_ptr(struct mt76_dev *dev, u16 idx)
{
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
index d14b626ee5115..80db102ed809c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
@@ -595,6 +595,7 @@ int mt7996_mmio_wed_init(struct mt7996_dev *dev, void *pdev_ptr,
wed->wlan.nbuf = MT7996_HW_TOKEN_SIZE;
wed->wlan.token_start = MT7996_TOKEN_SIZE - wed->wlan.nbuf;
+ wed->wlan.hif2 = hif2;
wed->wlan.amsdu_max_subframes = 8;
wed->wlan.amsdu_max_len = 1536;
diff --git a/drivers/net/wireless/mediatek/mt76/wed.c b/drivers/net/wireless/mediatek/mt76/wed.c
index 907a8e43e72ad..fbd7e59c73aaf 100644
--- a/drivers/net/wireless/mediatek/mt76/wed.c
+++ b/drivers/net/wireless/mediatek/mt76/wed.c
@@ -8,7 +8,7 @@
void mt76_wed_release_rx_buf(struct mtk_wed_device *wed)
{
- struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ struct mt76_dev *dev = mt76_wed_to_dev(wed);
int i;
for (i = 0; i < dev->rx_token_size; i++) {
@@ -31,8 +31,8 @@ EXPORT_SYMBOL_GPL(mt76_wed_release_rx_buf);
#ifdef CONFIG_NET_MEDIATEK_SOC_WED
u32 mt76_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
{
- struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
struct mtk_wed_bm_desc *desc = wed->rx_buf_ring.desc;
+ struct mt76_dev *dev = mt76_wed_to_dev(wed);
struct mt76_queue *q = &dev->q_rx[MT_RXQ_MAIN];
struct mt76_txwi_cache *t = NULL;
int i;
@@ -80,7 +80,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_init_rx_buf);
int mt76_wed_offload_enable(struct mtk_wed_device *wed)
{
- struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ struct mt76_dev *dev = mt76_wed_to_dev(wed);
spin_lock_bh(&dev->token_lock);
dev->token_size = wed->wlan.token_start;
@@ -164,7 +164,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_dma_setup);
void mt76_wed_offload_disable(struct mtk_wed_device *wed)
{
- struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ struct mt76_dev *dev = mt76_wed_to_dev(wed);
spin_lock_bh(&dev->token_lock);
dev->token_size = dev->drv->token_size;
@@ -174,7 +174,7 @@ EXPORT_SYMBOL_GPL(mt76_wed_offload_disable);
void mt76_wed_reset_complete(struct mtk_wed_device *wed)
{
- struct mt76_dev *dev = container_of(wed, struct mt76_dev, mmio.wed);
+ struct mt76_dev *dev = mt76_wed_to_dev(wed);
complete(&dev->mmio.wed_reset_complete);
}
diff --git a/include/linux/soc/mediatek/mtk_wed.h b/include/linux/soc/mediatek/mtk_wed.h
index c4ff6bab176db..3fa93bd650044 100644
--- a/include/linux/soc/mediatek/mtk_wed.h
+++ b/include/linux/soc/mediatek/mtk_wed.h
@@ -154,6 +154,7 @@ struct mtk_wed_device {
bool wcid_512;
bool hw_rro;
bool msi;
+ bool hif2;
u16 token_start;
unsigned int nbuf;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 386/614] wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 385/614] wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 387/614] Revert "wifi: mt76: mt792x: improve monitor interface handling" Greg Kroah-Hartman
` (241 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 2157e49892c5eae210b8fa6ee8672bd9d0ffa4b5 ]
Get rid of useless null-pointer check in mt7996_msdu_page_get_from_cache
since we have already verfied the list is not empty.
Fixes: b1e58e137b616 ("wifi: mt76: mt7996: Introduce RRO MSDU callbacks")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/r/202510100155.MS0IXhzm-lkp@intel.com/
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251014-mt7996_msdu_page_get_from_cache-remove-null-ptr-check-v1-1-fbeb7881e192@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 9501def3e0e3e..284f2eea71e5b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -1681,8 +1681,7 @@ mt7996_msdu_page_get_from_cache(struct mt7996_dev *dev)
if (!list_empty(&dev->wed_rro.page_cache)) {
p = list_first_entry(&dev->wed_rro.page_cache,
struct mt7996_msdu_page, list);
- if (p)
- list_del(&p->list);
+ list_del(&p->list);
}
spin_unlock(&dev->wed_rro.lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 387/614] Revert "wifi: mt76: mt792x: improve monitor interface handling"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 386/614] wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 388/614] wifi: mt76: mt7996: fix max nss value when getting rx chainmask Greg Kroah-Hartman
` (240 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit cdb2941a516cf06929293604e2e0f4c1d6f3541e ]
This reverts commit 55e95ce469d0c61041bae48b2ebb7fcbf6d1ba7f.
mt792x drivers don't seem to support multi-radio devices yet. At least
they don't mess with `struct wiphy_radio` at the moment.
Packet capturing on monitor interface doesn't work after the blamed patch:
tcpdump -i wls6mon -n -vvv
Revert the NO_VIRTUAL_MONITOR feature for now to resolve the issue.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 55e95ce469d0 ("wifi: mt76: mt792x: improve monitor interface handling")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Link: https://patch.msgid.link/20251027111843.38975-1-pchelkin@ispras.ru
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
index c0e56541a9547..9cad572c34a38 100644
--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
@@ -688,7 +688,6 @@ int mt792x_init_wiphy(struct ieee80211_hw *hw)
ieee80211_hw_set(hw, SUPPORTS_DYNAMIC_PS);
ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
ieee80211_hw_set(hw, CONNECTION_MONITOR);
- ieee80211_hw_set(hw, NO_VIRTUAL_MONITOR);
ieee80211_hw_set(hw, SUPPORTS_MULTI_BSSID);
ieee80211_hw_set(hw, SUPPORTS_ONLY_HE_MULTI_BSSID);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 388/614] wifi: mt76: mt7996: fix max nss value when getting rx chainmask
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 387/614] Revert "wifi: mt76: mt792x: improve monitor interface handling" Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 389/614] wifi: mt76: mt7996: fix implicit beamforming support for mt7992 Greg Kroah-Hartman
` (239 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, StanleyYP Wang, Shayne Chen,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
[ Upstream commit 361b59b6be7c33c43b619d5cada394efc0f3b398 ]
Since wiphy->available_antennas_tx now accumulates the chainmask of all
the radios of a wiphy, use phy->orig_antenna_mask to get the original
max nss for comparison.
Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy")
Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20251106064203.1000505-1-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 718e4d4ad85f2..1727e73a99ce6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -786,7 +786,7 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
static inline u16 mt7996_rx_chainmask(struct mt7996_phy *phy)
{
- int max_nss = hweight8(phy->mt76->hw->wiphy->available_antennas_tx);
+ int max_nss = hweight16(phy->orig_antenna_mask);
int cur_nss = hweight8(phy->mt76->antenna_mask);
u16 tx_chainmask = phy->mt76->chainmask;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 389/614] wifi: mt76: mt7996: fix implicit beamforming support for mt7992
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 388/614] wifi: mt76: mt7996: fix max nss value when getting rx chainmask Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 390/614] wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() Greg Kroah-Hartman
` (238 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Howard Hsu, Shayne Chen,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Howard Hsu <howard-yh.hsu@mediatek.com>
[ Upstream commit 5d86765828b47444908a8689f2625872e8dac48f ]
Fix the ibf_timeout field for mt7996, mt7992 and mt7990 chipsets. For
the mt7992, this value shall be set as 0xff, while the others shall be
set as 0x18.
Fixes: ad4c9a8a9803 ("wifi: mt76: mt7996: add implicit beamforming support for mt7992")
Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20251106064203.1000505-3-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index afa6a43bd51e5..9af3c48707ab7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -1822,8 +1822,8 @@ mt7996_mcu_sta_bfer_tlv(struct mt7996_dev *dev, struct sk_buff *skb,
bf->ibf_nrow = tx_ant;
if (link_sta->eht_cap.has_eht || link_sta->he_cap.has_he)
- bf->ibf_timeout = is_mt7996(&dev->mt76) ? MT7996_IBF_TIMEOUT :
- MT7992_IBF_TIMEOUT;
+ bf->ibf_timeout = is_mt7992(&dev->mt76) ? MT7992_IBF_TIMEOUT :
+ MT7996_IBF_TIMEOUT;
else if (!ebf && link_sta->bandwidth <= IEEE80211_STA_RX_BW_40 && !bf->ncol)
bf->ibf_timeout = MT7996_IBF_TIMEOUT_LEGACY;
else
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 390/614] wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 389/614] wifi: mt76: mt7996: fix implicit beamforming support for mt7992 Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 391/614] wifi: mt76: mt7996: fix teardown command for an MLD peer Greg Kroah-Hartman
` (237 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shayne Chen, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit bb705a606734e1ce0ff17a4f368a896757ba686d ]
Fix several fields in mt7996_mcu_bss_basic_tlv() that were not obtained
from the correct link. Without this patch, the MLD station interface
does not function properly.
Fixes: 34a41bfbcb71 ("wifi: mt76: mt7996: prepare mt7996_mcu_add_dev/bss_info for MLO support")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251106064203.1000505-5-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/mcu.c | 21 ++++++++++---------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 9af3c48707ab7..21be88e76c655 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -1034,7 +1034,6 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
struct mt76_connac_bss_basic_tlv *bss;
u32 type = CONNECTION_INFRA_AP;
u16 sta_wlan_idx = wlan_idx;
- struct ieee80211_sta *sta;
struct tlv *tlv;
int idx;
@@ -1045,14 +1044,18 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
break;
case NL80211_IFTYPE_STATION:
if (enable) {
+ struct ieee80211_sta *sta;
+
rcu_read_lock();
- sta = ieee80211_find_sta(vif, vif->bss_conf.bssid);
- /* TODO: enable BSS_INFO_UAPSD & BSS_INFO_PM */
+ sta = ieee80211_find_sta(vif, link_conf->bssid);
if (sta) {
- struct mt76_wcid *wcid;
+ struct mt7996_sta *msta = (void *)sta->drv_priv;
+ struct mt7996_sta_link *msta_link;
+ int link_id = link_conf->link_id;
- wcid = (struct mt76_wcid *)sta->drv_priv;
- sta_wlan_idx = wcid->idx;
+ msta_link = rcu_dereference(msta->link[link_id]);
+ if (msta_link)
+ sta_wlan_idx = msta_link->wcid.idx;
}
rcu_read_unlock();
}
@@ -1069,8 +1072,6 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*bss));
bss = (struct mt76_connac_bss_basic_tlv *)tlv;
- bss->bcn_interval = cpu_to_le16(link_conf->beacon_int);
- bss->dtim_period = link_conf->dtim_period;
bss->bmc_tx_wlan_idx = cpu_to_le16(wlan_idx);
bss->sta_idx = cpu_to_le16(sta_wlan_idx);
bss->conn_type = cpu_to_le32(type);
@@ -1090,10 +1091,10 @@ mt7996_mcu_bss_basic_tlv(struct sk_buff *skb,
memcpy(bss->bssid, link_conf->bssid, ETH_ALEN);
bss->bcn_interval = cpu_to_le16(link_conf->beacon_int);
- bss->dtim_period = vif->bss_conf.dtim_period;
+ bss->dtim_period = link_conf->dtim_period;
bss->phymode = mt76_connac_get_phy_mode(phy, vif,
chandef->chan->band, NULL);
- bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, &vif->bss_conf,
+ bss->phymode_ext = mt76_connac_get_phy_mode_ext(phy, link_conf,
chandef->chan->band);
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 391/614] wifi: mt76: mt7996: fix teardown command for an MLD peer
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 390/614] wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 392/614] wifi: mt76: mt7996: set link_valid field when initializing wcid Greg Kroah-Hartman
` (236 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shayne Chen, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit e077071e7ac48d5453072f615d51629891c5b90d ]
For an MLD peer, we only need to call the teardown command when removing
the last link, and there's no need to call mt7996_mcu_add_sta() for the
earlier links.
Fixes: c1d6dd5d03eb ("wifi: mt76: mt7996: Add mt7996_mcu_teardown_mld_sta rouine")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251106064203.1000505-6-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 2b52d057287a1..aa46ea707b406 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1206,13 +1206,13 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
mt7996_mac_twt_teardown_flow(dev, link,
msta_link, i);
- if (sta->mlo && links == BIT(link_id)) /* last link */
- mt7996_mcu_teardown_mld_sta(dev, link,
- msta_link);
- else
+ if (!sta->mlo)
mt7996_mcu_add_sta(dev, link_conf, link_sta,
link, msta_link,
CONN_STATE_DISCONNECT, false);
+ else if (sta->mlo && links == BIT(link_id)) /* last link */
+ mt7996_mcu_teardown_mld_sta(dev, link,
+ msta_link);
msta_link->wcid.sta_disabled = 1;
msta_link->wcid.sta = 0;
links = links & ~BIT(link_id);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 392/614] wifi: mt76: mt7996: set link_valid field when initializing wcid
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 391/614] wifi: mt76: mt7996: fix teardown command for an MLD peer Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 393/614] wifi: mt76: mt7996: fix MLD group index assignment Greg Kroah-Hartman
` (235 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shayne Chen, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit 7eaea3a8ba1e9bb58f87e3030f6ce18537e57e1f ]
This ensures the upper layer uses the correct link ID during packet
processing.
Fixes: dd82a9e02c05 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251106064203.1000505-7-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index aa46ea707b406..4e73854589558 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -343,6 +343,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
INIT_LIST_HEAD(&msta_link->rc_list);
msta_link->wcid.idx = idx;
msta_link->wcid.link_id = link_conf->link_id;
+ msta_link->wcid.link_valid = ieee80211_vif_is_mld(vif);
msta_link->wcid.tx_info |= MT_WCID_TX_INFO_SET;
mt76_wcid_init(&msta_link->wcid, band_idx);
@@ -984,6 +985,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev,
msta_link->wcid.sta = 1;
msta_link->wcid.idx = idx;
msta_link->wcid.link_id = link_id;
+ msta_link->wcid.link_valid = !!sta->valid_links;
msta_link->wcid.def_wcid = &msta->deflink.wcid;
ewma_avg_signal_init(&msta_link->avg_ack_signal);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 393/614] wifi: mt76: mt7996: fix MLD group index assignment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 392/614] wifi: mt76: mt7996: set link_valid field when initializing wcid Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 394/614] wifi: mt76: mt7996: fix MLO set key and group key issues Greg Kroah-Hartman
` (234 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shayne Chen, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit 4fb3b4e7d1ca5453c6167816230370afc15f26bf ]
Fix extender mode and MBSS issues caused by incorrect assignment of the
MLD group and remap indices.
Fixes: ed01c310eca9 ("wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251106064203.1000505-9-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/main.c | 58 +++++++++++++------
1 file changed, 40 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 4e73854589558..dc0fcf5cb7fb1 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -90,9 +90,11 @@ static void mt7996_stop(struct ieee80211_hw *hw, bool suspend)
{
}
-static inline int get_free_idx(u32 mask, u8 start, u8 end)
+static inline int get_free_idx(u64 mask, u8 start, u8 end)
{
- return ffs(~mask & GENMASK(end, start));
+ if (~mask & GENMASK_ULL(end, start))
+ return __ffs64(~mask & GENMASK_ULL(end, start)) + 1;
+ return 0;
}
static int get_omac_idx(enum nl80211_iftype type, u64 mask)
@@ -308,12 +310,6 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
if (idx < 0)
return -ENOSPC;
- if (!dev->mld_idx_mask) { /* first link in the group */
- mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true);
- mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask,
- 0, 15);
- }
-
mld_idx = get_own_mld_idx(dev->mld_idx_mask, false);
if (mld_idx < 0)
return -ENOSPC;
@@ -331,10 +327,6 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
return ret;
dev->mt76.vif_mask |= BIT_ULL(mlink->idx);
- if (!dev->mld_idx_mask) {
- dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
- dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
- }
dev->mld_idx_mask |= BIT_ULL(link->mld_idx);
phy->omac_mask |= BIT_ULL(mlink->omac_idx);
@@ -424,11 +416,6 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx);
dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx);
phy->omac_mask &= ~BIT_ULL(mlink->omac_idx);
- if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) {
- /* last link */
- dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
- dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
- }
spin_lock_bh(&dev->mt76.sta_poll_lock);
if (!list_empty(&msta_link->wcid.poll_list))
@@ -2217,7 +2204,42 @@ mt7996_change_vif_links(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
u16 old_links, u16 new_links,
struct ieee80211_bss_conf *old[IEEE80211_MLD_MAX_NUM_LINKS])
{
- return 0;
+ struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ int ret = 0;
+
+ mutex_lock(&dev->mt76.mutex);
+
+ if (!old_links) {
+ int idx;
+
+ idx = get_own_mld_idx(dev->mld_idx_mask, true);
+ if (idx < 0) {
+ ret = -ENOSPC;
+ goto out;
+ }
+ mvif->mld_group_idx = idx;
+ dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
+
+ idx = get_free_idx(dev->mld_remap_idx_mask, 0, 15) - 1;
+ if (idx < 0) {
+ ret = -ENOSPC;
+ goto out;
+ }
+ mvif->mld_remap_idx = idx;
+ dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
+ }
+
+ if (new_links)
+ goto out;
+
+ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
+ dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
+
+out:
+ mutex_unlock(&dev->mt76.mutex);
+
+ return ret;
}
static void
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 394/614] wifi: mt76: mt7996: fix MLO set key and group key issues
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 393/614] wifi: mt76: mt7996: fix MLD group index assignment Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 395/614] wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Greg Kroah-Hartman
` (233 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Allen Ye, Peter Chiu, Shayne Chen,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit e11be918d91e7d33ac4bad41dbe666a9abf1cfaa ]
This patch fixes the following key issues:
- Pass correct link BSS to mt7996_mcu_add_key(), and use HW beacon
protection mode for mt7990 chipset
- Do not do group key deletion for GTK and IGTK due to FW design, the
delete key command will delete all group keys of a link BSS
- For deleting BIGTK, FW adds a new flow, but the "sec->add" field
should be filled with "SET_KEY". Note that if BIGTK is not deleted, it
will cause beacon decryption issue when switching from an AP interface
to a station interface
Fixes: 0c45d52276fd ("wifi: mt76: mt7996: fix setting beacon protection keys")
Co-developed-by: Allen Ye <allen.ye@mediatek.com>
Signed-off-by: Allen Ye <allen.ye@mediatek.com>
Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20251106064203.1000505-10-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/mac.c | 7 +++-
.../net/wireless/mediatek/mt76/mt7996/main.c | 5 +--
.../net/wireless/mediatek/mt76/mt7996/mcu.c | 35 +++++++++++++------
.../wireless/mediatek/mt76/mt7996/mt7996.h | 2 +-
4 files changed, 34 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 284f2eea71e5b..fe31db5440a84 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -794,6 +794,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
__le16 fc = hdr->frame_control, sc = hdr->seq_ctrl;
u16 seqno = le16_to_cpu(sc);
+ bool hw_bigtk = false;
u8 fc_type, fc_stype;
u32 val;
@@ -819,7 +820,11 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
info->flags & IEEE80211_TX_CTL_USE_MINRATE)
val |= MT_TXD1_FIXED_RATE;
- if (key && multicast && ieee80211_is_robust_mgmt_frame(skb)) {
+ if (is_mt7990(&dev->mt76) && ieee80211_is_beacon(fc) &&
+ (wcid->hw_key_idx2 == 6 || wcid->hw_key_idx2 == 7))
+ hw_bigtk = true;
+
+ if ((key && multicast && ieee80211_is_robust_mgmt_frame(skb)) || hw_bigtk) {
val |= MT_TXD1_BIP;
txwi[3] &= ~cpu_to_le32(MT_TXD3_PROTECT_FRAME);
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index dc0fcf5cb7fb1..beb455185f904 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -249,12 +249,13 @@ mt7996_set_hw_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
else if (idx == *wcid_keyidx)
*wcid_keyidx = -1;
- if (cmd != SET_KEY && sta)
+ /* only do remove key for BIGTK */
+ if (cmd != SET_KEY && !is_bigtk)
return 0;
mt76_wcid_key_setup(&dev->mt76, &msta_link->wcid, key);
- err = mt7996_mcu_add_key(&dev->mt76, vif, key,
+ err = mt7996_mcu_add_key(&dev->mt76, link, key,
MCU_WMWA_UNI_CMD(STA_REC_UPDATE),
&msta_link->wcid, cmd);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index 21be88e76c655..5bde9959bbb99 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -2527,7 +2527,7 @@ int mt7996_mcu_teardown_mld_sta(struct mt7996_dev *dev,
}
static int
-mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
+mt7996_mcu_sta_key_tlv(struct mt76_dev *dev, struct mt76_wcid *wcid,
struct sk_buff *skb,
struct ieee80211_key_conf *key,
enum set_key_cmd cmd)
@@ -2539,7 +2539,10 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
sec = (struct sta_rec_sec_uni *)tlv;
- sec->add = 0;
+ /* due to connac3 FW design, we only do remove key for BIGTK; even for
+ * removal, the field should be filled with SET_KEY
+ */
+ sec->add = SET_KEY;
sec->n_cipher = 1;
sec_key = &sec->key[0];
sec_key->wlan_idx = cpu_to_le16(wcid->idx);
@@ -2579,29 +2582,33 @@ mt7996_mcu_sta_key_tlv(struct mt76_wcid *wcid,
case WLAN_CIPHER_SUITE_BIP_GMAC_256:
sec_key->cipher_id = MCU_CIPHER_BCN_PROT_GMAC_256;
break;
+ case WLAN_CIPHER_SUITE_BIP_CMAC_256:
+ if (!is_mt7990(dev))
+ return -EOPNOTSUPP;
+ sec_key->cipher_id = MCU_CIPHER_BCN_PROT_CMAC_256;
+ break;
default:
return -EOPNOTSUPP;
}
- sec_key->bcn_mode = BP_SW_MODE;
+ sec_key->bcn_mode = is_mt7990(dev) ? BP_HW_MODE : BP_SW_MODE;
return 0;
}
-int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_vif_link *link,
struct ieee80211_key_conf *key, int mcu_cmd,
struct mt76_wcid *wcid, enum set_key_cmd cmd)
{
- struct mt76_vif_link *mvif = (struct mt76_vif_link *)vif->drv_priv;
struct sk_buff *skb;
int ret;
- skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, wcid,
- MT7996_STA_UPDATE_MAX_SIZE);
+ skb = __mt76_connac_mcu_alloc_sta_req(dev, (struct mt76_vif_link *)link,
+ wcid, MT7996_STA_UPDATE_MAX_SIZE);
if (IS_ERR(skb))
return PTR_ERR(skb);
- ret = mt7996_mcu_sta_key_tlv(wcid, skb, key, cmd);
+ ret = mt7996_mcu_sta_key_tlv(dev, wcid, skb, key, cmd);
if (ret) {
dev_kfree_skb(skb);
return ret;
@@ -2721,12 +2728,18 @@ mt7996_mcu_beacon_mbss(struct sk_buff *rskb, struct sk_buff *skb,
static void
mt7996_mcu_beacon_cont(struct mt7996_dev *dev,
struct ieee80211_bss_conf *link_conf,
+ struct mt7996_vif_link *link,
struct sk_buff *rskb, struct sk_buff *skb,
struct bss_bcn_content_tlv *bcn,
struct ieee80211_mutable_offsets *offs)
{
- struct mt76_wcid *wcid = &dev->mt76.global_wcid;
- u8 *buf;
+ u8 *buf, keyidx = link->msta_link.wcid.hw_key_idx2;
+ struct mt76_wcid *wcid;
+
+ if (is_mt7990(&dev->mt76) && (keyidx == 6 || keyidx == 7))
+ wcid = &link->msta_link.wcid;
+ else
+ wcid = &dev->mt76.global_wcid;
bcn->pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len);
bcn->tim_ie_pos = cpu_to_le16(offs->tim_offset);
@@ -2801,7 +2814,7 @@ int mt7996_mcu_add_beacon(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
info = IEEE80211_SKB_CB(skb);
info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, mlink->band_idx);
- mt7996_mcu_beacon_cont(dev, link_conf, rskb, skb, bcn, &offs);
+ mt7996_mcu_beacon_cont(dev, link_conf, link, rskb, skb, bcn, &offs);
if (link_conf->bssid_indicator)
mt7996_mcu_beacon_mbss(rskb, skb, bcn, &offs);
mt7996_mcu_beacon_cntdwn(rskb, skb, &offs, link_conf->csa_active);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 1727e73a99ce6..b942928c79e28 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -848,7 +848,7 @@ void mt7996_update_channel(struct mt76_phy *mphy);
int mt7996_init_debugfs(struct mt7996_dev *dev);
void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len);
bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len);
-int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+int mt7996_mcu_add_key(struct mt76_dev *dev, struct mt7996_vif_link *link,
struct ieee80211_key_conf *key, int mcu_cmd,
struct mt76_wcid *wcid, enum set_key_cmd cmd);
int mt7996_mcu_bcn_prot_enable(struct mt7996_dev *dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 395/614] wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 394/614] wifi: mt76: mt7996: fix MLO set key and group key issues Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 396/614] wifi: mt76: mt7996: fix EMI rings for RRO Greg Kroah-Hartman
` (232 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shayne Chen, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit f1e9f369ae42ee433836b24467e645192d046a51 ]
Pass the correct mt7996_phy to mt7996_run().
Fixes: 0a5df0ec47f7 ("wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during restart")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251106064203.1000505-11-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index fe31db5440a84..b06728a98a691 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -2341,7 +2341,7 @@ mt7996_mac_restart(struct mt7996_dev *dev)
if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
continue;
- ret = mt7996_run(&dev->phy);
+ ret = mt7996_run(phy);
if (ret)
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 396/614] wifi: mt76: mt7996: fix EMI rings for RRO
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 395/614] wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 397/614] wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() Greg Kroah-Hartman
` (231 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rex Lu, Shayne Chen,
Lorenzo Bianconi, Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
[ Upstream commit a4031fec9d0d230224a7edcefa3368c06c317148 ]
The RRO EMI rings only need to be allocated when WED is not active.
This patch fixes command timeout issue for the setting of WED off and
RRO on.
Fixes: 3a29164425e9 ("wifi: mt76: mt7996: Add SW path for HW-RRO v3.1")
Co-developed-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Rex Lu <rex.lu@mediatek.com>
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251106064203.1000505-12-shayne.chen@mediatek.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/mediatek/mt76/mt7996/dma.c | 15 +++++++++------
.../net/wireless/mediatek/mt76/mt7996/init.c | 19 ++++++++++++++++---
2 files changed, 25 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
index 659015f93d323..7ed2f21b0e6db 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
@@ -512,12 +512,15 @@ int mt7996_dma_rro_init(struct mt7996_dev *dev)
if (ret)
return ret;
- /* We need to set cpu idx pointer before resetting the EMI
- * queues.
- */
- mdev->q_rx[MT_RXQ_RRO_RXDMAD_C].emi_cpu_idx =
- &dev->wed_rro.emi_rings_cpu.ptr->ring[0].idx;
- mt76_queue_reset(dev, &mdev->q_rx[MT_RXQ_RRO_RXDMAD_C], true);
+ if (!mtk_wed_device_active(&mdev->mmio.wed)) {
+ /* We need to set cpu idx pointer before resetting the
+ * EMI queues.
+ */
+ mdev->q_rx[MT_RXQ_RRO_RXDMAD_C].emi_cpu_idx =
+ &dev->wed_rro.emi_rings_cpu.ptr->ring[0].idx;
+ mt76_queue_reset(dev, &mdev->q_rx[MT_RXQ_RRO_RXDMAD_C],
+ true);
+ }
goto start_hw_rro;
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index 5e95a36b42d16..b136b9a669769 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -959,9 +959,10 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
MT7996_RRO_MSDU_PG_SIZE_PER_CR);
}
- if (dev->mt76.hwrro_mode == MT76_HWRRO_V3_1) {
+ if (!mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+ dev->mt76.hwrro_mode == MT76_HWRRO_V3_1) {
ptr = dmam_alloc_coherent(dev->mt76.dma_dev,
- sizeof(dev->wed_rro.emi_rings_cpu.ptr),
+ sizeof(*dev->wed_rro.emi_rings_cpu.ptr),
&dev->wed_rro.emi_rings_cpu.phy_addr,
GFP_KERNEL);
if (!ptr)
@@ -970,7 +971,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
dev->wed_rro.emi_rings_cpu.ptr = ptr;
ptr = dmam_alloc_coherent(dev->mt76.dma_dev,
- sizeof(dev->wed_rro.emi_rings_dma.ptr),
+ sizeof(*dev->wed_rro.emi_rings_dma.ptr),
&dev->wed_rro.emi_rings_dma.phy_addr,
GFP_KERNEL);
if (!ptr)
@@ -1036,6 +1037,18 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
dev->wed_rro.msdu_pg[i].phy_addr);
}
+ if (dev->wed_rro.emi_rings_cpu.ptr)
+ dmam_free_coherent(dev->mt76.dma_dev,
+ sizeof(*dev->wed_rro.emi_rings_cpu.ptr),
+ dev->wed_rro.emi_rings_cpu.ptr,
+ dev->wed_rro.emi_rings_cpu.phy_addr);
+
+ if (dev->wed_rro.emi_rings_dma.ptr)
+ dmam_free_coherent(dev->mt76.dma_dev,
+ sizeof(*dev->wed_rro.emi_rings_dma.ptr),
+ dev->wed_rro.emi_rings_dma.ptr,
+ dev->wed_rro.emi_rings_dma.phy_addr);
+
if (!dev->wed_rro.session.ptr)
return;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 397/614] wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 396/614] wifi: mt76: mt7996: fix EMI rings for RRO Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 398/614] wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() Greg Kroah-Hartman
` (230 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Ben Greear,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 5a4bcba26e9fbea87507a81ad891e70bb525014f ]
Grab mt76 mutex in mt7996_mac_sta_event routine in order to rely on
mt76_dereference() utility macro.
Fixes: ecd72f9695e7e ("wifi: mt76: mt7996: Support MLO in mt7996_mac_sta_event()")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Tested-by: Ben Greear <greearb@candelatech.com>
Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-1-259ebf11f654@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index beb455185f904..ead56ce4c0362 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1150,12 +1150,15 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
unsigned long links = sta->valid_links;
struct ieee80211_link_sta *link_sta;
unsigned int link_id;
+ int err = 0;
+
+ mutex_lock(&dev->mt76.mutex);
for_each_sta_active_link(vif, sta, link_sta, link_id) {
struct ieee80211_bss_conf *link_conf;
struct mt7996_sta_link *msta_link;
struct mt7996_vif_link *link;
- int i, err;
+ int i;
link_conf = link_conf_dereference_protected(vif, link_id);
if (!link_conf)
@@ -1175,12 +1178,12 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
link, msta_link,
CONN_STATE_CONNECT, true);
if (err)
- return err;
+ goto unlock;
err = mt7996_mcu_add_rate_ctrl(dev, msta_link->sta, vif,
link_id, false);
if (err)
- return err;
+ goto unlock;
msta_link->wcid.tx_info |= MT_WCID_TX_INFO_SET;
break;
@@ -1189,7 +1192,7 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
link, msta_link,
CONN_STATE_PORT_SECURE, false);
if (err)
- return err;
+ goto unlock;
break;
case MT76_STA_EVENT_DISASSOC:
for (i = 0; i < ARRAY_SIZE(msta_link->twt.flow); i++)
@@ -1209,8 +1212,10 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
break;
}
}
+unlock:
+ mutex_unlock(&dev->mt76.mutex);
- return 0;
+ return err;
}
static void
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 398/614] wifi: mt76: Move mt76_abort_scan out of mt76_reset_device()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 397/614] wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 399/614] wifi: mt76: mt7996: skip deflink accounting for offchannel links Greg Kroah-Hartman
` (229 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Ben Greear,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 6aaaaeacf18b2dc2b0f78f241800e0ea680938c7 ]
Move mt76_abort_scan routine out of mt76_reset_device() in order to
avoid a possible deadlock since mt76_reset_device routine is running
with mt76 mutex help and mt76_abort_scan_complete() can grab mt76 mutex
in some cases.
Fixes: b36d55610215a ("wifi: mt76: abort scan/roc on hw restart")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Tested-by: Ben Greear <greearb@candelatech.com>
Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-3-259ebf11f654@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mac80211.c | 2 --
drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 ++
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 ++
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 5ceaf78c9ea06..5e75861bf6f99 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -847,8 +847,6 @@ void mt76_reset_device(struct mt76_dev *dev)
}
rcu_read_unlock();
- mt76_abort_scan(dev);
-
INIT_LIST_HEAD(&dev->wcid_list);
INIT_LIST_HEAD(&dev->sta_poll_list);
dev->vif_mask = 0;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
index 1c0d310146d63..5caf818e82834 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
@@ -1451,6 +1451,8 @@ mt7915_mac_full_reset(struct mt7915_dev *dev)
if (ext_phy)
cancel_delayed_work_sync(&ext_phy->mac_work);
+ mt76_abort_scan(&dev->mt76);
+
mutex_lock(&dev->mt76.mutex);
for (i = 0; i < 10; i++) {
if (!mt7915_mac_restart(dev))
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index b06728a98a691..cfad46a532bb7 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -2424,6 +2424,8 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
mt7996_for_each_phy(dev, phy)
cancel_delayed_work_sync(&phy->mt76->mac_work);
+ mt76_abort_scan(&dev->mt76);
+
mutex_lock(&dev->mt76.mutex);
for (i = 0; i < 10; i++) {
if (!mt7996_mac_restart(dev))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 399/614] wifi: mt76: mt7996: skip deflink accounting for offchannel links
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 398/614] wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 400/614] wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove Greg Kroah-Hartman
` (228 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Ben Greear,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 4fe823b9ee0317b04ddc6d9e00fea892498aa0f2 ]
Do not take into account offchannel links for deflink accounting.
Fixes: a3316d2fc669f ("wifi: mt76: mt7996: set vif default link_id adding/removing vif links")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Tested-by: Ben Greear <greearb@candelatech.com>
Link: https://patch.msgid.link/20251114-mt76-fix-missing-mtx-v1-4-259ebf11f654@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index ead56ce4c0362..5ff7ab596f88c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -370,7 +370,8 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
ieee80211_iter_keys(mphy->hw, vif, mt7996_key_iter, &it);
- if (mvif->mt76.deflink_id == IEEE80211_LINK_UNSPECIFIED)
+ if (!mlink->wcid->offchannel &&
+ mvif->mt76.deflink_id == IEEE80211_LINK_UNSPECIFIED)
mvif->mt76.deflink_id = link_conf->link_id;
return 0;
@@ -401,7 +402,8 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
rcu_assign_pointer(dev->mt76.wcid[idx], NULL);
- if (mvif->mt76.deflink_id == link_conf->link_id) {
+ if (!mlink->wcid->offchannel &&
+ mvif->mt76.deflink_id == link_conf->link_id) {
struct ieee80211_bss_conf *iter;
unsigned int link_id;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 400/614] wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 399/614] wifi: mt76: mt7996: skip deflink accounting for offchannel links Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 401/614] wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Greg Kroah-Hartman
` (227 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Ben Greear,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 2a432a6d0066d4ce05a2d0eec1da9e061eb70c49 ]
mt7996_vif_link_remove routine is executed by mt76_scan_complete()
without holding the wiphy mutex triggering the following lockdep warning.
WARNING: CPU: 0 PID: 72 at net/mac80211/key.c:1029 ieee80211_iter_keys+0xe4/0x1a0 [mac80211]
CPU: 0 UID: 0 PID: 72 Comm: kworker/u32:2 Tainted: G S 6.18.0-rc5+ #27 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/15/2023
Workqueue: phy3 mt76_scan_work [mt76]
RIP: 0010:ieee80211_iter_keys+0xe4/0x1a0 [mac80211]
Code: 4c 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b 47 48 be ff ff ff ff 48 8d 78 68 e8 b4 eb 1e e1 85 c0 0f 85 49
ff ff ff 4c 8b ab 90 1a 00 00 48 8d 83 90
RSP: 0018:ffffc900002f7cb0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888127e00ee0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888127e00788 RDI: ffff88811132b5c8
RBP: ffffffffa0ddf400 R08: 0000000000000001 R09: 000000009dcc1dac
R10: 0000000000000001 R11: ffff88811132b5a0 R12: ffffc900002f7d00
R13: ffff8882581e6a80 R14: ffff888127e0afc8 R15: ffff888158832038
FS: 0000000000000000(0000) GS:ffff8884da486000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000030a0fd90 CR3: 0000000002c52004 CR4: 00000000003706f0
Call Trace:
<TASK>
? lock_acquire+0xc2/0x2c0
mt7996_vif_link_remove+0x64/0x2b0 [mt7996e]
mt76_put_vif_phy_link+0x41/0x50 [mt76]
mt76_scan_complete+0x77/0x100 [mt76]
mt76_scan_work+0x2eb/0x3f0 [mt76]
? process_one_work+0x1e5/0x6d0
process_one_work+0x221/0x6d0
worker_thread+0x19a/0x340
? rescuer_thread+0x450/0x450
kthread+0x108/0x220
? kthreads_online_cpu+0x110/0x110
ret_from_fork+0x1c6/0x220
? kthreads_online_cpu+0x110/0x110
ret_from_fork_asm+0x11/0x20
</TASK>
irq event stamp: 45471
hardirqs last enabled at (45477): [<ffffffff813d446e>] __up_console_sem+0x5e/0x70
hardirqs last disabled at (45482): [<ffffffff813d4453>] __up_console_sem+0x43/0x70
softirqs last enabled at (44500): [<ffffffff81f2ae0c>] napi_pp_put_page+0xac/0xd0
softirqs last disabled at (44498): [<ffffffff81fa32a0>] page_pool_put_unrefed_netmem+0x290/0x3d0
---[ end trace 0000000000000000 ]---
Fix the issue skipping ieee80211_iter_keys() for scanning links in
mt7996_vif_link_remove routine since we have not uploaded any hw keys
for these links.
Fixes: 04414d7bba78 ("wifi: mt76: mt7996: delete vif keys when requested")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Tested-by: Ben Greear <greearb@candelatech.com>
Link: https://patch.msgid.link/20251115-mt7996-key-iter-link-remove-fix-v1-1-4f3f4e1eaa78@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 5ff7ab596f88c..2ad52ae2c5f55 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -392,7 +392,8 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
};
int idx = msta_link->wcid.idx;
- ieee80211_iter_keys(mphy->hw, vif, mt7996_key_iter, &it);
+ if (!mlink->wcid->offchannel)
+ ieee80211_iter_keys(mphy->hw, vif, mt7996_key_iter, &it);
mt7996_mcu_add_sta(dev, link_conf, NULL, link, NULL,
CONN_STATE_DISCONNECT, false);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 401/614] wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 400/614] wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 402/614] mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() Greg Kroah-Hartman
` (226 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Felix Fietkau,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 7545551631fa63101f97974f49ac0b564814f703 ]
Grab the mt76 mutex running mt7996_mac_sta_rc_work() since it is
required by mt7996_mcu_add_rate_ctrl routine.
Fixes: 28d519d0d493a ("wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl_fixed()")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251118-mt7996-rc-work-missing-mtx-v1-1-0739c493a6cb@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index cfad46a532bb7..502136691a69e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -2860,6 +2860,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
LIST_HEAD(list);
u32 changed;
+ mutex_lock(&dev->mt76.mutex);
+
spin_lock_bh(&dev->mt76.sta_poll_lock);
list_splice_init(&dev->sta_rc_list, &list);
@@ -2892,6 +2894,8 @@ void mt7996_mac_sta_rc_work(struct work_struct *work)
}
spin_unlock_bh(&dev->mt76.sta_poll_lock);
+
+ mutex_unlock(&dev->mt76.mutex);
}
void mt7996_mac_work(struct work_struct *work)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 402/614] mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 401/614] wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 403/614] firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Greg Kroah-Hartman
` (225 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Lorenzo Bianconi,
Felix Fietkau, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 53d1548612670aa8b5d89745116cc33d9d172863 ]
In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the
subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function
returns an error without freeing sskb, leading to a memory leak.
Fix this by calling dev_kfree_skb() on sskb in the error handling path
to ensure it is properly released.
Fixes: 99c457d902cf9 ("mt76: mt7615: move mt7615_mcu_set_bmc to mt7615_mcu_ops")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/20251113062415.103611-1-zilin@seu.edu.cn
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index 4064e193d4dec..08ee2e861c4e2 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -874,8 +874,10 @@ mt7615_mcu_wtbl_sta_add(struct mt7615_phy *phy, struct ieee80211_vif *vif,
wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(&dev->mt76, &msta->wcid,
WTBL_RESET_AND_SET, NULL,
&wskb);
- if (IS_ERR(wtbl_hdr))
+ if (IS_ERR(wtbl_hdr)) {
+ dev_kfree_skb(sskb);
return PTR_ERR(wtbl_hdr);
+ }
if (enable) {
mt76_connac_mcu_wtbl_generic_tlv(&dev->mt76, wskb, vif, sta,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 403/614] firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 402/614] mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 404/614] staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Greg Kroah-Hartman
` (224 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Rothwell, Dinh Nguyen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinh Nguyen <dinguyen@kernel.org>
[ Upstream commit 377441d53a2df61b105e823b335010cd4f1a6e56 ]
Fix this warning that was generated from "make htmldocs":
WARNING: drivers/firmware/stratix10-svc.c:58 struct member 'intel_svc_fcs'
not described in 'stratix10_svc'
Fixes: e6281c26674e ("firmware: stratix10-svc: Add support for FCS")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Closes: https://lore.kernel.org/linux-next/20251106145941.37920e97@canb.auug.org.au/
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://patch.msgid.link/20251114185815.358423-1-dinguyen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/stratix10-svc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index 00f58e27f6de5..deee0e7be34bd 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -52,6 +52,7 @@ struct stratix10_svc_chan;
/**
* struct stratix10_svc - svc private data
* @stratix10_svc_rsu: pointer to stratix10 RSU device
+ * @intel_svc_fcs: pointer to the FCS device
*/
struct stratix10_svc {
struct platform_device *stratix10_svc_rsu;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 404/614] staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 403/614] firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 405/614] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Greg Kroah-Hartman
` (223 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianglei Nie, Andy Shevchenko,
Abdun Nihaal, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianglei Nie <niejianglei2021@163.com>
[ Upstream commit 47d3949a9b04cbcb0e10abae30c2b53e98706e11 ]
fbtft_probe_common() allocates a memory chunk for "info" with
fbtft_framebuffer_alloc(). When "display->buswidth == 0" is true, the
function returns without releasing the "info", which will lead to a
memory leak.
Fix it by calling fbtft_framebuffer_release() when "display->buswidth
== 0" is true.
Fixes: c296d5f9957c ("staging: fbtft: core support")
Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Abdun Nihaal <abdun.nihaal@gmail.com>
Link: https://patch.msgid.link/20251112192235.2088654-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/fbtft/fbtft-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
index 9e7b84071174c..8a5ccc8ae0a18 100644
--- a/drivers/staging/fbtft/fbtft-core.c
+++ b/drivers/staging/fbtft/fbtft-core.c
@@ -1171,8 +1171,8 @@ int fbtft_probe_common(struct fbtft_display *display,
par->pdev = pdev;
if (display->buswidth == 0) {
- dev_err(dev, "buswidth is not set\n");
- return -EINVAL;
+ ret = dev_err_probe(dev, -EINVAL, "buswidth is not set\n");
+ goto out_release;
}
/* write register functions */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 405/614] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 404/614] staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 406/614] bpftool: Allow bpftool to build with openssl < 3 Greg Kroah-Hartman
` (222 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Mentz, Ryan Huang,
Nicolin Chen, Pranjal Shrivastava, Jason Gunthorpe, Will Deacon,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Huang <tzukui@google.com>
[ Upstream commit 5941f0e0c1e0be03ebc15b461f64208f5250d3d9 ]
In arm_smmu_alloc_cd_tables(), the error check following the
dma_alloc_coherent() for cd_table->l2.l1tab incorrectly tests
cd_table->l2.l2ptrs.
This means an allocation failure for l1tab goes undetected, causing
the function to return 0 (success) erroneously.
Correct the check to test cd_table->l2.l1tab.
Fixes: e3b1be2e73db ("iommu/arm-smmu-v3: Reorganize struct arm_smmu_ctx_desc_cfg")
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Signed-off-by: Ryan Huang <tzukui@google.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 2a8b46b948f05..9780f40ba3e65 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -1464,7 +1464,7 @@ static int arm_smmu_alloc_cd_tables(struct arm_smmu_master *master)
cd_table->l2.l1tab = dma_alloc_coherent(smmu->dev, l1size,
&cd_table->cdtab_dma,
GFP_KERNEL);
- if (!cd_table->l2.l2ptrs) {
+ if (!cd_table->l2.l1tab) {
ret = -ENOMEM;
goto err_free_l2ptrs;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 406/614] bpftool: Allow bpftool to build with openssl < 3
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 405/614] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 407/614] selftests/bpf: Allow selftests to build with older xxd Greg Kroah-Hartman
` (221 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Maguire, Song Liu,
Quentin Monnet, Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit 90ae54b4c7eca42d5ce006dd0a8cb0b5bfbf80d0 ]
ERR_get_error_all()[1] is a openssl v3 API, so to make code
compatible with openssl v1 utilize ERR_get_err_line_data
instead. Since openssl is already a build requirement for
the kernel (minimum requirement openssl 1.0.0), this will
allow bpftool to compile where opensslv3 is not available.
Signing-related BPF selftests pass with openssl v1.
[1] https://docs.openssl.org/3.4/man3/ERR_get_error/
Fixes: 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Song Liu <song@kernel.org>
Acked-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/r/20251120084754.640405-2-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/sign.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tools/bpf/bpftool/sign.c b/tools/bpf/bpftool/sign.c
index b34f74d210e9c..f9b742f4bb104 100644
--- a/tools/bpf/bpftool/sign.c
+++ b/tools/bpf/bpftool/sign.c
@@ -28,6 +28,12 @@
#define OPEN_SSL_ERR_BUF_LEN 256
+/* Use deprecated in 3.0 ERR_get_error_line_data for openssl < 3 */
+#if !defined(OPENSSL_VERSION_MAJOR) || (OPENSSL_VERSION_MAJOR < 3)
+#define ERR_get_error_all(file, line, func, data, flags) \
+ ERR_get_error_line_data(file, line, data, flags)
+#endif
+
static void display_openssl_errors(int l)
{
char buf[OPEN_SSL_ERR_BUF_LEN];
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 407/614] selftests/bpf: Allow selftests to build with older xxd
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 406/614] bpftool: Allow bpftool to build with openssl < 3 Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 408/614] btrfs: fix double free of qgroup record after failure to add delayed ref head Greg Kroah-Hartman
` (220 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Maguire, Alexei Starovoitov,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit ad93ba02678eda5fc8e259cf4b52997e6fa570cf ]
Currently selftests require xxd with the "-n <name>" option
which allows the user to specify a name not derived from
the input object path. Instead of relying on this newer
feature, older xxd can be used if we link our desired name
("test_progs_verification_cert") to the input object.
Many distros ship xxd in vim-common package and do not have
the latest xxd with -n support.
Fixes: b720903e2b14d ("selftests/bpf: Enable signature verification for some lskel tests")
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Link: https://lore.kernel.org/r/20251120084754.640405-3-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/.gitignore | 1 +
tools/testing/selftests/bpf/Makefile | 6 ++++--
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore
index be1ee7ba7ce03..ca557e5668fd8 100644
--- a/tools/testing/selftests/bpf/.gitignore
+++ b/tools/testing/selftests/bpf/.gitignore
@@ -23,6 +23,7 @@ test_tcpnotify_user
test_libbpf
xdping
test_cpp
+test_progs_verification_cert
*.d
*.subskel.h
*.skel.h
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index f00587d4ede68..e59b2bbf8d920 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -721,7 +721,8 @@ $(VERIFICATION_CERT) $(PRIVATE_KEY): $(VERIFY_SIG_SETUP)
$(Q)$(VERIFY_SIG_SETUP) genkey $(BUILD_DIR)
$(VERIFY_SIG_HDR): $(VERIFICATION_CERT)
- $(Q)xxd -i -n test_progs_verification_cert $< > $@
+ $(Q)ln -fs $< test_progs_verification_cert && \
+ xxd -i test_progs_verification_cert > $@
# Define test_progs test runner.
TRUNNER_TESTS_DIR := prog_tests
@@ -893,7 +894,8 @@ EXTRA_CLEAN := $(SCRATCH_DIR) $(HOST_SCRATCH_DIR) \
$(addprefix $(OUTPUT)/,*.o *.d *.skel.h *.lskel.h *.subskel.h \
no_alu32 cpuv4 bpf_gcc \
liburandom_read.so) \
- $(OUTPUT)/FEATURE-DUMP.selftests
+ $(OUTPUT)/FEATURE-DUMP.selftests \
+ test_progs_verification_cert
.PHONY: docs docs-clean
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 408/614] btrfs: fix double free of qgroup record after failure to add delayed ref head
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 407/614] selftests/bpf: Allow selftests to build with older xxd Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 409/614] btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Greg Kroah-Hartman
` (219 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana,
Miquel Sabaté Solà, David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Sabaté Solà <mssola@mssola.com>
[ Upstream commit 725e46298876a2cc1f1c3fb22ba69d29102c3ddf ]
In the previous code it was possible to incur into a double kfree()
scenario when calling add_delayed_ref_head(). This could happen if the
record was reported to already exist in the
btrfs_qgroup_trace_extent_nolock() call, but then there was an error
later on add_delayed_ref_head(). In this case, since
add_delayed_ref_head() returned an error, the caller went to free the
record. Since add_delayed_ref_head() couldn't set this kfree'd pointer
to NULL, then kfree() would have acted on a non-NULL 'record' object
which was pointing to memory already freed by the callee.
The problem comes from the fact that the responsibility to kfree the
object is on both the caller and the callee at the same time. Hence, the
fix for this is to shift the ownership of the 'qrecord' object out of
the add_delayed_ref_head(). That is, we will never attempt to kfree()
the given object inside of this function, and will expect the caller to
act on the 'qrecord' object on its own. The only exception where the
'qrecord' object cannot be kfree'd is if it was inserted into the
tracing logic, for which we already have the 'qrecord_inserted_ret'
boolean to account for this. Hence, the caller has to kfree the object
only if add_delayed_ref_head() reports not to have inserted it on the
tracing logic.
As a side-effect of the above, we must guarantee that
'qrecord_inserted_ret' is properly initialized at the start of the
function, not at the end, and then set when an actual insert
happens. This way we avoid 'qrecord_inserted_ret' having an invalid
value on an early exit.
The documentation from the add_delayed_ref_head() has also been updated
to reflect on the exact ownership of the 'qrecord' object.
Fixes: 6ef8fbce0104 ("btrfs: fix missing error handling when adding delayed ref with qgroups enabled")
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/delayed-ref.c | 43 ++++++++++++++++++++++++++++++++----------
1 file changed, 33 insertions(+), 10 deletions(-)
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index 481802efaa143..f8fc26272f76c 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -798,9 +798,13 @@ static void init_delayed_ref_head(struct btrfs_delayed_ref_head *head_ref,
}
/*
- * helper function to actually insert a head node into the rbtree.
- * this does all the dirty work in terms of maintaining the correct
- * overall modification count.
+ * Helper function to actually insert a head node into the xarray. This does all
+ * the dirty work in terms of maintaining the correct overall modification
+ * count.
+ *
+ * The caller is responsible for calling kfree() on @qrecord. More specifically,
+ * if this function reports that it did not insert it as noted in
+ * @qrecord_inserted_ret, then it's safe to call kfree() on it.
*
* Returns an error pointer in case of an error.
*/
@@ -814,7 +818,14 @@ add_delayed_ref_head(struct btrfs_trans_handle *trans,
struct btrfs_delayed_ref_head *existing;
struct btrfs_delayed_ref_root *delayed_refs;
const unsigned long index = (head_ref->bytenr >> fs_info->sectorsize_bits);
- bool qrecord_inserted = false;
+
+ /*
+ * If 'qrecord_inserted_ret' is provided, then the first thing we need
+ * to do is to initialize it to false just in case we have an exit
+ * before trying to insert the record.
+ */
+ if (qrecord_inserted_ret)
+ *qrecord_inserted_ret = false;
delayed_refs = &trans->transaction->delayed_refs;
lockdep_assert_held(&delayed_refs->lock);
@@ -833,6 +844,12 @@ add_delayed_ref_head(struct btrfs_trans_handle *trans,
/* Record qgroup extent info if provided */
if (qrecord) {
+ /*
+ * Setting 'qrecord' but not 'qrecord_inserted_ret' will likely
+ * result in a memory leakage.
+ */
+ ASSERT(qrecord_inserted_ret != NULL);
+
int ret;
ret = btrfs_qgroup_trace_extent_nolock(fs_info, delayed_refs, qrecord,
@@ -840,12 +857,10 @@ add_delayed_ref_head(struct btrfs_trans_handle *trans,
if (ret) {
/* Clean up if insertion fails or item exists. */
xa_release(&delayed_refs->dirty_extents, index);
- /* Caller responsible for freeing qrecord on error. */
if (ret < 0)
return ERR_PTR(ret);
- kfree(qrecord);
- } else {
- qrecord_inserted = true;
+ } else if (qrecord_inserted_ret) {
+ *qrecord_inserted_ret = true;
}
}
@@ -888,8 +903,6 @@ add_delayed_ref_head(struct btrfs_trans_handle *trans,
delayed_refs->num_heads++;
delayed_refs->num_heads_ready++;
}
- if (qrecord_inserted_ret)
- *qrecord_inserted_ret = qrecord_inserted;
return head_ref;
}
@@ -1049,6 +1062,14 @@ static int add_delayed_ref(struct btrfs_trans_handle *trans,
xa_release(&delayed_refs->head_refs, index);
spin_unlock(&delayed_refs->lock);
ret = PTR_ERR(new_head_ref);
+
+ /*
+ * It's only safe to call kfree() on 'qrecord' if
+ * add_delayed_ref_head() has _not_ inserted it for
+ * tracing. Otherwise we need to handle this here.
+ */
+ if (!qrecord_reserved || qrecord_inserted)
+ goto free_head_ref;
goto free_record;
}
head_ref = new_head_ref;
@@ -1071,6 +1092,8 @@ static int add_delayed_ref(struct btrfs_trans_handle *trans,
if (qrecord_inserted)
return btrfs_qgroup_trace_extent_post(trans, record, generic_ref->bytenr);
+
+ kfree(record);
return 0;
free_record:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 409/614] btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 408/614] btrfs: fix double free of qgroup record after failure to add delayed ref head Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 410/614] btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() Greg Kroah-Hartman
` (218 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Boris Burkov,
David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <boris@bur.io>
[ Upstream commit 38e818718c5e04961eea0fa8feff3f100ce40408 ]
>From the memory-barriers.txt document regarding memory barrier ordering
guarantees:
(*) These guarantees do not apply to bitfields, because compilers often
generate code to modify these using non-atomic read-modify-write
sequences. Do not attempt to use bitfields to synchronize parallel
algorithms.
(*) Even in cases where bitfields are protected by locks, all fields
in a given bitfield must be protected by one lock. If two fields
in a given bitfield are protected by different locks, the compiler's
non-atomic read-modify-write sequences can cause an update to one
field to corrupt the value of an adjacent field.
btrfs_space_info has a bitfield sharing an underlying word consisting of
the fields full, chunk_alloc, and flush:
struct btrfs_space_info {
struct btrfs_fs_info * fs_info; /* 0 8 */
struct btrfs_space_info * parent; /* 8 8 */
...
int clamp; /* 172 4 */
unsigned int full:1; /* 176: 0 4 */
unsigned int chunk_alloc:1; /* 176: 1 4 */
unsigned int flush:1; /* 176: 2 4 */
...
Therefore, to be safe from parallel read-modify-writes losing a write to
one of the bitfield members protected by a lock, all writes to all the
bitfields must use the lock. They almost universally do, except for
btrfs_clear_space_info_full() which iterates over the space_infos and
writes out found->full = 0 without a lock.
Imagine that we have one thread completing a transaction in which we
finished deleting a block_group and are thus calling
btrfs_clear_space_info_full() while simultaneously the data reclaim
ticket infrastructure is running do_async_reclaim_data_space():
T1 T2
btrfs_commit_transaction
btrfs_clear_space_info_full
data_sinfo->full = 0
READ: full:0, chunk_alloc:0, flush:1
do_async_reclaim_data_space(data_sinfo)
spin_lock(&space_info->lock);
if(list_empty(tickets))
space_info->flush = 0;
READ: full: 0, chunk_alloc:0, flush:1
MOD/WRITE: full: 0, chunk_alloc:0, flush:0
spin_unlock(&space_info->lock);
return;
MOD/WRITE: full:0, chunk_alloc:0, flush:1
and now data_sinfo->flush is 1 but the reclaim worker has exited. This
breaks the invariant that flush is 0 iff there is no work queued or
running. Once this invariant is violated, future allocations that go
into __reserve_bytes() will add tickets to space_info->tickets but will
see space_info->flush is set to 1 and not queue the work. After this,
they will block forever on the resulting ticket, as it is now impossible
to kick the worker again.
I also confirmed by looking at the assembly of the affected kernel that
it is doing RMW operations. For example, to set the flush (3rd) bit to 0,
the assembly is:
andb $0xfb,0x60(%rbx)
and similarly for setting the full (1st) bit to 0:
andb $0xfe,-0x20(%rax)
So I think this is really a bug on practical systems. I have observed
a number of systems in this exact state, but am currently unable to
reproduce it.
Rather than leaving this footgun lying around for the future, take
advantage of the fact that there is room in the struct anyway, and that
it is already quite large and simply change the three bitfield members to
bools. This avoids writes to space_info->full having any effect on
writes to space_info->flush, regardless of locking.
Fixes: 957780eb2788 ("Btrfs: introduce ticketed enospc infrastructure")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Boris Burkov <boris@bur.io>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 6 +++---
fs/btrfs/space-info.c | 22 +++++++++++-----------
fs/btrfs/space-info.h | 6 +++---
3 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index 5322ef2ae015e..8bf501fbcc0be 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -4215,7 +4215,7 @@ int btrfs_chunk_alloc(struct btrfs_trans_handle *trans,
mutex_unlock(&fs_info->chunk_mutex);
} else {
/* Proceed with allocation */
- space_info->chunk_alloc = 1;
+ space_info->chunk_alloc = true;
wait_for_alloc = false;
spin_unlock(&space_info->lock);
}
@@ -4264,7 +4264,7 @@ int btrfs_chunk_alloc(struct btrfs_trans_handle *trans,
spin_lock(&space_info->lock);
if (ret < 0) {
if (ret == -ENOSPC)
- space_info->full = 1;
+ space_info->full = true;
else
goto out;
} else {
@@ -4274,7 +4274,7 @@ int btrfs_chunk_alloc(struct btrfs_trans_handle *trans,
space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
out:
- space_info->chunk_alloc = 0;
+ space_info->chunk_alloc = false;
spin_unlock(&space_info->lock);
mutex_unlock(&fs_info->chunk_mutex);
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 97452fb5d29b0..85c466c85910a 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -192,7 +192,7 @@ void btrfs_clear_space_info_full(struct btrfs_fs_info *info)
struct btrfs_space_info *found;
list_for_each_entry(found, head, list)
- found->full = 0;
+ found->full = false;
}
/*
@@ -372,7 +372,7 @@ void btrfs_add_bg_to_space_info(struct btrfs_fs_info *info,
space_info->bytes_readonly += block_group->bytes_super;
btrfs_space_info_update_bytes_zone_unusable(space_info, block_group->zone_unusable);
if (block_group->length > 0)
- space_info->full = 0;
+ space_info->full = false;
btrfs_try_granting_tickets(info, space_info);
spin_unlock(&space_info->lock);
@@ -1146,7 +1146,7 @@ static void do_async_reclaim_metadata_space(struct btrfs_space_info *space_info)
spin_lock(&space_info->lock);
to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info, space_info);
if (!to_reclaim) {
- space_info->flush = 0;
+ space_info->flush = false;
spin_unlock(&space_info->lock);
return;
}
@@ -1158,7 +1158,7 @@ static void do_async_reclaim_metadata_space(struct btrfs_space_info *space_info)
flush_space(fs_info, space_info, to_reclaim, flush_state, false);
spin_lock(&space_info->lock);
if (list_empty(&space_info->tickets)) {
- space_info->flush = 0;
+ space_info->flush = false;
spin_unlock(&space_info->lock);
return;
}
@@ -1201,7 +1201,7 @@ static void do_async_reclaim_metadata_space(struct btrfs_space_info *space_info)
flush_state = FLUSH_DELAYED_ITEMS_NR;
commit_cycles--;
} else {
- space_info->flush = 0;
+ space_info->flush = false;
}
} else {
flush_state = FLUSH_DELAYED_ITEMS_NR;
@@ -1383,7 +1383,7 @@ static void do_async_reclaim_data_space(struct btrfs_space_info *space_info)
spin_lock(&space_info->lock);
if (list_empty(&space_info->tickets)) {
- space_info->flush = 0;
+ space_info->flush = false;
spin_unlock(&space_info->lock);
return;
}
@@ -1394,7 +1394,7 @@ static void do_async_reclaim_data_space(struct btrfs_space_info *space_info)
flush_space(fs_info, space_info, U64_MAX, ALLOC_CHUNK_FORCE, false);
spin_lock(&space_info->lock);
if (list_empty(&space_info->tickets)) {
- space_info->flush = 0;
+ space_info->flush = false;
spin_unlock(&space_info->lock);
return;
}
@@ -1411,7 +1411,7 @@ static void do_async_reclaim_data_space(struct btrfs_space_info *space_info)
data_flush_states[flush_state], false);
spin_lock(&space_info->lock);
if (list_empty(&space_info->tickets)) {
- space_info->flush = 0;
+ space_info->flush = false;
spin_unlock(&space_info->lock);
return;
}
@@ -1428,7 +1428,7 @@ static void do_async_reclaim_data_space(struct btrfs_space_info *space_info)
if (maybe_fail_all_tickets(fs_info, space_info))
flush_state = 0;
else
- space_info->flush = 0;
+ space_info->flush = false;
} else {
flush_state = 0;
}
@@ -1444,7 +1444,7 @@ static void do_async_reclaim_data_space(struct btrfs_space_info *space_info)
aborted_fs:
maybe_fail_all_tickets(fs_info, space_info);
- space_info->flush = 0;
+ space_info->flush = false;
spin_unlock(&space_info->lock);
}
@@ -1825,7 +1825,7 @@ static int __reserve_bytes(struct btrfs_fs_info *fs_info,
*/
maybe_clamp_preempt(fs_info, space_info);
- space_info->flush = 1;
+ space_info->flush = true;
trace_btrfs_trigger_flush(fs_info,
space_info->flags,
orig_bytes, flush,
diff --git a/fs/btrfs/space-info.h b/fs/btrfs/space-info.h
index 679f22efb4073..a846f63585c95 100644
--- a/fs/btrfs/space-info.h
+++ b/fs/btrfs/space-info.h
@@ -142,11 +142,11 @@ struct btrfs_space_info {
flushing. The value is >> clamp, so turns
out to be a 2^clamp divisor. */
- unsigned int full:1; /* indicates that we cannot allocate any more
+ bool full; /* indicates that we cannot allocate any more
chunks for this space */
- unsigned int chunk_alloc:1; /* set if we are allocating a chunk */
+ bool chunk_alloc; /* set if we are allocating a chunk */
- unsigned int flush:1; /* set if we are trying to make space */
+ bool flush; /* set if we are trying to make space */
unsigned int force_alloc; /* set if we need to force a chunk
alloc for this space */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 410/614] btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 409/614] btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 411/614] btrfs: fix leaf leak in an error path in btrfs_del_items() Greg Kroah-Hartman
` (217 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qu Wenruo, David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit d435c513652e6a90a13c881986a2cc6420c99cab ]
Unlike queue_scrub_stripe() which uses the global sctx->extent_path and
sctx->csum_path which are always released at the end of scrub_stripe(),
scrub_raid56_parity_stripe() uses local extent_path and csum_path, as
that function is going to handle the full stripe, whose bytenr may be
smaller than the bytenr in the global sctx paths.
However the cleanup of local extent/csum paths is only happening after
we have successfully submitted an rbio.
There are several error routes that we didn't release those two paths:
- scrub_find_fill_first_stripe() errored out at csum tree search
In that case extent_path is still valid, and that function itself will
not release the extent_path passed in.
And the function returns directly without releasing both paths.
- The full stripe is empty
- Some blocks failed to be recovered
- btrfs_map_block() failed
- raid56_parity_alloc_scrub_rbio() failed
The function returns directly without releasing both paths.
Fix it by covering btrfs_release_path() calls inside the out: tag.
This is just a hot fix, in the long run we will go scoped based auto
freeing for both local paths.
Fixes: 1dc4888e725d ("btrfs: scrub: avoid unnecessary extent tree search preparing stripes")
Fixes: 3c771c194402 ("btrfs: scrub: avoid unnecessary csum tree search preparing stripes")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/scrub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index ba20d9286a340..65361af302343 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -2230,9 +2230,9 @@ static int scrub_raid56_parity_stripe(struct scrub_ctx *sctx,
bio_put(bio);
btrfs_bio_counter_dec(fs_info);
+out:
btrfs_release_path(&extent_path);
btrfs_release_path(&csum_path);
-out:
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 411/614] btrfs: fix leaf leak in an error path in btrfs_del_items()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 410/614] btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 412/614] PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Greg Kroah-Hartman
` (216 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Filipe Manana,
David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit e7dd1182fcedee7c6097c9f49eba8de94a4364e3 ]
If the call to btrfs_del_leaf() fails we return without decrementing the
extra ref we took on the leaf, therefore leaking it. Fix this by ensuring
we drop the ref count before returning the error.
Fixes: 751a27615dda ("btrfs: do not BUG_ON() on tree mod log failures at btrfs_del_ptr()")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ctree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 561658aca018b..6e053caa6e101 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -4566,9 +4566,9 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
if (btrfs_header_nritems(leaf) == 0) {
path->slots[1] = slot;
ret = btrfs_del_leaf(trans, root, path, leaf);
+ free_extent_buffer(leaf);
if (ret < 0)
return ret;
- free_extent_buffer(leaf);
ret = 0;
} else {
/* if we're still in the path, make sure
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 412/614] PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 411/614] btrfs: fix leaf leak in an error path in btrfs_del_items() Greg Kroah-Hartman
@ 2025-12-16 11:12 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 413/614] drm/nouveau: restrict the flush page to a 32-bit address Greg Kroah-Hartman
` (215 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Lin, Manivannan Sadhasivam,
Bjorn Helgaas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit bcc9a4a0bca3aee4303fa4a20302e57b24ac8f68 ]
As per DesignWare Cores PCI Express Controller Databook, section 5.50,
SII: Debug Signals, cxpl_debug_info[63:0]:
[5:0] smlh_ltssm_state: LTSSM current state. Encoding is same as the
dedicated smlh_ltssm_state output.
The mask should be 6 bits, from 0 to 5. Hence, fix the mask definition.
Fixes: 23fe5bd4be90 ("PCI: keystone: Cleanup ks_pcie_link_up()")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
[mani: reworded description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1763122140-203068-1-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pcie-designware.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
index e995f692a1ecd..24bfa5231923a 100644
--- a/drivers/pci/controller/dwc/pcie-designware.h
+++ b/drivers/pci/controller/dwc/pcie-designware.h
@@ -97,7 +97,7 @@
#define PORT_LANE_SKEW_INSERT_MASK GENMASK(23, 0)
#define PCIE_PORT_DEBUG0 0x728
-#define PORT_LOGIC_LTSSM_STATE_MASK 0x1f
+#define PORT_LOGIC_LTSSM_STATE_MASK 0x3f
#define PORT_LOGIC_LTSSM_STATE_L0 0x11
#define PCIE_PORT_DEBUG1 0x72C
#define PCIE_PORT_DEBUG1_LINK_UP BIT(4)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 413/614] drm/nouveau: restrict the flush page to a 32-bit address
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2025-12-16 11:12 ` [PATCH 6.18 412/614] PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 414/614] um: Dont rename vmap to kernel_vmap Greg Kroah-Hartman
` (214 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Timur Tabi, Lyude Paul, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <ttabi@nvidia.com>
[ Upstream commit 04d98b3452331fa53ec3b698b66273af6ef73288 ]
The flush page DMA address is stored in a special register that is not
associated with the GPU's standard DMA range. For example, on Turing,
the GPU's MMU can handle 47-bit addresses, but the flush page address
register is limited to 40 bits.
At the point during device initialization when the flush page is
allocated, the DMA mask is still at its default of 32 bits. So even
though it's unlikely that the flush page could exist above a 40-bit
address, the dma_map_page() call could fail, e.g. if IOMMU is disabled
and the address is above 32 bits. The simplest way to achieve all
constraints is to allocate the page in the DMA32 zone. Since the flush
page is literally just a page, this is an acceptable limitation. The
alternative is to temporarily set the DMA mask to 40 (or 52 for Hopper
and later) bits, but that could have unforseen side effects.
In situations where the flush page is allocated above 32 bits and IOMMU
is disabled, you will get an error like this:
nouveau 0000:65:00.0: DMA addr 0x0000000107c56000+4096 overflow (mask ffffffff, bus limit 0).
Fixes: 5728d064190e ("drm/nouveau/fb: handle sysmem flush page from common code")
Signed-off-by: Timur Tabi <ttabi@nvidia.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20251113230323.1271726-1-ttabi@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
index 8a286a9349ac6..7ce1b65e2c1c2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c
@@ -279,7 +279,7 @@ nvkm_fb_ctor(const struct nvkm_fb_func *func, struct nvkm_device *device,
mutex_init(&fb->tags.mutex);
if (func->sysmem.flush_page_init) {
- fb->sysmem.flush_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+ fb->sysmem.flush_page = alloc_page(GFP_KERNEL | GFP_DMA32 | __GFP_ZERO);
if (!fb->sysmem.flush_page)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 414/614] um: Dont rename vmap to kernel_vmap
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 413/614] drm/nouveau: restrict the flush page to a 32-bit address Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 415/614] iomap: always run error completions in user context Greg Kroah-Hartman
` (213 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Gow, Miguel Ojeda,
Johannes Berg, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gow <davidgow@google.com>
[ Upstream commit a74b6c0e53a6df8e8a096b50c06c4f872906368a ]
In order to work around the existence of a vmap symbol in libpcap, the
UML makefile unconditionally redefines vmap to kernel_vmap. However,
this not only affects the actual vmap symbol, but also anything else
named vmap, including a number of struct members in DRM.
This would not be too much of a problem, since all uses are also
updated, except we now have Rust DRM bindings, which expect the
corresponding Rust structs to have 'vmap' names. Since the redefinition
applies in bindgen, but not to Rust code, we end up with errors such as:
error[E0560]: struct `drm_gem_object_funcs` has no fields named `vmap`
--> rust/kernel/drm/gem/mod.rs:210:9
Since libpcap support was removed in commit 12b8e7e69aa7 ("um: Remove
obsolete pcap driver"), remove the, now unnecessary, define as well.
We also take this opportunity to update the comment.
Signed-off-by: David Gow <davidgow@google.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://patch.msgid.link/20251122083213.3996586-1-davidgow@google.com
Fixes: 12b8e7e69aa7 ("um: Remove obsolete pcap driver")
[adjust commmit message a bit]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/Makefile | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 7be0143b5ba35..721b652ffb658 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -46,19 +46,17 @@ ARCH_INCLUDE := -I$(srctree)/$(SHARED_HEADERS)
ARCH_INCLUDE += -I$(srctree)/$(HOST_DIR)/um/shared
KBUILD_CPPFLAGS += -I$(srctree)/$(HOST_DIR)/um
-# -Dvmap=kernel_vmap prevents anything from referencing the libpcap.o symbol so
-# named - it's a common symbol in libpcap, so we get a binary which crashes.
-#
-# Same things for in6addr_loopback and mktime - found in libc. For these two we
-# only get link-time error, luckily.
+# -Dstrrchr=kernel_strrchr (as well as the various in6addr symbols) prevents
+# anything from referencing
+# libc symbols with the same name, which can cause a linker error.
#
# -Dlongjmp=kernel_longjmp prevents anything from referencing the libpthread.a
# embedded copy of longjmp, same thing for setjmp.
#
-# These apply to USER_CFLAGS to.
+# These apply to USER_CFLAGS too.
KBUILD_CFLAGS += $(CFLAGS) $(CFLAGS-y) -D__arch_um__ \
- $(ARCH_INCLUDE) $(MODE_INCLUDE) -Dvmap=kernel_vmap \
+ $(ARCH_INCLUDE) $(MODE_INCLUDE) \
-Dlongjmp=kernel_longjmp -Dsetjmp=kernel_setjmp \
-Din6addr_loopback=kernel_in6addr_loopback \
-Din6addr_any=kernel_in6addr_any -Dstrrchr=kernel_strrchr \
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 415/614] iomap: always run error completions in user context
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 414/614] um: Dont rename vmap to kernel_vmap Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 416/614] iomap: allocate s_dio_done_wq for async reads as well Greg Kroah-Hartman
` (212 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jan Kara,
Chaitanya Kulkarni, Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit ddb4873286e03e193c5a3bebb5fc6fa820e9ee3a ]
At least zonefs expects error completions to be able to sleep. Because
error completions aren't performance critical, just defer them to workqueue
context unconditionally.
Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251113170633.1453259-3-hch@lst.de
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/iomap/direct-io.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c
index 5d5d63efbd576..143160042552b 100644
--- a/fs/iomap/direct-io.c
+++ b/fs/iomap/direct-io.c
@@ -179,7 +179,18 @@ static void iomap_dio_done(struct iomap_dio *dio)
WRITE_ONCE(dio->submit.waiter, NULL);
blk_wake_io_task(waiter);
- } else if (dio->flags & IOMAP_DIO_INLINE_COMP) {
+ return;
+ }
+
+ /*
+ * Always run error completions in user context. These are not
+ * performance critical and some code relies on taking sleeping locks
+ * for error handling.
+ */
+ if (dio->error)
+ dio->flags &= ~IOMAP_DIO_INLINE_COMP;
+
+ if (dio->flags & IOMAP_DIO_INLINE_COMP) {
WRITE_ONCE(iocb->private, NULL);
iomap_dio_complete_work(&dio->aio.work);
} else if (dio->flags & IOMAP_DIO_CALLER_COMP) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 416/614] iomap: allocate s_dio_done_wq for async reads as well
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 415/614] iomap: always run error completions in user context Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 417/614] wifi: ieee80211: correct FILS status codes Greg Kroah-Hartman
` (211 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a2b9a4ed0d61b1efb3f5,
Christoph Hellwig, Dave Chinner, Darrick J. Wong,
Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 7fd8720dff2d9c70cf5a1a13b7513af01952ec02 ]
Since commit 222f2c7c6d14 ("iomap: always run error completions in user
context"), read error completions are deferred to s_dio_done_wq. This
means the workqueue also needs to be allocated for async reads.
Fixes: 222f2c7c6d14 ("iomap: always run error completions in user context")
Reported-by: syzbot+a2b9a4ed0d61b1efb3f5@syzkaller.appspotmail.com
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251124140013.902853-1-hch@lst.de
Tested-by: syzbot+a2b9a4ed0d61b1efb3f5@syzkaller.appspotmail.com
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/iomap/direct-io.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c
index 143160042552b..6317e4cd42517 100644
--- a/fs/iomap/direct-io.c
+++ b/fs/iomap/direct-io.c
@@ -728,12 +728,12 @@ __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
}
goto out_free_dio;
}
+ }
- if (!wait_for_completion && !inode->i_sb->s_dio_done_wq) {
- ret = sb_init_dio_done_wq(inode->i_sb);
- if (ret < 0)
- goto out_free_dio;
- }
+ if (!wait_for_completion && !inode->i_sb->s_dio_done_wq) {
+ ret = sb_init_dio_done_wq(inode->i_sb);
+ if (ret < 0)
+ goto out_free_dio;
}
inode_dio_begin(inode);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 417/614] wifi: ieee80211: correct FILS status codes
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 416/614] iomap: allocate s_dio_done_wq for async reads as well Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 418/614] backlight: led-bl: Add devlink to supplier LEDs Greg Kroah-Hartman
` (210 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ria Thomas, Jeff Johnson,
Johannes Berg, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ria Thomas <ria.thomas@morsemicro.com>
[ Upstream commit 24d4da5c2565313c2ad3c43449937a9351a64407 ]
The FILS status codes are set to 108/109, but the IEEE 802.11-2020
spec defines them as 112/113. Update the enum so it matches the
specification and keeps the kernel consistent with standard values.
Fixes: a3caf7440ded ("cfg80211: Add support for FILS shared key authentication offload")
Signed-off-by: Ria Thomas <ria.thomas@morsemicro.com>
Reviewed-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Link: https://patch.msgid.link/20251124125637.3936154-1-ria.thomas@morsemicro.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ieee80211.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index ddff9102f6332..1f4679092e69d 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -3594,8 +3594,8 @@ enum ieee80211_statuscode {
WLAN_STATUS_DENIED_WITH_SUGGESTED_BAND_AND_CHANNEL = 99,
WLAN_STATUS_DENIED_DUE_TO_SPECTRUM_MANAGEMENT = 103,
/* 802.11ai */
- WLAN_STATUS_FILS_AUTHENTICATION_FAILURE = 108,
- WLAN_STATUS_UNKNOWN_AUTHENTICATION_SERVER = 109,
+ WLAN_STATUS_FILS_AUTHENTICATION_FAILURE = 112,
+ WLAN_STATUS_UNKNOWN_AUTHENTICATION_SERVER = 113,
WLAN_STATUS_SAE_HASH_TO_ELEMENT = 126,
WLAN_STATUS_SAE_PK = 127,
WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING = 133,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 418/614] backlight: led-bl: Add devlink to supplier LEDs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 417/614] wifi: ieee80211: correct FILS status codes Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 419/614] backlight: lp855x: Fix lp855x.h kernel-doc warnings Greg Kroah-Hartman
` (209 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ceresoli,
Daniel Thompson (RISCstar), Herve Codina, Alexander Sverdlin,
Lee Jones, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <luca.ceresoli@bootlin.com>
[ Upstream commit 9341d6698f4cfdfc374fb6944158d111ebe16a9d ]
LED Backlight is a consumer of one or multiple LED class devices, but
devlink is currently unable to create correct supplier-producer links when
the supplier is a class device. It creates instead a link where the
supplier is the parent of the expected device.
One consequence is that removal order is not correctly enforced.
Issues happen for example with the following sections in a device tree
overlay:
// An LED driver chip
pca9632@62 {
compatible = "nxp,pca9632";
reg = <0x62>;
// ...
addon_led_pwm: led-pwm@3 {
reg = <3>;
label = "addon:led:pwm";
};
};
backlight-addon {
compatible = "led-backlight";
leds = <&addon_led_pwm>;
brightness-levels = <255>;
default-brightness-level = <255>;
};
In this example, the devlink should be created between the backlight-addon
(consumer) and the pca9632@62 (supplier). Instead it is created between the
backlight-addon (consumer) and the parent of the pca9632@62, which is
typically the I2C bus adapter.
On removal of the above overlay, the LED driver can be removed before the
backlight device, resulting in:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
...
Call trace:
led_put+0xe0/0x140
devm_led_release+0x6c/0x98
Another way to reproduce the bug without any device tree overlays is
unbinding the LED class device (pca9632@62) before unbinding the consumer
(backlight-addon):
echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind
echo ...backlight-dock >/sys/bus/platform/drivers/led-backlight/unbind
Fix by adding a devlink between the consuming led-backlight device and the
supplying LED device, as other drivers and subsystems do as well.
Fixes: ae232e45acf9 ("backlight: add led-backlight driver")
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Tested-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://patch.msgid.link/20250519-led-backlight-add-devlink-to-supplier-class-device-v6-1-845224aeb2ce@bootlin.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/backlight/led_bl.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c
index efc5e380669ae..f7ab9b3607313 100644
--- a/drivers/video/backlight/led_bl.c
+++ b/drivers/video/backlight/led_bl.c
@@ -210,6 +210,19 @@ static int led_bl_probe(struct platform_device *pdev)
return PTR_ERR(priv->bl_dev);
}
+ for (i = 0; i < priv->nb_leds; i++) {
+ struct device_link *link;
+
+ link = device_link_add(&pdev->dev, priv->leds[i]->dev->parent,
+ DL_FLAG_AUTOREMOVE_CONSUMER);
+ if (!link) {
+ dev_err(&pdev->dev, "Failed to add devlink (consumer %s, supplier %s)\n",
+ dev_name(&pdev->dev), dev_name(priv->leds[i]->dev->parent));
+ backlight_device_unregister(priv->bl_dev);
+ return -EINVAL;
+ }
+ }
+
for (i = 0; i < priv->nb_leds; i++) {
mutex_lock(&priv->leds[i]->led_access);
led_sysfs_disable(priv->leds[i]);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 419/614] backlight: lp855x: Fix lp855x.h kernel-doc warnings
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 418/614] backlight: led-bl: Add devlink to supplier LEDs Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 420/614] iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Greg Kroah-Hartman
` (208 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap,
Daniel Thompson (RISCstar), Lee Jones, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 2d45db63260c6ae3cf007361e04a1c41bd265084 ]
Add a missing struct short description and a missing leading " *" to
lp855x.h to avoid kernel-doc warnings:
Warning: include/linux/platform_data/lp855x.h:126 missing initial short
description on line:
* struct lp855x_platform_data
Warning: include/linux/platform_data/lp855x.h:131 bad line:
Only valid when mode is PWM_BASED.
Fixes: 7be865ab8634 ("backlight: new backlight driver for LP855x devices")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
Link: https://patch.msgid.link/20251111060916.1995920-1-rdunlap@infradead.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/platform_data/lp855x.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/platform_data/lp855x.h b/include/linux/platform_data/lp855x.h
index ab222dd05bbc2..3b4a891acefe9 100644
--- a/include/linux/platform_data/lp855x.h
+++ b/include/linux/platform_data/lp855x.h
@@ -124,12 +124,12 @@ struct lp855x_rom_data {
};
/**
- * struct lp855x_platform_data
+ * struct lp855x_platform_data - lp855 platform-specific data
* @name : Backlight driver name. If it is not defined, default name is set.
* @device_control : value of DEVICE CONTROL register
* @initial_brightness : initial value of backlight brightness
* @period_ns : platform specific pwm period value. unit is nano.
- Only valid when mode is PWM_BASED.
+ * Only valid when mode is PWM_BASED.
* @size_program : total size of lp855x_rom_data
* @rom_data : list of new eeprom/eprom registers
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 420/614] iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 419/614] backlight: lp855x: Fix lp855x.h kernel-doc warnings Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 421/614] RDMA/irdma: Fix data race in irdma_sc_ccq_arm Greg Kroah-Hartman
` (207 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Will Deacon,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
[ Upstream commit 5583a55e074b33ccd88ac0542fd7cd656a7e2c8c ]
Some platforms (e.g. SC8280XP and X1E) support more than 128 stream
matching groups. This is more than what is defined as maximum by the ARM
SMMU architecture specification. Commit 122611347326 ("iommu/arm-smmu-qcom:
Limit the SMR groups to 128") disabled use of the additional groups because
they don't exhibit the same behavior as the architecture supported ones.
It seems like this is just another quirk of the hypervisor: When running
bare-metal without the hypervisor, the additional groups appear to behave
just like all others. The boot firmware uses some of the additional groups,
so ignoring them in this situation leads to stream match conflicts whenever
we allocate a new SMR group for the same SID.
The workaround exists primarily because the bypass quirk detection fails
when using a S2CR register from the additional matching groups, so let's
perform the test with the last reliable S2CR (127) and then limit the
number of SMR groups only if we detect that we are running below the
hypervisor (because of the bypass quirk).
Fixes: 122611347326 ("iommu/arm-smmu-qcom: Limit the SMR groups to 128")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 ++++++++++++++--------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index 57c097e876130..c939d0856b719 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -431,17 +431,19 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
/*
* Some platforms support more than the Arm SMMU architected maximum of
- * 128 stream matching groups. For unknown reasons, the additional
- * groups don't exhibit the same behavior as the architected registers,
- * so limit the groups to 128 until the behavior is fixed for the other
- * groups.
+ * 128 stream matching groups. The additional registers appear to have
+ * the same behavior as the architected registers in the hardware.
+ * However, on some firmware versions, the hypervisor does not
+ * correctly trap and emulate accesses to the additional registers,
+ * resulting in unexpected behavior.
+ *
+ * If there are more than 128 groups, use the last reliable group to
+ * detect if we need to apply the bypass quirk.
*/
- if (smmu->num_mapping_groups > 128) {
- dev_notice(smmu->dev, "\tLimiting the stream matching groups to 128\n");
- smmu->num_mapping_groups = 128;
- }
-
- last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1);
+ if (smmu->num_mapping_groups > 128)
+ last_s2cr = ARM_SMMU_GR0_S2CR(127);
+ else
+ last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1);
/*
* With some firmware versions writes to S2CR of type FAULT are
@@ -464,6 +466,11 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
reg = FIELD_PREP(ARM_SMMU_CBAR_TYPE, CBAR_TYPE_S1_TRANS_S2_BYPASS);
arm_smmu_gr1_write(smmu, ARM_SMMU_GR1_CBAR(qsmmu->bypass_cbndx), reg);
+
+ if (smmu->num_mapping_groups > 128) {
+ dev_notice(smmu->dev, "\tLimiting the stream matching groups to 128\n");
+ smmu->num_mapping_groups = 128;
+ }
}
for (i = 0; i < smmu->num_mapping_groups; i++) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 421/614] RDMA/irdma: Fix data race in irdma_sc_ccq_arm
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 420/614] iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 422/614] RDMA/irdma: Fix data race in irdma_free_pble Greg Kroah-Hartman
` (206 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Czurylo, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
[ Upstream commit a521928164433de44fed5aaf5f49aeb3f1fb96f5 ]
Adds a lock around irdma_sc_ccq_arm body to prevent inter-thread data race.
Fixes data race in irdma_sc_ccq_arm() reported by KCSAN:
BUG: KCSAN: data-race in irdma_sc_ccq_arm [irdma] / irdma_sc_ccq_arm [irdma]
read to 0xffff9d51b4034220 of 8 bytes by task 255 on cpu 11:
irdma_sc_ccq_arm+0x36/0xd0 [irdma]
irdma_cqp_ce_handler+0x300/0x310 [irdma]
cqp_compl_worker+0x2a/0x40 [irdma]
process_one_work+0x402/0x7e0
worker_thread+0xb3/0x6d0
kthread+0x178/0x1a0
ret_from_fork+0x2c/0x50
write to 0xffff9d51b4034220 of 8 bytes by task 89 on cpu 3:
irdma_sc_ccq_arm+0x7e/0xd0 [irdma]
irdma_cqp_ce_handler+0x300/0x310 [irdma]
irdma_wait_event+0xd4/0x3e0 [irdma]
irdma_handle_cqp_op+0xa5/0x220 [irdma]
irdma_hw_flush_wqes+0xb1/0x300 [irdma]
irdma_flush_wqes+0x22e/0x3a0 [irdma]
irdma_cm_disconn_true+0x4c7/0x5d0 [irdma]
irdma_disconnect_worker+0x35/0x50 [irdma]
process_one_work+0x402/0x7e0
worker_thread+0xb3/0x6d0
kthread+0x178/0x1a0
ret_from_fork+0x2c/0x50
value changed: 0x0000000000024000 -> 0x0000000000034000
Fixes: 3f49d6842569 ("RDMA/irdma: Implement HW Admin Queue OPs")
Signed-off-by: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-2-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/ctrl.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c
index 4ef1c29032f77..991ce4890bfb2 100644
--- a/drivers/infiniband/hw/irdma/ctrl.c
+++ b/drivers/infiniband/hw/irdma/ctrl.c
@@ -3950,11 +3950,13 @@ int irdma_sc_cqp_destroy(struct irdma_sc_cqp *cqp)
*/
void irdma_sc_ccq_arm(struct irdma_sc_cq *ccq)
{
+ unsigned long flags;
u64 temp_val;
u16 sw_cq_sel;
u8 arm_next_se;
u8 arm_seq_num;
+ spin_lock_irqsave(&ccq->dev->cqp_lock, flags);
get_64bit_val(ccq->cq_uk.shadow_area, 32, &temp_val);
sw_cq_sel = (u16)FIELD_GET(IRDMA_CQ_DBSA_SW_CQ_SELECT, temp_val);
arm_next_se = (u8)FIELD_GET(IRDMA_CQ_DBSA_ARM_NEXT_SE, temp_val);
@@ -3965,6 +3967,7 @@ void irdma_sc_ccq_arm(struct irdma_sc_cq *ccq)
FIELD_PREP(IRDMA_CQ_DBSA_ARM_NEXT_SE, arm_next_se) |
FIELD_PREP(IRDMA_CQ_DBSA_ARM_NEXT, 1);
set_64bit_val(ccq->cq_uk.shadow_area, 32, temp_val);
+ spin_unlock_irqrestore(&ccq->dev->cqp_lock, flags);
dma_wmb(); /* make sure shadow area is updated before arming */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 422/614] RDMA/irdma: Fix data race in irdma_free_pble
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 421/614] RDMA/irdma: Fix data race in irdma_sc_ccq_arm Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 423/614] RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 Greg Kroah-Hartman
` (205 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Czurylo, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
[ Upstream commit 81f44409fb4f027d1e6d54edbeba5156ad94b214 ]
Protects pble_rsrc counters with mutex to prevent data race.
Fixes the following data race in irdma_free_pble reported by KCSAN:
BUG: KCSAN: data-race in irdma_free_pble [irdma] / irdma_free_pble [irdma]
write to 0xffff91430baa0078 of 8 bytes by task 16956 on cpu 5:
irdma_free_pble+0x3b/0xb0 [irdma]
irdma_dereg_mr+0x108/0x110 [irdma]
ib_dereg_mr_user+0x74/0x160 [ib_core]
uverbs_free_mr+0x26/0x30 [ib_uverbs]
destroy_hw_idr_uobject+0x4a/0x90 [ib_uverbs]
uverbs_destroy_uobject+0x7b/0x330 [ib_uverbs]
uobj_destroy+0x61/0xb0 [ib_uverbs]
ib_uverbs_run_method+0x1f2/0x380 [ib_uverbs]
ib_uverbs_cmd_verbs+0x365/0x440 [ib_uverbs]
ib_uverbs_ioctl+0x111/0x190 [ib_uverbs]
__x64_sys_ioctl+0xc9/0x100
do_syscall_64+0x44/0xa0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
read to 0xffff91430baa0078 of 8 bytes by task 16953 on cpu 2:
irdma_free_pble+0x23/0xb0 [irdma]
irdma_dereg_mr+0x108/0x110 [irdma]
ib_dereg_mr_user+0x74/0x160 [ib_core]
uverbs_free_mr+0x26/0x30 [ib_uverbs]
destroy_hw_idr_uobject+0x4a/0x90 [ib_uverbs]
uverbs_destroy_uobject+0x7b/0x330 [ib_uverbs]
uobj_destroy+0x61/0xb0 [ib_uverbs]
ib_uverbs_run_method+0x1f2/0x380 [ib_uverbs]
ib_uverbs_cmd_verbs+0x365/0x440 [ib_uverbs]
ib_uverbs_ioctl+0x111/0x190 [ib_uverbs]
__x64_sys_ioctl+0xc9/0x100
do_syscall_64+0x44/0xa0
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
value changed: 0x0000000000005a62 -> 0x0000000000005a68
Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager")
Signed-off-by: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-3-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/pble.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/pble.c b/drivers/infiniband/hw/irdma/pble.c
index fa6325adaedec..28dfad7f940c2 100644
--- a/drivers/infiniband/hw/irdma/pble.c
+++ b/drivers/infiniband/hw/irdma/pble.c
@@ -506,12 +506,14 @@ int irdma_get_pble(struct irdma_hmc_pble_rsrc *pble_rsrc,
void irdma_free_pble(struct irdma_hmc_pble_rsrc *pble_rsrc,
struct irdma_pble_alloc *palloc)
{
- pble_rsrc->freedpbles += palloc->total_cnt;
-
if (palloc->level == PBLE_LEVEL_2)
free_lvl2(pble_rsrc, palloc);
else
irdma_prm_return_pbles(&pble_rsrc->pinfo,
&palloc->level1.chunkinfo);
+
+ mutex_lock(&pble_rsrc->pble_mutex_lock);
+ pble_rsrc->freedpbles += palloc->total_cnt;
pble_rsrc->stats_alloc_freed++;
+ mutex_unlock(&pble_rsrc->pble_mutex_lock);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 423/614] RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 422/614] RDMA/irdma: Fix data race in irdma_free_pble Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 424/614] RDMA/irdma: Fix SIGBUS in AEQ destroy Greg Kroah-Hartman
` (204 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Czurylo, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
[ Upstream commit 9e13d880ebae5da9b39ef2ed83a89737e927173f ]
During a refactor of the irdma GEN2 code, the kfree of the irdma_pci_f struct
in icrdma_remove(), which was originally introduced upstream as part of
commit 80f2ab46c2ee ("irdma: free iwdev->rf after removing MSI-X")
was accidentally removed.
Fixes: 0c2b80cac96e ("RDMA/irdma: Refactor GEN2 auxiliary driver")
Signed-off-by: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-4-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/icrdma_if.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
index 27b191f61caf4..5d3fd118e4f81 100644
--- a/drivers/infiniband/hw/irdma/icrdma_if.c
+++ b/drivers/infiniband/hw/irdma/icrdma_if.c
@@ -320,6 +320,8 @@ static void icrdma_remove(struct auxiliary_device *aux_dev)
irdma_ib_unregister_device(iwdev);
icrdma_deinit_interrupts(iwdev->rf, cdev_info);
+ kfree(iwdev->rf);
+
pr_debug("INIT: Gen[%d] func[%d] device remove success\n",
rdma_ver, PCI_FUNC(cdev_info->pdev->devfn));
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 424/614] RDMA/irdma: Fix SIGBUS in AEQ destroy
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 423/614] RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 425/614] RDMA/irdma: Add missing mutex destroy Greg Kroah-Hartman
` (203 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Czurylo, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
[ Upstream commit 5eff1ecce30143c3f8924d91770d81d44bd5abe5 ]
Removes write to IRDMA_PFINT_AEQCTL register prior to destroying AEQ,
as this register does not exist in GEN3+ hardware and this kind of IRQ
configuration is no longer required.
Fixes: b800e82feba7 ("RDMA/irdma: Add GEN3 support for AEQ and CEQ")
Signed-off-by: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-5-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/ctrl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c
index 991ce4890bfb2..cb970c9090ee0 100644
--- a/drivers/infiniband/hw/irdma/ctrl.c
+++ b/drivers/infiniband/hw/irdma/ctrl.c
@@ -4734,7 +4734,8 @@ static int irdma_sc_aeq_destroy(struct irdma_sc_aeq *aeq, u64 scratch,
u64 hdr;
dev = aeq->dev;
- if (dev->privileged)
+
+ if (dev->hw_attrs.uk_attrs.hw_rev <= IRDMA_GEN_2)
writel(0, dev->hw_regs[IRDMA_PFINT_AEQCTL]);
cqp = dev->cqp;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 425/614] RDMA/irdma: Add missing mutex destroy
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 424/614] RDMA/irdma: Fix SIGBUS in AEQ destroy Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 426/614] RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY Greg Kroah-Hartman
` (202 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anil Samal, Krzysztof Czurylo,
Tatyana Nikolova, Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Samal <anil.samal@intel.com>
[ Upstream commit 35bd787babd1f5a42641d0b1513edbed5d4e1624 ]
Add missing destroy of ah_tbl_lock and vchnl_mutex.
Fixes: d5edd33364a5 ("RDMA/irdma: RDMA/irdma: Add GEN3 core driver support")
Signed-off-by: Anil Samal <anil.samal@intel.com>
Signed-off-by: Krzysztof Czurylo <krzysztof.czurylo@intel.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-6-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/icrdma_if.c | 4 +++-
drivers/infiniband/hw/irdma/ig3rdma_if.c | 4 ++++
drivers/infiniband/hw/irdma/verbs.c | 4 +++-
3 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/icrdma_if.c b/drivers/infiniband/hw/irdma/icrdma_if.c
index 5d3fd118e4f81..b49fd9cf24765 100644
--- a/drivers/infiniband/hw/irdma/icrdma_if.c
+++ b/drivers/infiniband/hw/irdma/icrdma_if.c
@@ -302,7 +302,8 @@ static int icrdma_probe(struct auxiliary_device *aux_dev, const struct auxiliary
err_ctrl_init:
icrdma_deinit_interrupts(rf, cdev_info);
err_init_interrupts:
- kfree(iwdev->rf);
+ mutex_destroy(&rf->ah_tbl_lock);
+ kfree(rf);
ib_dealloc_device(&iwdev->ibdev);
return err;
@@ -319,6 +320,7 @@ static void icrdma_remove(struct auxiliary_device *aux_dev)
ice_rdma_update_vsi_filter(cdev_info, iwdev->vsi_num, false);
irdma_ib_unregister_device(iwdev);
icrdma_deinit_interrupts(iwdev->rf, cdev_info);
+ mutex_destroy(&iwdev->rf->ah_tbl_lock);
kfree(iwdev->rf);
diff --git a/drivers/infiniband/hw/irdma/ig3rdma_if.c b/drivers/infiniband/hw/irdma/ig3rdma_if.c
index 1bb42eb298ba6..e1d6670d9396e 100644
--- a/drivers/infiniband/hw/irdma/ig3rdma_if.c
+++ b/drivers/infiniband/hw/irdma/ig3rdma_if.c
@@ -55,6 +55,7 @@ static int ig3rdma_vchnl_init(struct irdma_pci_f *rf,
ret = irdma_sc_vchnl_init(&rf->sc_dev, &virt_info);
if (ret) {
destroy_workqueue(rf->vchnl_wq);
+ mutex_destroy(&rf->sc_dev.vchnl_mutex);
return ret;
}
@@ -124,7 +125,9 @@ static void ig3rdma_decfg_rf(struct irdma_pci_f *rf)
{
struct irdma_hw *hw = &rf->hw;
+ mutex_destroy(&rf->ah_tbl_lock);
destroy_workqueue(rf->vchnl_wq);
+ mutex_destroy(&rf->sc_dev.vchnl_mutex);
kfree(hw->io_regs);
iounmap(hw->rdma_reg.addr);
}
@@ -149,6 +152,7 @@ static int ig3rdma_cfg_rf(struct irdma_pci_f *rf,
err = ig3rdma_cfg_regions(&rf->hw, cdev_info);
if (err) {
destroy_workqueue(rf->vchnl_wq);
+ mutex_destroy(&rf->sc_dev.vchnl_mutex);
return err;
}
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c883c9ea5a831..c884f2ce282f9 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -5500,7 +5500,9 @@ void irdma_ib_dealloc_device(struct ib_device *ibdev)
irdma_rt_deinit_hw(iwdev);
if (!iwdev->is_vport) {
irdma_ctrl_deinit_hw(iwdev->rf);
- if (iwdev->rf->vchnl_wq)
+ if (iwdev->rf->vchnl_wq) {
destroy_workqueue(iwdev->rf->vchnl_wq);
+ mutex_destroy(&iwdev->rf->sc_dev.vchnl_mutex);
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 426/614] RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 425/614] RDMA/irdma: Add missing mutex destroy Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 427/614] RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ Greg Kroah-Hartman
` (201 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 71d3bdae5eab21cf8991a6f3cd914caa31d5a51f ]
The HW disables bounds checking for MRs with a length of zero, so
the driver will only allow a zero length MR if the "all_memory"
flag is set, and this flag is only set if IB_PD_UNSAFE_GLOBAL_RKEY
is set for the PD.
This means that the "get_dma_mr" method will currently fail unless
the IB_PD_UNSAFE_GLOBAL_RKEY flag is set. This has not been an issue
because the "get_dma_mr" method is only ever invoked if the device
does not support the local DMA key or if IB_PD_UNSAFE_GLOBAL_RKEY
is set, and so far, all IRDMA HW supports the local DMA lkey.
However, some new HW does not support the local DMA lkey, so the
"get_dma_mr" method needs to work without IB_PD_UNSAFE_GLOBAL_RKEY
being set.
To support HW that does not allow the local DMA lkey, the logic has
been changed to pass an explicit flag to indicate when a dma_mr is
being created so that the zero length will be allowed.
Also, the "all_memory" flag has been forced to false for normal MR
allocation since these MRs are never supposed to provide global
unsafe rkey semantics anyway; only the MR created with "get_dma_mr"
should support this.
Fixes: bb6d73d9add6 ("RDMA/irdma: Prevent zero-length STAG registration")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-7-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/cm.c | 2 +-
drivers/infiniband/hw/irdma/main.h | 2 +-
drivers/infiniband/hw/irdma/verbs.c | 15 ++++++++-------
drivers/infiniband/hw/irdma/verbs.h | 3 ++-
4 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/cm.c b/drivers/infiniband/hw/irdma/cm.c
index c6a0a661d6e7e..f4f4f92ba63ac 100644
--- a/drivers/infiniband/hw/irdma/cm.c
+++ b/drivers/infiniband/hw/irdma/cm.c
@@ -3710,7 +3710,7 @@ int irdma_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
iwpd = iwqp->iwpd;
tagged_offset = (uintptr_t)iwqp->ietf_mem.va;
ibmr = irdma_reg_phys_mr(&iwpd->ibpd, iwqp->ietf_mem.pa, buf_len,
- IB_ACCESS_LOCAL_WRITE, &tagged_offset);
+ IB_ACCESS_LOCAL_WRITE, &tagged_offset, false);
if (IS_ERR(ibmr)) {
ret = -ENOMEM;
goto error;
diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h
index 886b30da188ae..65ce4924dbfa6 100644
--- a/drivers/infiniband/hw/irdma/main.h
+++ b/drivers/infiniband/hw/irdma/main.h
@@ -556,7 +556,7 @@ void irdma_copy_ip_htonl(__be32 *dst, u32 *src);
u16 irdma_get_vlan_ipv4(u32 *addr);
void irdma_get_vlan_mac_ipv6(u32 *addr, u16 *vlan_id, u8 *mac);
struct ib_mr *irdma_reg_phys_mr(struct ib_pd *ib_pd, u64 addr, u64 size,
- int acc, u64 *iova_start);
+ int acc, u64 *iova_start, bool dma_mr);
int irdma_upload_qp_context(struct irdma_qp *iwqp, bool freeze, bool raw);
void irdma_cqp_ce_handler(struct irdma_pci_f *rf, struct irdma_sc_cq *cq);
int irdma_ah_cqp_op(struct irdma_pci_f *rf, struct irdma_sc_ah *sc_ah, u8 cmd,
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index c884f2ce282f9..8c44c3fcf9731 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -3108,7 +3108,6 @@ static int irdma_hw_alloc_stag(struct irdma_device *iwdev,
info->stag_idx = iwmr->stag >> IRDMA_CQPSQ_STAG_IDX_S;
info->pd_id = iwpd->sc_pd.pd_id;
info->total_len = iwmr->len;
- info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY;
info->remote_access = true;
cqp_info->cqp_cmd = IRDMA_OP_ALLOC_STAG;
cqp_info->post_sq = 1;
@@ -3119,7 +3118,7 @@ static int irdma_hw_alloc_stag(struct irdma_device *iwdev,
if (status)
return status;
- iwmr->is_hwreg = 1;
+ iwmr->is_hwreg = true;
return 0;
}
@@ -3263,7 +3262,7 @@ static int irdma_hwreg_mr(struct irdma_device *iwdev, struct irdma_mr *iwmr,
if (iwdev->rf->sc_dev.hw_attrs.uk_attrs.feature_flags & IRDMA_FEATURE_ATOMIC_OPS)
stag_info->remote_atomics_en = (access & IB_ACCESS_REMOTE_ATOMIC) ? 1 : 0;
stag_info->pd_id = iwpd->sc_pd.pd_id;
- stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY;
+ stag_info->all_memory = iwmr->dma_mr;
if (stag_info->access_rights & IRDMA_ACCESS_FLAGS_ZERO_BASED)
stag_info->addr_type = IRDMA_ADDR_TYPE_ZERO_BASED;
else
@@ -3290,7 +3289,7 @@ static int irdma_hwreg_mr(struct irdma_device *iwdev, struct irdma_mr *iwmr,
irdma_put_cqp_request(&iwdev->rf->cqp, cqp_request);
if (!ret)
- iwmr->is_hwreg = 1;
+ iwmr->is_hwreg = true;
return ret;
}
@@ -3663,7 +3662,7 @@ static int irdma_hwdereg_mr(struct ib_mr *ib_mr)
if (status)
return status;
- iwmr->is_hwreg = 0;
+ iwmr->is_hwreg = false;
return 0;
}
@@ -3786,9 +3785,10 @@ static struct ib_mr *irdma_rereg_user_mr(struct ib_mr *ib_mr, int flags,
* @size: size of memory to register
* @access: Access rights
* @iova_start: start of virtual address for physical buffers
+ * @dma_mr: Flag indicating whether this region is a PD DMA MR
*/
struct ib_mr *irdma_reg_phys_mr(struct ib_pd *pd, u64 addr, u64 size, int access,
- u64 *iova_start)
+ u64 *iova_start, bool dma_mr)
{
struct irdma_device *iwdev = to_iwdev(pd->device);
struct irdma_pbl *iwpbl;
@@ -3805,6 +3805,7 @@ struct ib_mr *irdma_reg_phys_mr(struct ib_pd *pd, u64 addr, u64 size, int access
iwpbl = &iwmr->iwpbl;
iwpbl->iwmr = iwmr;
iwmr->type = IRDMA_MEMREG_TYPE_MEM;
+ iwmr->dma_mr = dma_mr;
iwpbl->user_base = *iova_start;
stag = irdma_create_stag(iwdev);
if (!stag) {
@@ -3843,7 +3844,7 @@ static struct ib_mr *irdma_get_dma_mr(struct ib_pd *pd, int acc)
{
u64 kva = 0;
- return irdma_reg_phys_mr(pd, 0, 0, acc, &kva);
+ return irdma_reg_phys_mr(pd, 0, 0, acc, &kva, true);
}
/**
diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h
index ac8b387018350..aabbb3442098b 100644
--- a/drivers/infiniband/hw/irdma/verbs.h
+++ b/drivers/infiniband/hw/irdma/verbs.h
@@ -111,7 +111,8 @@ struct irdma_mr {
};
struct ib_umem *region;
int access;
- u8 is_hwreg;
+ bool is_hwreg:1;
+ bool dma_mr:1;
u16 type;
u32 page_cnt;
u64 page_size;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 427/614] RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 426/614] RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 428/614] RDMA/irdma: Remove doorbell elision logic Greg Kroah-Hartman
` (200 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit eef3ad030b08c0f100cb18de7f604442a1adb8c7 ]
The GEN3 hardware does not appear to support IBK_LOCAL_DMA_LKEY. Attempts
to use it will result in an AE.
Fixes: eb31dfc2b41a ("RDMA/irdma: Restrict Memory Window and CQE Timestamping to GEN3")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-8-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 8c44c3fcf9731..afccd9f08b8a5 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -27,7 +27,8 @@ static int irdma_query_device(struct ib_device *ibdev,
irdma_fw_minor_ver(&rf->sc_dev);
props->device_cap_flags = IB_DEVICE_MEM_WINDOW |
IB_DEVICE_MEM_MGT_EXTENSIONS;
- props->kernel_cap_flags = IBK_LOCAL_DMA_LKEY;
+ if (hw_attrs->uk_attrs.hw_rev < IRDMA_GEN_3)
+ props->kernel_cap_flags = IBK_LOCAL_DMA_LKEY;
props->vendor_id = pcidev->vendor;
props->vendor_part_id = pcidev->device;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 428/614] RDMA/irdma: Remove doorbell elision logic
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 427/614] RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 429/614] RDMA/irdma: Fix SRQ shadow area address initialization Greg Kroah-Hartman
` (199 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Tatyana Nikolova,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <jmoroni@google.com>
[ Upstream commit 62356fccb195f83d2ceafc787c5ba87ebbe5edfe ]
In some cases, this logic can result in doorbell writes being
skipped when they should not have been (at least on GEN3 HW),
so remove it. This also means that the mb() can be safely
downgraded to dma_wmb().
Fixes: 551c46edc769 ("RDMA/irdma: Add user/kernel shared libraries")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Link: https://patch.msgid.link/20251125025350.180-9-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/puda.c | 1 -
drivers/infiniband/hw/irdma/uk.c | 31 ++----------------------------
drivers/infiniband/hw/irdma/user.h | 1 -
3 files changed, 2 insertions(+), 31 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/puda.c b/drivers/infiniband/hw/irdma/puda.c
index 694e5a9ed15d0..9cd14a50f1a93 100644
--- a/drivers/infiniband/hw/irdma/puda.c
+++ b/drivers/infiniband/hw/irdma/puda.c
@@ -685,7 +685,6 @@ static int irdma_puda_qp_create(struct irdma_puda_rsrc *rsrc)
ukqp->rq_size = rsrc->rq_size;
IRDMA_RING_INIT(ukqp->sq_ring, ukqp->sq_size);
- IRDMA_RING_INIT(ukqp->initial_ring, ukqp->sq_size);
IRDMA_RING_INIT(ukqp->rq_ring, ukqp->rq_size);
ukqp->wqe_alloc_db = qp->pd->dev->wqe_alloc_db;
diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c
index ce1ae10c30fca..d5568584ad5e3 100644
--- a/drivers/infiniband/hw/irdma/uk.c
+++ b/drivers/infiniband/hw/irdma/uk.c
@@ -114,33 +114,8 @@ void irdma_clr_wqes(struct irdma_qp_uk *qp, u32 qp_wqe_idx)
*/
void irdma_uk_qp_post_wr(struct irdma_qp_uk *qp)
{
- u64 temp;
- u32 hw_sq_tail;
- u32 sw_sq_head;
-
- /* valid bit is written and loads completed before reading shadow */
- mb();
-
- /* read the doorbell shadow area */
- get_64bit_val(qp->shadow_area, 0, &temp);
-
- hw_sq_tail = (u32)FIELD_GET(IRDMA_QP_DBSA_HW_SQ_TAIL, temp);
- sw_sq_head = IRDMA_RING_CURRENT_HEAD(qp->sq_ring);
- if (sw_sq_head != qp->initial_ring.head) {
- if (sw_sq_head != hw_sq_tail) {
- if (sw_sq_head > qp->initial_ring.head) {
- if (hw_sq_tail >= qp->initial_ring.head &&
- hw_sq_tail < sw_sq_head)
- writel(qp->qp_id, qp->wqe_alloc_db);
- } else {
- if (hw_sq_tail >= qp->initial_ring.head ||
- hw_sq_tail < sw_sq_head)
- writel(qp->qp_id, qp->wqe_alloc_db);
- }
- }
- }
-
- qp->initial_ring.head = qp->sq_ring.head;
+ dma_wmb();
+ writel(qp->qp_id, qp->wqe_alloc_db);
}
/**
@@ -1574,7 +1549,6 @@ static void irdma_setup_connection_wqes(struct irdma_qp_uk *qp,
qp->conn_wqes = move_cnt;
IRDMA_RING_MOVE_HEAD_BY_COUNT_NOCHECK(qp->sq_ring, move_cnt);
IRDMA_RING_MOVE_TAIL_BY_COUNT(qp->sq_ring, move_cnt);
- IRDMA_RING_MOVE_HEAD_BY_COUNT_NOCHECK(qp->initial_ring, move_cnt);
}
/**
@@ -1719,7 +1693,6 @@ int irdma_uk_qp_init(struct irdma_qp_uk *qp, struct irdma_qp_uk_init_info *info)
qp->max_sq_frag_cnt = info->max_sq_frag_cnt;
sq_ring_size = qp->sq_size << info->sq_shift;
IRDMA_RING_INIT(qp->sq_ring, sq_ring_size);
- IRDMA_RING_INIT(qp->initial_ring, sq_ring_size);
if (info->first_sq_wq) {
irdma_setup_connection_wqes(qp, info);
qp->swqe_polarity = 1;
diff --git a/drivers/infiniband/hw/irdma/user.h b/drivers/infiniband/hw/irdma/user.h
index ab57f689827a0..aeebf768174ab 100644
--- a/drivers/infiniband/hw/irdma/user.h
+++ b/drivers/infiniband/hw/irdma/user.h
@@ -456,7 +456,6 @@ struct irdma_srq_uk {
struct irdma_uk_attrs *uk_attrs;
__le64 *shadow_area;
struct irdma_ring srq_ring;
- struct irdma_ring initial_ring;
u32 srq_id;
u32 srq_size;
u32 max_srq_frag_cnt;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 429/614] RDMA/irdma: Fix SRQ shadow area address initialization
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 428/614] RDMA/irdma: Remove doorbell elision logic Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 430/614] arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs Greg Kroah-Hartman
` (198 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jijun Wang, Jay Bhat,
Leon Romanovsky, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijun Wang <jijun.wang@intel.com>
[ Upstream commit 01dad9ca37c60d08f71e2ef639875ae895deede6 ]
Fix SRQ shadow area address initialization.
Fixes: 563e1feb5f6e ("RDMA/irdma: Add SRQ support")
Signed-off-by: Jijun Wang <jijun.wang@intel.com>
Signed-off-by: Jay Bhat <jay.bhat@intel.com>
Link: https://patch.msgid.link/20251125025350.180-10-tatyana.e.nikolova@intel.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index afccd9f08b8a5..b8655504da290 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -2307,8 +2307,8 @@ static int irdma_setup_kmode_srq(struct irdma_device *iwdev,
ukinfo->srq_size = depth >> shift;
ukinfo->shadow_area = mem->va + ring_size;
- info->shadow_area_pa = info->srq_pa + ring_size;
info->srq_pa = mem->pa;
+ info->shadow_area_pa = info->srq_pa + ring_size;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 430/614] arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 429/614] RDMA/irdma: Fix SRQ shadow area address initialization Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 431/614] drm/panthor: Avoid adding of kernel BOs to extobj list Greg Kroah-Hartman
` (197 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillaume La Roque, Neil Armstrong,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume La Roque <glaroque@baylibre.com>
[ Upstream commit a7ab6f946683e065fa22db1cc2f2748d4584178a ]
The original addition of cache information for the Amlogic S922X SoC
used the wrong next-level cache node for CPU cores 100 and 101,
incorrectly referencing `l2_cache_l`. These cores actually belong to
the big cluster and should reference `l2_cache_b`. Update the device
tree accordingly.
Fixes: e7f85e6c155a ("arm64: dts: amlogic: Add cache information to the Amlogic S922X SoC")
Signed-off-by: Guillaume La Roque <glaroque@baylibre.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20251123-fixkhadas-v1-1-045348f0a4c2@baylibre.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/amlogic/meson-g12b.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b.dtsi
index f04efa8282561..23358d94844c9 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b.dtsi
@@ -87,7 +87,7 @@ cpu100: cpu@100 {
i-cache-line-size = <32>;
i-cache-size = <0x8000>;
i-cache-sets = <32>;
- next-level-cache = <&l2_cache_l>;
+ next-level-cache = <&l2_cache_b>;
#cooling-cells = <2>;
};
@@ -103,7 +103,7 @@ cpu101: cpu@101 {
i-cache-line-size = <32>;
i-cache-size = <0x8000>;
i-cache-sets = <32>;
- next-level-cache = <&l2_cache_l>;
+ next-level-cache = <&l2_cache_b>;
#cooling-cells = <2>;
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 431/614] drm/panthor: Avoid adding of kernel BOs to extobj list
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 430/614] arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 432/614] clocksource/drivers/ralink: Fix resource leaks in init error path Greg Kroah-Hartman
` (196 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akash Goel, Boris Brezillon,
Steven Price, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash Goel <akash.goel@arm.com>
[ Upstream commit ce04ec03a9c2c4f3e60e26f21311b25d5a478208 ]
The kernel BOs unnecessarily got added to the external objects list
of drm_gpuvm, when mapping to GPU, which would have resulted in few
extra CPU cycles being spent at the time of job submission as
drm_exec_until_all_locked() loop iterates over all external objects.
Kernel BOs are private to a VM and so they share the dma_resv object of
the dummy GEM object created for a VM. Use of DRM_EXEC_IGNORE_DUPLICATES
flag ensured the recursive locking of the dummy GEM object was ignored.
Also no extra space got allocated to add fences to the dma_resv object
of dummy GEM object. So no other impact apart from few extra CPU cycles.
This commit sets the pointer to dma_resv object of GEM object of
kernel BOs before they are mapped to GPU, to prevent them from
being added to external objects list.
v2: Add R-bs and fixes tags
Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block")
Signed-off-by: Akash Goel <akash.goel@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251120172118.2741724-1-akash.goel@arm.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_gem.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c
index 14ed09d700f2f..43471babff86c 100644
--- a/drivers/gpu/drm/panthor/panthor_gem.c
+++ b/drivers/gpu/drm/panthor/panthor_gem.c
@@ -144,6 +144,9 @@ panthor_kernel_bo_create(struct panthor_device *ptdev, struct panthor_vm *vm,
bo = to_panthor_bo(&obj->base);
kbo->obj = &obj->base;
bo->flags = bo_flags;
+ bo->exclusive_vm_root_gem = panthor_vm_root_gem(vm);
+ drm_gem_object_get(bo->exclusive_vm_root_gem);
+ bo->base.base.resv = bo->exclusive_vm_root_gem->resv;
if (vm == panthor_fw_vm(ptdev))
debug_flags |= PANTHOR_DEBUGFS_GEM_USAGE_FLAG_FW_MAPPED;
@@ -167,9 +170,6 @@ panthor_kernel_bo_create(struct panthor_device *ptdev, struct panthor_vm *vm,
goto err_free_va;
kbo->vm = panthor_vm_get(vm);
- bo->exclusive_vm_root_gem = panthor_vm_root_gem(vm);
- drm_gem_object_get(bo->exclusive_vm_root_gem);
- bo->base.base.resv = bo->exclusive_vm_root_gem->resv;
return kbo;
err_free_va:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 432/614] clocksource/drivers/ralink: Fix resource leaks in init error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 431/614] drm/panthor: Avoid adding of kernel BOs to extobj list Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 433/614] clocksource/drivers/stm: Fix double deregistration on probe failure Greg Kroah-Hartman
` (195 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Daniel Lezcano,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 2ba8e2aae1324704565a7d4d66f199d056c9e3c6 ]
The ralink_systick_init() function does not release all acquired resources
on its error paths. If irq_of_parse_and_map() or a subsequent call fails,
the previously created I/O memory mapping and IRQ mapping are leaked.
Add goto-based error handling labels to ensure that all allocated
resources are correctly freed.
Fixes: 1f2acc5a8a0a ("MIPS: ralink: Add support for systick timer found on newer ralink SoC")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://patch.msgid.link/20251030090710.1603-1-vulab@iscas.ac.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-ralink.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/clocksource/timer-ralink.c b/drivers/clocksource/timer-ralink.c
index 6ecdb4228f763..68434d9ed9107 100644
--- a/drivers/clocksource/timer-ralink.c
+++ b/drivers/clocksource/timer-ralink.c
@@ -130,14 +130,15 @@ static int __init ralink_systick_init(struct device_node *np)
systick.dev.irq = irq_of_parse_and_map(np, 0);
if (!systick.dev.irq) {
pr_err("%pOFn: request_irq failed", np);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err_iounmap;
}
ret = clocksource_mmio_init(systick.membase + SYSTICK_COUNT, np->name,
SYSTICK_FREQ, 301, 16,
clocksource_mmio_readl_up);
if (ret)
- return ret;
+ goto err_free_irq;
clockevents_register_device(&systick.dev);
@@ -145,6 +146,12 @@ static int __init ralink_systick_init(struct device_node *np)
np, systick.dev.mult, systick.dev.shift);
return 0;
+
+err_free_irq:
+ irq_dispose_mapping(systick.dev.irq);
+err_iounmap:
+ iounmap(systick.membase);
+ return ret;
}
TIMER_OF_DECLARE(systick, "ralink,cevt-systick", ralink_systick_init);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 433/614] clocksource/drivers/stm: Fix double deregistration on probe failure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 432/614] clocksource/drivers/ralink: Fix resource leaks in init error path Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 434/614] clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind Greg Kroah-Hartman
` (194 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Daniel Lezcano,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6b38a8b31e2c5c2c3fd5f9848850788c190f216d ]
The purpose of the devm_add_action_or_reset() helper is to call the
action function in case adding an action ever fails so drop the clock
source deregistration from the error path to avoid deregistering twice.
Fixes: cec32ac75827 ("clocksource/drivers/nxp-timer: Add the System Timer Module for the s32gx platforms")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://patch.msgid.link/20251017055039.7307-1-johan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-nxp-stm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/clocksource/timer-nxp-stm.c b/drivers/clocksource/timer-nxp-stm.c
index bbc40623728fa..16d52167e949b 100644
--- a/drivers/clocksource/timer-nxp-stm.c
+++ b/drivers/clocksource/timer-nxp-stm.c
@@ -208,10 +208,8 @@ static int __init nxp_stm_clocksource_init(struct device *dev, struct stm_timer
return ret;
ret = devm_add_action_or_reset(dev, devm_clocksource_unregister, stm_timer);
- if (ret) {
- clocksource_unregister(&stm_timer->cs);
+ if (ret)
return ret;
- }
stm_sched_clock = stm_timer;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 434/614] clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 433/614] clocksource/drivers/stm: Fix double deregistration on probe failure Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 435/614] clocksource/drivers/nxp-pit: " Greg Kroah-Hartman
` (193 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Daniel Lezcano,
Marc Zyngier, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6aa10f0e2ef9eba1955be6a9d0a8eaecf6bdb7ae ]
Clockevents cannot be deregistered so suppress the bind attributes to
prevent the driver from being unbound and releasing the underlying
resources after registration.
Fixes: 4891f01527bb ("clocksource/drivers/arm_arch_timer: Add standalone MMIO driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20251111153226.579-2-johan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/arm_arch_timer_mmio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clocksource/arm_arch_timer_mmio.c b/drivers/clocksource/arm_arch_timer_mmio.c
index ebe1987d651eb..d10362692fdd3 100644
--- a/drivers/clocksource/arm_arch_timer_mmio.c
+++ b/drivers/clocksource/arm_arch_timer_mmio.c
@@ -426,6 +426,7 @@ static struct platform_driver arch_timer_mmio_drv = {
.driver = {
.name = "arch-timer-mmio",
.of_match_table = arch_timer_mmio_of_table,
+ .suppress_bind_attrs = true,
},
.probe = arch_timer_mmio_probe,
};
@@ -434,6 +435,7 @@ builtin_platform_driver(arch_timer_mmio_drv);
static struct platform_driver arch_timer_mmio_acpi_drv = {
.driver = {
.name = "gtdt-arm-mmio-timer",
+ .suppress_bind_attrs = true,
},
.probe = arch_timer_mmio_probe,
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 435/614] clocksource/drivers/nxp-pit: Prevent driver unbind
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 434/614] clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 436/614] clocksource/drivers/nxp-stm: Fix section mismatches Greg Kroah-Hartman
` (192 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Daniel Lezcano,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e25f964cf414dafa6bee5c9c2c0b1d1fb041dc92 ]
The driver does not support unbinding (e.g. as clockevents cannot be
deregistered) so suppress the bind attributes to prevent the driver from
being unbound and rebound after registration (and disabling the timer
when reprobing fails).
Even if the driver can currently only be built-in, also switch to
builtin_platform_driver() to prevent it from being unloaded should
modular builds ever be enabled.
Fixes: bee33f22d7c3 ("clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://patch.msgid.link/20251111153226.579-3-johan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-nxp-pit.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clocksource/timer-nxp-pit.c b/drivers/clocksource/timer-nxp-pit.c
index 2d0a3554b6bf7..d1740f18f7180 100644
--- a/drivers/clocksource/timer-nxp-pit.c
+++ b/drivers/clocksource/timer-nxp-pit.c
@@ -374,9 +374,10 @@ static struct platform_driver nxp_pit_driver = {
.driver = {
.name = "nxp-pit",
.of_match_table = pit_timer_of_match,
+ .suppress_bind_attrs = true,
},
.probe = pit_timer_probe,
};
-module_platform_driver(nxp_pit_driver);
+builtin_platform_driver(nxp_pit_driver);
TIMER_OF_DECLARE(vf610, "fsl,vf610-pit", pit_timer_init);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 436/614] clocksource/drivers/nxp-stm: Fix section mismatches
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 435/614] clocksource/drivers/nxp-pit: " Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 437/614] clocksource/drivers/nxp-stm: Prevent driver unbind Greg Kroah-Hartman
` (191 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Daniel Lezcano,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit b452d2c97eeccbf9c7ac5b3d2d9e80bf6d8a23db ]
Platform drivers can be probed after their init sections have been
discarded (e.g. on probe deferral or manual rebind through sysfs) so the
probe function must not live in init. Device managed resource actions
similarly cannot be discarded.
The "_probe" suffix of the driver structure name prevents modpost from
warning about this so replace it to catch any similar future issues.
Fixes: cec32ac75827 ("clocksource/drivers/nxp-timer: Add the System Timer Module for the s32gx platforms")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: stable@vger.kernel.org # 6.16
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://patch.msgid.link/20251017054943.7195-1-johan@kernel.org
Stable-dep-of: 6a2416892e89 ("clocksource/drivers/nxp-stm: Prevent driver unbind")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-nxp-stm.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/clocksource/timer-nxp-stm.c b/drivers/clocksource/timer-nxp-stm.c
index 16d52167e949b..c320d764b12e2 100644
--- a/drivers/clocksource/timer-nxp-stm.c
+++ b/drivers/clocksource/timer-nxp-stm.c
@@ -177,15 +177,15 @@ static void nxp_stm_clocksource_resume(struct clocksource *cs)
nxp_stm_clocksource_enable(cs);
}
-static void __init devm_clocksource_unregister(void *data)
+static void devm_clocksource_unregister(void *data)
{
struct stm_timer *stm_timer = data;
clocksource_unregister(&stm_timer->cs);
}
-static int __init nxp_stm_clocksource_init(struct device *dev, struct stm_timer *stm_timer,
- const char *name, void __iomem *base, struct clk *clk)
+static int nxp_stm_clocksource_init(struct device *dev, struct stm_timer *stm_timer,
+ const char *name, void __iomem *base, struct clk *clk)
{
int ret;
@@ -296,9 +296,9 @@ static void nxp_stm_clockevent_resume(struct clock_event_device *ced)
nxp_stm_module_get(stm_timer);
}
-static int __init nxp_stm_clockevent_per_cpu_init(struct device *dev, struct stm_timer *stm_timer,
- const char *name, void __iomem *base, int irq,
- struct clk *clk, int cpu)
+static int nxp_stm_clockevent_per_cpu_init(struct device *dev, struct stm_timer *stm_timer,
+ const char *name, void __iomem *base, int irq,
+ struct clk *clk, int cpu)
{
stm_timer->base = base;
stm_timer->rate = clk_get_rate(clk);
@@ -386,7 +386,7 @@ static irqreturn_t nxp_stm_module_interrupt(int irq, void *dev_id)
return IRQ_HANDLED;
}
-static int __init nxp_stm_timer_probe(struct platform_device *pdev)
+static int nxp_stm_timer_probe(struct platform_device *pdev)
{
struct stm_timer *stm_timer;
struct device *dev = &pdev->dev;
@@ -482,14 +482,14 @@ static const struct of_device_id nxp_stm_of_match[] = {
};
MODULE_DEVICE_TABLE(of, nxp_stm_of_match);
-static struct platform_driver nxp_stm_probe = {
+static struct platform_driver nxp_stm_driver = {
.probe = nxp_stm_timer_probe,
.driver = {
.name = "nxp-stm",
.of_match_table = nxp_stm_of_match,
},
};
-module_platform_driver(nxp_stm_probe);
+module_platform_driver(nxp_stm_driver);
MODULE_DESCRIPTION("NXP System Timer Module driver");
MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 437/614] clocksource/drivers/nxp-stm: Prevent driver unbind
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 436/614] clocksource/drivers/nxp-stm: Fix section mismatches Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 438/614] ASoC: nau8325: use simple i2c probe function Greg Kroah-Hartman
` (190 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Daniel Lezcano,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6a2416892e8942f5e2bfe9b85c0164f410a53a2d ]
Clockevents cannot be deregistered so suppress the bind attributes to
prevent the driver from being unbound and releasing the underlying
resources after registration.
Even if the driver can currently only be built-in, also switch to
builtin_platform_driver() to prevent it from being unloaded should
modular builds ever be enabled.
Fixes: cec32ac75827 ("clocksource/drivers/nxp-timer: Add the System Timer Module for the s32gx platforms")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://patch.msgid.link/20251111153226.579-4-johan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-nxp-stm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clocksource/timer-nxp-stm.c b/drivers/clocksource/timer-nxp-stm.c
index c320d764b12e2..1ab907233f481 100644
--- a/drivers/clocksource/timer-nxp-stm.c
+++ b/drivers/clocksource/timer-nxp-stm.c
@@ -487,9 +487,10 @@ static struct platform_driver nxp_stm_driver = {
.driver = {
.name = "nxp-stm",
.of_match_table = nxp_stm_of_match,
+ .suppress_bind_attrs = true,
},
};
-module_platform_driver(nxp_stm_driver);
+builtin_platform_driver(nxp_stm_driver);
MODULE_DESCRIPTION("NXP System Timer Module driver");
MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 438/614] ASoC: nau8325: use simple i2c probe function
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 437/614] clocksource/drivers/nxp-stm: Prevent driver unbind Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 439/614] ASoC: nau8325: add missing build config Greg Kroah-Hartman
` (189 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jaroslav Kysela, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <perex@perex.cz>
[ Upstream commit b4d072c98e47c562834f2a050ca98a1c709ef4f9 ]
The i2c probe functions here don't use the id information provided in
their second argument, so the single-parameter i2c probe function
("probe_new") can be used instead.
This avoids scanning the identifier tables during probes.
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://patch.msgid.link/20251126091759.2490019-2-perex@perex.cz
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: cd41d3420ef6 ("ASoC: nau8325: add missing build config")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/nau8325.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/sound/soc/codecs/nau8325.c b/sound/soc/codecs/nau8325.c
index 2266f320a8f22..5b3115b0a7e58 100644
--- a/sound/soc/codecs/nau8325.c
+++ b/sound/soc/codecs/nau8325.c
@@ -829,8 +829,7 @@ static int nau8325_read_device_properties(struct device *dev,
return 0;
}
-static int nau8325_i2c_probe(struct i2c_client *i2c,
- const struct i2c_device_id *id)
+static int nau8325_i2c_probe(struct i2c_client *i2c)
{
struct device *dev = &i2c->dev;
struct nau8325 *nau8325 = dev_get_platdata(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 439/614] ASoC: nau8325: add missing build config
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 438/614] ASoC: nau8325: use simple i2c probe function Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 440/614] gfs2: Prevent recursive memory reclaim Greg Kroah-Hartman
` (188 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seven Lee, Jaroslav Kysela,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <perex@perex.cz>
[ Upstream commit cd41d3420ef658b2ca902d7677536ec8e25b610a ]
This configuration was missing from the initial commit.
Found by Jiri Benc <jbenc@redhat.com>
Fixes: c0a3873b9938 ("ASoC: nau8325: new driver")
Cc: Seven Lee <wtli@nuvoton.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://patch.msgid.link/20251126091759.2490019-3-perex@perex.cz
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/Kconfig | 5 +++++
sound/soc/codecs/Makefile | 2 ++
2 files changed, 7 insertions(+)
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 160c07699a8b7..91ac99bc3edb2 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -170,6 +170,7 @@ config SND_SOC_ALL_CODECS
imply SND_SOC_MT6359
imply SND_SOC_MT6660
imply SND_SOC_NAU8315
+ imply SND_SOC_NAU8325
imply SND_SOC_NAU8540
imply SND_SOC_NAU8810
imply SND_SOC_NAU8821
@@ -2715,6 +2716,10 @@ config SND_SOC_MT6660
config SND_SOC_NAU8315
tristate "Nuvoton Technology Corporation NAU8315 CODEC"
+config SND_SOC_NAU8325
+ tristate "Nuvoton Technology Corporation NAU8325 CODEC"
+ depends on I2C
+
config SND_SOC_NAU8540
tristate "Nuvoton Technology Corporation NAU85L40 CODEC"
depends on I2C
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index bd95a7c911d5c..da4077463278e 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -192,6 +192,7 @@ snd-soc-mt6359-y := mt6359.o
snd-soc-mt6359-accdet-y := mt6359-accdet.o
snd-soc-mt6660-y := mt6660.o
snd-soc-nau8315-y := nau8315.o
+snd-soc-nau8325-y := nau8325.o
snd-soc-nau8540-y := nau8540.o
snd-soc-nau8810-y := nau8810.o
snd-soc-nau8821-y := nau8821.o
@@ -618,6 +619,7 @@ obj-$(CONFIG_SND_SOC_MT6359) += snd-soc-mt6359.o
obj-$(CONFIG_SND_SOC_MT6359_ACCDET) += mt6359-accdet.o
obj-$(CONFIG_SND_SOC_MT6660) += snd-soc-mt6660.o
obj-$(CONFIG_SND_SOC_NAU8315) += snd-soc-nau8315.o
+obj-$(CONFIG_SND_SOC_NAU8325) += snd-soc-nau8325.o
obj-$(CONFIG_SND_SOC_NAU8540) += snd-soc-nau8540.o
obj-$(CONFIG_SND_SOC_NAU8810) += snd-soc-nau8810.o
obj-$(CONFIG_SND_SOC_NAU8821) += snd-soc-nau8821.o
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 440/614] gfs2: Prevent recursive memory reclaim
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 439/614] ASoC: nau8325: add missing build config Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 441/614] ASoC: fsl_xcvr: clear the channel status control memory Greg Kroah-Hartman
` (187 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Price, Andreas Gruenbacher,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 2c5f4a53476e3cab70adc77b38942c066bd2c17c ]
Function new_inode() returns a new inode with inode->i_mapping->gfp_mask
set to GFP_HIGHUSER_MOVABLE. This value includes the __GFP_FS flag, so
allocations in that address space can recurse into filesystem memory
reclaim. We don't want that to happen because it can consume a
significant amount of stack memory.
Worse than that is that it can also deadlock: for example, in several
places, gfs2_unstuff_dinode() is called inside filesystem transactions.
This calls filemap_grab_folio(), which can allocate a new folio, which
can trigger memory reclaim. If memory reclaim recurses into the
filesystem and starts another transaction, a deadlock will ensue.
To fix these kinds of problems, prevent memory reclaim from recursing
into filesystem code by making sure that the gfp_mask of inode address
spaces doesn't include __GFP_FS.
The "meta" and resource group address spaces were already using GFP_NOFS
as their gfp_mask (which doesn't include __GFP_FS). The default value
of GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though. To
avoid being overly limiting, use the default value and only knock off
the __GFP_FS flag. I'm not sure if this will actually make a
difference, but it also shouldn't hurt.
This patch is loosely based on commit ad22c7a043c2 ("xfs: prevent stack
overflows from page cache allocation").
Fixes xfstest generic/273.
Fixes: dc0b9435238c ("gfs: Don't use GFP_NOFS in gfs2_unstuff_dinode")
Reviewed-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/glock.c | 5 ++++-
fs/gfs2/inode.c | 15 +++++++++++++++
fs/gfs2/inode.h | 1 +
fs/gfs2/ops_fstype.c | 2 +-
4 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index b677c0e6b9ab3..9f2eb7e385695 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1211,10 +1211,13 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
mapping = gfs2_glock2aspace(gl);
if (mapping) {
+ gfp_t gfp_mask;
+
mapping->a_ops = &gfs2_meta_aops;
mapping->host = sdp->sd_inode;
mapping->flags = 0;
- mapping_set_gfp_mask(mapping, GFP_NOFS);
+ gfp_mask = mapping_gfp_mask(sdp->sd_inode->i_mapping);
+ mapping_set_gfp_mask(mapping, gfp_mask);
mapping->i_private_data = NULL;
mapping->writeback_index = 0;
}
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 8a7ed80d9f2d6..d7e35a05c1610 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -89,6 +89,19 @@ static int iget_set(struct inode *inode, void *opaque)
return 0;
}
+void gfs2_setup_inode(struct inode *inode)
+{
+ gfp_t gfp_mask;
+
+ /*
+ * Ensure all page cache allocations are done from GFP_NOFS context to
+ * prevent direct reclaim recursion back into the filesystem and blowing
+ * stacks or deadlocking.
+ */
+ gfp_mask = mapping_gfp_mask(inode->i_mapping);
+ mapping_set_gfp_mask(inode->i_mapping, gfp_mask & ~__GFP_FS);
+}
+
/**
* gfs2_inode_lookup - Lookup an inode
* @sb: The super block
@@ -132,6 +145,7 @@ struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned int type,
struct gfs2_glock *io_gl;
int extra_flags = 0;
+ gfs2_setup_inode(inode);
error = gfs2_glock_get(sdp, no_addr, &gfs2_inode_glops, CREATE,
&ip->i_gl);
if (unlikely(error))
@@ -752,6 +766,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
error = -ENOMEM;
if (!inode)
goto fail_gunlock;
+ gfs2_setup_inode(inode);
ip = GFS2_I(inode);
error = posix_acl_create(dir, &mode, &default_acl, &acl);
diff --git a/fs/gfs2/inode.h b/fs/gfs2/inode.h
index e43f08eb26e72..2fcd96dd13613 100644
--- a/fs/gfs2/inode.h
+++ b/fs/gfs2/inode.h
@@ -86,6 +86,7 @@ static inline int gfs2_check_internal_file_size(struct inode *inode,
return -EIO;
}
+void gfs2_setup_inode(struct inode *inode);
struct inode *gfs2_inode_lookup(struct super_block *sb, unsigned type,
u64 no_addr, u64 no_formal_ino,
unsigned int blktype);
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index aa15183f9a168..1a2db8053da04 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1183,7 +1183,7 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
mapping = gfs2_aspace(sdp);
mapping->a_ops = &gfs2_rgrp_aops;
- mapping_set_gfp_mask(mapping, GFP_NOFS);
+ gfs2_setup_inode(sdp->sd_inode);
error = init_names(sdp, silent);
if (error)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 441/614] ASoC: fsl_xcvr: clear the channel status control memory
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 440/614] gfs2: Prevent recursive memory reclaim Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 442/614] firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Greg Kroah-Hartman
` (186 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit 73b97d46dde64fa184d47865d4a532d818c3a007 ]
memset_io() writes memory byte by byte with __raw_writeb() on the arm
platform if the size is word. but XCVR data RAM memory can't be accessed
with byte address, so with memset_io() the channel status control memory
is not really cleared, use writel_relaxed() instead.
Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20251126064509.1900974-1-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_xcvr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
index 5d804860f7d8c..58db4906a01d5 100644
--- a/sound/soc/fsl/fsl_xcvr.c
+++ b/sound/soc/fsl/fsl_xcvr.c
@@ -1421,7 +1421,7 @@ static irqreturn_t irq0_isr(int irq, void *devid)
bitrev32(val);
}
/* clear CS control register */
- memset_io(reg_ctrl, 0, sizeof(val));
+ writel_relaxed(0, reg_ctrl);
}
} else {
regmap_read(xcvr->regmap, FSL_XCVR_RX_CS_DATA_0,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 442/614] firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 441/614] ASoC: fsl_xcvr: clear the channel status control memory Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 443/614] greybus: gb-beagleplay: Fix timeout handling in bootloader functions Greg Kroah-Hartman
` (185 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexandre Courbot, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Courbot <acourbot@nvidia.com>
[ Upstream commit 9906efa545d1d2cf25a614eeb219d3f8d5a302cd ]
The use of firmware_loader is an implementation detail of drivers rather
than a dependency. FW_LOADER is typically selected rather than depended
on; the Rust abstractions should do the same thing.
Fixes: de6582833db0 ("rust: add firmware abstractions")
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20251106-b4-select-rust-fw-v3-1-771172257755@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/firmware_loader/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/firmware_loader/Kconfig b/drivers/base/firmware_loader/Kconfig
index 752b9a9bea038..15eff8a4b5053 100644
--- a/drivers/base/firmware_loader/Kconfig
+++ b/drivers/base/firmware_loader/Kconfig
@@ -38,7 +38,7 @@ config FW_LOADER_DEBUG
config RUST_FW_LOADER_ABSTRACTIONS
bool "Rust Firmware Loader abstractions"
depends on RUST
- depends on FW_LOADER=y
+ select FW_LOADER
help
This enables the Rust abstractions for the firmware loader API.
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 443/614] greybus: gb-beagleplay: Fix timeout handling in bootloader functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 442/614] firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 444/614] fs: refactor file timestamp update logic Greg Kroah-Hartman
` (184 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit e6df0f649cff08da7a2feb6d963b39076ca129f9 ]
wait_for_completion_timeout() returns the remaining jiffies
(at least 1) on success or 0 on timeout, but never negative
error codes. The current code incorrectly checks for negative
values, causing timeouts to be ignored and treated as success.
Check for a zero return value to correctly identify and
handle timeout events.
Fixes: 0cf7befa3ea2 ("greybus: gb-beagleplay: Add firmware upload API")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251121064027.571-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/greybus/gb-beagleplay.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/greybus/gb-beagleplay.c b/drivers/greybus/gb-beagleplay.c
index 9610f878da1b6..87186f891a6ac 100644
--- a/drivers/greybus/gb-beagleplay.c
+++ b/drivers/greybus/gb-beagleplay.c
@@ -644,8 +644,8 @@ static int cc1352_bootloader_wait_for_ack(struct gb_beagleplay *bg)
ret = wait_for_completion_timeout(
&bg->fwl_ack_com, msecs_to_jiffies(CC1352_BOOTLOADER_TIMEOUT));
- if (ret < 0)
- return dev_err_probe(&bg->sd->dev, ret,
+ if (!ret)
+ return dev_err_probe(&bg->sd->dev, -ETIMEDOUT,
"Failed to acquire ack semaphore");
switch (READ_ONCE(bg->fwl_ack)) {
@@ -683,8 +683,8 @@ static int cc1352_bootloader_get_status(struct gb_beagleplay *bg)
ret = wait_for_completion_timeout(
&bg->fwl_cmd_response_com,
msecs_to_jiffies(CC1352_BOOTLOADER_TIMEOUT));
- if (ret < 0)
- return dev_err_probe(&bg->sd->dev, ret,
+ if (!ret)
+ return dev_err_probe(&bg->sd->dev, -ETIMEDOUT,
"Failed to acquire last status semaphore");
switch (READ_ONCE(bg->fwl_cmd_response)) {
@@ -768,8 +768,8 @@ static int cc1352_bootloader_crc32(struct gb_beagleplay *bg, u32 *crc32)
ret = wait_for_completion_timeout(
&bg->fwl_cmd_response_com,
msecs_to_jiffies(CC1352_BOOTLOADER_TIMEOUT));
- if (ret < 0)
- return dev_err_probe(&bg->sd->dev, ret,
+ if (!ret)
+ return dev_err_probe(&bg->sd->dev, -ETIMEDOUT,
"Failed to acquire last status semaphore");
*crc32 = READ_ONCE(bg->fwl_cmd_response);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 444/614] fs: refactor file timestamp update logic
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 443/614] greybus: gb-beagleplay: Fix timeout handling in bootloader functions Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 445/614] fs: lift the FMODE_NOCMTIME check into file_update_time_flags Greg Kroah-Hartman
` (183 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Chaitanya Kulkarni, Jeff Layton, Jan Kara, Christian Brauner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 3cd9a42f1b5e34d3972237cbf8541af60844cbd4 ]
Currently the two high-level APIs use two helper functions to implement
almost all of the logic. Refactor the two helpers and the common logic
into a new file_update_time_flags routine that gets the iocb flags or
0 in case of file_update_time passed so that the entire logic is
contained in a single function and can be easily understood and modified.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251120064859.2911749-2-hch@lst.de
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 7f30e7a42371 ("fs: lift the FMODE_NOCMTIME check into file_update_time_flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/inode.c | 54 +++++++++++++++++-------------------------------------
1 file changed, 17 insertions(+), 37 deletions(-)
diff --git a/fs/inode.c b/fs/inode.c
index cff1d3af0d577..540f4a28c202d 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -2322,10 +2322,12 @@ struct timespec64 current_time(struct inode *inode)
}
EXPORT_SYMBOL(current_time);
-static int inode_needs_update_time(struct inode *inode)
+static int file_update_time_flags(struct file *file, unsigned int flags)
{
+ struct inode *inode = file_inode(file);
struct timespec64 now, ts;
- int sync_it = 0;
+ int sync_mode = 0;
+ int ret = 0;
/* First try to exhaust all avenues to not sync */
if (IS_NOCMTIME(inode))
@@ -2335,29 +2337,23 @@ static int inode_needs_update_time(struct inode *inode)
ts = inode_get_mtime(inode);
if (!timespec64_equal(&ts, &now))
- sync_it |= S_MTIME;
-
+ sync_mode |= S_MTIME;
ts = inode_get_ctime(inode);
if (!timespec64_equal(&ts, &now))
- sync_it |= S_CTIME;
-
+ sync_mode |= S_CTIME;
if (IS_I_VERSION(inode) && inode_iversion_need_inc(inode))
- sync_it |= S_VERSION;
+ sync_mode |= S_VERSION;
- return sync_it;
-}
-
-static int __file_update_time(struct file *file, int sync_mode)
-{
- int ret = 0;
- struct inode *inode = file_inode(file);
+ if (!sync_mode)
+ return 0;
- /* try to update time settings */
- if (!mnt_get_write_access_file(file)) {
- ret = inode_update_time(inode, sync_mode);
- mnt_put_write_access_file(file);
- }
+ if (flags & IOCB_NOWAIT)
+ return -EAGAIN;
+ if (mnt_get_write_access_file(file))
+ return 0;
+ ret = inode_update_time(inode, sync_mode);
+ mnt_put_write_access_file(file);
return ret;
}
@@ -2377,14 +2373,7 @@ static int __file_update_time(struct file *file, int sync_mode)
*/
int file_update_time(struct file *file)
{
- int ret;
- struct inode *inode = file_inode(file);
-
- ret = inode_needs_update_time(inode);
- if (ret <= 0)
- return ret;
-
- return __file_update_time(file, ret);
+ return file_update_time_flags(file, 0);
}
EXPORT_SYMBOL(file_update_time);
@@ -2406,7 +2395,6 @@ EXPORT_SYMBOL(file_update_time);
static int file_modified_flags(struct file *file, int flags)
{
int ret;
- struct inode *inode = file_inode(file);
/*
* Clear the security bits if the process is not being run by root.
@@ -2415,17 +2403,9 @@ static int file_modified_flags(struct file *file, int flags)
ret = file_remove_privs_flags(file, flags);
if (ret)
return ret;
-
if (unlikely(file->f_mode & FMODE_NOCMTIME))
return 0;
-
- ret = inode_needs_update_time(inode);
- if (ret <= 0)
- return ret;
- if (flags & IOCB_NOWAIT)
- return -EAGAIN;
-
- return __file_update_time(file, ret);
+ return file_update_time_flags(file, flags);
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 445/614] fs: lift the FMODE_NOCMTIME check into file_update_time_flags
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 444/614] fs: refactor file timestamp update logic Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 446/614] misc: rp1: Fix an error handling path in rp1_probe() Greg Kroah-Hartman
` (182 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Chaitanya Kulkarni, Jeff Layton, Jan Kara, Christian Brauner,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 7f30e7a42371af4bba53f9a875a0d320cead9f4b ]
FMODE_NOCMTIME used to be just a hack for the legacy XFS handle-based
"invisible I/O", but commit e5e9b24ab8fa ("nfsd: freeze c/mtime updates
with outstanding WRITE_ATTRS delegation") started using it from
generic callers.
I'm not sure other file systems are actually read for this in general,
so the above commit should get a closer look, but for it to make any
sense, file_update_time needs to respect the flag.
Lift the check from file_modified_flags to file_update_time so that
users of file_update_time inherit the behavior and so that all the
checks are done in one place.
Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251120064859.2911749-3-hch@lst.de
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/inode.c b/fs/inode.c
index 540f4a28c202d..2c55ec49b0239 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -2332,6 +2332,8 @@ static int file_update_time_flags(struct file *file, unsigned int flags)
/* First try to exhaust all avenues to not sync */
if (IS_NOCMTIME(inode))
return 0;
+ if (unlikely(file->f_mode & FMODE_NOCMTIME))
+ return 0;
now = current_time(inode);
@@ -2403,8 +2405,6 @@ static int file_modified_flags(struct file *file, int flags)
ret = file_remove_privs_flags(file, flags);
if (ret)
return ret;
- if (unlikely(file->f_mode & FMODE_NOCMTIME))
- return 0;
return file_update_time_flags(file, flags);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 446/614] misc: rp1: Fix an error handling path in rp1_probe()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 445/614] fs: lift the FMODE_NOCMTIME check into file_update_time_flags Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 447/614] kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node Greg Kroah-Hartman
` (181 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Andrea della Porta, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 43cd4b634ef90c4e2ff75eaeb361786fa04c8874 ]
When DT is used to get the reference of 'rp1_node', it should be released
when not needed anymore, otherwise it is leaking.
In such a case, add the missing of_node_put() call at the end of the probe,
as already done in the error handling path.
Fixes: 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Andrea della Porta <andrea.porta@suse.com>
Link: https://patch.msgid.link/9bc1206de787fa86384f3e5ba0a8027947bc00ff.1762585959.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/rp1/rp1_pci.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c
index 803832006ec87..a342bcc6164bb 100644
--- a/drivers/misc/rp1/rp1_pci.c
+++ b/drivers/misc/rp1/rp1_pci.c
@@ -289,6 +289,9 @@ static int rp1_probe(struct pci_dev *pdev, const struct pci_device_id *id)
goto err_unload_overlay;
}
+ if (skip_ovl)
+ of_node_put(rp1_node);
+
return 0;
err_unload_overlay:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 447/614] kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 446/614] misc: rp1: Fix an error handling path in rp1_probe() Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 16:52 ` Will Rosenberg
2025-12-16 11:13 ` [PATCH 6.18 448/614] drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() Greg Kroah-Hartman
` (180 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oliver Rosenberg, Will Rosenberg,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Rosenberg <whrosenb@asu.edu>
[ Upstream commit 382b1e8f30f779af8d6d33268e53df7de579ef3c ]
There exists a memory leak of kernfs_iattrs contained as an element
of kernfs_node allocated in __kernfs_new_node(). __kernfs_setattr()
allocates kernfs_iattrs as a sub-object, and the LSM security check
incorrectly errors out and does not free the kernfs_iattrs sub-object.
Make an additional error out case that properly frees kernfs_iattrs if
security_kernfs_init_security() fails.
Fixes: e19dfdc83b60 ("kernfs: initialize security of newly created nodes")
Co-developed-by: Oliver Rosenberg <olrose55@gmail.com>
Signed-off-by: Oliver Rosenberg <olrose55@gmail.com>
Signed-off-by: Will Rosenberg <whrosenb@asu.edu>
Link: https://patch.msgid.link/20251125151332.2010687-1-whrosenb@asu.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/kernfs/dir.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index a670ba3e565e0..5c0efd6b239f6 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -675,11 +675,14 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
if (parent) {
ret = security_kernfs_init_security(parent, kn);
if (ret)
- goto err_out3;
+ goto err_out4;
}
return kn;
+ err_out4:
+ simple_xattrs_free(&kn->iattr->xattrs, NULL);
+ kmem_cache_free(kernfs_iattrs_cache, kn->iattr);
err_out3:
spin_lock(&root->kernfs_idr_lock);
idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 448/614] drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 447/614] kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 449/614] drm/amdkfd: assign AID to uuid in topology for SPX mode Greg Kroah-Hartman
` (179 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Alex Hung,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 1a79482699b4d1e43948d14f0c7193dc1dcad858 ]
The .H_SYNC_POLARITY and .V_SYNC_POLARITY variables are 1 bit bitfields
of a u32. The ATOM_HSYNC_POLARITY define is 0x2 and the
ATOM_VSYNC_POLARITY is 0x4. When we do a bitwise negate of 0, 2, or 4
then the last bit is always 1 so this code always sets .H_SYNC_POLARITY
and .V_SYNC_POLARITY to true.
This code is instead intended to check if the ATOM_HSYNC_POLARITY or
ATOM_VSYNC_POLARITY flags are set and reverse the result. In other
words, it's supposed to be a logical negate instead of a bitwise negate.
Fixes: ae79c310b1a6 ("drm/amd/display: Add DCE12 bios parser support")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
index 04eb647acc4e1..550a9f1d03f82 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
@@ -1480,10 +1480,10 @@ static enum bp_result get_embedded_panel_info_v2_1(
/* not provided by VBIOS */
info->lcd_timing.misc_info.HORIZONTAL_CUT_OFF = 0;
- info->lcd_timing.misc_info.H_SYNC_POLARITY = ~(uint32_t) (lvds->lcd_timing.miscinfo
- & ATOM_HSYNC_POLARITY);
- info->lcd_timing.misc_info.V_SYNC_POLARITY = ~(uint32_t) (lvds->lcd_timing.miscinfo
- & ATOM_VSYNC_POLARITY);
+ info->lcd_timing.misc_info.H_SYNC_POLARITY = !(lvds->lcd_timing.miscinfo &
+ ATOM_HSYNC_POLARITY);
+ info->lcd_timing.misc_info.V_SYNC_POLARITY = !(lvds->lcd_timing.miscinfo &
+ ATOM_VSYNC_POLARITY);
/* not provided by VBIOS */
info->lcd_timing.misc_info.VERTICAL_CUT_OFF = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 449/614] drm/amdkfd: assign AID to uuid in topology for SPX mode
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 448/614] drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 450/614] hwmon: sy7636a: Fix regulator_enable resource leak on error path Greg Kroah-Hartman
` (178 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Huang, Harish Kasiviswanathan,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Huang <jinhuieric.huang@amd.com>
[ Upstream commit 089702632f1dd38fadc9af13816485d6aa518dbb ]
XCD id is assigned to uuid, which causes some performance
drop in SPX mode, assigning AID back will resolve the
issue.
Fixes: 3a75edf93aae ("drm/amdkfd: set uuid for each partition in topology")
Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 5c98746eb72df..811636af14eaa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -530,7 +530,9 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
sysfs_show_32bit_prop(buffer, offs, "sdma_fw_version",
dev->gpu->kfd->sdma_fw_version);
sysfs_show_64bit_prop(buffer, offs, "unique_id",
- dev->gpu->xcp ?
+ dev->gpu->xcp &&
+ (dev->gpu->xcp->xcp_mgr->mode !=
+ AMDGPU_SPX_PARTITION_MODE) ?
dev->gpu->xcp->unique_id :
dev->gpu->adev->unique_id);
sysfs_show_32bit_prop(buffer, offs, "num_xcc",
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 450/614] hwmon: sy7636a: Fix regulator_enable resource leak on error path
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 449/614] drm/amdkfd: assign AID to uuid in topology for SPX mode Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 451/614] ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Greg Kroah-Hartman
` (177 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Haotian Zhang,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 2f88425ef590b7fcc2324334b342e048edc144a9 ]
In sy7636a_sensor_probe(), regulator_enable() is called but if
devm_hwmon_device_register_with_info() fails, the function returns
without calling regulator_disable(), leaving the regulator enabled
and leaking the reference count.
Switch to devm_regulator_get_enable() to automatically
manage the regulator resource.
Fixes: de34a4053250 ("hwmon: sy7636a: Add temperature driver for sy7636a")
Suggested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/r/20251126162602.2086-1-vulab@iscas.ac.cn
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/sy7636a-hwmon.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/hwmon/sy7636a-hwmon.c b/drivers/hwmon/sy7636a-hwmon.c
index a12fc0ce70e76..d51daaf63d632 100644
--- a/drivers/hwmon/sy7636a-hwmon.c
+++ b/drivers/hwmon/sy7636a-hwmon.c
@@ -66,18 +66,13 @@ static const struct hwmon_chip_info sy7636a_chip_info = {
static int sy7636a_sensor_probe(struct platform_device *pdev)
{
struct regmap *regmap = dev_get_regmap(pdev->dev.parent, NULL);
- struct regulator *regulator;
struct device *hwmon_dev;
int err;
if (!regmap)
return -EPROBE_DEFER;
- regulator = devm_regulator_get(&pdev->dev, "vcom");
- if (IS_ERR(regulator))
- return PTR_ERR(regulator);
-
- err = regulator_enable(regulator);
+ err = devm_regulator_get_enable(&pdev->dev, "vcom");
if (err)
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 451/614] ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 450/614] hwmon: sy7636a: Fix regulator_enable resource leak on error path Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 452/614] ublk: prevent invalid access with DEBUG Greg Kroah-Hartman
` (176 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, René Rebe, Rafael J. Wysocki,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <rene@exactco.de>
[ Upstream commit 17e7972979e147cc51d4a165e6b6b0f93273ca68 ]
On all AMD AM4 systems I have seen, e.g ASUS X470-i, Pro WS X570 Ace
and equivalent Gigabyte, amd-pstate does not initialize when the
x2apic is enabled in the BIOS. Kernel debug messages include:
[ 0.315438] acpi LNXCPU:00: Failed to get CPU physical ID.
[ 0.354756] ACPI CPPC: No CPC descriptor for CPU:0
[ 0.714951] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled
I tracked this down to map_x2apic_id() checking device_declaration
passed in via the type argument of acpi_get_phys_id() via
map_madt_entry() while map_lapic_id() does not.
It appears these BIOSes use Processor statements for declaring the CPUs
in the ACPI namespace instead of processor device objects (which should
have been used). CPU declarations via Processor statements were
deprecated in ACPI 6.0 that was released 10 years ago. They should not
be used any more in any contemporary platform firmware.
I tried to contact Asus support multiple times, but never received a
reply nor did any BIOS update ever change this.
Fix amd-pstate w/ x2apic on am4 by allowing map_x2apic_id() to work with
CPUs declared via Processor statements for IDs less than 255, which is
consistent with ACPI 5.0 that still allowed Processor statements to be
used for declaring CPUs.
Fixes: 7237d3de78ff ("x86, ACPI: add support for x2apic ACPI extensions")
Signed-off-by: René Rebe <rene@exactco.de>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20251126.165513.1373131139292726554.rene@exactco.de
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/processor_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 9b6b71a2ffb54..a4498357bd165 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -54,7 +54,7 @@ static int map_x2apic_id(struct acpi_subtable_header *entry,
if (!(apic->lapic_flags & ACPI_MADT_ENABLED))
return -ENODEV;
- if (device_declaration && (apic->uid == acpi_id)) {
+ if (apic->uid == acpi_id && (device_declaration || acpi_id < 255)) {
*apic_id = apic->local_apic_id;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 452/614] ublk: prevent invalid access with DEBUG
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 451/614] ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 453/614] selftests/landlock: Fix makefile header list Greg Kroah-Hartman
` (175 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kevin Brodsky, Caleb Sander Mateos,
Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Brodsky <kevin.brodsky@arm.com>
[ Upstream commit c6a45ee7607de3a350008630f4369b1b5ac80884 ]
ublk_ch_uring_cmd_local() may jump to the out label before
initialising the io pointer. This will cause trouble if DEBUG is
defined, because the pr_devel() call dereferences io. Clang reports:
drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
2403 | if (tag >= ub->dev_info.queue_depth)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here
2492 | __func__, cmd_op, tag, ret, io->flags);
|
Fix this by initialising io to NULL and checking it before
dereferencing it.
Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 0c74a41a67530..359564c40cb50 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2367,7 +2367,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
u16 buf_idx = UBLK_INVALID_BUF_IDX;
struct ublk_device *ub = cmd->file->private_data;
struct ublk_queue *ubq;
- struct ublk_io *io;
+ struct ublk_io *io = NULL;
u32 cmd_op = cmd->cmd_op;
u16 q_id = READ_ONCE(ub_src->q_id);
u16 tag = READ_ONCE(ub_src->tag);
@@ -2488,7 +2488,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
out:
pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",
- __func__, cmd_op, tag, ret, io->flags);
+ __func__, cmd_op, tag, ret, io ? io->flags : 0);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 453/614] selftests/landlock: Fix makefile header list
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 452/614] ublk: prevent invalid access with DEBUG Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 454/614] bpf: Fix exclusive map memory leak Greg Kroah-Hartman
` (174 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthieu Buffet,
Mickaël Salaün, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Buffet <matthieu@buffet.re>
[ Upstream commit e61462232a58bddd818fa6a913a9a2e76fd3634f ]
Make all headers part of make's dependencies computations.
Otherwise, updating audit.h, common.h, scoped_base_variants.h,
scoped_common.h, scoped_multiple_domain_variants.h, or wrappers.h,
re-running make and running selftests could lead to testing stale headers.
Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs")
Fixes: fefcf0f7cf47 ("selftests/landlock: Test abstract UNIX socket scoping")
Fixes: 5147779d5e1b ("selftests/landlock: Add wrappers.h")
Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://lore.kernel.org/r/20251027011440.1838514-1-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/landlock/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/landlock/Makefile b/tools/testing/selftests/landlock/Makefile
index a3f449914bf93..044b83bde16eb 100644
--- a/tools/testing/selftests/landlock/Makefile
+++ b/tools/testing/selftests/landlock/Makefile
@@ -4,7 +4,7 @@
CFLAGS += -Wall -O2 $(KHDR_INCLUDES)
-LOCAL_HDRS += common.h
+LOCAL_HDRS += $(wildcard *.h)
src_test := $(wildcard *_test.c)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 454/614] bpf: Fix exclusive map memory leak
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 453/614] selftests/landlock: Fix makefile header list Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 455/614] ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Greg Kroah-Hartman
` (173 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cf08c551fecea9fd1320,
Edward Adam Davis, Yonghong Song, Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit 688b745401ab16e2e1a3b504863f0a45fd345638 ]
When excl_prog_hash is 0 and excl_prog_hash_size is non-zero, the map also
needs to be freed. Otherwise, the map memory will not be reclaimed, just
like the memory leak problem reported by syzbot [1].
syzbot reported:
BUG: memory leak
backtrace (crc 7b9fb9b4):
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
Fixes: baefdbdf6812 ("bpf: Implement exclusive map creation")
Reported-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf08c551fecea9fd1320
Tested-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/tencent_3F226F882CE56DCC94ACE90EED1ECCFC780A@qq.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/syscall.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 15f9afdbfc275..df219e7259099 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1585,7 +1585,8 @@ static int map_create(union bpf_attr *attr, bpfptr_t uattr)
goto free_map;
}
} else if (attr->excl_prog_hash_size) {
- return -EINVAL;
+ err = -EINVAL;
+ goto free_map;
}
err = security_bpf_map_create(map, attr, token, uattr.is_kernel);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 455/614] ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 454/614] bpf: Fix exclusive map memory leak Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 456/614] selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Greg Kroah-Hartman
` (172 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Yongjian Sun, Baokun Li,
Theodore Tso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongjian Sun <sunyongjian1@huawei.com>
[ Upstream commit d9ee3ff810f1cc0e253c9f2b17b668b973cb0e06 ]
When the MB_CHECK_ASSERT macro is enabled, we found that the
current validation logic in __mb_check_buddy has a gap in
detecting certain invalid buddy states, particularly related
to order-0 (bitmap) bits.
The original logic consists of three steps:
1. Validates higher-order buddies: if a higher-order bit is
set, at most one of the two corresponding lower-order bits
may be free; if a higher-order bit is clear, both lower-order
bits must be allocated (and their bitmap bits must be 0).
2. For any set bit in order-0, ensures all corresponding
higher-order bits are not free.
3. Verifies that all preallocated blocks (pa) in the group
have pa_pstart within bounds and their bitmap bits marked as
allocated.
However, this approach fails to properly validate cases where
order-0 bits are incorrectly cleared (0), allowing some invalid
configurations to pass:
corrupt integral
order 3 1 1
order 2 1 1 1 1
order 1 1 1 1 1 1 1 1 1
order 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Here we get two adjacent free blocks at order-0 with inconsistent
higher-order state, and the right one shows the correct scenario.
The root cause is insufficient validation of order-0 zero bits.
To fix this and improve completeness without significant performance
cost, we refine the logic:
1. Maintain the top-down higher-order validation, but we no longer
check the cases where the higher-order bit is 0, as this case will
be covered in step 2.
2. Enhance order-0 checking by examining pairs of bits:
- If either bit in a pair is set (1), all corresponding
higher-order bits must not be free.
- If both bits are clear (0), then exactly one of the
corresponding higher-order bits must be free
3. Keep the preallocation (pa) validation unchanged.
This change closes the validation gap, ensuring illegal buddy states
involving order-0 are correctly detected, while removing redundant
checks and maintaining efficiency.
Fixes: c9de560ded61f ("ext4: Add multi block allocator for ext4")
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Yongjian Sun <sunyongjian1@huawei.com>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Message-ID: <20251106060614.631382-3-sunyongjian@huaweicloud.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/mballoc.c | 49 +++++++++++++++++++++++++++++++----------------
1 file changed, 32 insertions(+), 17 deletions(-)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 9087183602e44..c56b51e1162eb 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -682,6 +682,24 @@ do { \
} \
} while (0)
+/*
+ * Perform buddy integrity check with the following steps:
+ *
+ * 1. Top-down validation (from highest order down to order 1, excluding order-0 bitmap):
+ * For each pair of adjacent orders, if a higher-order bit is set (indicating a free block),
+ * at most one of the two corresponding lower-order bits may be clear (free).
+ *
+ * 2. Order-0 (bitmap) validation, performed on bit pairs:
+ * - If either bit in a pair is set (1, allocated), then all corresponding higher-order bits
+ * must not be free (0).
+ * - If both bits in a pair are clear (0, free), then exactly one of the corresponding
+ * higher-order bits must be free (0).
+ *
+ * 3. Preallocation (pa) list validation:
+ * For each preallocated block (pa) in the group:
+ * - Verify that pa_pstart falls within the bounds of this block group.
+ * - Ensure the corresponding bit(s) in the order-0 bitmap are marked as allocated (1).
+ */
static void __mb_check_buddy(struct ext4_buddy *e4b, char *file,
const char *function, int line)
{
@@ -723,15 +741,6 @@ static void __mb_check_buddy(struct ext4_buddy *e4b, char *file,
continue;
}
- /* both bits in buddy2 must be 1 */
- MB_CHECK_ASSERT(mb_test_bit(i << 1, buddy2));
- MB_CHECK_ASSERT(mb_test_bit((i << 1) + 1, buddy2));
-
- for (j = 0; j < (1 << order); j++) {
- k = (i * (1 << order)) + j;
- MB_CHECK_ASSERT(
- !mb_test_bit(k, e4b->bd_bitmap));
- }
count++;
}
MB_CHECK_ASSERT(e4b->bd_info->bb_counters[order] == count);
@@ -747,15 +756,21 @@ static void __mb_check_buddy(struct ext4_buddy *e4b, char *file,
fragments++;
fstart = i;
}
- continue;
+ } else {
+ fstart = -1;
}
- fstart = -1;
- /* check used bits only */
- for (j = 0; j < e4b->bd_blkbits + 1; j++) {
- buddy2 = mb_find_buddy(e4b, j, &max2);
- k = i >> j;
- MB_CHECK_ASSERT(k < max2);
- MB_CHECK_ASSERT(mb_test_bit(k, buddy2));
+ if (!(i & 1)) {
+ int in_use, zero_bit_count = 0;
+
+ in_use = mb_test_bit(i, buddy) || mb_test_bit(i + 1, buddy);
+ for (j = 1; j < e4b->bd_blkbits + 2; j++) {
+ buddy2 = mb_find_buddy(e4b, j, &max2);
+ k = i >> j;
+ MB_CHECK_ASSERT(k < max2);
+ if (!mb_test_bit(k, buddy2))
+ zero_bit_count++;
+ }
+ MB_CHECK_ASSERT(zero_bit_count == !in_use);
}
}
MB_CHECK_ASSERT(!EXT4_MB_GRP_NEED_INIT(e4b->bd_info));
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 456/614] selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 455/614] ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 457/614] of: Skip devicetree kunit tests when RISCV+ACPI doesnt populate root node Greg Kroah-Hartman
` (171 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neal Cardwell, Willem de Bruijn,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit c01a6e5b2e4f21d31cf725b9f3803cb0280b1b8d ]
The --send_omit_free flag is needed for TCP zero copy tests, to ensure
that packetdrill doesn't free the send() buffer after the send() call.
Fixes: 1e42f73fd3c2 ("selftests/net: packetdrill: import tcp/zerocopy")
Closes: https://lore.kernel.org/netdev/20251124071831.4cbbf412@kernel.org/
Suggested-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20251125234029.1320984-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 ++++
.../testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt | 2 ++
.../testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt | 2 ++
.../testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt | 2 ++
.../testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt | 2 ++
.../selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 +++
.../net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 +++
.../selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 +++
.../net/packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 ++
.../net/packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 ++
.../selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 ++
.../testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt | 2 ++
12 files changed, 29 insertions(+)
diff --git a/tools/testing/selftests/net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt b/tools/testing/selftests/net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt
index b2b2cdf27e20f..454441e7ecff6 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_syscall_bad_arg_sendmsg-empty-iov.pkt
@@ -1,6 +1,10 @@
// SPDX-License-Identifier: GPL-2.0
// Test that we correctly skip zero-length IOVs.
+
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
+
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_ZEROCOPY, [1], 4) = 0
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt
index a82c8899d36bf..0a0700afdaa38 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_basic.pkt
@@ -4,6 +4,8 @@
// send a packet with MSG_ZEROCOPY and receive the notification ID
// repeat and verify IDs are consecutive
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt
index c01915e7f4a15..df91675d2991c 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_batch.pkt
@@ -3,6 +3,8 @@
//
// send multiple packets, then read one range of all notifications.
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt
index 6509882932e91..2963cfcb14dfd 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_client.pkt
@@ -1,6 +1,8 @@
// SPDX-License-Identifier: GPL-2.0
// Minimal client-side zerocopy test
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 4
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt
index 2cd78755cb2ac..ea0c2fa73c2d6 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_closed.pkt
@@ -7,6 +7,8 @@
// First send on a closed socket and wait for (absent) notification.
// Then connect and send and verify that notification nr. is zero.
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 4
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt
index 7671c20e01cf6..4df978a9b82e7 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_edge.pkt
@@ -7,6 +7,9 @@
// fire two sends with MSG_ZEROCOPY and receive the acks. confirm that EPOLLERR
// is correctly fired only once, when EPOLLET is set. send another packet with
// MSG_ZEROCOPY. confirm that EPOLLERR is correctly fired again only once.
+
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt
index fadc480fdb7fe..36b6edc4858c4 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_exclusive.pkt
@@ -8,6 +8,9 @@
// fire two sends with MSG_ZEROCOPY and receive the acks. confirm that EPOLLERR
// is correctly fired only once, when EPOLLET is set. send another packet with
// MSG_ZEROCOPY. confirm that EPOLLERR is correctly fired again only once.
+
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt
index 5bfa0d1d2f4a3..1bea6f3b4558d 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt
@@ -8,6 +8,9 @@
// is correctly fired only once, when EPOLLONESHOT is set. send another packet
// with MSG_ZEROCOPY. confirm that EPOLLERR is not fired. Rearm the FD and
// confirm that EPOLLERR is correctly set.
+
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-client.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-client.pkt
index 4a73bbf469610..e27c21ff5d18d 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-client.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-client.pkt
@@ -8,6 +8,8 @@
// one will have no data in the initial send. On return 0 the
// zerocopy notification counter is not incremented. Verify this too.
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
// Send a FastOpen request, no cookie yet so no data in SYN
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-server.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-server.pkt
index 36086c5877ce7..b1fa77c77dfa7 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-server.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_fastopen-server.pkt
@@ -4,6 +4,8 @@
// send data with MSG_FASTOPEN | MSG_ZEROCOPY and verify that the
// kernel returns the notification ID.
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh
./set_sysctls.py /proc/sys/net/ipv4/tcp_fastopen=0x207`
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt
index 672f817faca0d..2f5317d0a9fab 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_maxfrags.pkt
@@ -7,6 +7,8 @@
// because each iovec element becomes a frag
// 3) the PSH bit is set on an skb when it runs out of fragments
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
diff --git a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt
index a9a1ac0aea4f4..9d5272c6b2079 100644
--- a/tools/testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt
+++ b/tools/testing/selftests/net/packetdrill/tcp_zerocopy_small.pkt
@@ -4,6 +4,8 @@
// verify that SO_EE_CODE_ZEROCOPY_COPIED is set on zerocopy
// packets of all sizes, including the smallest payload, 1B.
+--send_omit_free // do not reuse send buffers with zerocopy
+
`./defaults.sh`
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 457/614] of: Skip devicetree kunit tests when RISCV+ACPI doesnt populate root node
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 456/614] selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 458/614] virtio_vdpa: fix misleading return in void function Greg Kroah-Hartman
` (170 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Han Gao, Paul Walmsley,
Guenter Roeck, Rob Herring (Arm), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 546dbb0223102813ffb5bbcb9443a47c3183f195 ]
Starting with commit 69a8b62a7aa1 ("riscv: acpi: avoid errors caused by
probing DT devices when ACPI is used"), riscv images no longer populate
devicetree if ACPI is enabled. This causes unit tests to fail which require
the root node to be set.
# Subtest: of_dtb
# module: of_test
1..2
# of_dtb_root_node_found_by_path: EXPECTATION FAILED at drivers/of/of_test.c:21
Expected np is not null, but is
# of_dtb_root_node_found_by_path: pass:0 fail:1 skip:0 total:1
not ok 1 of_dtb_root_node_found_by_path
# of_dtb_root_node_populates_of_root: EXPECTATION FAILED at drivers/of/of_test.c:31
Expected of_root is not null, but is
# of_dtb_root_node_populates_of_root: pass:0 fail:1 skip:0 total:1
not ok 2 of_dtb_root_node_populates_of_root
Skip those tests for RISCV if the root node is not populated.
Fixes: 69a8b62a7aa1 ("riscv: acpi: avoid errors caused by probing DT devices when ACPI is used")
Cc: Han Gao <rabenda.cn@gmail.com>
Cc: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Paul Walmsley <pjw@kernel.org> # arch/riscv
Link: https://patch.msgid.link/20251023160415.705294-1-linux@roeck-us.net
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/of_kunit_helpers.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/of/of_kunit_helpers.c b/drivers/of/of_kunit_helpers.c
index 7b3ed5a382aaa..f6ed1af8b62aa 100644
--- a/drivers/of/of_kunit_helpers.c
+++ b/drivers/of/of_kunit_helpers.c
@@ -18,8 +18,9 @@
*/
void of_root_kunit_skip(struct kunit *test)
{
- if (IS_ENABLED(CONFIG_ARM64) && IS_ENABLED(CONFIG_ACPI) && !of_root)
- kunit_skip(test, "arm64+acpi doesn't populate a root node");
+ if ((IS_ENABLED(CONFIG_ARM64) || IS_ENABLED(CONFIG_RISCV)) &&
+ IS_ENABLED(CONFIG_ACPI) && !of_root)
+ kunit_skip(test, "arm64/riscv+acpi doesn't populate a root node");
}
EXPORT_SYMBOL_GPL(of_root_kunit_skip);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 458/614] virtio_vdpa: fix misleading return in void function
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 457/614] of: Skip devicetree kunit tests when RISCV+ACPI doesnt populate root node Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 459/614] virtio: fix kernel-doc for mapping/free_coherent functions Greg Kroah-Hartman
` (169 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Michael S. Tsirkin,
Jason Wang, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit e40b6abe0b1247d43bc61942aa7534fca7209e44 ]
virtio_vdpa_set_status() is declared as returning void, but it used
"return vdpa_set_status()" Since vdpa_set_status() also returns
void, the return statement is unnecessary and misleading.
Remove it.
Fixes: c043b4a8cf3b ("virtio: introduce a vDPA based transport")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Message-Id: <20251001191653.1713923-1-alok.a.tiwari@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/virtio/virtio_vdpa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c
index f9a29045eca0d..0a801f67b5996 100644
--- a/drivers/virtio/virtio_vdpa.c
+++ b/drivers/virtio/virtio_vdpa.c
@@ -80,7 +80,7 @@ static void virtio_vdpa_set_status(struct virtio_device *vdev, u8 status)
{
struct vdpa_device *vdpa = vd_get_vdpa(vdev);
- return vdpa_set_status(vdpa, status);
+ vdpa_set_status(vdpa, status);
}
static void virtio_vdpa_reset(struct virtio_device *vdev)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 459/614] virtio: fix kernel-doc for mapping/free_coherent functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 458/614] virtio_vdpa: fix misleading return in void function Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 460/614] virtio: fix typo in virtio_device_ready() comment Greg Kroah-Hartman
` (168 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kriish Sharma, Chaitanya Kulkarni,
Michael S. Tsirkin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kriish Sharma <kriish.sharma2006@gmail.com>
[ Upstream commit f8113000855a8cc2c6d8e19b97a390f1c082285d ]
Documentation build reported:
WARNING: ./drivers/virtio/virtio_ring.c:3174 function parameter 'vaddr' not described in 'virtqueue_map_free_coherent'
WARNING: ./drivers/virtio/virtio_ring.c:3308 expecting prototype for virtqueue_mapping_error(). Prototype was for virtqueue_map_mapping_error() instead
The kernel-doc block for virtqueue_map_free_coherent() omitted the @vaddr parameter, and
the kernel-doc header for virtqueue_map_mapping_error() used the wrong function name
(virtqueue_mapping_error) instead of the actual function name.
This change updates:
- the function name in the comment to virtqueue_map_mapping_error()
- adds the missing @vaddr description in the comment for virtqueue_map_free_coherent()
Fixes: b41cb3bcf67f ("virtio: rename dma helpers")
Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251110202920.2250244-1-kriish.sharma2006@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/virtio/virtio_ring.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 7b6205253b46b..ddab689596717 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -3166,6 +3166,7 @@ EXPORT_SYMBOL_GPL(virtqueue_map_alloc_coherent);
* @vdev: the virtio device we are talking to
* @map: metadata for performing mapping
* @size: the size of the buffer
+ * @vaddr: the virtual address that needs to be freed
* @map_handle: the mapped address that needs to be freed
*
*/
@@ -3190,7 +3191,7 @@ EXPORT_SYMBOL_GPL(virtqueue_map_free_coherent);
* @dir: mapping direction
* @attrs: mapping attributes
*
- * Returns mapped address. Caller should check that by virtqueue_mapping_error().
+ * Returns mapped address. Caller should check that by virtqueue_map_mapping_error().
*/
dma_addr_t virtqueue_map_page_attrs(const struct virtqueue *_vq,
struct page *page,
@@ -3249,7 +3250,7 @@ EXPORT_SYMBOL_GPL(virtqueue_unmap_page_attrs);
* The caller calls this to do dma mapping in advance. The DMA address can be
* passed to this _vq when it is in pre-mapped mode.
*
- * return mapped address. Caller should check that by virtqueue_mapping_error().
+ * return mapped address. Caller should check that by virtqueue_map_mapping_error().
*/
dma_addr_t virtqueue_map_single_attrs(const struct virtqueue *_vq, void *ptr,
size_t size,
@@ -3299,7 +3300,7 @@ void virtqueue_unmap_single_attrs(const struct virtqueue *_vq,
EXPORT_SYMBOL_GPL(virtqueue_unmap_single_attrs);
/**
- * virtqueue_mapping_error - check dma address
+ * virtqueue_map_mapping_error - check dma address
* @_vq: the struct virtqueue we're talking about.
* @addr: DMA address
*
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 460/614] virtio: fix typo in virtio_device_ready() comment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 459/614] virtio: fix kernel-doc for mapping/free_coherent functions Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 461/614] virtio: fix whitespace in virtio_config_ops Greg Kroah-Hartman
` (167 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 361173f95ae4b726ebbbf0bd594274f5576c4abc ]
"coherenct" -> "coherent"
Fixes: 8b4ec69d7e09 ("virtio: harden vring IRQ")
Message-Id: <db286e9a65449347f6584e68c9960fd5ded2b4b0.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 16001e9f9b391..1ea5baa62141f 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -362,7 +362,7 @@ void virtio_device_ready(struct virtio_device *dev)
* specific set_status() method.
*
* A well behaved device will only notify a virtqueue after
- * DRIVER_OK, this means the device should "see" the coherenct
+ * DRIVER_OK, this means the device should "see" the coherent
* memory write that set vq->broken as false which is done by
* the driver when it sees DRIVER_OK, then the following
* driver's vring_interrupt() will see vq->broken as false so
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 461/614] virtio: fix whitespace in virtio_config_ops
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 460/614] virtio: fix typo in virtio_device_ready() comment Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 462/614] virtio: fix grammar in virtio_queue_info docs Greg Kroah-Hartman
` (166 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 7831791e77a1cd29528d4dc336ce14466aef5ba6 ]
The finalize_features documentation uses a tab between words.
Use space instead.
Fixes: d16c0cd27331 ("docs: driver-api: virtio: virtio on Linux")
Message-Id: <39d7685c82848dc6a876d175e33a1407f6ab3fc1.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 1ea5baa62141f..dbc7eff1f101f 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -86,7 +86,7 @@ struct virtqueue_info {
* vdev: the virtio_device
* This sends the driver feature bits to the device: it can change
* the dev->feature bits if it wants.
- * Note that despite the name this can be called any number of
+ * Note that despite the name this can be called any number of
* times.
* Returns 0 on success or error status
* @bus_name: return the bus name associated with the device (optional)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 462/614] virtio: fix grammar in virtio_queue_info docs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 461/614] virtio: fix whitespace in virtio_config_ops Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 463/614] virtio: fix grammar in virtio_map_ops docs Greg Kroah-Hartman
` (165 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 63598fba55ab9d384818fed48dc04006cecf7be4 ]
Fix grammar in the description of @ctx
Fixes: c502eb85c34e ("virtio: introduce virtio_queue_info struct and find_vqs_info() config op")
Message-Id: <a5cf2b92573200bdb1c1927e559d3930d61a4af2.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index dbc7eff1f101f..78cf4119f5674 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -24,7 +24,7 @@ typedef void vq_callback_t(struct virtqueue *);
* a virtqueue unused by the driver.
* @callback: A callback to invoke on a used buffer notification.
* NULL for a virtqueue that does not need a callback.
- * @ctx: A flag to indicate to maintain an extra context per virtqueue.
+ * @ctx: whether to maintain an extra context per virtqueue.
*/
struct virtqueue_info {
const char *name;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 463/614] virtio: fix grammar in virtio_map_ops docs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 462/614] virtio: fix grammar in virtio_queue_info docs Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 464/614] virtio: standardize Returns documentation style Greg Kroah-Hartman
` (164 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit c15f42e09178d2849744ccf064200f5e7f71e688 ]
Fix grammar issues in the virtio_map_ops docs:
- missing article before "transport"
- "implements" -> "implement" to match subject
Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core")
Message-Id: <3f7bcae5a984f14b72e67e82572b110acb06fa7e.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 78cf4119f5674..6660132258d40 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -141,8 +141,8 @@ struct virtio_config_ops {
/**
* struct virtio_map_ops - operations for mapping buffer for a virtio device
- * Note: For transport that has its own mapping logic it must
- * implements all of the operations
+ * Note: For a transport that has its own mapping logic it must
+ * implement all of the operations
* @map_page: map a buffer to the device
* map: metadata for performing mapping
* page: the page that will be mapped by the device
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 464/614] virtio: standardize Returns documentation style
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 463/614] virtio: fix grammar in virtio_map_ops docs Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 465/614] virtio: fix virtqueue_set_affinity() docs Greg Kroah-Hartman
` (163 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 5e88a5a97d113619b674ebfdd1d2065f2edd10eb ]
Remove colons after "Returns" in virtio_map_ops function
documentation - both to avoid triggering an htmldoc warning
and for consistency with virtio_config_ops.
This affects map_page, alloc, need_sync, and max_mapping_size.
Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core")
Message-Id: <c262893fa21f4b1265147ef864574a9bd173348f.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 6660132258d40..e231147ff92db 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -150,7 +150,7 @@ struct virtio_config_ops {
* size: the buffer size
* dir: mapping direction
* attrs: mapping attributes
- * Returns: the mapped address
+ * Returns the mapped address
* @unmap_page: unmap a buffer from the device
* map: device specific mapping map
* map_handle: the mapped address
@@ -172,7 +172,7 @@ struct virtio_config_ops {
* size: the size of the buffer
* map_handle: the mapping address to sync
* gfp: allocation flag (GFP_XXX)
- * Returns: virtual address of the allocated buffer
+ * Returns virtual address of the allocated buffer
* @free: free a coherent buffer mapping
* map: metadata for performing mapping
* size: the size of the buffer
@@ -182,13 +182,13 @@ struct virtio_config_ops {
* @need_sync: if the buffer needs synchronization
* map: metadata for performing mapping
* map_handle: the mapped address
- * Returns: whether the buffer needs synchronization
+ * Returns whether the buffer needs synchronization
* @mapping_error: if the mapping address is error
* map: metadata for performing mapping
* map_handle: the mapped address
* @max_mapping_size: get the maximum buffer size that can be mapped
* map: metadata for performing mapping
- * Returns: the maximum buffer size that can be mapped
+ * Returns the maximum buffer size that can be mapped
*/
struct virtio_map_ops {
dma_addr_t (*map_page)(union virtio_map map, struct page *page,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 465/614] virtio: fix virtqueue_set_affinity() docs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 464/614] virtio: standardize Returns documentation style Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 466/614] virtio: fix map ops comment Greg Kroah-Hartman
` (162 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 43236d8bbafff94b423afecc4a692dd90602d426 ]
Rewrite the comment for better grammar and clarity.
Fixes: 75a0a52be3c2 ("virtio: introduce an API to set affinity for a virtqueue")
Message-Id: <e317e91bd43b070e5eaec0ebbe60c5749d02e2dd.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index e231147ff92db..1a019a1f168d5 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -384,7 +384,7 @@ const char *virtio_bus_name(struct virtio_device *vdev)
* @vq: the virtqueue
* @cpu_mask: the cpu mask
*
- * Pay attention the function are best-effort: the affinity hint may not be set
+ * Note that this function is best-effort: the affinity hint may not be set
* due to config support, irq type and sharing.
*
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 466/614] virtio: fix map ops comment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 465/614] virtio: fix virtqueue_set_affinity() docs Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 467/614] vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues Greg Kroah-Hartman
` (161 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Wang, Michael S. Tsirkin,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit deb55fc994e3dc38f139c0147c15fc2a9db27086 ]
@free will free the map handle not sync it. Fix the doc to match.
Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core")
Message-Id: <f6ff1c7aff8401900bf362007d7fb52dfdb6a15b.1763026134.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/virtio_config.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index 1a019a1f168d5..a1af2676bbe6a 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -177,7 +177,7 @@ struct virtio_config_ops {
* map: metadata for performing mapping
* size: the size of the buffer
* vaddr: virtual address of the buffer
- * map_handle: the mapping address to sync
+ * map_handle: the mapping address that needs to be freed
* attrs: unmapping attributes
* @need_sync: if the buffer needs synchronization
* map: metadata for performing mapping
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 467/614] vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 466/614] virtio: fix map ops comment Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 468/614] vhost: Fix kthread worker cgroup failure handling Greg Kroah-Hartman
` (160 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Jason Wang,
Dragos Tatulea, Michael S. Tsirkin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit f0ea2e91093ac979d07ebd033e0f45869b1d2608 ]
When query_virtqueues() fails, the error log prints the variable err
instead of cmd->err. Since err may still be zero at this point, the
log message can misleadingly report a success value 0 even though the
command actually failed.
Even worse, once err is set to the first failure, subsequent logs
print that same stale value. This makes the error reporting appear
one step behind the actual failing queue index, which is confusing
and misleading.
Fix the log to report cmd->err, which reflects the real failure code
returned by the firmware.
Fixes: 1fcdf43ea69e ("vdpa/mlx5: Use async API for vq query command")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250929134258.80956-1-alok.a.tiwari@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
index a7936bd1aabe1..ddaa1366704bb 100644
--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
@@ -1256,7 +1256,7 @@ static int query_virtqueues(struct mlx5_vdpa_net *ndev,
int vq_idx = start_vq + i;
if (cmd->err) {
- mlx5_vdpa_err(mvdev, "query vq %d failed, err: %d\n", vq_idx, err);
+ mlx5_vdpa_err(mvdev, "query vq %d failed, err: %d\n", vq_idx, cmd->err);
if (!err)
err = cmd->err;
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 468/614] vhost: Fix kthread worker cgroup failure handling
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 467/614] vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 469/614] vdpa/pds: use %pe for ERR_PTR() in event handler registration Greg Kroah-Hartman
` (159 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Christie, Jason Wang,
Chaitanya Kulkarni, Michael S. Tsirkin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit f3f64c2eaffbc3169bbe1e5d1e897e6dacc839d1 ]
If we fail to attach to a cgroup we are leaking the id. This adds
a new goto to free the id.
Fixes: 7d9896e9f6d0 ("vhost: Reintroduce kthread API and add mode selection")
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251101194358.13605-1-michael.christie@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vhost.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index a78226b37739d..bccdc9eab267a 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -804,11 +804,13 @@ static int vhost_kthread_worker_create(struct vhost_worker *worker,
ret = vhost_attach_task_to_cgroups(worker);
if (ret)
- goto stop_worker;
+ goto free_id;
worker->id = id;
return 0;
+free_id:
+ xa_erase(&dev->worker_xa, id);
stop_worker:
vhost_kthread_do_stop(worker);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 469/614] vdpa/pds: use %pe for ERR_PTR() in event handler registration
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 468/614] vhost: Fix kthread worker cgroup failure handling Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 470/614] virtio: clean up features qword/dword terms Greg Kroah-Hartman
` (158 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Brett Creeley,
Michael S. Tsirkin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit 731ca4a4cc52fd5c5ae309edcfd2d7e54ece3321 ]
Use %pe instead of %ps when printing ERR_PTR() values. %ps is intended
for string pointers, while %pe correctly prints symbolic error names
for error pointers returned via ERR_PTR().
This shows the returned error value more clearly.
Fixes: 67f27b8b3a34 ("pds_vdpa: subscribe to the pds_core events")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251018174705.1511982-1-alok.a.tiwari@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vdpa/pds/vdpa_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vdpa/pds/vdpa_dev.c b/drivers/vdpa/pds/vdpa_dev.c
index 36f61cc96e211..43426bd971acc 100644
--- a/drivers/vdpa/pds/vdpa_dev.c
+++ b/drivers/vdpa/pds/vdpa_dev.c
@@ -51,7 +51,7 @@ static int pds_vdpa_register_event_handler(struct pds_vdpa_device *pdsv)
err = pdsc_register_notify(nb);
if (err) {
nb->notifier_call = NULL;
- dev_err(dev, "failed to register pds event handler: %ps\n",
+ dev_err(dev, "failed to register pds event handler: %pe\n",
ERR_PTR(err));
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 470/614] virtio: clean up features qword/dword terms
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 469/614] vdpa/pds: use %pe for ERR_PTR() in event handler registration Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 471/614] ASoC: Intel: catpt: Fix error path in hw_params() Greg Kroah-Hartman
` (157 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Jason Wang,
Michael S. Tsirkin, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
[ Upstream commit 9513f25056b22100ddffe24898c587873b0d022c ]
virtio pci uses word to mean "16 bits". mmio uses it to mean
"32 bits".
To avoid confusion, let's avoid the term in core virtio
altogether. Just say U64 to mean "64 bit".
Fixes: e7d4c1c5a546 ("virtio: introduce extended features")
Cc: Paolo Abeni <pabeni@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-ID: <ad53b7b6be87fc524f45abaeca0bb05fb3633397.1764225384.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/net.c | 12 +++++------
drivers/virtio/virtio.c | 12 +++++------
drivers/virtio/virtio_debug.c | 10 ++++-----
drivers/virtio/virtio_pci_modern_dev.c | 6 +++---
include/linux/virtio.h | 2 +-
include/linux/virtio_config.h | 2 +-
include/linux/virtio_features.h | 29 +++++++++++++-------------
include/linux/virtio_pci_modern.h | 8 +++----
8 files changed, 41 insertions(+), 40 deletions(-)
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 8f7f50acb6d63..1e77c0482b849 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -69,7 +69,7 @@ MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;"
#define VHOST_DMA_IS_DONE(len) ((__force u32)(len) >= (__force u32)VHOST_DMA_DONE_LEN)
-static const u64 vhost_net_features[VIRTIO_FEATURES_DWORDS] = {
+static const u64 vhost_net_features[VIRTIO_FEATURES_U64S] = {
VHOST_FEATURES |
(1ULL << VHOST_NET_F_VIRTIO_NET_HDR) |
(1ULL << VIRTIO_NET_F_MRG_RXBUF) |
@@ -1731,7 +1731,7 @@ static long vhost_net_set_owner(struct vhost_net *n)
static long vhost_net_ioctl(struct file *f, unsigned int ioctl,
unsigned long arg)
{
- u64 all_features[VIRTIO_FEATURES_DWORDS];
+ u64 all_features[VIRTIO_FEATURES_U64S];
struct vhost_net *n = f->private_data;
void __user *argp = (void __user *)arg;
u64 __user *featurep = argp;
@@ -1763,7 +1763,7 @@ static long vhost_net_ioctl(struct file *f, unsigned int ioctl,
/* Copy the net features, up to the user-provided buffer size */
argp += sizeof(u64);
- copied = min(count, VIRTIO_FEATURES_DWORDS);
+ copied = min(count, (u64)VIRTIO_FEATURES_U64S);
if (copy_to_user(argp, vhost_net_features,
copied * sizeof(u64)))
return -EFAULT;
@@ -1778,13 +1778,13 @@ static long vhost_net_ioctl(struct file *f, unsigned int ioctl,
virtio_features_zero(all_features);
argp += sizeof(u64);
- copied = min(count, VIRTIO_FEATURES_DWORDS);
+ copied = min(count, (u64)VIRTIO_FEATURES_U64S);
if (copy_from_user(all_features, argp, copied * sizeof(u64)))
return -EFAULT;
/*
* Any feature specified by user-space above
- * VIRTIO_FEATURES_MAX is not supported by definition.
+ * VIRTIO_FEATURES_BITS is not supported by definition.
*/
for (i = copied; i < count; ++i) {
if (copy_from_user(&features, featurep + 1 + i,
@@ -1794,7 +1794,7 @@ static long vhost_net_ioctl(struct file *f, unsigned int ioctl,
return -EOPNOTSUPP;
}
- for (i = 0; i < VIRTIO_FEATURES_DWORDS; i++)
+ for (i = 0; i < VIRTIO_FEATURES_U64S; i++)
if (all_features[i] & ~vhost_net_features[i])
return -EOPNOTSUPP;
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index a09eb4d62f82d..5bdc6b82b30b4 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -53,7 +53,7 @@ static ssize_t features_show(struct device *_d,
/* We actually represent this as a bitstring, as it could be
* arbitrary length in future. */
- for (i = 0; i < VIRTIO_FEATURES_MAX; i++)
+ for (i = 0; i < VIRTIO_FEATURES_BITS; i++)
len += sysfs_emit_at(buf, len, "%c",
__virtio_test_bit(dev, i) ? '1' : '0');
len += sysfs_emit_at(buf, len, "\n");
@@ -272,8 +272,8 @@ static int virtio_dev_probe(struct device *_d)
int err, i;
struct virtio_device *dev = dev_to_virtio(_d);
struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
- u64 device_features[VIRTIO_FEATURES_DWORDS];
- u64 driver_features[VIRTIO_FEATURES_DWORDS];
+ u64 device_features[VIRTIO_FEATURES_U64S];
+ u64 driver_features[VIRTIO_FEATURES_U64S];
u64 driver_features_legacy;
/* We have a driver! */
@@ -286,7 +286,7 @@ static int virtio_dev_probe(struct device *_d)
virtio_features_zero(driver_features);
for (i = 0; i < drv->feature_table_size; i++) {
unsigned int f = drv->feature_table[i];
- if (!WARN_ON_ONCE(f >= VIRTIO_FEATURES_MAX))
+ if (!WARN_ON_ONCE(f >= VIRTIO_FEATURES_BITS))
virtio_features_set_bit(driver_features, f);
}
@@ -303,7 +303,7 @@ static int virtio_dev_probe(struct device *_d)
}
if (virtio_features_test_bit(device_features, VIRTIO_F_VERSION_1)) {
- for (i = 0; i < VIRTIO_FEATURES_DWORDS; ++i)
+ for (i = 0; i < VIRTIO_FEATURES_U64S; ++i)
dev->features_array[i] = driver_features[i] &
device_features[i];
} else {
@@ -325,7 +325,7 @@ static int virtio_dev_probe(struct device *_d)
goto err;
if (drv->validate) {
- u64 features[VIRTIO_FEATURES_DWORDS];
+ u64 features[VIRTIO_FEATURES_U64S];
virtio_features_copy(features, dev->features_array);
err = drv->validate(dev);
diff --git a/drivers/virtio/virtio_debug.c b/drivers/virtio/virtio_debug.c
index d58713ddf2e58..ccf1955a1183a 100644
--- a/drivers/virtio/virtio_debug.c
+++ b/drivers/virtio/virtio_debug.c
@@ -8,12 +8,12 @@ static struct dentry *virtio_debugfs_dir;
static int virtio_debug_device_features_show(struct seq_file *s, void *data)
{
- u64 device_features[VIRTIO_FEATURES_DWORDS];
+ u64 device_features[VIRTIO_FEATURES_U64S];
struct virtio_device *dev = s->private;
unsigned int i;
virtio_get_features(dev, device_features);
- for (i = 0; i < VIRTIO_FEATURES_MAX; i++) {
+ for (i = 0; i < VIRTIO_FEATURES_BITS; i++) {
if (virtio_features_test_bit(device_features, i))
seq_printf(s, "%u\n", i);
}
@@ -26,7 +26,7 @@ static int virtio_debug_filter_features_show(struct seq_file *s, void *data)
struct virtio_device *dev = s->private;
unsigned int i;
- for (i = 0; i < VIRTIO_FEATURES_MAX; i++) {
+ for (i = 0; i < VIRTIO_FEATURES_BITS; i++) {
if (virtio_features_test_bit(dev->debugfs_filter_features, i))
seq_printf(s, "%u\n", i);
}
@@ -50,7 +50,7 @@ static int virtio_debug_filter_feature_add(void *data, u64 val)
{
struct virtio_device *dev = data;
- if (val >= VIRTIO_FEATURES_MAX)
+ if (val >= VIRTIO_FEATURES_BITS)
return -EINVAL;
virtio_features_set_bit(dev->debugfs_filter_features, val);
@@ -64,7 +64,7 @@ static int virtio_debug_filter_feature_del(void *data, u64 val)
{
struct virtio_device *dev = data;
- if (val >= VIRTIO_FEATURES_MAX)
+ if (val >= VIRTIO_FEATURES_BITS)
return -EINVAL;
virtio_features_clear_bit(dev->debugfs_filter_features, val);
diff --git a/drivers/virtio/virtio_pci_modern_dev.c b/drivers/virtio/virtio_pci_modern_dev.c
index 9e503b7a58d81..413a8c3534638 100644
--- a/drivers/virtio/virtio_pci_modern_dev.c
+++ b/drivers/virtio/virtio_pci_modern_dev.c
@@ -401,7 +401,7 @@ void vp_modern_get_extended_features(struct virtio_pci_modern_device *mdev,
int i;
virtio_features_zero(features);
- for (i = 0; i < VIRTIO_FEATURES_WORDS; i++) {
+ for (i = 0; i < VIRTIO_FEATURES_BITS / 32; i++) {
u64 cur;
vp_iowrite32(i, &cfg->device_feature_select);
@@ -427,7 +427,7 @@ vp_modern_get_driver_extended_features(struct virtio_pci_modern_device *mdev,
int i;
virtio_features_zero(features);
- for (i = 0; i < VIRTIO_FEATURES_WORDS; i++) {
+ for (i = 0; i < VIRTIO_FEATURES_BITS / 32; i++) {
u64 cur;
vp_iowrite32(i, &cfg->guest_feature_select);
@@ -448,7 +448,7 @@ void vp_modern_set_extended_features(struct virtio_pci_modern_device *mdev,
struct virtio_pci_common_cfg __iomem *cfg = mdev->common;
int i;
- for (i = 0; i < VIRTIO_FEATURES_WORDS; i++) {
+ for (i = 0; i < VIRTIO_FEATURES_BITS / 32; i++) {
u32 cur = features[i >> 1] >> (32 * (i & 1));
vp_iowrite32(i, &cfg->guest_feature_select);
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 96c66126c0741..132a474e59140 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -177,7 +177,7 @@ struct virtio_device {
union virtio_map vmap;
#ifdef CONFIG_VIRTIO_DEBUG
struct dentry *debugfs_dir;
- u64 debugfs_filter_features[VIRTIO_FEATURES_DWORDS];
+ u64 debugfs_filter_features[VIRTIO_FEATURES_U64S];
#endif
};
diff --git a/include/linux/virtio_config.h b/include/linux/virtio_config.h
index a1af2676bbe6a..69f84ea85d71a 100644
--- a/include/linux/virtio_config.h
+++ b/include/linux/virtio_config.h
@@ -80,7 +80,7 @@ struct virtqueue_info {
* Returns the first 64 feature bits.
* @get_extended_features:
* vdev: the virtio_device
- * Returns the first VIRTIO_FEATURES_MAX feature bits (all we currently
+ * Returns the first VIRTIO_FEATURES_BITS feature bits (all we currently
* need).
* @finalize_features: confirm what device features we'll be using.
* vdev: the virtio_device
diff --git a/include/linux/virtio_features.h b/include/linux/virtio_features.h
index f748f2f87de8d..ea2ad8717882e 100644
--- a/include/linux/virtio_features.h
+++ b/include/linux/virtio_features.h
@@ -4,15 +4,16 @@
#include <linux/bits.h>
-#define VIRTIO_FEATURES_DWORDS 2
-#define VIRTIO_FEATURES_MAX (VIRTIO_FEATURES_DWORDS * 64)
-#define VIRTIO_FEATURES_WORDS (VIRTIO_FEATURES_DWORDS * 2)
+#define VIRTIO_FEATURES_U64S 2
+#define VIRTIO_FEATURES_BITS (VIRTIO_FEATURES_U64S * 64)
+
#define VIRTIO_BIT(b) BIT_ULL((b) & 0x3f)
-#define VIRTIO_DWORD(b) ((b) >> 6)
+#define VIRTIO_U64(b) ((b) >> 6)
+
#define VIRTIO_DECLARE_FEATURES(name) \
union { \
u64 name; \
- u64 name##_array[VIRTIO_FEATURES_DWORDS];\
+ u64 name##_array[VIRTIO_FEATURES_U64S];\
}
static inline bool virtio_features_chk_bit(unsigned int bit)
@@ -22,9 +23,9 @@ static inline bool virtio_features_chk_bit(unsigned int bit)
* Don't care returning the correct value: the build
* will fail before any bad features access
*/
- BUILD_BUG_ON(bit >= VIRTIO_FEATURES_MAX);
+ BUILD_BUG_ON(bit >= VIRTIO_FEATURES_BITS);
} else {
- if (WARN_ON_ONCE(bit >= VIRTIO_FEATURES_MAX))
+ if (WARN_ON_ONCE(bit >= VIRTIO_FEATURES_BITS))
return false;
}
return true;
@@ -34,26 +35,26 @@ static inline bool virtio_features_test_bit(const u64 *features,
unsigned int bit)
{
return virtio_features_chk_bit(bit) &&
- !!(features[VIRTIO_DWORD(bit)] & VIRTIO_BIT(bit));
+ !!(features[VIRTIO_U64(bit)] & VIRTIO_BIT(bit));
}
static inline void virtio_features_set_bit(u64 *features,
unsigned int bit)
{
if (virtio_features_chk_bit(bit))
- features[VIRTIO_DWORD(bit)] |= VIRTIO_BIT(bit);
+ features[VIRTIO_U64(bit)] |= VIRTIO_BIT(bit);
}
static inline void virtio_features_clear_bit(u64 *features,
unsigned int bit)
{
if (virtio_features_chk_bit(bit))
- features[VIRTIO_DWORD(bit)] &= ~VIRTIO_BIT(bit);
+ features[VIRTIO_U64(bit)] &= ~VIRTIO_BIT(bit);
}
static inline void virtio_features_zero(u64 *features)
{
- memset(features, 0, sizeof(features[0]) * VIRTIO_FEATURES_DWORDS);
+ memset(features, 0, sizeof(features[0]) * VIRTIO_FEATURES_U64S);
}
static inline void virtio_features_from_u64(u64 *features, u64 from)
@@ -66,7 +67,7 @@ static inline bool virtio_features_equal(const u64 *f1, const u64 *f2)
{
int i;
- for (i = 0; i < VIRTIO_FEATURES_DWORDS; ++i)
+ for (i = 0; i < VIRTIO_FEATURES_U64S; ++i)
if (f1[i] != f2[i])
return false;
return true;
@@ -74,14 +75,14 @@ static inline bool virtio_features_equal(const u64 *f1, const u64 *f2)
static inline void virtio_features_copy(u64 *to, const u64 *from)
{
- memcpy(to, from, sizeof(to[0]) * VIRTIO_FEATURES_DWORDS);
+ memcpy(to, from, sizeof(to[0]) * VIRTIO_FEATURES_U64S);
}
static inline void virtio_features_andnot(u64 *to, const u64 *f1, const u64 *f2)
{
int i;
- for (i = 0; i < VIRTIO_FEATURES_DWORDS; i++)
+ for (i = 0; i < VIRTIO_FEATURES_U64S; i++)
to[i] = f1[i] & ~f2[i];
}
diff --git a/include/linux/virtio_pci_modern.h b/include/linux/virtio_pci_modern.h
index 48bc12d1045bd..9a3f2fc53bd65 100644
--- a/include/linux/virtio_pci_modern.h
+++ b/include/linux/virtio_pci_modern.h
@@ -107,7 +107,7 @@ void vp_modern_set_extended_features(struct virtio_pci_modern_device *mdev,
static inline u64
vp_modern_get_features(struct virtio_pci_modern_device *mdev)
{
- u64 features_array[VIRTIO_FEATURES_DWORDS];
+ u64 features_array[VIRTIO_FEATURES_U64S];
vp_modern_get_extended_features(mdev, features_array);
return features_array[0];
@@ -116,11 +116,11 @@ vp_modern_get_features(struct virtio_pci_modern_device *mdev)
static inline u64
vp_modern_get_driver_features(struct virtio_pci_modern_device *mdev)
{
- u64 features_array[VIRTIO_FEATURES_DWORDS];
+ u64 features_array[VIRTIO_FEATURES_U64S];
int i;
vp_modern_get_driver_extended_features(mdev, features_array);
- for (i = 1; i < VIRTIO_FEATURES_DWORDS; ++i)
+ for (i = 1; i < VIRTIO_FEATURES_U64S; ++i)
WARN_ON_ONCE(features_array[i]);
return features_array[0];
}
@@ -128,7 +128,7 @@ vp_modern_get_driver_features(struct virtio_pci_modern_device *mdev)
static inline void
vp_modern_set_features(struct virtio_pci_modern_device *mdev, u64 features)
{
- u64 features_array[VIRTIO_FEATURES_DWORDS];
+ u64 features_array[VIRTIO_FEATURES_U64S];
virtio_features_from_u64(features_array, features);
vp_modern_set_extended_features(mdev, features_array);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 471/614] ASoC: Intel: catpt: Fix error path in hw_params()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 470/614] virtio: clean up features qword/dword terms Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 472/614] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Greg Kroah-Hartman
` (156 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cezary Rojewski, Andy Shevchenko,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <cezary.rojewski@intel.com>
[ Upstream commit 86a5b621be658fc8fe594ca6db317d64de30cce1 ]
Do not leave any resources hanging on the DSP side if
applying user settings fails.
Fixes: 768a3a3b327d ("ASoC: Intel: catpt: Optimize applying user settings")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20251126095523.3925364-4-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/catpt/pcm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/intel/catpt/pcm.c b/sound/soc/intel/catpt/pcm.c
index bf734c69c4e09..eb03cecdee281 100644
--- a/sound/soc/intel/catpt/pcm.c
+++ b/sound/soc/intel/catpt/pcm.c
@@ -417,8 +417,10 @@ static int catpt_dai_hw_params(struct snd_pcm_substream *substream,
return CATPT_IPC_ERROR(ret);
ret = catpt_dai_apply_usettings(dai, stream);
- if (ret)
+ if (ret) {
+ catpt_ipc_free_stream(cdev, stream->info.stream_hw_id);
return ret;
+ }
stream->allocated = true;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 472/614] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 471/614] ASoC: Intel: catpt: Fix error path in hw_params() Greg Kroah-Hartman
@ 2025-12-16 11:13 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 473/614] soc: samsung: exynos-pmu: Fix structure initialization Greg Kroah-Hartman
` (155 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikhail Kshevetskiy,
AngeloGioacchino Del Regno, Andy Shevchenko, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
[ Upstream commit 061795b345aff371df8f71d54ae7c7dc8ae630d0 ]
Airoha EN7523 specific bug
--------------------------
We found that some serial console may pull TX line to GROUND during board
boot time. Airoha uses TX line as one of its bootstrap pins. On the EN7523
SoC this may lead to booting in RESERVED boot mode.
It was found that some flashes operates incorrectly in RESERVED mode.
Micron and Skyhigh flashes are definitely affected by the issue,
Winbond flashes are not affected.
Details:
--------
DMA reading of odd pages on affected flashes operates incorrectly. Page
reading offset (start of the page) on hardware level is replaced by 0x10.
Thus results in incorrect data reading. As result OS loading becomes
impossible.
Usage of UBI make things even worse. On attaching, UBI will detects
corruptions (because of wrong reading of odd pages) and will try to
recover. For recovering UBI will erase and write 'damaged' blocks with
a valid information. This will destroy all UBI data.
Non-DMA reading is OK.
This patch detects booting in reserved mode, turn off DMA and print big
fat warning.
It's worth noting that the boot configuration is preserved across reboots.
Therefore, to boot normally, you should do the following:
- disconnect the serial console from the board,
- power cycle the board.
Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver")
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20251125234047.1101985-2-mikhail.kshevetskiy@iopsys.eu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-airoha-snfi.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-airoha-snfi.c b/drivers/spi/spi-airoha-snfi.c
index b78163eaed61d..20b5d469d519a 100644
--- a/drivers/spi/spi-airoha-snfi.c
+++ b/drivers/spi/spi-airoha-snfi.c
@@ -1030,6 +1030,11 @@ static const struct spi_controller_mem_ops airoha_snand_mem_ops = {
.dirmap_write = airoha_snand_dirmap_write,
};
+static const struct spi_controller_mem_ops airoha_snand_nodma_mem_ops = {
+ .supports_op = airoha_snand_supports_op,
+ .exec_op = airoha_snand_exec_op,
+};
+
static int airoha_snand_setup(struct spi_device *spi)
{
struct airoha_snand_ctrl *as_ctrl;
@@ -1104,7 +1109,9 @@ static int airoha_snand_probe(struct platform_device *pdev)
struct airoha_snand_ctrl *as_ctrl;
struct device *dev = &pdev->dev;
struct spi_controller *ctrl;
+ bool dma_enable = true;
void __iomem *base;
+ u32 sfc_strap;
int err;
ctrl = devm_spi_alloc_host(dev, sizeof(*as_ctrl));
@@ -1139,12 +1146,28 @@ static int airoha_snand_probe(struct platform_device *pdev)
return dev_err_probe(dev, PTR_ERR(as_ctrl->spi_clk),
"unable to get spi clk\n");
+ if (device_is_compatible(dev, "airoha,en7523-snand")) {
+ err = regmap_read(as_ctrl->regmap_ctrl,
+ REG_SPI_CTRL_SFC_STRAP, &sfc_strap);
+ if (err)
+ return err;
+
+ if (!(sfc_strap & 0x04)) {
+ dma_enable = false;
+ dev_warn(dev, "Detected booting in RESERVED mode (UART_TXD was short to GND).\n");
+ dev_warn(dev, "This mode is known for incorrect DMA reading of some flashes.\n");
+ dev_warn(dev, "Much slower PIO mode will be used to prevent flash data damage.\n");
+ dev_warn(dev, "Unplug UART cable and power cycle board to get full performance.\n");
+ }
+ }
+
err = dma_set_mask(as_ctrl->dev, DMA_BIT_MASK(32));
if (err)
return err;
ctrl->num_chipselect = 2;
- ctrl->mem_ops = &airoha_snand_mem_ops;
+ ctrl->mem_ops = dma_enable ? &airoha_snand_mem_ops
+ : &airoha_snand_nodma_mem_ops;
ctrl->bits_per_word_mask = SPI_BPW_MASK(8);
ctrl->mode_bits = SPI_RX_DUAL;
ctrl->setup = airoha_snand_setup;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 473/614] soc: samsung: exynos-pmu: Fix structure initialization
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2025-12-16 11:13 ` [PATCH 6.18 472/614] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 474/614] ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Greg Kroah-Hartman
` (154 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 2224ea67c75d0a0b9eaf803d0dfdab8d0c601c35 ]
Commit 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for
gs101") added system wide suspend/resume callbacks to Exynos PMU driver,
but some items used by these callbacks are initialized only on
GS101-compatible boards. Move that initialization to exynos_pmu_probe()
to avoid potential lockdep warnings like below observed during system
suspend/resume cycle:
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 2134 Comm: rtcwake Not tainted 6.18.0-rc7-next-20251126-00039-g1d656a1af243 #11794 PREEMPT
Hardware name: Samsung Exynos (Flattened Device Tree)
Call trace:
unwind_backtrace from show_stack+0x10/0x14
show_stack from dump_stack_lvl+0x68/0x88
dump_stack_lvl from register_lock_class+0x970/0x988
register_lock_class from __lock_acquire+0xc8/0x29ec
__lock_acquire from lock_acquire+0x134/0x39c
lock_acquire from _raw_spin_lock+0x38/0x48
_raw_spin_lock from exynos_cpupm_suspend_noirq+0x18/0x34
exynos_cpupm_suspend_noirq from dpm_run_callback+0x98/0x2b8
dpm_run_callback from device_suspend_noirq+0x8c/0x310
Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20251126110038.3326768-1-m.szyprowski@samsung.com
[krzk: include calltrace into commit msg]
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/samsung/exynos-pmu.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index 22c50ca2aa79b..df5b1f299a260 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -585,10 +585,6 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
if (!pmu_context->in_cpuhp)
return -ENOMEM;
- raw_spin_lock_init(&pmu_context->cpupm_lock);
- pmu_context->sys_inreboot = false;
- pmu_context->sys_insuspend = false;
-
/* set PMU to power on */
for_each_online_cpu(cpu)
gs101_cpuhp_pmu_online(cpu);
@@ -657,6 +653,9 @@ static int exynos_pmu_probe(struct platform_device *pdev)
pmu_context->pmureg = regmap;
pmu_context->dev = dev;
+ raw_spin_lock_init(&pmu_context->cpupm_lock);
+ pmu_context->sys_inreboot = false;
+ pmu_context->sys_insuspend = false;
if (pmu_context->pmu_data && pmu_context->pmu_data->pmu_cpuhp) {
ret = setup_cpuhp_and_cpuidle(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 474/614] ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 473/614] soc: samsung: exynos-pmu: Fix structure initialization Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 475/614] ARM: dts: samsung: exynos4210-i9100: " Greg Kroah-Hartman
` (153 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 97aee67e2406ea381408915e606c5f86448f3949 ]
Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board
requires it") changed default behavior of the BRCMFMAC driver, which now
keeps SDIO card powered during system suspend to enable optional support
for WOWL. This feature is not supported by the legacy Exynos4 based
boards and leads to WLAN disfunction after system suspend/resume cycle.
Fix this by annotating SDIO host used by WLAN chip with
'cap-power-off-card' property, which should have been there from the
beginning.
Fixes: f1b0ffaa686f ("ARM: dts: exynos: Enable WLAN support for the UniversalC210 board")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20251126102618.3103517-2-m.szyprowski@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts b/arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts
index bdc30f8cf748f..91490693432b6 100644
--- a/arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts
+++ b/arch/arm/boot/dts/samsung/exynos4210-universal_c210.dts
@@ -610,6 +610,7 @@ &sdhci_3 {
#size-cells = <0>;
non-removable;
+ cap-power-off-card;
bus-width = <4>;
mmc-pwrseq = <&wlan_pwrseq>;
vmmc-supply = <&ldo5_reg>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 475/614] ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 474/614] ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 476/614] ARM: dts: samsung: exynos4210-trats: " Greg Kroah-Hartman
` (152 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 863d69923bdb6f414d0a3f504f1dfaeacbc00b09 ]
Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board
requires it") changed default behavior of the BRCMFMAC driver, which now
keeps SDIO card powered during system suspend to enable optional support
for WOWL. This feature is not supported by the legacy Exynos4 based
boards and leads to WLAN disfunction after system suspend/resume cycle.
Fix this by annotating SDIO host used by WLAN chip with
'cap-power-off-card' property, which should have been there from the
beginning.
Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20251126102618.3103517-3-m.szyprowski@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/samsung/exynos4210-i9100.dts b/arch/arm/boot/dts/samsung/exynos4210-i9100.dts
index df229fb8a16be..8a635bee59fa9 100644
--- a/arch/arm/boot/dts/samsung/exynos4210-i9100.dts
+++ b/arch/arm/boot/dts/samsung/exynos4210-i9100.dts
@@ -853,6 +853,7 @@ &sdhci_3 {
#size-cells = <0>;
non-removable;
+ cap-power-off-card;
bus-width = <4>;
mmc-pwrseq = <&wlan_pwrseq>;
vmmc-supply = <&vtf_reg>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 476/614] ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 475/614] ARM: dts: samsung: exynos4210-i9100: " Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 477/614] ARM: dts: samsung: exynos4412-midas: " Greg Kroah-Hartman
` (151 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 97cc9c346b2c9cde075b9420fc172137d2427711 ]
Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board
requires it") changed default behavior of the BRCMFMAC driver, which now
keeps SDIO card powered during system suspend to enable optional support
for WOWL. This feature is not supported by the legacy Exynos4 based
boards and leads to WLAN disfunction after system suspend/resume cycle.
Fix this by annotating SDIO host used by WLAN chip with
'cap-power-off-card' property, which should have been there from the
beginning.
Fixes: a19f6efc01df ("ARM: dts: exynos: Enable WLAN support for the Trats board")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20251126102618.3103517-4-m.szyprowski@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/samsung/exynos4210-trats.dts b/arch/arm/boot/dts/samsung/exynos4210-trats.dts
index 95e0e01b6ff6b..6bd902cb8f4ad 100644
--- a/arch/arm/boot/dts/samsung/exynos4210-trats.dts
+++ b/arch/arm/boot/dts/samsung/exynos4210-trats.dts
@@ -518,6 +518,7 @@ &sdhci_3 {
#size-cells = <0>;
non-removable;
+ cap-power-off-card;
bus-width = <4>;
mmc-pwrseq = <&wlan_pwrseq>;
vmmc-supply = <&tflash_reg>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 477/614] ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 476/614] ARM: dts: samsung: exynos4210-trats: " Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 478/614] regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex Greg Kroah-Hartman
` (150 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski,
Krzysztof Kozlowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 2ff147fdfa99b8cbb8c2833e685fde7c42580ae6 ]
Commit 8c3170628a9c ("wifi: brcmfmac: keep power during suspend if board
requires it") changed default behavior of the BRCMFMAC driver, which now
keeps SDIO card powered during system suspend to enable optional support
for WOWL. This feature is not supported by the legacy Exynos4 based
boards and leads to WLAN disfunction after system suspend/resume cycle.
Fix this by annotating SDIO host used by WLAN chip with
'cap-power-off-card' property, which should have been there from the
beginning.
Fixes: f77cbb9a3e5d ("ARM: dts: exynos: Add bcm4334 device node to Trats2")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://patch.msgid.link/20251126102618.3103517-5-m.szyprowski@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/samsung/exynos4412-midas.dtsi b/arch/arm/boot/dts/samsung/exynos4412-midas.dtsi
index 05ddddb565ee3..48245b1665a69 100644
--- a/arch/arm/boot/dts/samsung/exynos4412-midas.dtsi
+++ b/arch/arm/boot/dts/samsung/exynos4412-midas.dtsi
@@ -1440,6 +1440,7 @@ &sdhci_3 {
#address-cells = <1>;
#size-cells = <0>;
non-removable;
+ cap-power-off-card;
bus-width = <4>;
mmc-pwrseq = <&wlan_pwrseq>;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 478/614] regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 477/614] ARM: dts: samsung: exynos4412-midas: " Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 479/614] arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 Greg Kroah-Hartman
` (149 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sparkhuang, Charles Keepax,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: sparkhuang <huangshaobo3@xiaomi.com>
[ Upstream commit 0cc15a10c3b4ab14cd71b779fd5c9ca0cb2bc30d ]
regulator_supply_alias_list was accessed without any locking in
regulator_supply_alias(), regulator_register_supply_alias(), and
regulator_unregister_supply_alias(). Concurrent registration,
unregistration and lookups can race, leading to:
1 use-after-free if an alias entry is removed while being read,
2 duplicate entries when two threads register the same alias,
3 inconsistent alias mappings observed by consumers.
Protect all traversals, insertions and deletions on
regulator_supply_alias_list with the existing regulator_list_mutex.
Fixes: a06ccd9c3785f ("regulator: core: Add ability to create a lookup alias for supply")
Signed-off-by: sparkhuang <huangshaobo3@xiaomi.com>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20251127025716.5440-1-huangshaobo3@xiaomi.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index fc93612f4ec0c..b38b087eccfd7 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1947,6 +1947,7 @@ static void regulator_supply_alias(struct device **dev, const char **supply)
{
struct regulator_supply_alias *map;
+ mutex_lock(®ulator_list_mutex);
map = regulator_find_supply_alias(*dev, *supply);
if (map) {
dev_dbg(*dev, "Mapping supply %s to %s,%s\n",
@@ -1955,6 +1956,7 @@ static void regulator_supply_alias(struct device **dev, const char **supply)
*dev = map->alias_dev;
*supply = map->alias_supply;
}
+ mutex_unlock(®ulator_list_mutex);
}
static int regulator_match(struct device *dev, const void *data)
@@ -2497,22 +2499,26 @@ int regulator_register_supply_alias(struct device *dev, const char *id,
const char *alias_id)
{
struct regulator_supply_alias *map;
+ struct regulator_supply_alias *new_map;
- map = regulator_find_supply_alias(dev, id);
- if (map)
- return -EEXIST;
-
- map = kzalloc(sizeof(struct regulator_supply_alias), GFP_KERNEL);
- if (!map)
+ new_map = kzalloc(sizeof(struct regulator_supply_alias), GFP_KERNEL);
+ if (!new_map)
return -ENOMEM;
- map->src_dev = dev;
- map->src_supply = id;
- map->alias_dev = alias_dev;
- map->alias_supply = alias_id;
-
- list_add(&map->list, ®ulator_supply_alias_list);
+ mutex_lock(®ulator_list_mutex);
+ map = regulator_find_supply_alias(dev, id);
+ if (map) {
+ mutex_unlock(®ulator_list_mutex);
+ kfree(new_map);
+ return -EEXIST;
+ }
+ new_map->src_dev = dev;
+ new_map->src_supply = id;
+ new_map->alias_dev = alias_dev;
+ new_map->alias_supply = alias_id;
+ list_add(&new_map->list, ®ulator_supply_alias_list);
+ mutex_unlock(®ulator_list_mutex);
pr_info("Adding alias for supply %s,%s -> %s,%s\n",
id, dev_name(dev), alias_id, dev_name(alias_dev));
@@ -2532,11 +2538,13 @@ void regulator_unregister_supply_alias(struct device *dev, const char *id)
{
struct regulator_supply_alias *map;
+ mutex_lock(®ulator_list_mutex);
map = regulator_find_supply_alias(dev, id);
if (map) {
list_del(&map->list);
kfree(map);
}
+ mutex_unlock(®ulator_list_mutex);
}
EXPORT_SYMBOL_GPL(regulator_unregister_supply_alias);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 479/614] arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 478/614] regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 480/614] Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Greg Kroah-Hartman
` (148 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Arnd Bergmann, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit ce48af13e6381772cc27676be63a6d9176c14a49 ]
The base address of JPEG decoder core 1 should start at 0x10000, and
have a size of 0x10000, i.e. it is right after core 0.
Instead the core has the same base address as core 0, and with a crazy
large size. This looks like a mixup of address and size cells when the
ranges were converted.
This causes the kernel to fail to register the second core due to sysfs
name conflicts:
sysfs: cannot create duplicate filename '/devices/platform/soc/soc:jpeg-decoder@1a040000/1a040000.jpgdec'
Fix up the address range.
Fixes: a9eac43d039f ("arm64: dts: mediatek: mt8195: Fix ranges for jpeg enc/decoder nodes")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Acked-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20251127100044.612825-1-wenst@chromium.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
index ec452d6570314..c7adafaa83288 100644
--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
@@ -3067,7 +3067,7 @@ jpgdec@0,0 {
jpgdec@0,10000 {
compatible = "mediatek,mt8195-jpgdec-hw";
- reg = <0 0 0x10000 0x10000>;/* JPGDEC_C1 */
+ reg = <0 0x10000 0 0x10000>;/* JPGDEC_C1 */
iommus = <&iommu_vdo M4U_PORT_L19_JPGDEC_WDMA0>,
<&iommu_vdo M4U_PORT_L19_JPGDEC_BSDMA0>,
<&iommu_vdo M4U_PORT_L19_JPGDEC_WDMA1>,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 480/614] Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 479/614] arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 481/614] netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Greg Kroah-Hartman
` (147 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilias Stamatis,
David Hildenbrand (Red Hat), Andriy Shevchenko, Baoquan He,
Huang, Ying, Nadav Amit, Andrew Morton, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilias Stamatis <ilstam@amazon.com>
[ Upstream commit 6fb3acdebf65a72df0a95f9fd2c901ff2bc9a3a2 ]
Commit 97523a4edb7b ("kernel/resource: remove first_lvl / siblings_only
logic") removed an optimization introduced by commit 756398750e11
("resource: avoid unnecessary lookups in find_next_iomem_res()"). That
was not called out in the message of the first commit explicitly so it's
not entirely clear whether removing the optimization happened
inadvertently or not.
As the original commit message of the optimization explains there is no
point considering the children of a subtree in find_next_iomem_res() if
the top level range does not match.
Reinstating the optimization results in performance improvements in
systems where /proc/iomem is ~5k lines long. Calling mmap() on /dev/mem
in such platforms takes 700-1500μs without the optimisation and 10-50μs
with the optimisation.
Note that even though commit 97523a4edb7b removed the 'sibling_only'
parameter from next_resource(), newer kernels have basically reinstated it
under the name 'skip_children'.
Link: https://lore.kernel.org/all/20251124165349.3377826-1-ilstam@amazon.com/T/#u
Fixes: 97523a4edb7b ("kernel/resource: remove first_lvl / siblings_only logic")
Signed-off-by: Ilias Stamatis <ilstam@amazon.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Andriy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: "Huang, Ying" <huang.ying.caritas@gmail.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/resource.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/kernel/resource.c b/kernel/resource.c
index b9fa2a4ce089c..e4e9bac12e6e1 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -341,6 +341,8 @@ static int find_next_iomem_res(resource_size_t start, resource_size_t end,
unsigned long flags, unsigned long desc,
struct resource *res)
{
+ /* Skip children until we find a top level range that matches */
+ bool skip_children = true;
struct resource *p;
if (!res)
@@ -351,7 +353,7 @@ static int find_next_iomem_res(resource_size_t start, resource_size_t end,
read_lock(&resource_lock);
- for_each_resource(&iomem_resource, p, false) {
+ for_each_resource(&iomem_resource, p, skip_children) {
/* If we passed the resource we are looking for, stop */
if (p->start > end) {
p = NULL;
@@ -362,6 +364,12 @@ static int find_next_iomem_res(resource_size_t start, resource_size_t end,
if (p->end < start)
continue;
+ /*
+ * We found a top level range that matches what we are looking
+ * for. Time to start checking children too.
+ */
+ skip_children = false;
+
/* Found a match, break */
if (is_type_match(p, flags, desc))
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 481/614] netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 480/614] Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 482/614] netfilter: nf_conncount: rework API to use sk_buff directly Greg Kroah-Hartman
` (146 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 634f3853cc98d73bdec8918010ee29b06981583e ]
Add a sanity check to skip path discovery if the maximum number of
encapsulation is reached. While at it, check for underflow too.
Fixes: 26267bf9bb57 ("netfilter: flowtable: bridge vlan hardware offload and switchdev")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_flow_offload.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index 14dd1c0698c3c..e95e5f59a3d6a 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -141,12 +141,19 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
info->ingress_vlans |= BIT(info->num_encaps - 1);
break;
case DEV_PATH_BR_VLAN_TAG:
+ if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
+ info->indev = NULL;
+ break;
+ }
info->encap[info->num_encaps].id = path->bridge.vlan_id;
info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
info->num_encaps++;
break;
case DEV_PATH_BR_VLAN_UNTAG:
- info->num_encaps--;
+ if (WARN_ON_ONCE(info->num_encaps-- == 0)) {
+ info->indev = NULL;
+ break;
+ }
break;
case DEV_PATH_BR_VLAN_KEEP:
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 482/614] netfilter: nf_conncount: rework API to use sk_buff directly
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 481/614] netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 483/614] netfilter: nft_connlimit: update the count if add was skipped Greg Kroah-Hartman
` (145 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Pablo Neira Ayuso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit be102eb6a0e7c03db00e50540622f4e43b2d2844 ]
When using nf_conncount infrastructure for non-confirmed connections a
duplicated track is possible due to an optimization introduced since
commit d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC").
In order to fix this introduce a new conncount API that receives
directly an sk_buff struct. It fetches the tuple and zone and the
corresponding ct from it. It comes with both existing conncount variants
nf_conncount_count_skb() and nf_conncount_add_skb(). In addition remove
the old API and adjust all the users to use the new one.
This way, for each sk_buff struct it is possible to check if there is a
ct present and already confirmed. If so, skip the add operation.
Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/netfilter/nf_conntrack_count.h | 17 +-
net/netfilter/nf_conncount.c | 177 ++++++++++++++-------
net/netfilter/nft_connlimit.c | 21 +--
net/netfilter/xt_connlimit.c | 14 +-
net/openvswitch/conntrack.c | 16 +-
5 files changed, 142 insertions(+), 103 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_count.h b/include/net/netfilter/nf_conntrack_count.h
index 1b58b5b91ff6a..52a06de41aa0f 100644
--- a/include/net/netfilter/nf_conntrack_count.h
+++ b/include/net/netfilter/nf_conntrack_count.h
@@ -18,15 +18,14 @@ struct nf_conncount_list {
struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int keylen);
void nf_conncount_destroy(struct net *net, struct nf_conncount_data *data);
-unsigned int nf_conncount_count(struct net *net,
- struct nf_conncount_data *data,
- const u32 *key,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone);
-
-int nf_conncount_add(struct net *net, struct nf_conncount_list *list,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone);
+unsigned int nf_conncount_count_skb(struct net *net,
+ const struct sk_buff *skb,
+ u16 l3num,
+ struct nf_conncount_data *data,
+ const u32 *key);
+
+int nf_conncount_add_skb(struct net *net, const struct sk_buff *skb,
+ u16 l3num, struct nf_conncount_list *list);
void nf_conncount_list_init(struct nf_conncount_list *list);
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 913ede2f57f9a..0ffc5ff78a714 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -122,15 +122,65 @@ find_or_evict(struct net *net, struct nf_conncount_list *list,
return ERR_PTR(-EAGAIN);
}
+static bool get_ct_or_tuple_from_skb(struct net *net,
+ const struct sk_buff *skb,
+ u16 l3num,
+ struct nf_conn **ct,
+ struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_zone **zone,
+ bool *refcounted)
+{
+ const struct nf_conntrack_tuple_hash *h;
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *found_ct;
+
+ found_ct = nf_ct_get(skb, &ctinfo);
+ if (found_ct && !nf_ct_is_template(found_ct)) {
+ *tuple = found_ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ *zone = nf_ct_zone(found_ct);
+ *ct = found_ct;
+ return true;
+ }
+
+ if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), l3num, net, tuple))
+ return false;
+
+ if (found_ct)
+ *zone = nf_ct_zone(found_ct);
+
+ h = nf_conntrack_find_get(net, *zone, tuple);
+ if (!h)
+ return true;
+
+ found_ct = nf_ct_tuplehash_to_ctrack(h);
+ *refcounted = true;
+ *ct = found_ct;
+
+ return true;
+}
+
static int __nf_conncount_add(struct net *net,
- struct nf_conncount_list *list,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone)
+ const struct sk_buff *skb,
+ u16 l3num,
+ struct nf_conncount_list *list)
{
+ const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
const struct nf_conntrack_tuple_hash *found;
struct nf_conncount_tuple *conn, *conn_n;
+ struct nf_conntrack_tuple tuple;
+ struct nf_conn *ct = NULL;
struct nf_conn *found_ct;
unsigned int collect = 0;
+ bool refcounted = false;
+
+ if (!get_ct_or_tuple_from_skb(net, skb, l3num, &ct, &tuple, &zone, &refcounted))
+ return -ENOENT;
+
+ if (ct && nf_ct_is_confirmed(ct)) {
+ if (refcounted)
+ nf_ct_put(ct);
+ return 0;
+ }
if ((u32)jiffies == list->last_gc)
goto add_new_node;
@@ -144,10 +194,10 @@ static int __nf_conncount_add(struct net *net,
if (IS_ERR(found)) {
/* Not found, but might be about to be confirmed */
if (PTR_ERR(found) == -EAGAIN) {
- if (nf_ct_tuple_equal(&conn->tuple, tuple) &&
+ if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
nf_ct_zone_id(zone, zone->dir))
- return 0; /* already exists */
+ goto out_put; /* already exists */
} else {
collect++;
}
@@ -156,7 +206,7 @@ static int __nf_conncount_add(struct net *net,
found_ct = nf_ct_tuplehash_to_ctrack(found);
- if (nf_ct_tuple_equal(&conn->tuple, tuple) &&
+ if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
nf_ct_zone_equal(found_ct, zone, zone->dir)) {
/*
* We should not see tuples twice unless someone hooks
@@ -165,7 +215,7 @@ static int __nf_conncount_add(struct net *net,
* Attempt to avoid a re-add in this case.
*/
nf_ct_put(found_ct);
- return 0;
+ goto out_put;
} else if (already_closed(found_ct)) {
/*
* we do not care about connections which are
@@ -188,31 +238,35 @@ static int __nf_conncount_add(struct net *net,
if (conn == NULL)
return -ENOMEM;
- conn->tuple = *tuple;
+ conn->tuple = tuple;
conn->zone = *zone;
conn->cpu = raw_smp_processor_id();
conn->jiffies32 = (u32)jiffies;
list_add_tail(&conn->node, &list->head);
list->count++;
list->last_gc = (u32)jiffies;
+
+out_put:
+ if (refcounted)
+ nf_ct_put(ct);
return 0;
}
-int nf_conncount_add(struct net *net,
- struct nf_conncount_list *list,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone)
+int nf_conncount_add_skb(struct net *net,
+ const struct sk_buff *skb,
+ u16 l3num,
+ struct nf_conncount_list *list)
{
int ret;
/* check the saved connections */
spin_lock_bh(&list->list_lock);
- ret = __nf_conncount_add(net, list, tuple, zone);
+ ret = __nf_conncount_add(net, skb, l3num, list);
spin_unlock_bh(&list->list_lock);
return ret;
}
-EXPORT_SYMBOL_GPL(nf_conncount_add);
+EXPORT_SYMBOL_GPL(nf_conncount_add_skb);
void nf_conncount_list_init(struct nf_conncount_list *list)
{
@@ -309,19 +363,22 @@ static void schedule_gc_worker(struct nf_conncount_data *data, int tree)
static unsigned int
insert_tree(struct net *net,
+ const struct sk_buff *skb,
+ u16 l3num,
struct nf_conncount_data *data,
struct rb_root *root,
unsigned int hash,
- const u32 *key,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone)
+ const u32 *key)
{
struct nf_conncount_rb *gc_nodes[CONNCOUNT_GC_MAX_NODES];
+ const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
+ bool do_gc = true, refcounted = false;
+ unsigned int count = 0, gc_count = 0;
struct rb_node **rbnode, *parent;
- struct nf_conncount_rb *rbconn;
+ struct nf_conntrack_tuple tuple;
struct nf_conncount_tuple *conn;
- unsigned int count = 0, gc_count = 0;
- bool do_gc = true;
+ struct nf_conncount_rb *rbconn;
+ struct nf_conn *ct = NULL;
spin_lock_bh(&nf_conncount_locks[hash]);
restart:
@@ -340,7 +397,7 @@ insert_tree(struct net *net,
} else {
int ret;
- ret = nf_conncount_add(net, &rbconn->list, tuple, zone);
+ ret = nf_conncount_add_skb(net, skb, l3num, &rbconn->list);
if (ret)
count = 0; /* hotdrop */
else
@@ -364,30 +421,35 @@ insert_tree(struct net *net,
goto restart;
}
- /* expected case: match, insert new node */
- rbconn = kmem_cache_alloc(conncount_rb_cachep, GFP_ATOMIC);
- if (rbconn == NULL)
- goto out_unlock;
+ if (get_ct_or_tuple_from_skb(net, skb, l3num, &ct, &tuple, &zone, &refcounted)) {
+ /* expected case: match, insert new node */
+ rbconn = kmem_cache_alloc(conncount_rb_cachep, GFP_ATOMIC);
+ if (rbconn == NULL)
+ goto out_unlock;
- conn = kmem_cache_alloc(conncount_conn_cachep, GFP_ATOMIC);
- if (conn == NULL) {
- kmem_cache_free(conncount_rb_cachep, rbconn);
- goto out_unlock;
- }
+ conn = kmem_cache_alloc(conncount_conn_cachep, GFP_ATOMIC);
+ if (conn == NULL) {
+ kmem_cache_free(conncount_rb_cachep, rbconn);
+ goto out_unlock;
+ }
- conn->tuple = *tuple;
- conn->zone = *zone;
- conn->cpu = raw_smp_processor_id();
- conn->jiffies32 = (u32)jiffies;
- memcpy(rbconn->key, key, sizeof(u32) * data->keylen);
+ conn->tuple = tuple;
+ conn->zone = *zone;
+ conn->cpu = raw_smp_processor_id();
+ conn->jiffies32 = (u32)jiffies;
+ memcpy(rbconn->key, key, sizeof(u32) * data->keylen);
+
+ nf_conncount_list_init(&rbconn->list);
+ list_add(&conn->node, &rbconn->list.head);
+ count = 1;
+ rbconn->list.count = count;
- nf_conncount_list_init(&rbconn->list);
- list_add(&conn->node, &rbconn->list.head);
- count = 1;
- rbconn->list.count = count;
+ rb_link_node_rcu(&rbconn->node, parent, rbnode);
+ rb_insert_color(&rbconn->node, root);
- rb_link_node_rcu(&rbconn->node, parent, rbnode);
- rb_insert_color(&rbconn->node, root);
+ if (refcounted)
+ nf_ct_put(ct);
+ }
out_unlock:
spin_unlock_bh(&nf_conncount_locks[hash]);
return count;
@@ -395,10 +457,10 @@ insert_tree(struct net *net,
static unsigned int
count_tree(struct net *net,
+ const struct sk_buff *skb,
+ u16 l3num,
struct nf_conncount_data *data,
- const u32 *key,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone)
+ const u32 *key)
{
struct rb_root *root;
struct rb_node *parent;
@@ -422,7 +484,7 @@ count_tree(struct net *net,
} else {
int ret;
- if (!tuple) {
+ if (!skb) {
nf_conncount_gc_list(net, &rbconn->list);
return rbconn->list.count;
}
@@ -437,7 +499,7 @@ count_tree(struct net *net,
}
/* same source network -> be counted! */
- ret = __nf_conncount_add(net, &rbconn->list, tuple, zone);
+ ret = __nf_conncount_add(net, skb, l3num, &rbconn->list);
spin_unlock_bh(&rbconn->list.list_lock);
if (ret)
return 0; /* hotdrop */
@@ -446,10 +508,10 @@ count_tree(struct net *net,
}
}
- if (!tuple)
+ if (!skb)
return 0;
- return insert_tree(net, data, root, hash, key, tuple, zone);
+ return insert_tree(net, skb, l3num, data, root, hash, key);
}
static void tree_gc_worker(struct work_struct *work)
@@ -511,18 +573,19 @@ static void tree_gc_worker(struct work_struct *work)
}
/* Count and return number of conntrack entries in 'net' with particular 'key'.
- * If 'tuple' is not null, insert it into the accounting data structure.
- * Call with RCU read lock.
+ * If 'skb' is not null, insert the corresponding tuple into the accounting
+ * data structure. Call with RCU read lock.
*/
-unsigned int nf_conncount_count(struct net *net,
- struct nf_conncount_data *data,
- const u32 *key,
- const struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_zone *zone)
+unsigned int nf_conncount_count_skb(struct net *net,
+ const struct sk_buff *skb,
+ u16 l3num,
+ struct nf_conncount_data *data,
+ const u32 *key)
{
- return count_tree(net, data, key, tuple, zone);
+ return count_tree(net, skb, l3num, data, key);
+
}
-EXPORT_SYMBOL_GPL(nf_conncount_count);
+EXPORT_SYMBOL_GPL(nf_conncount_count_skb);
struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int keylen)
{
diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index fc35a11cdca20..5df7134131d29 100644
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -24,26 +24,11 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,
const struct nft_pktinfo *pkt,
const struct nft_set_ext *ext)
{
- const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
- const struct nf_conntrack_tuple *tuple_ptr;
- struct nf_conntrack_tuple tuple;
- enum ip_conntrack_info ctinfo;
- const struct nf_conn *ct;
unsigned int count;
+ int err;
- tuple_ptr = &tuple;
-
- ct = nf_ct_get(pkt->skb, &ctinfo);
- if (ct != NULL) {
- tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
- zone = nf_ct_zone(ct);
- } else if (!nf_ct_get_tuplepr(pkt->skb, skb_network_offset(pkt->skb),
- nft_pf(pkt), nft_net(pkt), &tuple)) {
- regs->verdict.code = NF_DROP;
- return;
- }
-
- if (nf_conncount_add(nft_net(pkt), priv->list, tuple_ptr, zone)) {
+ err = nf_conncount_add_skb(nft_net(pkt), pkt->skb, nft_pf(pkt), priv->list);
+ if (err) {
regs->verdict.code = NF_DROP;
return;
}
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 0189f8b6b0bd1..848287ab79cfb 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -31,8 +31,6 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
struct net *net = xt_net(par);
const struct xt_connlimit_info *info = par->matchinfo;
- struct nf_conntrack_tuple tuple;
- const struct nf_conntrack_tuple *tuple_ptr = &tuple;
const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
enum ip_conntrack_info ctinfo;
const struct nf_conn *ct;
@@ -40,13 +38,8 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
u32 key[5];
ct = nf_ct_get(skb, &ctinfo);
- if (ct != NULL) {
- tuple_ptr = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ if (ct)
zone = nf_ct_zone(ct);
- } else if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb),
- xt_family(par), net, &tuple)) {
- goto hotdrop;
- }
if (xt_family(par) == NFPROTO_IPV6) {
const struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -69,10 +62,9 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
key[1] = zone->id;
}
- connections = nf_conncount_count(net, info->data, key, tuple_ptr,
- zone);
+ connections = nf_conncount_count_skb(net, skb, xt_family(par), info->data, key);
if (connections == 0)
- /* kmalloc failed, drop it entirely */
+ /* kmalloc failed or tuple couldn't be found, drop it entirely */
goto hotdrop;
return (connections > info->limit) ^ !!(info->flags & XT_CONNLIMIT_INVERT);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e573e92213029..a0811e1fba656 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -928,8 +928,8 @@ static u32 ct_limit_get(const struct ovs_ct_limit_info *info, u16 zone)
}
static int ovs_ct_check_limit(struct net *net,
- const struct ovs_conntrack_info *info,
- const struct nf_conntrack_tuple *tuple)
+ const struct sk_buff *skb,
+ const struct ovs_conntrack_info *info)
{
struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info;
@@ -942,8 +942,9 @@ static int ovs_ct_check_limit(struct net *net,
if (per_zone_limit == OVS_CT_LIMIT_UNLIMITED)
return 0;
- connections = nf_conncount_count(net, ct_limit_info->data,
- &conncount_key, tuple, &info->zone);
+ connections = nf_conncount_count_skb(net, skb, info->family,
+ ct_limit_info->data,
+ &conncount_key);
if (connections > per_zone_limit)
return -ENOMEM;
@@ -972,8 +973,7 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT)
if (static_branch_unlikely(&ovs_ct_limit_enabled)) {
if (!nf_ct_is_confirmed(ct)) {
- err = ovs_ct_check_limit(net, info,
- &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+ err = ovs_ct_check_limit(net, skb, info);
if (err) {
net_warn_ratelimited("openvswitch: zone: %u "
"exceeds conntrack limit\n",
@@ -1770,8 +1770,8 @@ static int __ovs_ct_limit_get_zone_limit(struct net *net,
zone_limit.limit = limit;
nf_ct_zone_init(&ct_zone, zone_id, NF_CT_DEFAULT_ZONE_DIR, 0);
- zone_limit.count = nf_conncount_count(net, data, &conncount_key, NULL,
- &ct_zone);
+ zone_limit.count = nf_conncount_count_skb(net, NULL, 0, data,
+ &conncount_key);
return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 483/614] netfilter: nft_connlimit: update the count if add was skipped
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 482/614] netfilter: nf_conncount: rework API to use sk_buff directly Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 484/614] iavf: Implement settime64 with -EOPNOTSUPP Greg Kroah-Hartman
` (144 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Pablo Neira Ayuso, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e ]
Connlimit expression can be used for all kind of packets and not only
for packets with connection state new. See this ruleset as example:
table ip filter {
chain input {
type filter hook input priority filter; policy accept;
tcp dport 22 ct count over 4 counter
}
}
Currently, if the connection count goes over the limit the counter will
count the packets. When a connection is closed, the connection count
won't decrement as it should because it is only updated for new
connections due to an optimization on __nf_conncount_add() that prevents
updating the list if the connection is duplicated.
To solve this problem, check whether the connection was skipped and if
so, update the list. Adjust count_tree() too so the same fix is applied
for xt_connlimit.
Fixes: 976afca1ceba ("netfilter: nf_conncount: Early exit in nf_conncount_lookup() and cleanup")
Closes: https://lore.kernel.org/netfilter/trinity-85c72a88-d762-46c3-be97-36f10e5d9796-1761173693813@3c-app-mailcom-bs12/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conncount.c | 12 ++++++++----
net/netfilter/nft_connlimit.c | 13 +++++++++++--
2 files changed, 19 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 0ffc5ff78a714..b84cfb5616df4 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -179,7 +179,7 @@ static int __nf_conncount_add(struct net *net,
if (ct && nf_ct_is_confirmed(ct)) {
if (refcounted)
nf_ct_put(ct);
- return 0;
+ return -EEXIST;
}
if ((u32)jiffies == list->last_gc)
@@ -398,7 +398,7 @@ insert_tree(struct net *net,
int ret;
ret = nf_conncount_add_skb(net, skb, l3num, &rbconn->list);
- if (ret)
+ if (ret && ret != -EEXIST)
count = 0; /* hotdrop */
else
count = rbconn->list.count;
@@ -501,10 +501,14 @@ count_tree(struct net *net,
/* same source network -> be counted! */
ret = __nf_conncount_add(net, skb, l3num, &rbconn->list);
spin_unlock_bh(&rbconn->list.list_lock);
- if (ret)
+ if (ret && ret != -EEXIST) {
return 0; /* hotdrop */
- else
+ } else {
+ /* -EEXIST means add was skipped, update the list */
+ if (ret == -EEXIST)
+ nf_conncount_gc_list(net, &rbconn->list);
return rbconn->list.count;
+ }
}
}
diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 5df7134131d29..d4964087bbc5e 100644
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -29,8 +29,17 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,
err = nf_conncount_add_skb(nft_net(pkt), pkt->skb, nft_pf(pkt), priv->list);
if (err) {
- regs->verdict.code = NF_DROP;
- return;
+ if (err == -EEXIST) {
+ /* Call gc to update the list count if any connection has
+ * been closed already. This is useful for softlimit
+ * connections like limiting bandwidth based on a number
+ * of open connections.
+ */
+ nf_conncount_gc_list(nft_net(pkt), priv->list);
+ } else {
+ regs->verdict.code = NF_DROP;
+ return;
+ }
}
count = READ_ONCE(priv->list->count);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 484/614] iavf: Implement settime64 with -EOPNOTSUPP
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 483/614] netfilter: nft_connlimit: update the count if add was skipped Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 485/614] net: vxlan: prevent NULL deref in vxlan_xmit_one Greg Kroah-Hartman
` (143 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Schmidt, Aleksandr Loktionov,
Tim Hostetler, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 1e43ebcd5152b3e681a334cc6542fb21770c3a2e ]
ptp_clock_settime() assumes every ptp_clock has implemented settime64().
Stub it with -EOPNOTSUPP to prevent a NULL dereference.
The fix is similar to commit 329d050bbe63 ("gve: Implement settime64
with -EOPNOTSUPP").
Fixes: d734223b2f0d ("iavf: add initial framework for registering PTP clock")
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Tim Hostetler <thostet@google.com>
Link: https://patch.msgid.link/20251126094850.2842557-1-mschmidt@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_ptp.c b/drivers/net/ethernet/intel/iavf/iavf_ptp.c
index b4d5eda2e84fc..9cbd8c1540318 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_ptp.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_ptp.c
@@ -252,6 +252,12 @@ static int iavf_ptp_gettimex64(struct ptp_clock_info *info,
return iavf_read_phc_indirect(adapter, ts, sts);
}
+static int iavf_ptp_settime64(struct ptp_clock_info *info,
+ const struct timespec64 *ts)
+{
+ return -EOPNOTSUPP;
+}
+
/**
* iavf_ptp_cache_phc_time - Cache PHC time for performing timestamp extension
* @adapter: private adapter structure
@@ -320,6 +326,7 @@ static int iavf_ptp_register_clock(struct iavf_adapter *adapter)
KBUILD_MODNAME, dev_name(dev));
ptp_info->owner = THIS_MODULE;
ptp_info->gettimex64 = iavf_ptp_gettimex64;
+ ptp_info->settime64 = iavf_ptp_settime64;
ptp_info->do_aux_work = iavf_ptp_do_aux_work;
clock = ptp_clock_register(ptp_info, dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 485/614] net: vxlan: prevent NULL deref in vxlan_xmit_one
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 484/614] iavf: Implement settime64 with -EOPNOTSUPP Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 486/614] net: stmmac: fix rx limit check in stmmac_rx_zc() Greg Kroah-Hartman
` (142 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liang Li, Beniamino Galvani,
Antoine Tenart, Ido Schimmel, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Tenart <atenart@kernel.org>
[ Upstream commit 1f73a56f986005f0bc64ed23873930e2ee4f5911 ]
Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in
vxlan_xmit_one, e.g. if the iface is brought down. This can lead to the
following NULL dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000010
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:vxlan_xmit_one+0xbb3/0x1580
Call Trace:
vxlan_xmit+0x429/0x610
dev_hard_start_xmit+0x55/0xa0
__dev_queue_xmit+0x6d0/0x7f0
ip_finish_output2+0x24b/0x590
ip_output+0x63/0x110
Mentioned commits changed the code path in vxlan_xmit_one and as a side
effect the sock4/6 pointer validity checks in vxlan(6)_get_route were
lost. Fix this by adding back checks.
Since both commits being fixed were released in the same version (v6.7)
and are strongly related, bundle the fixes in a single commit.
Reported-by: Liang Li <liali@redhat.com>
Fixes: 6f19b2c136d9 ("vxlan: use generic function for tunnel IPv4 route lookup")
Fixes: 2aceb896ee18 ("vxlan: use generic function for tunnel IPv6 route lookup")
Cc: Beniamino Galvani <b.galvani@gmail.com>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251126102627.74223-1-atenart@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan/vxlan_core.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index a5c55e7e4d795..e957aa12a8a44 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -2349,7 +2349,7 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
int addr_family;
__u8 tos, ttl;
int ifindex;
- int err;
+ int err = 0;
u32 flags = vxlan->cfg.flags;
bool use_cache;
bool udp_sum = false;
@@ -2454,12 +2454,18 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
rcu_read_lock();
if (addr_family == AF_INET) {
- struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock);
+ struct vxlan_sock *sock4;
u16 ipcb_flags = 0;
struct rtable *rt;
__be16 df = 0;
__be32 saddr;
+ sock4 = rcu_dereference(vxlan->vn4_sock);
+ if (unlikely(!sock4)) {
+ reason = SKB_DROP_REASON_DEV_READY;
+ goto tx_error;
+ }
+
if (!ifindex)
ifindex = sock4->sock->sk->sk_bound_dev_if;
@@ -2534,10 +2540,16 @@ void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
ipcb_flags);
#if IS_ENABLED(CONFIG_IPV6)
} else {
- struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock);
+ struct vxlan_sock *sock6;
struct in6_addr saddr;
u16 ip6cb_flags = 0;
+ sock6 = rcu_dereference(vxlan->vn6_sock);
+ if (unlikely(!sock6)) {
+ reason = SKB_DROP_REASON_DEV_READY;
+ goto tx_error;
+ }
+
if (!ifindex)
ifindex = sock6->sock->sk->sk_bound_dev_if;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 486/614] net: stmmac: fix rx limit check in stmmac_rx_zc()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 485/614] net: vxlan: prevent NULL deref in vxlan_xmit_one Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 487/614] mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors Greg Kroah-Hartman
` (141 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Kodanev,
Russell King (Oracle), Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
[ Upstream commit 8048168df56e225c94e50b04cb7b0514135d7a1c ]
The extra "count >= limit" check in stmmac_rx_zc() is redundant and
has no effect because the value of "count" doesn't change after the
while condition at this point.
However, it can change after "read_again:" label:
while (count < limit) {
...
if (count >= limit)
break;
read_again:
...
/* XSK pool expects RX frame 1:1 mapped to XSK buffer */
if (likely(status & rx_not_ls)) {
xsk_buff_free(buf->xdp);
buf->xdp = NULL;
dirty++;
count++;
goto read_again;
}
...
This patch addresses the same issue previously resolved in stmmac_rx()
by commit fa02de9e7588 ("net: stmmac: fix rx budget limit check").
The fix is the same: move the check after the label to ensure that it
bounds the goto loop.
Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/20251126104327.175590-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 7b90ecd3a55e6..86e912471dead 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5258,10 +5258,10 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)
len = 0;
}
+read_again:
if (count >= limit)
break;
-read_again:
buf1_len = 0;
entry = next_entry;
buf = &rx_q->buf_pool[entry];
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 487/614] mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 486/614] net: stmmac: fix rx limit check in stmmac_rx_zc() Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 488/614] spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Greg Kroah-Hartman
` (140 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Geert Uytterhoeven,
Miquel Raynal, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit a3623e1ae1ed6be4d49b2ccb9996a9d2b65c1828 ]
devm_pm_runtime_enable() can fail due to memory allocation failures.
The current code ignores its return value and proceeds with
pm_runtime_resume_and_get(), which may operate on incorrectly
initialized runtime PM state.
Check the return value of devm_pm_runtime_enable() and return the
error code if it fails.
Fixes: 6a2277a0ebe7 ("mtd: rawnand: renesas: Use runtime PM instead of the raw clock API")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/renesas-nand-controller.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/renesas-nand-controller.c b/drivers/mtd/nand/raw/renesas-nand-controller.c
index ac8c1b80d7be9..201dd62b99905 100644
--- a/drivers/mtd/nand/raw/renesas-nand-controller.c
+++ b/drivers/mtd/nand/raw/renesas-nand-controller.c
@@ -1336,7 +1336,10 @@ static int rnandc_probe(struct platform_device *pdev)
if (IS_ERR(rnandc->regs))
return PTR_ERR(rnandc->regs);
- devm_pm_runtime_enable(&pdev->dev);
+ ret = devm_pm_runtime_enable(&pdev->dev);
+ if (ret)
+ return ret;
+
ret = pm_runtime_resume_and_get(&pdev->dev);
if (ret < 0)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 488/614] spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 487/614] mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 489/614] arm64/pageattr: Propagate return value from __change_memory_common Greg Kroah-Hartman
` (139 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
[ Upstream commit 545d1287e40a55242f6ab68bcc1ba3b74088b1bc ]
Discovered by Atuin - Automated Vulnerability Discovery Engine.
The 'len' variable is calculated as 'min(32, trans->len + 1)',
which includes the 1-byte command header.
When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len'
as the length is incorrect because:
1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size
'trans->len', i.e., 'len - 1' in this context).
2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is
CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1
overflows the buffer.
Fix this by copying 'len - 1' bytes.
Fixes: 8846739f52af ("spi: add ch341a usb2spi driver")
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/20251128160630.0f922c45ec6084a46fb57099@linux.dev
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ch341.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-ch341.c b/drivers/spi/spi-ch341.c
index 46bc208f2d050..79d2f9ab4ef03 100644
--- a/drivers/spi/spi-ch341.c
+++ b/drivers/spi/spi-ch341.c
@@ -78,7 +78,7 @@ static int ch341_transfer_one(struct spi_controller *host,
ch341->tx_buf[0] = CH341A_CMD_SPI_STREAM;
- memcpy(ch341->tx_buf + 1, trans->tx_buf, len);
+ memcpy(ch341->tx_buf + 1, trans->tx_buf, len - 1);
ret = usb_bulk_msg(ch341->udev, ch341->write_pipe, ch341->tx_buf, len,
NULL, CH341_DEFAULT_TIMEOUT);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 489/614] arm64/pageattr: Propagate return value from __change_memory_common
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 488/614] spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 490/614] vfio/pci: Use RCU for error/request triggers to avoid circular locking Greg Kroah-Hartman
` (138 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dev Jain, Ryan Roberts,
Catalin Marinas, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dev Jain <dev.jain@arm.com>
[ Upstream commit e5efd56fa157d2e7d789949d1d64eccbac18a897 ]
The rodata=on security measure requires that any code path which does
vmalloc -> set_memory_ro/set_memory_rox must protect the linear map alias
too. Therefore, if such a call fails, we must abort set_memory_* and caller
must take appropriate action; currently we are suppressing the error, and
there is a real chance of such an error arising post commit a166563e7ec3
("arm64: mm: support large block mapping when rodata=full"). Therefore,
propagate any error to the caller.
Fixes: a166563e7ec3 ("arm64: mm: support large block mapping when rodata=full")
Signed-off-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/pageattr.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index 5135f2d66958d..b4ea86cd3a719 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -148,6 +148,7 @@ static int change_memory_common(unsigned long addr, int numpages,
unsigned long size = PAGE_SIZE * numpages;
unsigned long end = start + size;
struct vm_struct *area;
+ int ret;
int i;
if (!PAGE_ALIGNED(addr)) {
@@ -185,8 +186,10 @@ static int change_memory_common(unsigned long addr, int numpages,
if (rodata_full && (pgprot_val(set_mask) == PTE_RDONLY ||
pgprot_val(clear_mask) == PTE_RDONLY)) {
for (i = 0; i < area->nr_pages; i++) {
- __change_memory_common((u64)page_address(area->pages[i]),
+ ret = __change_memory_common((u64)page_address(area->pages[i]),
PAGE_SIZE, set_mask, clear_mask);
+ if (ret)
+ return ret;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 490/614] vfio/pci: Use RCU for error/request triggers to avoid circular locking
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 489/614] arm64/pageattr: Propagate return value from __change_memory_common Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 491/614] landlock: Fix handling of disconnected directories Greg Kroah-Hartman
` (137 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson, Jason Gunthorpe,
Alex Williamson, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@nvidia.com>
[ Upstream commit 98693e0897f754e3f51ce6626ed5f785f625ba2b ]
Thanks to a device generating an ACS violation during bus reset,
lockdep reported the following circular locking issue:
CPU0: SET_IRQS (MSI/X): holds igate, acquires memory_lock
CPU1: HOT_RESET: holds memory_lock, acquires pci_bus_sem
CPU2: AER: holds pci_bus_sem, acquires igate
This results in a potential 3-way deadlock.
Remove the pci_bus_sem->igate leg of the triangle by using RCU
to peek at the eventfd rather than locking it with igate.
Fixes: 3be3a074cf5b ("vfio-pci: Don't use device_lock around AER interrupt setup")
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20251124223623.2770706-1-alex@shazbot.org
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/vfio_pci_core.c | 68 ++++++++++++++++++++++---------
drivers/vfio/pci/vfio_pci_intrs.c | 52 ++++++++++++++---------
drivers/vfio/pci/vfio_pci_priv.h | 4 ++
include/linux/vfio_pci_core.h | 10 ++++-
4 files changed, 93 insertions(+), 41 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 7dcf5439dedc9..5efe7535f41ed 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -41,6 +41,40 @@ static bool nointxmask;
static bool disable_vga;
static bool disable_idle_d3;
+static void vfio_pci_eventfd_rcu_free(struct rcu_head *rcu)
+{
+ struct vfio_pci_eventfd *eventfd =
+ container_of(rcu, struct vfio_pci_eventfd, rcu);
+
+ eventfd_ctx_put(eventfd->ctx);
+ kfree(eventfd);
+}
+
+int vfio_pci_eventfd_replace_locked(struct vfio_pci_core_device *vdev,
+ struct vfio_pci_eventfd __rcu **peventfd,
+ struct eventfd_ctx *ctx)
+{
+ struct vfio_pci_eventfd *new = NULL;
+ struct vfio_pci_eventfd *old;
+
+ lockdep_assert_held(&vdev->igate);
+
+ if (ctx) {
+ new = kzalloc(sizeof(*new), GFP_KERNEL_ACCOUNT);
+ if (!new)
+ return -ENOMEM;
+
+ new->ctx = ctx;
+ }
+
+ old = rcu_replace_pointer(*peventfd, new,
+ lockdep_is_held(&vdev->igate));
+ if (old)
+ call_rcu(&old->rcu, vfio_pci_eventfd_rcu_free);
+
+ return 0;
+}
+
/* List of PF's that vfio_pci_core_sriov_configure() has been called on */
static DEFINE_MUTEX(vfio_pci_sriov_pfs_mutex);
static LIST_HEAD(vfio_pci_sriov_pfs);
@@ -696,14 +730,8 @@ void vfio_pci_core_close_device(struct vfio_device *core_vdev)
vfio_pci_core_disable(vdev);
mutex_lock(&vdev->igate);
- if (vdev->err_trigger) {
- eventfd_ctx_put(vdev->err_trigger);
- vdev->err_trigger = NULL;
- }
- if (vdev->req_trigger) {
- eventfd_ctx_put(vdev->req_trigger);
- vdev->req_trigger = NULL;
- }
+ vfio_pci_eventfd_replace_locked(vdev, &vdev->err_trigger, NULL);
+ vfio_pci_eventfd_replace_locked(vdev, &vdev->req_trigger, NULL);
mutex_unlock(&vdev->igate);
}
EXPORT_SYMBOL_GPL(vfio_pci_core_close_device);
@@ -1800,21 +1828,21 @@ void vfio_pci_core_request(struct vfio_device *core_vdev, unsigned int count)
struct vfio_pci_core_device *vdev =
container_of(core_vdev, struct vfio_pci_core_device, vdev);
struct pci_dev *pdev = vdev->pdev;
+ struct vfio_pci_eventfd *eventfd;
- mutex_lock(&vdev->igate);
-
- if (vdev->req_trigger) {
+ rcu_read_lock();
+ eventfd = rcu_dereference(vdev->req_trigger);
+ if (eventfd) {
if (!(count % 10))
pci_notice_ratelimited(pdev,
"Relaying device request to user (#%u)\n",
count);
- eventfd_signal(vdev->req_trigger);
+ eventfd_signal(eventfd->ctx);
} else if (count == 0) {
pci_warn(pdev,
"No device request channel registered, blocked until released by user\n");
}
-
- mutex_unlock(&vdev->igate);
+ rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(vfio_pci_core_request);
@@ -2227,13 +2255,13 @@ pci_ers_result_t vfio_pci_core_aer_err_detected(struct pci_dev *pdev,
pci_channel_state_t state)
{
struct vfio_pci_core_device *vdev = dev_get_drvdata(&pdev->dev);
+ struct vfio_pci_eventfd *eventfd;
- mutex_lock(&vdev->igate);
-
- if (vdev->err_trigger)
- eventfd_signal(vdev->err_trigger);
-
- mutex_unlock(&vdev->igate);
+ rcu_read_lock();
+ eventfd = rcu_dereference(vdev->err_trigger);
+ if (eventfd)
+ eventfd_signal(eventfd->ctx);
+ rcu_read_unlock();
return PCI_ERS_RESULT_CAN_RECOVER;
}
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 30d3e921cb0de..c76e753b3cecd 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -731,21 +731,27 @@ static int vfio_pci_set_msi_trigger(struct vfio_pci_core_device *vdev,
return 0;
}
-static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx,
+static int vfio_pci_set_ctx_trigger_single(struct vfio_pci_core_device *vdev,
+ struct vfio_pci_eventfd __rcu **peventfd,
unsigned int count, uint32_t flags,
void *data)
{
/* DATA_NONE/DATA_BOOL enables loopback testing */
if (flags & VFIO_IRQ_SET_DATA_NONE) {
- if (*ctx) {
- if (count) {
- eventfd_signal(*ctx);
- } else {
- eventfd_ctx_put(*ctx);
- *ctx = NULL;
- }
+ struct vfio_pci_eventfd *eventfd;
+
+ eventfd = rcu_dereference_protected(*peventfd,
+ lockdep_is_held(&vdev->igate));
+
+ if (!eventfd)
+ return -EINVAL;
+
+ if (count) {
+ eventfd_signal(eventfd->ctx);
return 0;
}
+
+ return vfio_pci_eventfd_replace_locked(vdev, peventfd, NULL);
} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
uint8_t trigger;
@@ -753,8 +759,15 @@ static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx,
return -EINVAL;
trigger = *(uint8_t *)data;
- if (trigger && *ctx)
- eventfd_signal(*ctx);
+
+ if (trigger) {
+ struct vfio_pci_eventfd *eventfd =
+ rcu_dereference_protected(*peventfd,
+ lockdep_is_held(&vdev->igate));
+
+ if (eventfd)
+ eventfd_signal(eventfd->ctx);
+ }
return 0;
} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
@@ -765,22 +778,23 @@ static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx,
fd = *(int32_t *)data;
if (fd == -1) {
- if (*ctx)
- eventfd_ctx_put(*ctx);
- *ctx = NULL;
+ return vfio_pci_eventfd_replace_locked(vdev,
+ peventfd, NULL);
} else if (fd >= 0) {
struct eventfd_ctx *efdctx;
+ int ret;
efdctx = eventfd_ctx_fdget(fd);
if (IS_ERR(efdctx))
return PTR_ERR(efdctx);
- if (*ctx)
- eventfd_ctx_put(*ctx);
+ ret = vfio_pci_eventfd_replace_locked(vdev,
+ peventfd, efdctx);
+ if (ret)
+ eventfd_ctx_put(efdctx);
- *ctx = efdctx;
+ return ret;
}
- return 0;
}
return -EINVAL;
@@ -793,7 +807,7 @@ static int vfio_pci_set_err_trigger(struct vfio_pci_core_device *vdev,
if (index != VFIO_PCI_ERR_IRQ_INDEX || start != 0 || count > 1)
return -EINVAL;
- return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger,
+ return vfio_pci_set_ctx_trigger_single(vdev, &vdev->err_trigger,
count, flags, data);
}
@@ -804,7 +818,7 @@ static int vfio_pci_set_req_trigger(struct vfio_pci_core_device *vdev,
if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count > 1)
return -EINVAL;
- return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger,
+ return vfio_pci_set_ctx_trigger_single(vdev, &vdev->req_trigger,
count, flags, data);
}
diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h
index a9972eacb2936..97d992c063229 100644
--- a/drivers/vfio/pci/vfio_pci_priv.h
+++ b/drivers/vfio/pci/vfio_pci_priv.h
@@ -26,6 +26,10 @@ struct vfio_pci_ioeventfd {
bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev);
void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev);
+int vfio_pci_eventfd_replace_locked(struct vfio_pci_core_device *vdev,
+ struct vfio_pci_eventfd __rcu **peventfd,
+ struct eventfd_ctx *ctx);
+
int vfio_pci_set_irqs_ioctl(struct vfio_pci_core_device *vdev, uint32_t flags,
unsigned index, unsigned start, unsigned count,
void *data);
diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h
index f541044e42a2a..f5c93787f8e0b 100644
--- a/include/linux/vfio_pci_core.h
+++ b/include/linux/vfio_pci_core.h
@@ -12,6 +12,7 @@
#include <linux/pci.h>
#include <linux/vfio.h>
#include <linux/irqbypass.h>
+#include <linux/rcupdate.h>
#include <linux/types.h>
#include <linux/uuid.h>
#include <linux/notifier.h>
@@ -27,6 +28,11 @@
struct vfio_pci_core_device;
struct vfio_pci_region;
+struct vfio_pci_eventfd {
+ struct eventfd_ctx *ctx;
+ struct rcu_head rcu;
+};
+
struct vfio_pci_regops {
ssize_t (*rw)(struct vfio_pci_core_device *vdev, char __user *buf,
size_t count, loff_t *ppos, bool iswrite);
@@ -83,8 +89,8 @@ struct vfio_pci_core_device {
struct pci_saved_state *pci_saved_state;
struct pci_saved_state *pm_save;
int ioeventfds_nr;
- struct eventfd_ctx *err_trigger;
- struct eventfd_ctx *req_trigger;
+ struct vfio_pci_eventfd __rcu *err_trigger;
+ struct vfio_pci_eventfd __rcu *req_trigger;
struct eventfd_ctx *pm_wake_eventfd_ctx;
struct list_head dummy_resources_list;
struct mutex ioeventfds_lock;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 491/614] landlock: Fix handling of disconnected directories
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 490/614] vfio/pci: Use RCU for error/request triggers to avoid circular locking Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 492/614] net: phy: aquantia: check for NVMEM deferral Greg Kroah-Hartman
` (136 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Brauner,
Günther Noack, Song Liu, Tingmao Wang,
Mickaël Salaün, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <mic@digikod.net>
[ Upstream commit 49c9e09d961025b22e61ef9ad56aa1c21b6ce2f1 ]
Disconnected files or directories can appear when they are visible and
opened from a bind mount, but have been renamed or moved from the source
of the bind mount in a way that makes them inaccessible from the mount
point (i.e. out of scope).
Previously, access rights tied to files or directories opened through a
disconnected directory were collected by walking the related hierarchy
down to the root of the filesystem, without taking into account the
mount point because it couldn't be found. This could lead to
inconsistent access results, potential access right widening, and
hard-to-debug renames, especially since such paths cannot be printed.
For a sandboxed task to create a disconnected directory, it needs to
have write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to
the underlying source of the bind mount, and read access to the related
mount point. Because a sandboxed task cannot acquire more access
rights than those defined by its Landlock domain, this could lead to
inconsistent access rights due to missing permissions that should be
inherited from the mount point hierarchy, while inheriting permissions
from the filesystem hierarchy hidden by this mount point instead.
Landlock now handles files and directories opened from disconnected
directories by taking into account the filesystem hierarchy when the
mount point is not found in the hierarchy walk, and also always taking
into account the mount point from which these disconnected directories
were opened. This ensures that a rename is not allowed if it would
widen access rights [1].
The rationale is that, even if disconnected hierarchies might not be
visible or accessible to a sandboxed task, relying on the collected
access rights from them improves the guarantee that access rights will
not be widened during a rename because of the access right comparison
between the source and the destination (see LANDLOCK_ACCESS_FS_REFER).
It may look like this would grant more access on disconnected files and
directories, but the security policies are always enforced for all the
evaluated hierarchies. This new behavior should be less surprising to
users and safer from an access control perspective.
Remove a wrong WARN_ON_ONCE() canary in collect_domain_accesses() and
fix the related comment.
Because opened files have their access rights stored in the related file
security properties, there is no impact for disconnected or unlinked
files.
Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack@google.com>
Cc: Song Liu <song@kernel.org>
Reported-by: Tingmao Wang <m@maowtm.org>
Closes: https://lore.kernel.org/r/027d5190-b37a-40a8-84e9-4ccbc352bcdf@maowtm.org
Closes: https://lore.kernel.org/r/09b24128f86973a6022e6aa8338945fcfb9a33e4.1749925391.git.m@maowtm.org
Fixes: b91c3e4ea756 ("landlock: Add support for file reparenting with LANDLOCK_ACCESS_FS_REFER")
Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
Link: https://lore.kernel.org/r/b0f46246-f2c5-42ca-93ce-0d629702a987@maowtm.org [1]
Reviewed-by: Tingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/20251128172200.760753-2-mic@digikod.net
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/landlock/errata/abi-1.h | 16 +++++++++++++
security/landlock/fs.c | 40 ++++++++++++++++++++++----------
2 files changed, 44 insertions(+), 12 deletions(-)
create mode 100644 security/landlock/errata/abi-1.h
diff --git a/security/landlock/errata/abi-1.h b/security/landlock/errata/abi-1.h
new file mode 100644
index 0000000000000..e8a2bff2e5b6a
--- /dev/null
+++ b/security/landlock/errata/abi-1.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+/**
+ * DOC: erratum_3
+ *
+ * Erratum 3: Disconnected directory handling
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This fix addresses an issue with disconnected directories that occur when a
+ * directory is moved outside the scope of a bind mount. The change ensures
+ * that evaluated access rights include both those from the disconnected file
+ * hierarchy down to its filesystem root and those from the related mount point
+ * hierarchy. This prevents access right widening through rename or link
+ * actions.
+ */
+LANDLOCK_ERRATUM(3)
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index d9c12b993fa7d..a2ed0e76938aa 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -909,21 +909,31 @@ static bool is_access_to_paths_allowed(
break;
}
}
+
if (unlikely(IS_ROOT(walker_path.dentry))) {
- /*
- * Stops at disconnected root directories. Only allows
- * access to internal filesystems (e.g. nsfs, which is
- * reachable through /proc/<pid>/ns/<namespace>).
- */
- if (walker_path.mnt->mnt_flags & MNT_INTERNAL) {
+ if (likely(walker_path.mnt->mnt_flags & MNT_INTERNAL)) {
+ /*
+ * Stops and allows access when reaching disconnected root
+ * directories that are part of internal filesystems (e.g. nsfs,
+ * which is reachable through /proc/<pid>/ns/<namespace>).
+ */
allowed_parent1 = true;
allowed_parent2 = true;
+ break;
}
- break;
+
+ /*
+ * We reached a disconnected root directory from a bind mount.
+ * Let's continue the walk with the mount point we missed.
+ */
+ dput(walker_path.dentry);
+ walker_path.dentry = walker_path.mnt->mnt_root;
+ dget(walker_path.dentry);
+ } else {
+ parent_dentry = dget_parent(walker_path.dentry);
+ dput(walker_path.dentry);
+ walker_path.dentry = parent_dentry;
}
- parent_dentry = dget_parent(walker_path.dentry);
- dput(walker_path.dentry);
- walker_path.dentry = parent_dentry;
}
path_put(&walker_path);
@@ -1021,6 +1031,9 @@ static access_mask_t maybe_remove(const struct dentry *const dentry)
* file. While walking from @dir to @mnt_root, we record all the domain's
* allowed accesses in @layer_masks_dom.
*
+ * Because of disconnected directories, this walk may not reach @mnt_dir. In
+ * this case, the walk will continue to @mnt_dir after this call.
+ *
* This is similar to is_access_to_paths_allowed() but much simpler because it
* only handles walking on the same mount point and only checks one set of
* accesses.
@@ -1062,8 +1075,11 @@ static bool collect_domain_accesses(
break;
}
- /* We should not reach a root other than @mnt_root. */
- if (dir == mnt_root || WARN_ON_ONCE(IS_ROOT(dir)))
+ /*
+ * Stops at the mount point or the filesystem root for a disconnected
+ * directory.
+ */
+ if (dir == mnt_root || unlikely(IS_ROOT(dir)))
break;
parent_dentry = dget_parent(dir);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 492/614] net: phy: aquantia: check for NVMEM deferral
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 491/614] landlock: Fix handling of disconnected directories Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 493/614] selftests: bonding: add delay before each xvlan_over_bond connectivity check Greg Kroah-Hartman
` (135 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Marko, Russell King (Oracle),
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Marko <robimarko@gmail.com>
[ Upstream commit a6c121a2432eee2c4ebceb1483ccd4a50a52983d ]
Currently, if NVMEM provider is probed later than Aquantia, loading the
firmware will fail with -EINVAL.
To fix this, simply check for -EPROBE_DEFER when NVMEM is attempted and
return it.
Fixes: e93984ebc1c8 ("net: phy: aquantia: add firmware load support")
Signed-off-by: Robert Marko <robimarko@gmail.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/20251127114514.460924-1-robimarko@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/aquantia/aquantia_firmware.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/phy/aquantia/aquantia_firmware.c b/drivers/net/phy/aquantia/aquantia_firmware.c
index bbbcc9736b00e..569256152689f 100644
--- a/drivers/net/phy/aquantia/aquantia_firmware.c
+++ b/drivers/net/phy/aquantia/aquantia_firmware.c
@@ -369,7 +369,7 @@ int aqr_firmware_load(struct phy_device *phydev)
* assume that, and load a new image.
*/
ret = aqr_firmware_load_nvmem(phydev);
- if (!ret)
+ if (ret == -EPROBE_DEFER || !ret)
return ret;
ret = aqr_firmware_load_fs(phydev);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 493/614] selftests: bonding: add delay before each xvlan_over_bond connectivity check
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 492/614] net: phy: aquantia: check for NVMEM deferral Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 494/614] net: netpoll: initialize work queue before error checks Greg Kroah-Hartman
` (134 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Hangbin Liu,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 2c28ee720ad14f58eb88a97ec3efe7c5c315ea5d ]
Jakub reported increased flakiness in bond_macvlan_ipvlan.sh on regular
kernel, while the tests consistently pass on a debug kernel. This suggests
a timing-sensitive issue.
To mitigate this, introduce a short sleep before each xvlan_over_bond
connectivity check. The delay helps ensure neighbor and route cache
have fully converged before verifying connectivity.
The sleep interval is kept minimal since check_connection() is invoked
nearly 100 times during the test.
Fixes: 246af950b940 ("selftests: bonding: add macvlan over bond testing")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netdev/20251114082014.750edfad@kernel.org
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20251127143310.47740-1-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh b/tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh
index c4711272fe45d..559f300f965aa 100755
--- a/tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh
+++ b/tools/testing/selftests/drivers/net/bonding/bond_macvlan_ipvlan.sh
@@ -30,6 +30,7 @@ check_connection()
local message=${3}
RET=0
+ sleep 0.25
ip netns exec ${ns} ping ${target} -c 4 -i 0.1 &>/dev/null
check_err $? "ping failed"
log_test "${bond_mode}/${xvlan_type}_${xvlan_mode}: ${message}"
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 494/614] net: netpoll: initialize work queue before error checks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 493/614] selftests: bonding: add delay before each xvlan_over_bond connectivity check Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 495/614] mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Greg Kroah-Hartman
` (133 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit e5235eb6cfe02a51256013a78f7b28779a7740d5 ]
Prevent a kernel warning when netconsole setup fails on devices with
IFF_DISABLE_NETPOLL flag. The warning (at kernel/workqueue.c:4242 in
__flush_work) occurs because the cleanup path tries to cancel an
uninitialized work queue.
When __netpoll_setup() encounters a device with IFF_DISABLE_NETPOLL,
it fails early and calls skb_pool_flush() for cleanup. This function
calls cancel_work_sync(&np->refill_wq), but refill_wq hasn't been
initialized yet, triggering the warning.
Move INIT_WORK() to the beginning of __netpoll_setup(), ensuring the
work queue is properly initialized before any potential failure points.
This allows the cleanup path to safely cancel the work queue regardless
of where the setup fails.
Fixes: 248f6571fd4c5 ("netpoll: Optimize skb refilling on critical path")
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20251127-netpoll_fix_init_work-v1-1-65c07806d736@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/netpoll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 331764845e8fa..09f72f10813cc 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -554,6 +554,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
int err;
skb_queue_head_init(&np->skb_pool);
+ INIT_WORK(&np->refill_wq, refill_skbs_work_handler);
if (ndev->priv_flags & IFF_DISABLE_NETPOLL) {
np_err(np, "%s doesn't support polling, aborting\n",
@@ -591,7 +592,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
/* fill up the skb queue */
refill_skbs(np);
- INIT_WORK(&np->refill_wq, refill_skbs_work_handler);
/* last thing to do is link it to the net device structure */
rcu_assign_pointer(ndev->npinfo, npinfo);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 495/614] mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 494/614] net: netpoll: initialize work queue before error checks Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 496/614] rqspinlock: Enclose lock/unlock within lock entry acquisitions Greg Kroah-Hartman
` (132 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivan Stepchenko, Miquel Raynal,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Stepchenko <sid@itb.spb.ru>
[ Upstream commit c909fec69f84b39e63876c69b9df2c178c6b76ba ]
There are several places where a value of type 'int' is shifted by
lpddr->chipshift. lpddr->chipshift is derived from QINFO geometry and
might reach 31 when QINFO reports a 2 GiB size - the maximum supported by
LPDDR(1) compliant chips. This may cause unexpected sign-extensions when
casting the integer value to the type of 'unsigned long'.
Use '1UL << lpddr->chipshift' and cast 'j' to unsigned long before
shifting so the computation is performed at the destination width.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: c68264711ca6 ("[MTD] LPDDR Command set driver")
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/lpddr/lpddr_cmds.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index 290fd0119e984..cd37d58abacb7 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -79,7 +79,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
mutex_init(&shared[i].lock);
for (j = 0; j < lpddr->qinfo->HWPartsNum; j++) {
*chip = lpddr->chips[i];
- chip->start += j << lpddr->chipshift;
+ chip->start += (unsigned long)j << lpddr->chipshift;
chip->oldstate = chip->state = FL_READY;
chip->priv = &shared[i];
/* those should be reset too since
@@ -559,7 +559,7 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len,
break;
if ((len + ofs - 1) >> lpddr->chipshift)
- thislen = (1<<lpddr->chipshift) - ofs;
+ thislen = (1UL << lpddr->chipshift) - ofs;
else
thislen = len;
/* get the chip */
@@ -575,7 +575,7 @@ static int lpddr_point(struct mtd_info *mtd, loff_t adr, size_t len,
len -= thislen;
ofs = 0;
- last_end += 1 << lpddr->chipshift;
+ last_end += 1UL << lpddr->chipshift;
chipnum++;
chip = &lpddr->chips[chipnum];
}
@@ -601,7 +601,7 @@ static int lpddr_unpoint (struct mtd_info *mtd, loff_t adr, size_t len)
break;
if ((len + ofs - 1) >> lpddr->chipshift)
- thislen = (1<<lpddr->chipshift) - ofs;
+ thislen = (1UL << lpddr->chipshift) - ofs;
else
thislen = len;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 496/614] rqspinlock: Enclose lock/unlock within lock entry acquisitions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 495/614] mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 497/614] rqspinlock: Use trylock fallback when per-CPU rqnode is busy Greg Kroah-Hartman
` (131 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Oedayrajsingh Varma,
Kumar Kartikeya Dwivedi, Alexei Starovoitov, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
[ Upstream commit beb7021a6003d9c6a463fffca0d6311efb8e0e66 ]
Ritesh reported that timeouts occurred frequently for rqspinlock despite
reentrancy on the same lock on the same CPU in [0]. This patch closes
one of the races leading to this behavior, and reduces the frequency of
timeouts.
We currently have a tiny window between the fast-path cmpxchg and the
grabbing of the lock entry where an NMI could land, attempt the same
lock that was just acquired, and end up timing out. This is not ideal.
Instead, move the lock entry acquisition from the fast path to before
the cmpxchg, and remove the grabbing of the lock entry in the slow path,
assuming it was already taken by the fast path. The TAS fallback is
invoked directly without being preceded by the typical fast path,
therefore we must continue to grab the deadlock detection entry in that
case.
Case on lock leading to missed AA:
cmpxchg lock A
<NMI>
... rqspinlock acquisition of A
... timeout
</NMI>
grab_held_lock_entry(A)
There is a similar case when unlocking the lock. If the NMI lands
between the WRITE_ONCE and smp_store_release, it is possible that we end
up in a situation where the NMI fails to diagnose the AA condition,
leading to a timeout.
Case on unlock leading to missed AA:
WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL)
<NMI>
... rqspinlock acquisition of A
... timeout
</NMI>
smp_store_release(A->locked, 0)
The patch changes the order on unlock to smp_store_release() succeeded
by WRITE_ONCE() of NULL. This avoids the missed AA detection described
above, but may lead to a false positive if the NMI lands between these
two statements, which is acceptable (and preferred over a timeout).
The original intention of the reverse order on unlock was to prevent the
following possible misdiagnosis of an ABBA scenario:
grab entry A
lock A
grab entry B
lock B
unlock B
smp_store_release(B->locked, 0)
grab entry B
lock B
grab entry A
lock A
! <detect ABBA>
WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL)
If the store release were is after the WRITE_ONCE, the other CPU would
not observe B in the table of the CPU unlocking the lock B. However,
since the threads are obviously participating in an ABBA deadlock, it
is no longer appealing to use the order above since it may lead to a
250 ms timeout due to missed AA detection.
[0]: https://lore.kernel.org/bpf/CAH6OuBTjG+N=+GGwcpOUbeDN563oz4iVcU3rbse68egp9wj9_A@mail.gmail.com
Fixes: 0d80e7f951be ("rqspinlock: Choose trylock fallback for NMI waiters")
Reported-by: Ritesh Oedayrajsingh Varma <ritesh@superluminal.eu>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20251128232802.1031906-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/asm-generic/rqspinlock.h | 60 +++++++++++++++++---------------
kernel/bpf/rqspinlock.c | 15 ++++----
2 files changed, 38 insertions(+), 37 deletions(-)
diff --git a/include/asm-generic/rqspinlock.h b/include/asm-generic/rqspinlock.h
index 6d4244d643df3..0f2dcbbfee2f0 100644
--- a/include/asm-generic/rqspinlock.h
+++ b/include/asm-generic/rqspinlock.h
@@ -129,8 +129,8 @@ static __always_inline void release_held_lock_entry(void)
* <error> for lock B
* release_held_lock_entry
*
- * try_cmpxchg_acquire for lock A
* grab_held_lock_entry
+ * try_cmpxchg_acquire for lock A
*
* Lack of any ordering means reordering may occur such that dec, inc
* are done before entry is overwritten. This permits a remote lock
@@ -139,13 +139,8 @@ static __always_inline void release_held_lock_entry(void)
* CPU holds a lock it is attempting to acquire, leading to false ABBA
* diagnosis).
*
- * In case of unlock, we will always do a release on the lock word after
- * releasing the entry, ensuring that other CPUs cannot hold the lock
- * (and make conclusions about deadlocks) until the entry has been
- * cleared on the local CPU, preventing any anomalies. Reordering is
- * still possible there, but a remote CPU cannot observe a lock in our
- * table which it is already holding, since visibility entails our
- * release store for the said lock has not retired.
+ * The case of unlock is treated differently due to NMI reentrancy, see
+ * comments in res_spin_unlock.
*
* In theory we don't have a problem if the dec and WRITE_ONCE above get
* reordered with each other, we either notice an empty NULL entry on
@@ -175,10 +170,22 @@ static __always_inline int res_spin_lock(rqspinlock_t *lock)
{
int val = 0;
- if (likely(atomic_try_cmpxchg_acquire(&lock->val, &val, _Q_LOCKED_VAL))) {
- grab_held_lock_entry(lock);
+ /*
+ * Grab the deadlock detection entry before doing the cmpxchg, so that
+ * reentrancy due to NMIs between the succeeding cmpxchg and creation of
+ * held lock entry can correctly detect an acquisition attempt in the
+ * interrupted context.
+ *
+ * cmpxchg lock A
+ * <NMI>
+ * res_spin_lock(A) --> missed AA, leads to timeout
+ * </NMI>
+ * grab_held_lock_entry(A)
+ */
+ grab_held_lock_entry(lock);
+
+ if (likely(atomic_try_cmpxchg_acquire(&lock->val, &val, _Q_LOCKED_VAL)))
return 0;
- }
return resilient_queued_spin_lock_slowpath(lock, val);
}
@@ -192,28 +199,25 @@ static __always_inline void res_spin_unlock(rqspinlock_t *lock)
{
struct rqspinlock_held *rqh = this_cpu_ptr(&rqspinlock_held_locks);
- if (unlikely(rqh->cnt > RES_NR_HELD))
- goto unlock;
- WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL);
-unlock:
/*
- * Release barrier, ensures correct ordering. See release_held_lock_entry
- * for details. Perform release store instead of queued_spin_unlock,
- * since we use this function for test-and-set fallback as well. When we
- * have CONFIG_QUEUED_SPINLOCKS=n, we clear the full 4-byte lockword.
+ * Release barrier, ensures correct ordering. Perform release store
+ * instead of queued_spin_unlock, since we use this function for the TAS
+ * fallback as well. When we have CONFIG_QUEUED_SPINLOCKS=n, we clear
+ * the full 4-byte lockword.
*
- * Like release_held_lock_entry, we can do the release before the dec.
- * We simply care about not seeing the 'lock' in our table from a remote
- * CPU once the lock has been released, which doesn't rely on the dec.
+ * Perform the smp_store_release before clearing the lock entry so that
+ * NMIs landing in the unlock path can correctly detect AA issues. The
+ * opposite order shown below may lead to missed AA checks:
*
- * Unlike smp_wmb(), release is not a two way fence, hence it is
- * possible for a inc to move up and reorder with our clearing of the
- * entry. This isn't a problem however, as for a misdiagnosis of ABBA,
- * the remote CPU needs to hold this lock, which won't be released until
- * the store below is done, which would ensure the entry is overwritten
- * to NULL, etc.
+ * WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL)
+ * <NMI>
+ * res_spin_lock(A) --> missed AA, leads to timeout
+ * </NMI>
+ * smp_store_release(A->locked, 0)
*/
smp_store_release(&lock->locked, 0);
+ if (likely(rqh->cnt <= RES_NR_HELD))
+ WRITE_ONCE(rqh->locks[rqh->cnt - 1], NULL);
this_cpu_dec(rqspinlock_held_locks.cnt);
}
diff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c
index 21be48108e962..f4c534fa4e87b 100644
--- a/kernel/bpf/rqspinlock.c
+++ b/kernel/bpf/rqspinlock.c
@@ -275,6 +275,10 @@ int __lockfunc resilient_tas_spin_lock(rqspinlock_t *lock)
int val, ret = 0;
RES_INIT_TIMEOUT(ts);
+ /*
+ * The fast path is not invoked for the TAS fallback, so we must grab
+ * the deadlock detection entry here.
+ */
grab_held_lock_entry(lock);
/*
@@ -397,10 +401,7 @@ int __lockfunc resilient_queued_spin_lock_slowpath(rqspinlock_t *lock, u32 val)
goto queue;
}
- /*
- * Grab an entry in the held locks array, to enable deadlock detection.
- */
- grab_held_lock_entry(lock);
+ /* Deadlock detection entry already held after failing fast path. */
/*
* We're pending, wait for the owner to go away.
@@ -448,11 +449,7 @@ int __lockfunc resilient_queued_spin_lock_slowpath(rqspinlock_t *lock, u32 val)
*/
queue:
lockevent_inc(lock_slowpath);
- /*
- * Grab deadlock detection entry for the queue path.
- */
- grab_held_lock_entry(lock);
-
+ /* Deadlock detection entry already held after failing fast path. */
node = this_cpu_ptr(&rqnodes[0].mcs);
idx = node->count++;
tail = encode_tail(smp_processor_id(), idx);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 497/614] rqspinlock: Use trylock fallback when per-CPU rqnode is busy
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 496/614] rqspinlock: Enclose lock/unlock within lock entry acquisitions Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 498/614] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Greg Kroah-Hartman
` (130 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Oedayrajsingh Varma,
Alexei Starovoitov, Kumar Kartikeya Dwivedi, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
[ Upstream commit 81d5a6a438595e46be191d602e5c2d6d73992fdc ]
In addition to deferring to the trylock fallback in NMIs, only do so
when an rqspinlock waiter is queued on the current CPU. This is detected
by noticing a non-zero node index. This allows NMI waiters to join the
waiter queue if it isn't interrupting an existing rqspinlock waiter, and
increase the chances of fairly obtaining the lock, performing deadlock
detection as the head, and not being starved while attempting the
trylock.
The trylock path in particular is unlikely to succeed under contention,
as it relies on the lock word becoming 0, which indicates no contention.
This means that the most likely result for NMIs attempting a trylock is
a timeout under contention if they don't hit an AA or ABBA case.
The core problem being addressed through the fixed commit was removing
the dependency edge between an NMI queue waiter and the queue waiter it
is interrupting. Whenever a circular dependency forms, and with no way
to break it (as non-head waiters don't poll for deadlocks or timeouts),
we would enter into a deadlock. A trylock either breaks such an edge by
probing for deadlocks, and finally terminating the waiting loop using a
timeout.
By excluding queueing on CPUs where the node index is non-zero for NMIs,
this sort of dependency is broken. The CPU enters the trylock path for
those cases, and falls back to deadlock checks and timeouts. However, in
other case where it doesn't interrupt the CPU in the slow path while its
queued on the lock, it can join the queue as a normal waiter, and avoid
trylock associated starvation and subsequent timeouts.
There are a few remaining cases here that matter: the NMI can still
preempt the owner in its critical section, and if it queues as a
non-head waiter, it can end up impeding the progress of the owner. While
this won't deadlock, since the head waiter will eventually signal the
NMI waiter to either stop (due to a timeout), it can still lead to long
timeouts. These gaps will be addressed in subsequent commits.
Note that while the node count detection approach is less conservative
than simply deferring NMIs to trylock, it is going to return errors
where attempts to lock B in NMI happen while waiters for lock A are in a
lower context on the same CPU. However, this only occurs when the lower
context is queued in the slow path, and the NMI attempt can proceed
without failure in all other cases. To continue to prevent AA deadlocks
(or ABBA in a similar NMI interrupting lower context pattern), we'd need
a more fleshed out algorithm to unlink NMI waiters after they queue and
detect such cases. However, all that complexity isn't appealing yet to
reduce the failure rate in the small window inside the slow path.
It is important to note that reentrancy in the slow path can also happen
through trace_contention_{begin,end}, but in those cases, unlike an NMI,
the forward progress of the head waiter (or the predecessor in general)
is not being blocked.
Fixes: 0d80e7f951be ("rqspinlock: Choose trylock fallback for NMI waiters")
Reported-by: Ritesh Oedayrajsingh Varma <ritesh@superluminal.eu>
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20251128232802.1031906-4-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/rqspinlock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c
index f4c534fa4e87b..3faf9cbd6c753 100644
--- a/kernel/bpf/rqspinlock.c
+++ b/kernel/bpf/rqspinlock.c
@@ -465,7 +465,7 @@ int __lockfunc resilient_queued_spin_lock_slowpath(rqspinlock_t *lock, u32 val)
* any MCS node. This is not the most elegant solution, but is
* simple enough.
*/
- if (unlikely(idx >= _Q_MAX_NODES || in_nmi())) {
+ if (unlikely(idx >= _Q_MAX_NODES || (in_nmi() && idx > 0))) {
lockevent_inc(lock_no_node);
RES_RESET_TIMEOUT(ts, RES_DEF_TIMEOUT);
while (!queued_spin_trylock(lock)) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 498/614] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 497/614] rqspinlock: Use trylock fallback when per-CPU rqnode is busy Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 499/614] md/raid5: fix IO hang when array is broken with IO inflight Greg Kroah-Hartman
` (129 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandru Gagniuc, Bjorn Andersson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
[ Upstream commit 7e81fa8d809ed1e67ae9ecd52d20a20c2c65d877 ]
The "qcom,halt-regs" consists of a phandle reference followed by the
three offsets within syscon for halt registers. Thus, we need to
request 4 integers from of_property_read_variable_u32_array(), with
the halt_reg ofsets at indexes 1, 2, and 3. Offset 0 is the phandle.
With MAX_HALT_REG at 3, of_property_read_variable_u32_array() returns
-EOVERFLOW, causing .probe() to fail.
Increase MAX_HALT_REG to 4, and update the indexes accordingly.
Fixes: 0af65b9b915e ("remoteproc: qcom: wcss: Add non pas wcss Q6 support for QCS404")
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://lore.kernel.org/r/20251129013207.3981517-1-mr.nuke.me@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5_wcss.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/remoteproc/qcom_q6v5_wcss.c b/drivers/remoteproc/qcom_q6v5_wcss.c
index 07c88623f5978..23ec87827d4f8 100644
--- a/drivers/remoteproc/qcom_q6v5_wcss.c
+++ b/drivers/remoteproc/qcom_q6v5_wcss.c
@@ -85,7 +85,7 @@
#define TCSR_WCSS_CLK_MASK 0x1F
#define TCSR_WCSS_CLK_ENABLE 0x14
-#define MAX_HALT_REG 3
+#define MAX_HALT_REG 4
enum {
WCSS_IPQ8074,
WCSS_QCS404,
@@ -864,9 +864,9 @@ static int q6v5_wcss_init_mmio(struct q6v5_wcss *wcss,
return -EINVAL;
}
- wcss->halt_q6 = halt_reg[0];
- wcss->halt_wcss = halt_reg[1];
- wcss->halt_nc = halt_reg[2];
+ wcss->halt_q6 = halt_reg[1];
+ wcss->halt_wcss = halt_reg[2];
+ wcss->halt_nc = halt_reg[3];
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 499/614] md/raid5: fix IO hang when array is broken with IO inflight
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 498/614] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 500/614] clk: keystone: fix compile testing Greg Kroah-Hartman
` (128 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Li Nan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai@fnnas.com>
[ Upstream commit a913d1f6a7f607c110aeef8b58c8988f47a4b24e ]
Following test can cause IO hang:
mdadm -CvR /dev/md0 -l10 -n4 /dev/sd[abcd] --assume-clean --chunk=64K --bitmap=none
sleep 5
echo 1 > /sys/block/sda/device/delete
echo 1 > /sys/block/sdb/device/delete
echo 1 > /sys/block/sdc/device/delete
echo 1 > /sys/block/sdd/device/delete
dd if=/dev/md0 of=/dev/null bs=8k count=1 iflag=direct
Root cause:
1) all disks removed, however all rdevs in the array is still in sync,
IO will be issued normally.
2) IO failure from sda, and set badblocks failed, sda will be faulty
and MD_SB_CHANGING_PENDING will be set.
3) error recovery try to recover this IO from other disks, IO will be
issued to sdb, sdc, and sdd.
4) IO failure from sdb, and set badblocks failed again, now array is
broken and will become read-only.
5) IO failure from sdc and sdd, however, stripe can't be handled anymore
because MD_SB_CHANGING_PENDING is set:
handle_stripe
handle_stripe
if (test_bit MD_SB_CHANGING_PENDING)
set_bit STRIPE_HANDLE
goto finish
// skip handling failed stripe
release_stripe
if (test_bit STRIPE_HANDLE)
list_add_tail conf->hand_list
6) later raid5d can't handle failed stripe as well:
raid5d
md_check_recovery
md_update_sb
if (!md_is_rdwr())
// can't clear pending bit
return
if (test_bit MD_SB_CHANGING_PENDING)
break;
// can't handle failed stripe
Since MD_SB_CHANGING_PENDING can never be cleared for read-only array,
fix this problem by skip this checking for read-only array.
Link: https://lore.kernel.org/linux-raid/20251117085557.770572-3-yukuai@fnnas.com
Fixes: d87f064f5874 ("md: never update metadata when array is read-only.")
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/raid5.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 24b32a0c95b40..8b5f8a12d4179 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4956,7 +4956,8 @@ static void handle_stripe(struct stripe_head *sh)
goto finish;
if (s.handle_bad_blocks ||
- test_bit(MD_SB_CHANGE_PENDING, &conf->mddev->sb_flags)) {
+ (md_is_rdwr(conf->mddev) &&
+ test_bit(MD_SB_CHANGE_PENDING, &conf->mddev->sb_flags))) {
set_bit(STRIPE_HANDLE, &sh->state);
goto finish;
}
@@ -6768,7 +6769,8 @@ static void raid5d(struct md_thread *thread)
int batch_size, released;
unsigned int offset;
- if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags))
+ if (md_is_rdwr(mddev) &&
+ test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags))
break;
released = release_stripe_list(conf, conf->temp_inactive_list);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 500/614] clk: keystone: fix compile testing
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 499/614] md/raid5: fix IO hang when array is broken with IO inflight Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 501/614] smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper Greg Kroah-Hartman
` (127 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Stephen Boyd,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit b276445e98fe28609688fb85b89a81b803910e63 ]
Some keystone clock drivers can be selected when COMPILE_TEST is
enabled but since commit b745c0794e2f ("clk: keystone: Add sci-clk
driver support") they are never actually built.
Enable compile testing by allowing the build system to process the
keystone drivers.
Fixes: b745c0794e2f ("clk: keystone: Add sci-clk driver support")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/Makefile | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index b74a1767ca278..61ec08404442b 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -125,8 +125,7 @@ obj-$(CONFIG_ARCH_HISI) += hisilicon/
obj-y += imgtec/
obj-y += imx/
obj-y += ingenic/
-obj-$(CONFIG_ARCH_K3) += keystone/
-obj-$(CONFIG_ARCH_KEYSTONE) += keystone/
+obj-y += keystone/
obj-y += mediatek/
obj-$(CONFIG_ARCH_MESON) += meson/
obj-y += microchip/
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 501/614] smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 500/614] clk: keystone: fix compile testing Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 502/614] smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() Greg Kroah-Hartman
` (126 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve French, Tom Talpey, Long Li,
Namjae Jeon, Paulo Alcantara, linux-cifs, samba-technical,
Stefan Metzmacher, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 1f3fd108c5c5a9885c6c276a2489c49b60a6b90d ]
This can be used like this:
int err = somefunc();
pr_warn("err=%1pe\n", SMBDIRECT_DEBUG_ERR_PTR(err));
This will be used in the following fixes in order
to be prepared to identify real world problems
more easily.
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 425c32750b48 ("smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/common/smbdirect/smbdirect_socket.h | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h
index ee5a90d691c89..611986827a5e2 100644
--- a/fs/smb/common/smbdirect/smbdirect_socket.h
+++ b/fs/smb/common/smbdirect/smbdirect_socket.h
@@ -74,6 +74,19 @@ const char *smbdirect_socket_status_string(enum smbdirect_socket_status status)
return "<unknown>";
}
+/*
+ * This can be used with %1pe to print errors as strings or '0'
+ * And it avoids warnings like: warn: passing zero to 'ERR_PTR'
+ * from smatch -p=kernel --pedantic
+ */
+static __always_inline
+const void * __must_check SMBDIRECT_DEBUG_ERR_PTR(long error)
+{
+ if (error == 0)
+ return NULL;
+ return ERR_PTR(error);
+}
+
enum smbdirect_keepalive_status {
SMBDIRECT_KEEPALIVE_NONE,
SMBDIRECT_KEEPALIVE_PENDING,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 502/614] smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 501/614] smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 503/614] smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() Greg Kroah-Hartman
` (125 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve French, Tom Talpey, Long Li,
Namjae Jeon, Paulo Alcantara, linux-cifs, samba-technical,
Stefan Metzmacher, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 1adb2dab9727c5beaaf253f67bf4fc2c54ae70e7 ]
These will be used in various places in order to assert
the current status mostly during the connect and negotiation
phase. It will replace the WARN_ON_ONCE(sc->status != ...)
calls, which are very useless in order to identify the
problem that happened.
As a start client and server will need to define their own
__SMBDIRECT_SOCKET_DISCONNECT(__sc) macro in order to use
SMBDIRECT_CHECK_STATUS_DISCONNECT().
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 425c32750b48 ("smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/common/smbdirect/smbdirect_socket.h | 38 ++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h
index 611986827a5e2..384b19177e1c3 100644
--- a/fs/smb/common/smbdirect/smbdirect_socket.h
+++ b/fs/smb/common/smbdirect/smbdirect_socket.h
@@ -394,6 +394,44 @@ static __always_inline void smbdirect_socket_init(struct smbdirect_socket *sc)
init_waitqueue_head(&sc->mr_io.cleanup.wait_queue);
}
+#define __SMBDIRECT_CHECK_STATUS_FAILED(__sc, __expected_status, __error_cmd, __unexpected_cmd) ({ \
+ bool __failed = false; \
+ if (unlikely((__sc)->first_error)) { \
+ __failed = true; \
+ __error_cmd \
+ } else if (unlikely((__sc)->status != (__expected_status))) { \
+ __failed = true; \
+ __unexpected_cmd \
+ } \
+ __failed; \
+})
+
+#define __SMBDIRECT_CHECK_STATUS_WARN(__sc, __expected_status, __unexpected_cmd) \
+ __SMBDIRECT_CHECK_STATUS_FAILED(__sc, __expected_status, \
+ , \
+ { \
+ const struct sockaddr_storage *__src = NULL; \
+ const struct sockaddr_storage *__dst = NULL; \
+ if ((__sc)->rdma.cm_id) { \
+ __src = &(__sc)->rdma.cm_id->route.addr.src_addr; \
+ __dst = &(__sc)->rdma.cm_id->route.addr.dst_addr; \
+ } \
+ WARN_ONCE(1, \
+ "expected[%s] != %s first_error=%1pe local=%pISpsfc remote=%pISpsfc\n", \
+ smbdirect_socket_status_string(__expected_status), \
+ smbdirect_socket_status_string((__sc)->status), \
+ SMBDIRECT_DEBUG_ERR_PTR((__sc)->first_error), \
+ __src, __dst); \
+ __unexpected_cmd \
+ })
+
+#define SMBDIRECT_CHECK_STATUS_WARN(__sc, __expected_status) \
+ __SMBDIRECT_CHECK_STATUS_WARN(__sc, __expected_status, /* nothing */)
+
+#define SMBDIRECT_CHECK_STATUS_DISCONNECT(__sc, __expected_status) \
+ __SMBDIRECT_CHECK_STATUS_WARN(__sc, __expected_status, \
+ __SMBDIRECT_SOCKET_DISCONNECT(__sc);)
+
struct smbdirect_send_io {
struct smbdirect_socket *socket;
struct ib_cqe cqe;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 503/614] smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 502/614] smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 504/614] smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() Greg Kroah-Hartman
` (124 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve French, Tom Talpey, Long Li,
Namjae Jeon, Paulo Alcantara, linux-cifs, samba-technical,
Stefan Metzmacher, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 425c32750b48956a6e156b6a4609d281ee471359 ]
Namjae reported the following:
I have a simple file copy test with windows 11 client, and get the
following error message.
[ 894.140312] ------------[ cut here ]------------
[ 894.140316] WARNING: CPU: 1 PID: 116 at
fs/smb/server/transport_rdma.c:642 recv_done+0x308/0x360 [ksmbd]
[ 894.140335] Modules linked in: ksmbd cmac nls_utf8 nls_ucs2_utils
libarc4 nls_iso8859_1 snd_hda_codec_intelhdmi snd_hda_codec_hdmi
snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic
rpcrdma intel_rapl_msr rdma_ucm intel_rapl_common snd_hda_intel
ib_iser snd_hda_codec intel_uncore_frequency
intel_uncore_frequency_common snd_hda_core intel_tcc_cooling
x86_pkg_temp_thermal intel_powerclamp snd_intel_dspcfg libiscsi
snd_intel_sdw_acpi coretemp scsi_transport_iscsi snd_hwdep kvm_intel
i915 snd_pcm ib_umad rdma_cm snd_seq_midi ib_ipoib kvm
snd_seq_midi_event iw_cm snd_rawmidi ghash_clmulni_intel ib_cm
aesni_intel snd_seq mei_hdcp drm_buddy rapl snd_seq_device eeepc_wmi
asus_wmi snd_timer intel_cstate ttm snd drm_client_lib
drm_display_helper sparse_keymap soundcore platform_profile mxm_wmi
wmi_bmof joydev mei_me cec acpi_pad mei rc_core drm_kms_helper
input_leds i2c_algo_bit mac_hid sch_fq_codel msr parport_pc ppdev lp
nfsd parport auth_rpcgss binfmt_misc nfs_acl lockd grace drm sunrpc
ramoops efi_pstore
[ 894.140414] reed_solomon pstore_blk pstore_zone autofs4 btrfs
blake2b_generic xor raid6_pq mlx5_ib ib_uverbs ib_core hid_generic uas
usbhid hid r8169 i2c_i801 usb_storage i2c_mux i2c_smbus mlx5_core
realtek ahci mlxfw psample libahci video wmi [last unloaded: ksmbd]
[ 894.140442] CPU: 1 UID: 0 PID: 116 Comm: kworker/1:1H Tainted: G
W 6.18.0-rc5+ #1 PREEMPT(voluntary)
[ 894.140447] Tainted: [W]=WARN
[ 894.140448] Hardware name: System manufacturer System Product
Name/H110M-K, BIOS 3601 12/12/2017
[ 894.140450] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
[ 894.140476] RIP: 0010:recv_done+0x308/0x360 [ksmbd]
[ 894.140487] Code: 2e f2 ff ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc
cc cc cc 41 8b 55 10 49 8b 75 08 b9 02 00 00 00 e8 ed f4 f2 c3 e9 59
fd ff ff <0f> 0b e9 02 ff ff ff 49 8b 74 24 28 49 8d 94 24 c8 00 00 00
bf 00
[ 894.140490] RSP: 0018:ffffa47ec03f3d78 EFLAGS: 00010293
[ 894.140492] RAX: 0000000000000001 RBX: ffff8eb84c818000 RCX: 000000010002ba00
[ 894.140494] RDX: 0000000037600001 RSI: 0000000000000083 RDI: ffff8eb92ec9ee40
[ 894.140496] RBP: ffffa47ec03f3da0 R08: 0000000000000000 R09: 0000000000000010
[ 894.140498] R10: ffff8eb801705680 R11: fefefefefefefeff R12: ffff8eb7454b8810
[ 894.140499] R13: ffff8eb746deb988 R14: ffff8eb746deb980 R15: ffff8eb84c818000
[ 894.140501] FS: 0000000000000000(0000) GS:ffff8eb9a7355000(0000)
knlGS:0000000000000000
[ 894.140503] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 894.140505] CR2: 00002d9401d60018 CR3: 0000000010a40006 CR4: 00000000003726f0
[ 894.140507] Call Trace:
[ 894.140509] <TASK>
[ 894.140512] __ib_process_cq+0x8e/0x190 [ib_core]
[ 894.140530] ib_cq_poll_work+0x2f/0x90 [ib_core]
[ 894.140545] process_scheduled_works+0xd4/0x430
[ 894.140554] worker_thread+0x12a/0x270
[ 894.140558] kthread+0x10d/0x250
[ 894.140564] ? __pfx_worker_thread+0x10/0x10
[ 894.140567] ? __pfx_kthread+0x10/0x10
[ 894.140571] ret_from_fork+0x11a/0x160
[ 894.140574] ? __pfx_kthread+0x10/0x10
[ 894.140577] ret_from_fork_asm+0x1a/0x30
[ 894.140584] </TASK>
[ 894.140585] ---[ end trace 0000000000000000 ]---
[ 894.154363] ------------[ cut here ]------------
[ 894.154367] WARNING: CPU: 3 PID: 5543 at
fs/smb/server/transport_rdma.c:1728 smb_direct_cm_handler+0x121/0x130
[ksmbd]
[ 894.154384] Modules linked in: ksmbd cmac nls_utf8 nls_ucs2_utils
libarc4 nls_iso8859_1 snd_hda_codec_intelhdmi snd_hda_codec_hdmi
snd_hda_codec_alc882 snd_hda_codec_realtek_lib snd_hda_codec_generic
rpcrdma intel_rapl_msr rdma_ucm intel_rapl_common snd_hda_intel
ib_iser snd_hda_codec intel_uncore_frequency
intel_uncore_frequency_common snd_hda_core intel_tcc_cooling
x86_pkg_temp_thermal intel_powerclamp snd_intel_dspcfg libiscsi
snd_intel_sdw_acpi coretemp scsi_transport_iscsi snd_hwdep kvm_intel
i915 snd_pcm ib_umad rdma_cm snd_seq_midi ib_ipoib kvm
snd_seq_midi_event iw_cm snd_rawmidi ghash_clmulni_intel ib_cm
aesni_intel snd_seq mei_hdcp drm_buddy rapl snd_seq_device eeepc_wmi
asus_wmi snd_timer intel_cstate ttm snd drm_client_lib
drm_display_helper sparse_keymap soundcore platform_profile mxm_wmi
wmi_bmof joydev mei_me cec acpi_pad mei rc_core drm_kms_helper
input_leds i2c_algo_bit mac_hid sch_fq_codel msr parport_pc ppdev lp
nfsd parport auth_rpcgss binfmt_misc nfs_acl lockd grace drm sunrpc
ramoops efi_pstore
[ 894.154456] reed_solomon pstore_blk pstore_zone autofs4 btrfs
blake2b_generic xor raid6_pq mlx5_ib ib_uverbs ib_core hid_generic uas
usbhid hid r8169 i2c_i801 usb_storage i2c_mux i2c_smbus mlx5_core
realtek ahci mlxfw psample libahci video wmi [last unloaded: ksmbd]
[ 894.154483] CPU: 3 UID: 0 PID: 5543 Comm: kworker/3:6 Tainted: G
W 6.18.0-rc5+ #1 PREEMPT(voluntary)
[ 894.154487] Tainted: [W]=WARN
[ 894.154488] Hardware name: System manufacturer System Product
Name/H110M-K, BIOS 3601 12/12/2017
[ 894.154490] Workqueue: ib_cm cm_work_handler [ib_cm]
[ 894.154499] RIP: 0010:smb_direct_cm_handler+0x121/0x130 [ksmbd]
[ 894.154507] Code: e7 e8 13 b1 ef ff 44 89 e1 4c 89 ee 48 c7 c7 80
d7 59 c1 48 89 c2 e8 2e 4d ef c3 31 c0 5b 41 5c 41 5d 41 5e 5d c3 cc
cc cc cc <0f> 0b eb a5 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90
90 90
[ 894.154510] RSP: 0018:ffffa47ec1b27c00 EFLAGS: 00010206
[ 894.154512] RAX: ffffffffc1304e00 RBX: ffff8eb89ae50880 RCX: 0000000000000000
[ 894.154514] RDX: ffff8eb730960000 RSI: ffffa47ec1b27c60 RDI: ffff8eb7454b9400
[ 894.154515] RBP: ffffa47ec1b27c20 R08: 0000000000000002 R09: ffff8eb730b8c18b
[ 894.154517] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000009
[ 894.154518] R13: ffff8eb7454b9400 R14: ffff8eb7454b8810 R15: ffff8eb815c43000
[ 894.154520] FS: 0000000000000000(0000) GS:ffff8eb9a7455000(0000)
knlGS:0000000000000000
[ 894.154522] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 894.154523] CR2: 00007fe1310e99d0 CR3: 0000000010a40005 CR4: 00000000003726f0
[ 894.154525] Call Trace:
[ 894.154527] <TASK>
[ 894.154530] cma_cm_event_handler+0x27/0xd0 [rdma_cm]
[ 894.154541] cma_ib_handler+0x99/0x2e0 [rdma_cm]
[ 894.154551] cm_process_work+0x28/0xf0 [ib_cm]
[ 894.154557] cm_queue_work_unlock+0x41/0xf0 [ib_cm]
[ 894.154563] cm_work_handler+0x2eb/0x25b0 [ib_cm]
[ 894.154568] ? pwq_activate_first_inactive+0x52/0x70
[ 894.154572] ? pwq_dec_nr_in_flight+0x244/0x330
[ 894.154575] process_scheduled_works+0xd4/0x430
[ 894.154579] worker_thread+0x12a/0x270
[ 894.154581] kthread+0x10d/0x250
[ 894.154585] ? __pfx_worker_thread+0x10/0x10
[ 894.154587] ? __pfx_kthread+0x10/0x10
[ 894.154590] ret_from_fork+0x11a/0x160
[ 894.154593] ? __pfx_kthread+0x10/0x10
[ 894.154596] ret_from_fork_asm+0x1a/0x30
[ 894.154602] </TASK>
[ 894.154603] ---[ end trace 0000000000000000 ]---
[ 894.154931] ksmbd: smb_direct: disconnected
[ 894.157278] ksmbd: smb_direct: disconnected
I guess sc->first_error is already set and sc->status
is thus unexpected, so this should avoid the WARN[_ON]_ONCE()
if sc->first_error is already set and have a usable error path.
While there set sc->first_error as soon as possible.
v1 of this patch revealed the real problem with this message:
[ 309.560973] expected[NEGOTIATE_NEEDED] != RDMA_CONNECT_RUNNING
first_error=0 local=192.168.0.200:445 remote=192.168.0.100:60445
[ 309.561034] WARNING: CPU: 2 PID: 78 at transport_rdma.c:643
recv_done+0x2fa/0x3d0 [ksmbd]
Some drivers (at least mlx5_ib) might post a recv completion before
RDMA_CM_EVENT_ESTABLISHED, so we need to adjust our expectation in that
case.
Fixes: e2d5e516c663 ("smb: server: only turn into SMBDIRECT_SOCKET_CONNECTED when negotiation is done")
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/transport_rdma.c | 40 +++++++++++++++++++++++++++-------
1 file changed, 32 insertions(+), 8 deletions(-)
diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index e2be9a4961546..4e7ab8d9314f6 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -19,6 +19,8 @@
#include <rdma/rdma_cm.h>
#include <rdma/rw.h>
+#define __SMBDIRECT_SOCKET_DISCONNECT(__sc) smb_direct_disconnect_rdma_connection(__sc)
+
#include "glob.h"
#include "connection.h"
#include "smb_common.h"
@@ -231,6 +233,9 @@ static void smb_direct_disconnect_rdma_work(struct work_struct *work)
struct smbdirect_socket *sc =
container_of(work, struct smbdirect_socket, disconnect_work);
+ if (sc->first_error == 0)
+ sc->first_error = -ECONNABORTED;
+
/*
* make sure this and other work is not queued again
* but here we don't block and avoid
@@ -241,9 +246,6 @@ static void smb_direct_disconnect_rdma_work(struct work_struct *work)
disable_delayed_work(&sc->idle.timer_work);
disable_work(&sc->idle.immediate_work);
- if (sc->first_error == 0)
- sc->first_error = -ECONNABORTED;
-
switch (sc->status) {
case SMBDIRECT_SOCKET_NEGOTIATE_NEEDED:
case SMBDIRECT_SOCKET_NEGOTIATE_RUNNING:
@@ -287,6 +289,9 @@ static void smb_direct_disconnect_rdma_work(struct work_struct *work)
static void
smb_direct_disconnect_rdma_connection(struct smbdirect_socket *sc)
{
+ if (sc->first_error == 0)
+ sc->first_error = -ECONNABORTED;
+
/*
* make sure other work (than disconnect_work) is
* not queued again but here we don't block and avoid
@@ -296,9 +301,6 @@ smb_direct_disconnect_rdma_connection(struct smbdirect_socket *sc)
disable_work(&sc->idle.immediate_work);
disable_delayed_work(&sc->idle.timer_work);
- if (sc->first_error == 0)
- sc->first_error = -ECONNABORTED;
-
switch (sc->status) {
case SMBDIRECT_SOCKET_RESOLVE_ADDR_FAILED:
case SMBDIRECT_SOCKET_RESOLVE_ROUTE_FAILED:
@@ -639,7 +641,18 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
return;
}
sc->recv_io.reassembly.full_packet_received = true;
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_NEGOTIATE_NEEDED);
+ /*
+ * Some drivers (at least mlx5_ib) might post a
+ * recv completion before RDMA_CM_EVENT_ESTABLISHED,
+ * we need to adjust our expectation in that case.
+ */
+ if (!sc->first_error && sc->status == SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING)
+ sc->status = SMBDIRECT_SOCKET_NEGOTIATE_NEEDED;
+ if (SMBDIRECT_CHECK_STATUS_WARN(sc, SMBDIRECT_SOCKET_NEGOTIATE_NEEDED)) {
+ put_recvmsg(sc, recvmsg);
+ smb_direct_disconnect_rdma_connection(sc);
+ return;
+ }
sc->status = SMBDIRECT_SOCKET_NEGOTIATE_RUNNING;
enqueue_reassembly(sc, recvmsg, 0);
wake_up(&sc->status_wait);
@@ -1725,7 +1738,18 @@ static int smb_direct_cm_handler(struct rdma_cm_id *cm_id,
switch (event->event) {
case RDMA_CM_EVENT_ESTABLISHED: {
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING);
+ /*
+ * Some drivers (at least mlx5_ib) might post a
+ * recv completion before RDMA_CM_EVENT_ESTABLISHED,
+ * we need to adjust our expectation in that case.
+ *
+ * As we already started the negotiation, we just
+ * ignore RDMA_CM_EVENT_ESTABLISHED here.
+ */
+ if (!sc->first_error && sc->status > SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING)
+ break;
+ if (SMBDIRECT_CHECK_STATUS_DISCONNECT(sc, SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING))
+ break;
sc->status = SMBDIRECT_SOCKET_NEGOTIATE_NEEDED;
wake_up(&sc->status_wait);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 504/614] smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 503/614] smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 505/614] um: Disable KASAN_INLINE when STATIC_LINK is selected Greg Kroah-Hartman
` (123 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steve French, Tom Talpey, Long Li,
Namjae Jeon, Paulo Alcantara, linux-cifs, samba-technical,
Stefan Metzmacher, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit dc10cf1368af8cb816dcaa2502ba7d44fff20612 ]
sc->first_error might already be set and sc->status
is thus unexpected, so this should avoid the WARN[_ON]_ONCE()
if sc->first_error is already set and have a usable error path.
While there set sc->first_error as soon as possible.
This is done based on a problem seen in similar places on
the server. And there it was already very useful in order
to find the problem when we have a meaningful WARN_ONCE()
that prints details about the connection.
This is much more useful:
[ 309.560973] expected[NEGOTIATE_NEEDED] != RDMA_CONNECT_RUNNING
first_error=0 local=192.168.0.200:445 remote=192.168.0.100:60445
[ 309.561034] WARNING: CPU: 2 PID: 78 at transport_rdma.c:643
recv_done+0x2fa/0x3d0 [ksmbd]
than what we had before (only):
[ 894.140316] WARNING: CPU: 1 PID: 116 at
fs/smb/server/transport_rdma.c:642 recv_done+0x308/0x360 [ksmbd]
Fixes: 58dfba8a2d4e ("smb: client/smbdirect: replace SMBDIRECT_SOCKET_CONNECTING with more detailed states")
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Long Li <longli@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smbdirect.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
index c6c428c2e08dd..788a0670c4a8d 100644
--- a/fs/smb/client/smbdirect.c
+++ b/fs/smb/client/smbdirect.c
@@ -7,6 +7,7 @@
#include <linux/module.h>
#include <linux/highmem.h>
#include <linux/folio_queue.h>
+#define __SMBDIRECT_SOCKET_DISCONNECT(__sc) smbd_disconnect_rdma_connection(__sc)
#include "../common/smbdirect/smbdirect_pdu.h"
#include "smbdirect.h"
#include "cifs_debug.h"
@@ -186,6 +187,9 @@ static void smbd_disconnect_rdma_work(struct work_struct *work)
struct smbdirect_socket *sc =
container_of(work, struct smbdirect_socket, disconnect_work);
+ if (sc->first_error == 0)
+ sc->first_error = -ECONNABORTED;
+
/*
* make sure this and other work is not queued again
* but here we don't block and avoid
@@ -197,9 +201,6 @@ static void smbd_disconnect_rdma_work(struct work_struct *work)
disable_work(&sc->idle.immediate_work);
disable_delayed_work(&sc->idle.timer_work);
- if (sc->first_error == 0)
- sc->first_error = -ECONNABORTED;
-
switch (sc->status) {
case SMBDIRECT_SOCKET_NEGOTIATE_NEEDED:
case SMBDIRECT_SOCKET_NEGOTIATE_RUNNING:
@@ -242,6 +243,9 @@ static void smbd_disconnect_rdma_work(struct work_struct *work)
static void smbd_disconnect_rdma_connection(struct smbdirect_socket *sc)
{
+ if (sc->first_error == 0)
+ sc->first_error = -ECONNABORTED;
+
/*
* make sure other work (than disconnect_work) is
* not queued again but here we don't block and avoid
@@ -252,9 +256,6 @@ static void smbd_disconnect_rdma_connection(struct smbdirect_socket *sc)
disable_work(&sc->idle.immediate_work);
disable_delayed_work(&sc->idle.timer_work);
- if (sc->first_error == 0)
- sc->first_error = -ECONNABORTED;
-
switch (sc->status) {
case SMBDIRECT_SOCKET_RESOLVE_ADDR_FAILED:
case SMBDIRECT_SOCKET_RESOLVE_ROUTE_FAILED:
@@ -322,27 +323,27 @@ static int smbd_conn_upcall(
switch (event->event) {
case RDMA_CM_EVENT_ADDR_RESOLVED:
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RESOLVE_ADDR_RUNNING);
+ if (SMBDIRECT_CHECK_STATUS_DISCONNECT(sc, SMBDIRECT_SOCKET_RESOLVE_ADDR_RUNNING))
+ break;
sc->status = SMBDIRECT_SOCKET_RESOLVE_ROUTE_NEEDED;
wake_up(&sc->status_wait);
break;
case RDMA_CM_EVENT_ROUTE_RESOLVED:
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RESOLVE_ROUTE_RUNNING);
+ if (SMBDIRECT_CHECK_STATUS_DISCONNECT(sc, SMBDIRECT_SOCKET_RESOLVE_ROUTE_RUNNING))
+ break;
sc->status = SMBDIRECT_SOCKET_RDMA_CONNECT_NEEDED;
wake_up(&sc->status_wait);
break;
case RDMA_CM_EVENT_ADDR_ERROR:
log_rdma_event(ERR, "connecting failed event=%s\n", event_name);
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RESOLVE_ADDR_RUNNING);
sc->status = SMBDIRECT_SOCKET_RESOLVE_ADDR_FAILED;
smbd_disconnect_rdma_work(&sc->disconnect_work);
break;
case RDMA_CM_EVENT_ROUTE_ERROR:
log_rdma_event(ERR, "connecting failed event=%s\n", event_name);
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RESOLVE_ROUTE_RUNNING);
sc->status = SMBDIRECT_SOCKET_RESOLVE_ROUTE_FAILED;
smbd_disconnect_rdma_work(&sc->disconnect_work);
break;
@@ -428,7 +429,8 @@ static int smbd_conn_upcall(
min_t(u8, sp->responder_resources,
peer_responder_resources);
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING);
+ if (SMBDIRECT_CHECK_STATUS_DISCONNECT(sc, SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING))
+ break;
sc->status = SMBDIRECT_SOCKET_NEGOTIATE_NEEDED;
wake_up(&sc->status_wait);
break;
@@ -437,7 +439,6 @@ static int smbd_conn_upcall(
case RDMA_CM_EVENT_UNREACHABLE:
case RDMA_CM_EVENT_REJECTED:
log_rdma_event(ERR, "connecting failed event=%s\n", event_name);
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_RDMA_CONNECT_RUNNING);
sc->status = SMBDIRECT_SOCKET_RDMA_CONNECT_FAILED;
smbd_disconnect_rdma_work(&sc->disconnect_work);
break;
@@ -699,7 +700,8 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
negotiate_done =
process_negotiation_response(response, wc->byte_len);
put_receive_buffer(sc, response);
- WARN_ON_ONCE(sc->status != SMBDIRECT_SOCKET_NEGOTIATE_RUNNING);
+ if (SMBDIRECT_CHECK_STATUS_WARN(sc, SMBDIRECT_SOCKET_NEGOTIATE_RUNNING))
+ negotiate_done = false;
if (!negotiate_done) {
sc->status = SMBDIRECT_SOCKET_NEGOTIATE_FAILED;
smbd_disconnect_rdma_connection(sc);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 505/614] um: Disable KASAN_INLINE when STATIC_LINK is selected
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 504/614] smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 506/614] net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 Greg Kroah-Hartman
` (122 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Christophe Leroy (CS GROUP), Johannes Berg, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
[ Upstream commit a3209bb94b36351f11e0d9e72ac44e5dd777a069 ]
um doesn't support KASAN_INLINE together with STATIC_LINK.
Instead of failing the build, disable KASAN_INLINE when
STATIC_LINK is selected.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202511290451.x9GZVJ1l-lkp@intel.com/
Fixes: 1e338f4d99e6 ("kasan: introduce ARCH_DEFER_KASAN and unify static key across modes")
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Link: https://patch.msgid.link/2620ab0bbba640b6237c50b9c0dca1c7d1142f5d.1764410067.git.chleroy@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/Kconfig | 1 +
arch/um/include/asm/kasan.h | 4 ----
2 files changed, 1 insertion(+), 4 deletions(-)
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 49781bee79058..93ed850d508ed 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -5,6 +5,7 @@ menu "UML-specific options"
config UML
bool
default y
+ select ARCH_DISABLE_KASAN_INLINE if STATIC_LINK
select ARCH_NEEDS_DEFER_KASAN if STATIC_LINK
select ARCH_WANTS_DYNAMIC_TASK_STRUCT
select ARCH_HAS_CACHE_LINE_SIZE
diff --git a/arch/um/include/asm/kasan.h b/arch/um/include/asm/kasan.h
index b54a4e937fd12..81bcdc0f962e6 100644
--- a/arch/um/include/asm/kasan.h
+++ b/arch/um/include/asm/kasan.h
@@ -24,10 +24,6 @@
#ifdef CONFIG_KASAN
void kasan_init(void);
-
-#if defined(CONFIG_STATIC_LINK) && defined(CONFIG_KASAN_INLINE)
-#error UML does not work in KASAN_INLINE mode with STATIC_LINK enabled!
-#endif
#else
static inline void kasan_init(void) { }
#endif /* CONFIG_KASAN */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 506/614] net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 505/614] um: Disable KASAN_INLINE when STATIC_LINK is selected Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 507/614] net: dsa: b53: fix extracting VID from entry " Greg Kroah-Hartman
` (121 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli,
Álvaro Fernández Rojas, Jonas Gorski, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 6f268e275c74dae0536e0b61982a8db25bcf4f16 ]
Since BCM5325 and BCM5365 only support up to 256 VLANs, the VLAN_ID_IDX
register is only 8 bit wide, not 16 bit, so use an appropriate accessor.
Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365")
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://patch.msgid.link/20251128080625.27181-2-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index eb767edc4c135..a09ed32dccc07 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1924,8 +1924,12 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
/* Perform a read for the given MAC and VID */
b53_write48(dev, B53_ARLIO_PAGE, B53_MAC_ADDR_IDX, mac);
- if (!is5325m(dev))
- b53_write16(dev, B53_ARLIO_PAGE, B53_VLAN_ID_IDX, vid);
+ if (!is5325m(dev)) {
+ if (is5325(dev) || is5365(dev))
+ b53_write8(dev, B53_ARLIO_PAGE, B53_VLAN_ID_IDX, vid);
+ else
+ b53_write16(dev, B53_ARLIO_PAGE, B53_VLAN_ID_IDX, vid);
+ }
/* Issue a read operation for this MAC */
ret = b53_arl_rw_op(dev, 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 507/614] net: dsa: b53: fix extracting VID from entry for BCM5325/65
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 506/614] net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 508/614] net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision Greg Kroah-Hartman
` (120 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli,
Álvaro Fernández Rojas, Jonas Gorski, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 9316012dd01952f75e37035360138ccc786ef727 ]
BCM5325/65's Entry register uses the highest three bits for
VALID/STATIC/AGE, so shifting by 53 only will add these to
b53_arl_entry::vid.
So make sure to mask the vid value as well, to not get invalid VIDs.
Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365")
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://patch.msgid.link/20251128080625.27181-3-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_priv.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 458775f951643..2f44b3b6a0d9f 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -338,7 +338,7 @@ static inline void b53_arl_to_entry_25(struct b53_arl_entry *ent,
ent->is_age = !!(mac_vid & ARLTBL_AGE_25);
ent->is_static = !!(mac_vid & ARLTBL_STATIC_25);
u64_to_ether_addr(mac_vid, ent->mac);
- ent->vid = mac_vid >> ARLTBL_VID_S_65;
+ ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
}
static inline void b53_arl_from_entry(u64 *mac_vid, u32 *fwd_entry,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 508/614] net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 507/614] net: dsa: b53: fix extracting VID from entry " Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 509/614] net: dsa: b53: move reading ARL entries into their own function Greg Kroah-Hartman
` (119 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit a6e4fd38bf2f2e2363b61c27f4e6c49b14e4bb07 ]
Align the b53_arl_read{,25}() functions by consistently using the
parsed arl entry instead of parsing the raw registers again.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-2-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index a09ed32dccc07..4d8de90fb4ab8 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1830,7 +1830,7 @@ static int b53_arl_rw_op(struct b53_device *dev, unsigned int op)
return b53_arl_op_wait(dev);
}
-static int b53_arl_read(struct b53_device *dev, u64 mac,
+static int b53_arl_read(struct b53_device *dev, const u8 *mac,
u16 vid, struct b53_arl_entry *ent, u8 *idx)
{
DECLARE_BITMAP(free_bins, B53_ARLTBL_MAX_BIN_ENTRIES);
@@ -1854,14 +1854,13 @@ static int b53_arl_read(struct b53_device *dev, u64 mac,
B53_ARLTBL_DATA_ENTRY(i), &fwd_entry);
b53_arl_to_entry(ent, mac_vid, fwd_entry);
- if (!(fwd_entry & ARLTBL_VALID)) {
+ if (!ent->is_valid) {
set_bit(i, free_bins);
continue;
}
- if ((mac_vid & ARLTBL_MAC_MASK) != mac)
+ if (!ether_addr_equal(ent->mac, mac))
continue;
- if (dev->vlan_enabled &&
- ((mac_vid >> ARLTBL_VID_S) & ARLTBL_VID_MASK) != vid)
+ if (dev->vlan_enabled && ent->vid != vid)
continue;
*idx = i;
return 0;
@@ -1871,7 +1870,7 @@ static int b53_arl_read(struct b53_device *dev, u64 mac,
return *idx >= dev->num_arl_bins ? -ENOSPC : -ENOENT;
}
-static int b53_arl_read_25(struct b53_device *dev, u64 mac,
+static int b53_arl_read_25(struct b53_device *dev, const u8 *mac,
u16 vid, struct b53_arl_entry *ent, u8 *idx)
{
DECLARE_BITMAP(free_bins, B53_ARLTBL_MAX_BIN_ENTRIES);
@@ -1893,14 +1892,13 @@ static int b53_arl_read_25(struct b53_device *dev, u64 mac,
b53_arl_to_entry_25(ent, mac_vid);
- if (!(mac_vid & ARLTBL_VALID_25)) {
+ if (!ent->is_valid) {
set_bit(i, free_bins);
continue;
}
- if ((mac_vid & ARLTBL_MAC_MASK) != mac)
+ if (!ether_addr_equal(ent->mac, mac))
continue;
- if (dev->vlan_enabled &&
- ((mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25) != vid)
+ if (dev->vlan_enabled && ent->vid != vid)
continue;
*idx = i;
return 0;
@@ -1937,9 +1935,9 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
return ret;
if (is5325(dev) || is5365(dev))
- ret = b53_arl_read_25(dev, mac, vid, &ent, &idx);
+ ret = b53_arl_read_25(dev, addr, vid, &ent, &idx);
else
- ret = b53_arl_read(dev, mac, vid, &ent, &idx);
+ ret = b53_arl_read(dev, addr, vid, &ent, &idx);
/* If this is a read, just finish now */
if (op)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 509/614] net: dsa: b53: move reading ARL entries into their own function
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 508/614] net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 510/614] net: dsa: b53: move writing ARL entries into their own functions Greg Kroah-Hartman
` (118 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 4a291fe7226736a465ddb3fa93c21fcef7162ec7 ]
Instead of duplicating the whole code iterating over all bins for
BCM5325, factor out reading and parsing the entry into its own
functions, and name it the modern one after the first chip with that ARL
format, (BCM53)95.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-3-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 69 +++++++++++---------------------
1 file changed, 23 insertions(+), 46 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 4d8de90fb4ab8..41dcd2d03230d 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1830,48 +1830,30 @@ static int b53_arl_rw_op(struct b53_device *dev, unsigned int op)
return b53_arl_op_wait(dev);
}
-static int b53_arl_read(struct b53_device *dev, const u8 *mac,
- u16 vid, struct b53_arl_entry *ent, u8 *idx)
+static void b53_arl_read_entry_25(struct b53_device *dev,
+ struct b53_arl_entry *ent, u8 idx)
{
- DECLARE_BITMAP(free_bins, B53_ARLTBL_MAX_BIN_ENTRIES);
- unsigned int i;
- int ret;
-
- ret = b53_arl_op_wait(dev);
- if (ret)
- return ret;
-
- bitmap_zero(free_bins, dev->num_arl_bins);
-
- /* Read the bins */
- for (i = 0; i < dev->num_arl_bins; i++) {
- u64 mac_vid;
- u32 fwd_entry;
+ u64 mac_vid;
- b53_read64(dev, B53_ARLIO_PAGE,
- B53_ARLTBL_MAC_VID_ENTRY(i), &mac_vid);
- b53_read32(dev, B53_ARLIO_PAGE,
- B53_ARLTBL_DATA_ENTRY(i), &fwd_entry);
- b53_arl_to_entry(ent, mac_vid, fwd_entry);
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
+ &mac_vid);
+ b53_arl_to_entry_25(ent, mac_vid);
+}
- if (!ent->is_valid) {
- set_bit(i, free_bins);
- continue;
- }
- if (!ether_addr_equal(ent->mac, mac))
- continue;
- if (dev->vlan_enabled && ent->vid != vid)
- continue;
- *idx = i;
- return 0;
- }
+static void b53_arl_read_entry_95(struct b53_device *dev,
+ struct b53_arl_entry *ent, u8 idx)
+{
+ u32 fwd_entry;
+ u64 mac_vid;
- *idx = find_first_bit(free_bins, dev->num_arl_bins);
- return *idx >= dev->num_arl_bins ? -ENOSPC : -ENOENT;
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
+ &mac_vid);
+ b53_read32(dev, B53_ARLIO_PAGE, B53_ARLTBL_DATA_ENTRY(idx), &fwd_entry);
+ b53_arl_to_entry(ent, mac_vid, fwd_entry);
}
-static int b53_arl_read_25(struct b53_device *dev, const u8 *mac,
- u16 vid, struct b53_arl_entry *ent, u8 *idx)
+static int b53_arl_read(struct b53_device *dev, const u8 *mac,
+ u16 vid, struct b53_arl_entry *ent, u8 *idx)
{
DECLARE_BITMAP(free_bins, B53_ARLTBL_MAX_BIN_ENTRIES);
unsigned int i;
@@ -1885,12 +1867,10 @@ static int b53_arl_read_25(struct b53_device *dev, const u8 *mac,
/* Read the bins */
for (i = 0; i < dev->num_arl_bins; i++) {
- u64 mac_vid;
-
- b53_read64(dev, B53_ARLIO_PAGE,
- B53_ARLTBL_MAC_VID_ENTRY(i), &mac_vid);
-
- b53_arl_to_entry_25(ent, mac_vid);
+ if (is5325(dev) || is5365(dev))
+ b53_arl_read_entry_25(dev, ent, i);
+ else
+ b53_arl_read_entry_95(dev, ent, i);
if (!ent->is_valid) {
set_bit(i, free_bins);
@@ -1934,10 +1914,7 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
if (ret)
return ret;
- if (is5325(dev) || is5365(dev))
- ret = b53_arl_read_25(dev, addr, vid, &ent, &idx);
- else
- ret = b53_arl_read(dev, addr, vid, &ent, &idx);
+ ret = b53_arl_read(dev, addr, vid, &ent, &idx);
/* If this is a read, just finish now */
if (op)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 510/614] net: dsa: b53: move writing ARL entries into their own functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 509/614] net: dsa: b53: move reading ARL entries into their own function Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 511/614] net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL Greg Kroah-Hartman
` (117 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit bf6e9d2ae1dbafee53ec4ccd126595172e1e5278 ]
Move writing ARL entries into individual functions for each format.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-4-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 38 ++++++++++++++++++++++----------
1 file changed, 26 insertions(+), 12 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 41dcd2d03230d..4c418e0531f73 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1840,6 +1840,16 @@ static void b53_arl_read_entry_25(struct b53_device *dev,
b53_arl_to_entry_25(ent, mac_vid);
}
+static void b53_arl_write_entry_25(struct b53_device *dev,
+ const struct b53_arl_entry *ent, u8 idx)
+{
+ u64 mac_vid;
+
+ b53_arl_from_entry_25(&mac_vid, ent);
+ b53_write64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
+ mac_vid);
+}
+
static void b53_arl_read_entry_95(struct b53_device *dev,
struct b53_arl_entry *ent, u8 idx)
{
@@ -1852,6 +1862,19 @@ static void b53_arl_read_entry_95(struct b53_device *dev,
b53_arl_to_entry(ent, mac_vid, fwd_entry);
}
+static void b53_arl_write_entry_95(struct b53_device *dev,
+ const struct b53_arl_entry *ent, u8 idx)
+{
+ u32 fwd_entry;
+ u64 mac_vid;
+
+ b53_arl_from_entry(&mac_vid, &fwd_entry, ent);
+ b53_write64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
+ mac_vid);
+ b53_write32(dev, B53_ARLIO_PAGE, B53_ARLTBL_DATA_ENTRY(idx),
+ fwd_entry);
+}
+
static int b53_arl_read(struct b53_device *dev, const u8 *mac,
u16 vid, struct b53_arl_entry *ent, u8 *idx)
{
@@ -1892,9 +1915,8 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
const unsigned char *addr, u16 vid, bool is_valid)
{
struct b53_arl_entry ent;
- u32 fwd_entry;
- u64 mac, mac_vid = 0;
u8 idx = 0;
+ u64 mac;
int ret;
/* Convert the array into a 64-bit MAC */
@@ -1931,7 +1953,6 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
/* We could not find a matching MAC, so reset to a new entry */
dev_dbg(dev->dev, "{%pM,%.4d} not found, using idx: %d\n",
addr, vid, idx);
- fwd_entry = 0;
break;
default:
dev_dbg(dev->dev, "{%pM,%.4d} found, using idx: %d\n",
@@ -1959,16 +1980,9 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
ent.is_age = false;
memcpy(ent.mac, addr, ETH_ALEN);
if (is5325(dev) || is5365(dev))
- b53_arl_from_entry_25(&mac_vid, &ent);
+ b53_arl_write_entry_25(dev, &ent, idx);
else
- b53_arl_from_entry(&mac_vid, &fwd_entry, &ent);
-
- b53_write64(dev, B53_ARLIO_PAGE,
- B53_ARLTBL_MAC_VID_ENTRY(idx), mac_vid);
-
- if (!is5325(dev) && !is5365(dev))
- b53_write32(dev, B53_ARLIO_PAGE,
- B53_ARLTBL_DATA_ENTRY(idx), fwd_entry);
+ b53_arl_write_entry_95(dev, &ent, idx);
return b53_arl_rw_op(dev, 0);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 511/614] net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 510/614] net: dsa: b53: move writing ARL entries into their own functions Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 512/614] net: dsa: b53: split reading search entry into their own functions Greg Kroah-Hartman
` (116 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 1716be6db04af53bac9b869f01156a460595cf41 ]
In order to more easily support more formats, move accessing
ARL_SRCH_CTL into helper functions to contain the differences.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-5-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 37 +++++++++++++++++++++-----------
1 file changed, 24 insertions(+), 13 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 4c418e0531f73..38e6fa05042ca 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2017,18 +2017,37 @@ int b53_fdb_del(struct dsa_switch *ds, int port,
}
EXPORT_SYMBOL(b53_fdb_del);
-static int b53_arl_search_wait(struct b53_device *dev)
+static void b53_read_arl_srch_ctl(struct b53_device *dev, u8 *val)
{
- unsigned int timeout = 1000;
- u8 reg, offset;
+ u8 offset;
+
+ if (is5325(dev) || is5365(dev))
+ offset = B53_ARL_SRCH_CTL_25;
+ else
+ offset = B53_ARL_SRCH_CTL;
+
+ b53_read8(dev, B53_ARLIO_PAGE, offset, val);
+}
+
+static void b53_write_arl_srch_ctl(struct b53_device *dev, u8 val)
+{
+ u8 offset;
if (is5325(dev) || is5365(dev))
offset = B53_ARL_SRCH_CTL_25;
else
offset = B53_ARL_SRCH_CTL;
+ b53_write8(dev, B53_ARLIO_PAGE, offset, val);
+}
+
+static int b53_arl_search_wait(struct b53_device *dev)
+{
+ unsigned int timeout = 1000;
+ u8 reg;
+
do {
- b53_read8(dev, B53_ARLIO_PAGE, offset, ®);
+ b53_read_arl_srch_ctl(dev, ®);
if (!(reg & ARL_SRCH_STDN))
return -ENOENT;
@@ -2083,23 +2102,15 @@ int b53_fdb_dump(struct dsa_switch *ds, int port,
unsigned int count = 0, results_per_hit = 1;
struct b53_device *priv = ds->priv;
struct b53_arl_entry results[2];
- u8 offset;
int ret;
- u8 reg;
if (priv->num_arl_bins > 2)
results_per_hit = 2;
mutex_lock(&priv->arl_mutex);
- if (is5325(priv) || is5365(priv))
- offset = B53_ARL_SRCH_CTL_25;
- else
- offset = B53_ARL_SRCH_CTL;
-
/* Start search operation */
- reg = ARL_SRCH_STDN;
- b53_write8(priv, B53_ARLIO_PAGE, offset, reg);
+ b53_write_arl_srch_ctl(priv, ARL_SRCH_STDN);
do {
ret = b53_arl_search_wait(priv);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 512/614] net: dsa: b53: split reading search entry into their own functions
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 511/614] net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 513/614] net: dsa: b53: move ARL entry functions into ops struct Greg Kroah-Hartman
` (115 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit e0c476f325a8c9b961a3d446c24d3c8ecae7d186 ]
Split reading search entries into a function for each format.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-6-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 56 ++++++++++++++++++++++----------
1 file changed, 38 insertions(+), 18 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 38e6fa05042ca..190eb11644917 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2060,28 +2060,48 @@ static int b53_arl_search_wait(struct b53_device *dev)
return -ETIMEDOUT;
}
-static void b53_arl_search_rd(struct b53_device *dev, u8 idx,
- struct b53_arl_entry *ent)
+static void b53_arl_search_read_25(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
{
u64 mac_vid;
- if (is5325(dev)) {
- b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_0_MACVID_25,
- &mac_vid);
- b53_arl_to_entry_25(ent, mac_vid);
- } else if (is5365(dev)) {
- b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_0_MACVID_65,
- &mac_vid);
- b53_arl_to_entry_25(ent, mac_vid);
- } else {
- u32 fwd_entry;
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_0_MACVID_25,
+ &mac_vid);
+ b53_arl_to_entry_25(ent, mac_vid);
+}
- b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_MACVID(idx),
- &mac_vid);
- b53_read32(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL(idx),
- &fwd_entry);
- b53_arl_to_entry(ent, mac_vid, fwd_entry);
- }
+static void b53_arl_search_read_65(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
+{
+ u64 mac_vid;
+
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_0_MACVID_65,
+ &mac_vid);
+ b53_arl_to_entry_25(ent, mac_vid);
+}
+
+static void b53_arl_search_read_95(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
+{
+ u32 fwd_entry;
+ u64 mac_vid;
+
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_MACVID(idx),
+ &mac_vid);
+ b53_read32(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL(idx),
+ &fwd_entry);
+ b53_arl_to_entry(ent, mac_vid, fwd_entry);
+}
+
+static void b53_arl_search_rd(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
+{
+ if (is5325(dev))
+ b53_arl_search_read_25(dev, idx, ent);
+ else if (is5365(dev))
+ b53_arl_search_read_65(dev, idx, ent);
+ else
+ b53_arl_search_read_95(dev, idx, ent);
}
static int b53_fdb_copy(int port, const struct b53_arl_entry *ent,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 513/614] net: dsa: b53: move ARL entry functions into ops struct
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 512/614] net: dsa: b53: split reading search entry into their own functions Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 514/614] net: dsa: b53: add support for 5389/5397/5398 ARL entry format Greg Kroah-Hartman
` (114 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit a7e73339ad46ade76d29fb6cc7d7854222608c26 ]
Now that the differences in ARL entry formats are neatly contained into
functions per chip family, wrap them into an ops struct and add wrapper
functions to access them.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-7-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 67 ++++++++++++++++++++++----------
drivers/net/dsa/b53/b53_priv.h | 30 ++++++++++++++
2 files changed, 76 insertions(+), 21 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 190eb11644917..50ed9b7157197 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1890,10 +1890,7 @@ static int b53_arl_read(struct b53_device *dev, const u8 *mac,
/* Read the bins */
for (i = 0; i < dev->num_arl_bins; i++) {
- if (is5325(dev) || is5365(dev))
- b53_arl_read_entry_25(dev, ent, i);
- else
- b53_arl_read_entry_95(dev, ent, i);
+ b53_arl_read_entry(dev, ent, i);
if (!ent->is_valid) {
set_bit(i, free_bins);
@@ -1979,10 +1976,7 @@ static int b53_arl_op(struct b53_device *dev, int op, int port,
ent.is_static = true;
ent.is_age = false;
memcpy(ent.mac, addr, ETH_ALEN);
- if (is5325(dev) || is5365(dev))
- b53_arl_write_entry_25(dev, &ent, idx);
- else
- b53_arl_write_entry_95(dev, &ent, idx);
+ b53_arl_write_entry(dev, &ent, idx);
return b53_arl_rw_op(dev, 0);
}
@@ -2093,17 +2087,6 @@ static void b53_arl_search_read_95(struct b53_device *dev, u8 idx,
b53_arl_to_entry(ent, mac_vid, fwd_entry);
}
-static void b53_arl_search_rd(struct b53_device *dev, u8 idx,
- struct b53_arl_entry *ent)
-{
- if (is5325(dev))
- b53_arl_search_read_25(dev, idx, ent);
- else if (is5365(dev))
- b53_arl_search_read_65(dev, idx, ent);
- else
- b53_arl_search_read_95(dev, idx, ent);
-}
-
static int b53_fdb_copy(int port, const struct b53_arl_entry *ent,
dsa_fdb_dump_cb_t *cb, void *data)
{
@@ -2137,13 +2120,13 @@ int b53_fdb_dump(struct dsa_switch *ds, int port,
if (ret)
break;
- b53_arl_search_rd(priv, 0, &results[0]);
+ b53_arl_search_read(priv, 0, &results[0]);
ret = b53_fdb_copy(port, &results[0], cb, data);
if (ret)
break;
if (results_per_hit == 2) {
- b53_arl_search_rd(priv, 1, &results[1]);
+ b53_arl_search_read(priv, 1, &results[1]);
ret = b53_fdb_copy(port, &results[1], cb, data);
if (ret)
break;
@@ -2669,6 +2652,24 @@ static const struct dsa_switch_ops b53_switch_ops = {
.port_change_mtu = b53_change_mtu,
};
+static const struct b53_arl_ops b53_arl_ops_25 = {
+ .arl_read_entry = b53_arl_read_entry_25,
+ .arl_write_entry = b53_arl_write_entry_25,
+ .arl_search_read = b53_arl_search_read_25,
+};
+
+static const struct b53_arl_ops b53_arl_ops_65 = {
+ .arl_read_entry = b53_arl_read_entry_25,
+ .arl_write_entry = b53_arl_write_entry_25,
+ .arl_search_read = b53_arl_search_read_65,
+};
+
+static const struct b53_arl_ops b53_arl_ops_95 = {
+ .arl_read_entry = b53_arl_read_entry_95,
+ .arl_write_entry = b53_arl_write_entry_95,
+ .arl_search_read = b53_arl_search_read_95,
+};
+
struct b53_chip_data {
u32 chip_id;
const char *dev_name;
@@ -2682,6 +2683,7 @@ struct b53_chip_data {
u8 duplex_reg;
u8 jumbo_pm_reg;
u8 jumbo_size_reg;
+ const struct b53_arl_ops *arl_ops;
};
#define B53_VTA_REGS \
@@ -2701,6 +2703,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.arl_buckets = 1024,
.imp_port = 5,
.duplex_reg = B53_DUPLEX_STAT_FE,
+ .arl_ops = &b53_arl_ops_25,
},
{
.chip_id = BCM5365_DEVICE_ID,
@@ -2711,6 +2714,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.arl_buckets = 1024,
.imp_port = 5,
.duplex_reg = B53_DUPLEX_STAT_FE,
+ .arl_ops = &b53_arl_ops_65,
},
{
.chip_id = BCM5389_DEVICE_ID,
@@ -2724,6 +2728,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM5395_DEVICE_ID,
@@ -2737,6 +2742,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM5397_DEVICE_ID,
@@ -2750,6 +2756,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM5398_DEVICE_ID,
@@ -2763,6 +2770,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53101_DEVICE_ID,
@@ -2776,6 +2784,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53115_DEVICE_ID,
@@ -2789,6 +2798,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53125_DEVICE_ID,
@@ -2802,6 +2812,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53128_DEVICE_ID,
@@ -2815,6 +2826,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM63XX_DEVICE_ID,
@@ -2828,6 +2840,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_63XX,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK_63XX,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53010_DEVICE_ID,
@@ -2841,6 +2854,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53011_DEVICE_ID,
@@ -2854,6 +2868,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53012_DEVICE_ID,
@@ -2867,6 +2882,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53018_DEVICE_ID,
@@ -2880,6 +2896,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53019_DEVICE_ID,
@@ -2893,6 +2910,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM58XX_DEVICE_ID,
@@ -2906,6 +2924,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM583XX_DEVICE_ID,
@@ -2919,6 +2938,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
/* Starfighter 2 */
{
@@ -2933,6 +2953,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM7445_DEVICE_ID,
@@ -2946,6 +2967,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM7278_DEVICE_ID,
@@ -2959,6 +2981,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
{
.chip_id = BCM53134_DEVICE_ID,
@@ -2973,6 +2996,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+ .arl_ops = &b53_arl_ops_95,
},
};
@@ -3001,6 +3025,7 @@ static int b53_switch_init(struct b53_device *dev)
dev->num_vlans = chip->vlans;
dev->num_arl_bins = chip->arl_bins;
dev->num_arl_buckets = chip->arl_buckets;
+ dev->arl_ops = chip->arl_ops;
break;
}
}
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 2f44b3b6a0d9f..c6e2d5e41c758 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -58,6 +58,17 @@ struct b53_io_ops {
bool link_up);
};
+struct b53_arl_entry;
+
+struct b53_arl_ops {
+ void (*arl_read_entry)(struct b53_device *dev,
+ struct b53_arl_entry *ent, u8 idx);
+ void (*arl_write_entry)(struct b53_device *dev,
+ const struct b53_arl_entry *ent, u8 idx);
+ void (*arl_search_read)(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent);
+};
+
#define B53_INVALID_LANE 0xff
enum {
@@ -127,6 +138,7 @@ struct b53_device {
struct mutex stats_mutex;
struct mutex arl_mutex;
const struct b53_io_ops *ops;
+ const struct b53_arl_ops *arl_ops;
/* chip specific data */
u32 chip_id;
@@ -371,6 +383,24 @@ static inline void b53_arl_from_entry_25(u64 *mac_vid,
*mac_vid |= ARLTBL_AGE_25;
}
+static inline void b53_arl_read_entry(struct b53_device *dev,
+ struct b53_arl_entry *ent, u8 idx)
+{
+ dev->arl_ops->arl_read_entry(dev, ent, idx);
+}
+
+static inline void b53_arl_write_entry(struct b53_device *dev,
+ const struct b53_arl_entry *ent, u8 idx)
+{
+ dev->arl_ops->arl_write_entry(dev, ent, idx);
+}
+
+static inline void b53_arl_search_read(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
+{
+ dev->arl_ops->arl_search_read(dev, idx, ent);
+}
+
#ifdef CONFIG_BCM47XX
#include <linux/bcm47xx_nvram.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 514/614] net: dsa: b53: add support for 5389/5397/5398 ARL entry format
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 513/614] net: dsa: b53: move ARL entry functions into ops struct Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 515/614] net: dsa: b53: use same ARL search result offset for BCM5325/65 Greg Kroah-Hartman
` (113 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 300f78e8b6b7be17c2c78afeded75be68acb1aa7 ]
BCM5389, BCM5397 and BCM5398 use a different ARL entry format with just
a 16 bit fwdentry register, as well as different search control and data
offsets.
So add appropriate ops for them and switch those chips to use them.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-8-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 8e46aacea426 ("net: dsa: b53: use same ARL search result offset for BCM5325/65")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 53 ++++++++++++++++++++++++++++++--
drivers/net/dsa/b53/b53_priv.h | 26 ++++++++++++++++
drivers/net/dsa/b53/b53_regs.h | 13 ++++++++
3 files changed, 89 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 50ed9b7157197..dedbd53412871 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1850,6 +1850,31 @@ static void b53_arl_write_entry_25(struct b53_device *dev,
mac_vid);
}
+static void b53_arl_read_entry_89(struct b53_device *dev,
+ struct b53_arl_entry *ent, u8 idx)
+{
+ u64 mac_vid;
+ u16 fwd_entry;
+
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
+ &mac_vid);
+ b53_read16(dev, B53_ARLIO_PAGE, B53_ARLTBL_DATA_ENTRY(idx), &fwd_entry);
+ b53_arl_to_entry_89(ent, mac_vid, fwd_entry);
+}
+
+static void b53_arl_write_entry_89(struct b53_device *dev,
+ const struct b53_arl_entry *ent, u8 idx)
+{
+ u32 fwd_entry;
+ u64 mac_vid;
+
+ b53_arl_from_entry_89(&mac_vid, &fwd_entry, ent);
+ b53_write64(dev, B53_ARLIO_PAGE,
+ B53_ARLTBL_MAC_VID_ENTRY(idx), mac_vid);
+ b53_write16(dev, B53_ARLIO_PAGE,
+ B53_ARLTBL_DATA_ENTRY(idx), fwd_entry);
+}
+
static void b53_arl_read_entry_95(struct b53_device *dev,
struct b53_arl_entry *ent, u8 idx)
{
@@ -2017,6 +2042,8 @@ static void b53_read_arl_srch_ctl(struct b53_device *dev, u8 *val)
if (is5325(dev) || is5365(dev))
offset = B53_ARL_SRCH_CTL_25;
+ else if (dev->chip_id == BCM5389_DEVICE_ID || is5397_98(dev))
+ offset = B53_ARL_SRCH_CTL_89;
else
offset = B53_ARL_SRCH_CTL;
@@ -2029,6 +2056,8 @@ static void b53_write_arl_srch_ctl(struct b53_device *dev, u8 val)
if (is5325(dev) || is5365(dev))
offset = B53_ARL_SRCH_CTL_25;
+ else if (dev->chip_id == BCM5389_DEVICE_ID || is5397_98(dev))
+ offset = B53_ARL_SRCH_CTL_89;
else
offset = B53_ARL_SRCH_CTL;
@@ -2074,6 +2103,18 @@ static void b53_arl_search_read_65(struct b53_device *dev, u8 idx,
b53_arl_to_entry_25(ent, mac_vid);
}
+static void b53_arl_search_read_89(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
+{
+ u16 fwd_entry;
+ u64 mac_vid;
+
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSLT_MACVID_89,
+ &mac_vid);
+ b53_read16(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSLT_89, &fwd_entry);
+ b53_arl_to_entry_89(ent, mac_vid, fwd_entry);
+}
+
static void b53_arl_search_read_95(struct b53_device *dev, u8 idx,
struct b53_arl_entry *ent)
{
@@ -2664,6 +2705,12 @@ static const struct b53_arl_ops b53_arl_ops_65 = {
.arl_search_read = b53_arl_search_read_65,
};
+static const struct b53_arl_ops b53_arl_ops_89 = {
+ .arl_read_entry = b53_arl_read_entry_89,
+ .arl_write_entry = b53_arl_write_entry_89,
+ .arl_search_read = b53_arl_search_read_89,
+};
+
static const struct b53_arl_ops b53_arl_ops_95 = {
.arl_read_entry = b53_arl_read_entry_95,
.arl_write_entry = b53_arl_write_entry_95,
@@ -2728,7 +2775,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
- .arl_ops = &b53_arl_ops_95,
+ .arl_ops = &b53_arl_ops_89,
},
{
.chip_id = BCM5395_DEVICE_ID,
@@ -2756,7 +2803,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
- .arl_ops = &b53_arl_ops_95,
+ .arl_ops = &b53_arl_ops_89,
},
{
.chip_id = BCM5398_DEVICE_ID,
@@ -2770,7 +2817,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.duplex_reg = B53_DUPLEX_STAT_GE,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
- .arl_ops = &b53_arl_ops_95,
+ .arl_ops = &b53_arl_ops_89,
},
{
.chip_id = BCM53101_DEVICE_ID,
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index c6e2d5e41c758..127ce7f6b16ba 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -353,6 +353,18 @@ static inline void b53_arl_to_entry_25(struct b53_arl_entry *ent,
ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
}
+static inline void b53_arl_to_entry_89(struct b53_arl_entry *ent,
+ u64 mac_vid, u16 fwd_entry)
+{
+ memset(ent, 0, sizeof(*ent));
+ ent->port = fwd_entry & ARLTBL_DATA_PORT_ID_MASK_89;
+ ent->is_valid = !!(fwd_entry & ARLTBL_VALID_89);
+ ent->is_age = !!(fwd_entry & ARLTBL_AGE_89);
+ ent->is_static = !!(fwd_entry & ARLTBL_STATIC_89);
+ u64_to_ether_addr(mac_vid, ent->mac);
+ ent->vid = mac_vid >> ARLTBL_VID_S;
+}
+
static inline void b53_arl_from_entry(u64 *mac_vid, u32 *fwd_entry,
const struct b53_arl_entry *ent)
{
@@ -383,6 +395,20 @@ static inline void b53_arl_from_entry_25(u64 *mac_vid,
*mac_vid |= ARLTBL_AGE_25;
}
+static inline void b53_arl_from_entry_89(u64 *mac_vid, u32 *fwd_entry,
+ const struct b53_arl_entry *ent)
+{
+ *mac_vid = ether_addr_to_u64(ent->mac);
+ *mac_vid |= (u64)(ent->vid & ARLTBL_VID_MASK) << ARLTBL_VID_S;
+ *fwd_entry = ent->port & ARLTBL_DATA_PORT_ID_MASK_89;
+ if (ent->is_valid)
+ *fwd_entry |= ARLTBL_VALID_89;
+ if (ent->is_static)
+ *fwd_entry |= ARLTBL_STATIC_89;
+ if (ent->is_age)
+ *fwd_entry |= ARLTBL_AGE_89;
+}
+
static inline void b53_arl_read_entry(struct b53_device *dev,
struct b53_arl_entry *ent, u8 idx)
{
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index 8ce1ce72e9385..d9026cf865549 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -342,12 +342,20 @@
#define ARLTBL_STATIC BIT(15)
#define ARLTBL_VALID BIT(16)
+/* BCM5389 ARL Table Data Entry N Register format (16 bit) */
+#define ARLTBL_DATA_PORT_ID_MASK_89 GENMASK(8, 0)
+#define ARLTBL_TC_MASK_89 GENMASK(12, 10)
+#define ARLTBL_AGE_89 BIT(13)
+#define ARLTBL_STATIC_89 BIT(14)
+#define ARLTBL_VALID_89 BIT(15)
+
/* Maximum number of bin entries in the ARL for all switches */
#define B53_ARLTBL_MAX_BIN_ENTRIES 4
/* ARL Search Control Register (8 bit) */
#define B53_ARL_SRCH_CTL 0x50
#define B53_ARL_SRCH_CTL_25 0x20
+#define B53_ARL_SRCH_CTL_89 0x30
#define ARL_SRCH_VLID BIT(0)
#define ARL_SRCH_STDN BIT(7)
@@ -355,10 +363,12 @@
#define B53_ARL_SRCH_ADDR 0x51
#define B53_ARL_SRCH_ADDR_25 0x22
#define B53_ARL_SRCH_ADDR_65 0x24
+#define B53_ARL_SRCH_ADDR_89 0x31
#define ARL_ADDR_MASK GENMASK(14, 0)
/* ARL Search MAC/VID Result (64 bit) */
#define B53_ARL_SRCH_RSTL_0_MACVID 0x60
+#define B53_ARL_SRCH_RSLT_MACVID_89 0x33
/* Single register search result on 5325 */
#define B53_ARL_SRCH_RSTL_0_MACVID_25 0x24
@@ -368,6 +378,9 @@
/* ARL Search Data Result (32 bit) */
#define B53_ARL_SRCH_RSTL_0 0x68
+/* BCM5389 ARL Search Data Result (16 bit) */
+#define B53_ARL_SRCH_RSLT_89 0x3b
+
#define B53_ARL_SRCH_RSTL_MACVID(x) (B53_ARL_SRCH_RSTL_0_MACVID + ((x) * 0x10))
#define B53_ARL_SRCH_RSTL(x) (B53_ARL_SRCH_RSTL_0 + ((x) * 0x10))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 515/614] net: dsa: b53: use same ARL search result offset for BCM5325/65
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 514/614] net: dsa: b53: add support for 5389/5397/5398 ARL entry format Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 516/614] net: dsa: b53: fix CPU port unicast ARL entries " Greg Kroah-Hartman
` (112 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli,
Álvaro Fernández Rojas, Jonas Gorski, Jakub Kicinski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 8e46aacea4264bcb8d4265fb07577afff58ae78d ]
BCM5365's search result is at the same offset as BCM5325's search
result, and they (mostly) share the same format, so switch BCM5365 to
BCM5325's arl ops.
Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365")
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://patch.msgid.link/20251128080625.27181-4-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 18 +-----------------
drivers/net/dsa/b53/b53_regs.h | 4 +---
2 files changed, 2 insertions(+), 20 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index dedbd53412871..68e9162087ab4 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2093,16 +2093,6 @@ static void b53_arl_search_read_25(struct b53_device *dev, u8 idx,
b53_arl_to_entry_25(ent, mac_vid);
}
-static void b53_arl_search_read_65(struct b53_device *dev, u8 idx,
- struct b53_arl_entry *ent)
-{
- u64 mac_vid;
-
- b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_0_MACVID_65,
- &mac_vid);
- b53_arl_to_entry_25(ent, mac_vid);
-}
-
static void b53_arl_search_read_89(struct b53_device *dev, u8 idx,
struct b53_arl_entry *ent)
{
@@ -2699,12 +2689,6 @@ static const struct b53_arl_ops b53_arl_ops_25 = {
.arl_search_read = b53_arl_search_read_25,
};
-static const struct b53_arl_ops b53_arl_ops_65 = {
- .arl_read_entry = b53_arl_read_entry_25,
- .arl_write_entry = b53_arl_write_entry_25,
- .arl_search_read = b53_arl_search_read_65,
-};
-
static const struct b53_arl_ops b53_arl_ops_89 = {
.arl_read_entry = b53_arl_read_entry_89,
.arl_write_entry = b53_arl_write_entry_89,
@@ -2761,7 +2745,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
.arl_buckets = 1024,
.imp_port = 5,
.duplex_reg = B53_DUPLEX_STAT_FE,
- .arl_ops = &b53_arl_ops_65,
+ .arl_ops = &b53_arl_ops_25,
},
{
.chip_id = BCM5389_DEVICE_ID,
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index d9026cf865549..f2a3696d122fa 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -370,10 +370,8 @@
#define B53_ARL_SRCH_RSTL_0_MACVID 0x60
#define B53_ARL_SRCH_RSLT_MACVID_89 0x33
-/* Single register search result on 5325 */
+/* Single register search result on 5325/5365 */
#define B53_ARL_SRCH_RSTL_0_MACVID_25 0x24
-/* Single register search result on 5365 */
-#define B53_ARL_SRCH_RSTL_0_MACVID_65 0x30
/* ARL Search Data Result (32 bit) */
#define B53_ARL_SRCH_RSTL_0 0x68
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 516/614] net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 515/614] net: dsa: b53: use same ARL search result offset for BCM5325/65 Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 517/614] net: dsa: b53: add support for bcm63xx ARL entry format Greg Kroah-Hartman
` (111 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 85132103f700b1340fc17df8a981509d17bf4872 ]
On BCM5325 and BCM5365, unicast ARL entries use 8 as the value for the
CPU port, so we need to translate it to/from 5 as used for the CPU port
at most other places.
Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251128080625.27181-5-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_priv.h | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 127ce7f6b16ba..80e7dd6169b47 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -344,12 +344,14 @@ static inline void b53_arl_to_entry_25(struct b53_arl_entry *ent,
u64 mac_vid)
{
memset(ent, 0, sizeof(*ent));
- ent->port = (mac_vid >> ARLTBL_DATA_PORT_ID_S_25) &
- ARLTBL_DATA_PORT_ID_MASK_25;
ent->is_valid = !!(mac_vid & ARLTBL_VALID_25);
ent->is_age = !!(mac_vid & ARLTBL_AGE_25);
ent->is_static = !!(mac_vid & ARLTBL_STATIC_25);
u64_to_ether_addr(mac_vid, ent->mac);
+ ent->port = (mac_vid >> ARLTBL_DATA_PORT_ID_S_25) &
+ ARLTBL_DATA_PORT_ID_MASK_25;
+ if (is_unicast_ether_addr(ent->mac) && ent->port == B53_CPU_PORT)
+ ent->port = B53_CPU_PORT_25;
ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
}
@@ -383,8 +385,11 @@ static inline void b53_arl_from_entry_25(u64 *mac_vid,
const struct b53_arl_entry *ent)
{
*mac_vid = ether_addr_to_u64(ent->mac);
- *mac_vid |= (u64)(ent->port & ARLTBL_DATA_PORT_ID_MASK_25) <<
- ARLTBL_DATA_PORT_ID_S_25;
+ if (is_unicast_ether_addr(ent->mac) && ent->port == B53_CPU_PORT_25)
+ *mac_vid |= (u64)B53_CPU_PORT << ARLTBL_DATA_PORT_ID_S_25;
+ else
+ *mac_vid |= (u64)(ent->port & ARLTBL_DATA_PORT_ID_MASK_25) <<
+ ARLTBL_DATA_PORT_ID_S_25;
*mac_vid |= (u64)(ent->vid & ARLTBL_VID_MASK_25) <<
ARLTBL_VID_S_65;
if (ent->is_valid)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 517/614] net: dsa: b53: add support for bcm63xx ARL entry format
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 516/614] net: dsa: b53: fix CPU port unicast ARL entries " Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 518/614] net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks Greg Kroah-Hartman
` (110 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 2b3013ac03028a2364d8779719bb6bfbc0212435 ]
The ARL registers of BCM63XX embedded switches are somewhat unique. The
normal ARL table access registers have the same format as BCM5389, but
the ARL search registers differ:
* SRCH_CTL is at the same offset of BCM5389, but 16 bits wide. It does
not have more fields, just needs to be accessed by a 16 bit read.
* SRCH_RSLT_MACVID and SRCH_RSLT are aligned to 32 bit, and have shifted
offsets.
* SRCH_RSLT has a different format than the normal ARL data entry
register.
* There is only one set of ENTRY_N registers, implying a 1 bin layout.
So add appropriate ops for bcm63xx and let it use it.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251107080749.26936-9-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 3b08863469aa ("net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 44 +++++++++++++++++++++++++++-----
drivers/net/dsa/b53/b53_priv.h | 15 +++++++++++
drivers/net/dsa/b53/b53_regs.h | 9 +++++++
3 files changed, 61 insertions(+), 7 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 68e9162087ab4..db1ed8c9c536e 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2042,12 +2042,20 @@ static void b53_read_arl_srch_ctl(struct b53_device *dev, u8 *val)
if (is5325(dev) || is5365(dev))
offset = B53_ARL_SRCH_CTL_25;
- else if (dev->chip_id == BCM5389_DEVICE_ID || is5397_98(dev))
+ else if (dev->chip_id == BCM5389_DEVICE_ID || is5397_98(dev) ||
+ is63xx(dev))
offset = B53_ARL_SRCH_CTL_89;
else
offset = B53_ARL_SRCH_CTL;
- b53_read8(dev, B53_ARLIO_PAGE, offset, val);
+ if (is63xx(dev)) {
+ u16 val16;
+
+ b53_read16(dev, B53_ARLIO_PAGE, offset, &val16);
+ *val = val16 & 0xff;
+ } else {
+ b53_read8(dev, B53_ARLIO_PAGE, offset, val);
+ }
}
static void b53_write_arl_srch_ctl(struct b53_device *dev, u8 val)
@@ -2056,12 +2064,16 @@ static void b53_write_arl_srch_ctl(struct b53_device *dev, u8 val)
if (is5325(dev) || is5365(dev))
offset = B53_ARL_SRCH_CTL_25;
- else if (dev->chip_id == BCM5389_DEVICE_ID || is5397_98(dev))
+ else if (dev->chip_id == BCM5389_DEVICE_ID || is5397_98(dev) ||
+ is63xx(dev))
offset = B53_ARL_SRCH_CTL_89;
else
offset = B53_ARL_SRCH_CTL;
- b53_write8(dev, B53_ARLIO_PAGE, offset, val);
+ if (is63xx(dev))
+ b53_write16(dev, B53_ARLIO_PAGE, offset, val);
+ else
+ b53_write8(dev, B53_ARLIO_PAGE, offset, val);
}
static int b53_arl_search_wait(struct b53_device *dev)
@@ -2105,6 +2117,18 @@ static void b53_arl_search_read_89(struct b53_device *dev, u8 idx,
b53_arl_to_entry_89(ent, mac_vid, fwd_entry);
}
+static void b53_arl_search_read_63xx(struct b53_device *dev, u8 idx,
+ struct b53_arl_entry *ent)
+{
+ u16 fwd_entry;
+ u64 mac_vid;
+
+ b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSLT_MACVID_63XX,
+ &mac_vid);
+ b53_read16(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSLT_63XX, &fwd_entry);
+ b53_arl_search_to_entry_63xx(ent, mac_vid, fwd_entry);
+}
+
static void b53_arl_search_read_95(struct b53_device *dev, u8 idx,
struct b53_arl_entry *ent)
{
@@ -2695,6 +2719,12 @@ static const struct b53_arl_ops b53_arl_ops_89 = {
.arl_search_read = b53_arl_search_read_89,
};
+static const struct b53_arl_ops b53_arl_ops_63xx = {
+ .arl_read_entry = b53_arl_read_entry_89,
+ .arl_write_entry = b53_arl_write_entry_89,
+ .arl_search_read = b53_arl_search_read_63xx,
+};
+
static const struct b53_arl_ops b53_arl_ops_95 = {
.arl_read_entry = b53_arl_read_entry_95,
.arl_write_entry = b53_arl_write_entry_95,
@@ -2864,14 +2894,14 @@ static const struct b53_chip_data b53_switch_chips[] = {
.dev_name = "BCM63xx",
.vlans = 4096,
.enabled_ports = 0, /* pdata must provide them */
- .arl_bins = 4,
- .arl_buckets = 1024,
+ .arl_bins = 1,
+ .arl_buckets = 4096,
.imp_port = 8,
.vta_regs = B53_VTA_REGS_63XX,
.duplex_reg = B53_DUPLEX_STAT_63XX,
.jumbo_pm_reg = B53_JUMBO_PORT_MASK_63XX,
.jumbo_size_reg = B53_JUMBO_MAX_SIZE_63XX,
- .arl_ops = &b53_arl_ops_95,
+ .arl_ops = &b53_arl_ops_63xx,
},
{
.chip_id = BCM53010_DEVICE_ID,
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 80e7dd6169b47..ae2c615c088ed 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -414,6 +414,21 @@ static inline void b53_arl_from_entry_89(u64 *mac_vid, u32 *fwd_entry,
*fwd_entry |= ARLTBL_AGE_89;
}
+static inline void b53_arl_search_to_entry_63xx(struct b53_arl_entry *ent,
+ u64 mac_vid, u16 fwd_entry)
+{
+ memset(ent, 0, sizeof(*ent));
+ u64_to_ether_addr(mac_vid, ent->mac);
+ ent->vid = mac_vid >> ARLTBL_VID_S;
+
+ ent->port = fwd_entry & ARL_SRST_PORT_ID_MASK_63XX;
+ ent->port >>= 1;
+
+ ent->is_age = !!(fwd_entry & ARL_SRST_AGE_63XX);
+ ent->is_static = !!(fwd_entry & ARL_SRST_STATIC_63XX);
+ ent->is_valid = 1;
+}
+
static inline void b53_arl_read_entry(struct b53_device *dev,
struct b53_arl_entry *ent, u8 idx)
{
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index f2a3696d122fa..fcedd5fb00337 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -364,11 +364,13 @@
#define B53_ARL_SRCH_ADDR_25 0x22
#define B53_ARL_SRCH_ADDR_65 0x24
#define B53_ARL_SRCH_ADDR_89 0x31
+#define B53_ARL_SRCH_ADDR_63XX 0x32
#define ARL_ADDR_MASK GENMASK(14, 0)
/* ARL Search MAC/VID Result (64 bit) */
#define B53_ARL_SRCH_RSTL_0_MACVID 0x60
#define B53_ARL_SRCH_RSLT_MACVID_89 0x33
+#define B53_ARL_SRCH_RSLT_MACVID_63XX 0x34
/* Single register search result on 5325/5365 */
#define B53_ARL_SRCH_RSTL_0_MACVID_25 0x24
@@ -382,6 +384,13 @@
#define B53_ARL_SRCH_RSTL_MACVID(x) (B53_ARL_SRCH_RSTL_0_MACVID + ((x) * 0x10))
#define B53_ARL_SRCH_RSTL(x) (B53_ARL_SRCH_RSTL_0 + ((x) * 0x10))
+/* 63XX ARL Search Data Result (16 bit) */
+#define B53_ARL_SRCH_RSLT_63XX 0x3c
+#define ARL_SRST_PORT_ID_MASK_63XX GENMASK(9, 1)
+#define ARL_SRST_TC_MASK_63XX GENMASK(13, 11)
+#define ARL_SRST_AGE_63XX BIT(14)
+#define ARL_SRST_STATIC_63XX BIT(15)
+
/*************************************************************************
* IEEE 802.1X Registers
*************************************************************************/
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 518/614] net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 517/614] net: dsa: b53: add support for bcm63xx ARL entry format Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 519/614] net: dsa: b53: fix BCM5325/65 ARL entry VIDs Greg Kroah-Hartman
` (109 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Jonas Gorski,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 3b08863469aa6028ac7c3120966f4e2f6051cf6b ]
We currently use the mask 0xf for writing and reading b53_entry::port,
but this is only correct for unicast ARL entries. Multicast ARL entries
use a bitmask, and 0xf is not enough space for ports > 3, which includes
the CPU port.
So extend the mask accordingly to also fit port 4 (bit 4) and MII (bit
5). According to the datasheet the multicast port mask is [60:48],
making it 12 bit wide, but bits 60-55 are reserved anyway, and collide
with the priority field at [60:59], so I am not sure if this is valid.
Therefore leave it at the actual used range, [53:48].
The ARL search result register differs a bit, and there the mask is only
[52:48], so only spanning the user ports. The MII port bit is
contained in the Search Result Extension register. So create a separate
search result parse function that properly handles this.
Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365")
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://patch.msgid.link/20251128080625.27181-6-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 4 +++-
drivers/net/dsa/b53/b53_priv.h | 25 +++++++++++++++++++++----
drivers/net/dsa/b53/b53_regs.h | 8 +++++++-
3 files changed, 31 insertions(+), 6 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index db1ed8c9c536e..5544e8e9c6446 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2099,10 +2099,12 @@ static void b53_arl_search_read_25(struct b53_device *dev, u8 idx,
struct b53_arl_entry *ent)
{
u64 mac_vid;
+ u8 ext;
+ b53_read8(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSLT_EXT_25, &ext);
b53_read64(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_RSTL_0_MACVID_25,
&mac_vid);
- b53_arl_to_entry_25(ent, mac_vid);
+ b53_arl_search_to_entry_25(ent, mac_vid, ext);
}
static void b53_arl_search_read_89(struct b53_device *dev, u8 idx,
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index ae2c615c088ed..f4afbfcc345e6 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -348,8 +348,8 @@ static inline void b53_arl_to_entry_25(struct b53_arl_entry *ent,
ent->is_age = !!(mac_vid & ARLTBL_AGE_25);
ent->is_static = !!(mac_vid & ARLTBL_STATIC_25);
u64_to_ether_addr(mac_vid, ent->mac);
- ent->port = (mac_vid >> ARLTBL_DATA_PORT_ID_S_25) &
- ARLTBL_DATA_PORT_ID_MASK_25;
+ ent->port = (mac_vid & ARLTBL_DATA_PORT_ID_MASK_25) >>
+ ARLTBL_DATA_PORT_ID_S_25;
if (is_unicast_ether_addr(ent->mac) && ent->port == B53_CPU_PORT)
ent->port = B53_CPU_PORT_25;
ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
@@ -388,8 +388,8 @@ static inline void b53_arl_from_entry_25(u64 *mac_vid,
if (is_unicast_ether_addr(ent->mac) && ent->port == B53_CPU_PORT_25)
*mac_vid |= (u64)B53_CPU_PORT << ARLTBL_DATA_PORT_ID_S_25;
else
- *mac_vid |= (u64)(ent->port & ARLTBL_DATA_PORT_ID_MASK_25) <<
- ARLTBL_DATA_PORT_ID_S_25;
+ *mac_vid |= ((u64)ent->port << ARLTBL_DATA_PORT_ID_S_25) &
+ ARLTBL_DATA_PORT_ID_MASK_25;
*mac_vid |= (u64)(ent->vid & ARLTBL_VID_MASK_25) <<
ARLTBL_VID_S_65;
if (ent->is_valid)
@@ -414,6 +414,23 @@ static inline void b53_arl_from_entry_89(u64 *mac_vid, u32 *fwd_entry,
*fwd_entry |= ARLTBL_AGE_89;
}
+static inline void b53_arl_search_to_entry_25(struct b53_arl_entry *ent,
+ u64 mac_vid, u8 ext)
+{
+ memset(ent, 0, sizeof(*ent));
+ ent->is_valid = !!(mac_vid & ARLTBL_VALID_25);
+ ent->is_age = !!(mac_vid & ARLTBL_AGE_25);
+ ent->is_static = !!(mac_vid & ARLTBL_STATIC_25);
+ u64_to_ether_addr(mac_vid, ent->mac);
+ ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
+ ent->port = (mac_vid & ARL_SRCH_RSLT_PORT_ID_MASK_25) >>
+ ARL_SRCH_RSLT_PORT_ID_S_25;
+ if (is_multicast_ether_addr(ent->mac) && (ext & ARL_SRCH_RSLT_EXT_MC_MII))
+ ent->port |= BIT(B53_CPU_PORT_25);
+ else if (!is_multicast_ether_addr(ent->mac) && ent->port == B53_CPU_PORT)
+ ent->port = B53_CPU_PORT_25;
+}
+
static inline void b53_arl_search_to_entry_63xx(struct b53_arl_entry *ent,
u64 mac_vid, u16 fwd_entry)
{
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index fcedd5fb00337..e0379e70900b7 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -328,7 +328,7 @@
#define ARLTBL_VID_MASK_25 0xff
#define ARLTBL_VID_MASK 0xfff
#define ARLTBL_DATA_PORT_ID_S_25 48
-#define ARLTBL_DATA_PORT_ID_MASK_25 0xf
+#define ARLTBL_DATA_PORT_ID_MASK_25 GENMASK_ULL(53, 48)
#define ARLTBL_VID_S_65 53
#define ARLTBL_AGE_25 BIT_ULL(61)
#define ARLTBL_STATIC_25 BIT_ULL(62)
@@ -374,6 +374,12 @@
/* Single register search result on 5325/5365 */
#define B53_ARL_SRCH_RSTL_0_MACVID_25 0x24
+#define ARL_SRCH_RSLT_PORT_ID_S_25 48
+#define ARL_SRCH_RSLT_PORT_ID_MASK_25 GENMASK_ULL(52, 48)
+
+/* BCM5325/5365 Search result extend register (8 bit) */
+#define B53_ARL_SRCH_RSLT_EXT_25 0x2c
+#define ARL_SRCH_RSLT_EXT_MC_MII BIT(2)
/* ARL Search Data Result (32 bit) */
#define B53_ARL_SRCH_RSTL_0 0x68
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 519/614] net: dsa: b53: fix BCM5325/65 ARL entry VIDs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 518/614] net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 520/614] net: hsr: create an API to get hsr port type Greg Kroah-Hartman
` (108 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit d39514e6a2d14f57830d649e2bf03b49612c2f73 ]
BCM5325/65's ARL entry registers do not contain the VID, only the search
result register does. ARL entries have a separate VID entry register for
the index into the VLAN table.
So make ARL entry accessors use the VID entry registers instead, and
move the VLAN ID field definition to the search register definition.
Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251128080625.27181-7-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 9 +++++++--
drivers/net/dsa/b53/b53_priv.h | 12 ++++++------
drivers/net/dsa/b53/b53_regs.h | 7 +++++--
3 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 5544e8e9c6446..62cafced758e7 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1833,19 +1833,24 @@ static int b53_arl_rw_op(struct b53_device *dev, unsigned int op)
static void b53_arl_read_entry_25(struct b53_device *dev,
struct b53_arl_entry *ent, u8 idx)
{
+ u8 vid_entry;
u64 mac_vid;
+ b53_read8(dev, B53_ARLIO_PAGE, B53_ARLTBL_VID_ENTRY_25(idx),
+ &vid_entry);
b53_read64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
&mac_vid);
- b53_arl_to_entry_25(ent, mac_vid);
+ b53_arl_to_entry_25(ent, mac_vid, vid_entry);
}
static void b53_arl_write_entry_25(struct b53_device *dev,
const struct b53_arl_entry *ent, u8 idx)
{
+ u8 vid_entry;
u64 mac_vid;
- b53_arl_from_entry_25(&mac_vid, ent);
+ b53_arl_from_entry_25(&mac_vid, &vid_entry, ent);
+ b53_write8(dev, B53_ARLIO_PAGE, B53_ARLTBL_VID_ENTRY_25(idx), vid_entry);
b53_write64(dev, B53_ARLIO_PAGE, B53_ARLTBL_MAC_VID_ENTRY(idx),
mac_vid);
}
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index f4afbfcc345e6..bd6849e5bb939 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -341,7 +341,7 @@ static inline void b53_arl_to_entry(struct b53_arl_entry *ent,
}
static inline void b53_arl_to_entry_25(struct b53_arl_entry *ent,
- u64 mac_vid)
+ u64 mac_vid, u8 vid_entry)
{
memset(ent, 0, sizeof(*ent));
ent->is_valid = !!(mac_vid & ARLTBL_VALID_25);
@@ -352,7 +352,7 @@ static inline void b53_arl_to_entry_25(struct b53_arl_entry *ent,
ARLTBL_DATA_PORT_ID_S_25;
if (is_unicast_ether_addr(ent->mac) && ent->port == B53_CPU_PORT)
ent->port = B53_CPU_PORT_25;
- ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
+ ent->vid = vid_entry;
}
static inline void b53_arl_to_entry_89(struct b53_arl_entry *ent,
@@ -381,7 +381,7 @@ static inline void b53_arl_from_entry(u64 *mac_vid, u32 *fwd_entry,
*fwd_entry |= ARLTBL_AGE;
}
-static inline void b53_arl_from_entry_25(u64 *mac_vid,
+static inline void b53_arl_from_entry_25(u64 *mac_vid, u8 *vid_entry,
const struct b53_arl_entry *ent)
{
*mac_vid = ether_addr_to_u64(ent->mac);
@@ -390,14 +390,13 @@ static inline void b53_arl_from_entry_25(u64 *mac_vid,
else
*mac_vid |= ((u64)ent->port << ARLTBL_DATA_PORT_ID_S_25) &
ARLTBL_DATA_PORT_ID_MASK_25;
- *mac_vid |= (u64)(ent->vid & ARLTBL_VID_MASK_25) <<
- ARLTBL_VID_S_65;
if (ent->is_valid)
*mac_vid |= ARLTBL_VALID_25;
if (ent->is_static)
*mac_vid |= ARLTBL_STATIC_25;
if (ent->is_age)
*mac_vid |= ARLTBL_AGE_25;
+ *vid_entry = ent->vid;
}
static inline void b53_arl_from_entry_89(u64 *mac_vid, u32 *fwd_entry,
@@ -422,7 +421,8 @@ static inline void b53_arl_search_to_entry_25(struct b53_arl_entry *ent,
ent->is_age = !!(mac_vid & ARLTBL_AGE_25);
ent->is_static = !!(mac_vid & ARLTBL_STATIC_25);
u64_to_ether_addr(mac_vid, ent->mac);
- ent->vid = (mac_vid >> ARLTBL_VID_S_65) & ARLTBL_VID_MASK_25;
+ ent->vid = (mac_vid & ARL_SRCH_RSLT_VID_MASK_25) >>
+ ARL_SRCH_RSLT_VID_S_25;
ent->port = (mac_vid & ARL_SRCH_RSLT_PORT_ID_MASK_25) >>
ARL_SRCH_RSLT_PORT_ID_S_25;
if (is_multicast_ether_addr(ent->mac) && (ext & ARL_SRCH_RSLT_EXT_MC_MII))
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index e0379e70900b7..b6fe7d207a2c1 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -325,11 +325,9 @@
#define B53_ARLTBL_MAC_VID_ENTRY(n) ((0x10 * (n)) + 0x10)
#define ARLTBL_MAC_MASK 0xffffffffffffULL
#define ARLTBL_VID_S 48
-#define ARLTBL_VID_MASK_25 0xff
#define ARLTBL_VID_MASK 0xfff
#define ARLTBL_DATA_PORT_ID_S_25 48
#define ARLTBL_DATA_PORT_ID_MASK_25 GENMASK_ULL(53, 48)
-#define ARLTBL_VID_S_65 53
#define ARLTBL_AGE_25 BIT_ULL(61)
#define ARLTBL_STATIC_25 BIT_ULL(62)
#define ARLTBL_VALID_25 BIT_ULL(63)
@@ -349,6 +347,9 @@
#define ARLTBL_STATIC_89 BIT(14)
#define ARLTBL_VALID_89 BIT(15)
+/* BCM5325/BCM565 ARL Table VID Entry N Registers (8 bit) */
+#define B53_ARLTBL_VID_ENTRY_25(n) ((0x2 * (n)) + 0x30)
+
/* Maximum number of bin entries in the ARL for all switches */
#define B53_ARLTBL_MAX_BIN_ENTRIES 4
@@ -376,6 +377,8 @@
#define B53_ARL_SRCH_RSTL_0_MACVID_25 0x24
#define ARL_SRCH_RSLT_PORT_ID_S_25 48
#define ARL_SRCH_RSLT_PORT_ID_MASK_25 GENMASK_ULL(52, 48)
+#define ARL_SRCH_RSLT_VID_S_25 53
+#define ARL_SRCH_RSLT_VID_MASK_25 GENMASK_ULL(60, 53)
/* BCM5325/5365 Search result extend register (8 bit) */
#define B53_ARL_SRCH_RSLT_EXT_25 0x2c
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 520/614] net: hsr: create an API to get hsr port type
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 519/614] net: dsa: b53: fix BCM5325/65 ARL entry VIDs Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 521/614] net: dsa: xrs700x: reject unsupported HSR configurations Greg Kroah-Hartman
` (107 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Lukasz Majewski, Xiaoliang Yang, Vladimir Oltean,
Łukasz Majewski, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
[ Upstream commit a0244e76213980f3b9bb5d40b0b6705fcf24230d ]
Since the introduction of HSR_PT_INTERLINK in commit 5055cccfc2d1 ("net:
hsr: Provide RedBox support (HSR-SAN)"), we see that different port
types require different settings for hardware offload, which was not the
case before when we only had HSR_PT_SLAVE_A and HSR_PT_SLAVE_B. But
there is currently no way to know which port is which type, so create
the hsr_get_port_type() API function and export it.
When hsr_get_port_type() is called from the device driver, the port can
must be found in the HSR port list. An important use case is for this
function to work from offloading drivers' NETDEV_CHANGEUPPER handler,
which is triggered by hsr_portdev_setup() -> netdev_master_upper_dev_link().
Therefore, we need to move the addition of the hsr_port to the HSR port
list prior to calling hsr_portdev_setup(). This makes the error
restoration path also more similar to hsr_del_port(), where
kfree_rcu(port) is already used.
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Lukasz Majewski <lukma@denx.de>
Signed-off-by: Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Łukasz Majewski <lukma@nabladev.com>
Link: https://patch.msgid.link/20251130131657.65080-3-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 30296ac76426 ("net: dsa: xrs700x: reject unsupported HSR configurations")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/if_hsr.h | 9 +++++++++
net/hsr/hsr_device.c | 20 ++++++++++++++++++++
net/hsr/hsr_slave.c | 7 ++++---
3 files changed, 33 insertions(+), 3 deletions(-)
diff --git a/include/linux/if_hsr.h b/include/linux/if_hsr.h
index d7941fd880329..f4cf2dd36d193 100644
--- a/include/linux/if_hsr.h
+++ b/include/linux/if_hsr.h
@@ -43,6 +43,8 @@ extern bool is_hsr_master(struct net_device *dev);
extern int hsr_get_version(struct net_device *dev, enum hsr_version *ver);
struct net_device *hsr_get_port_ndev(struct net_device *ndev,
enum hsr_port_type pt);
+int hsr_get_port_type(struct net_device *hsr_dev, struct net_device *dev,
+ enum hsr_port_type *type);
#else
static inline bool is_hsr_master(struct net_device *dev)
{
@@ -59,6 +61,13 @@ static inline struct net_device *hsr_get_port_ndev(struct net_device *ndev,
{
return ERR_PTR(-EINVAL);
}
+
+static inline int hsr_get_port_type(struct net_device *hsr_dev,
+ struct net_device *dev,
+ enum hsr_port_type *type)
+{
+ return -EINVAL;
+}
#endif /* CONFIG_HSR */
#endif /*_LINUX_IF_HSR_H_*/
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 492cbc78ab75a..d1bfc49b5f017 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -690,6 +690,26 @@ struct net_device *hsr_get_port_ndev(struct net_device *ndev,
}
EXPORT_SYMBOL(hsr_get_port_ndev);
+int hsr_get_port_type(struct net_device *hsr_dev, struct net_device *dev,
+ enum hsr_port_type *type)
+{
+ struct hsr_priv *hsr = netdev_priv(hsr_dev);
+ struct hsr_port *port;
+
+ rcu_read_lock();
+ hsr_for_each_port(hsr, port) {
+ if (port->dev == dev) {
+ *type = port->type;
+ rcu_read_unlock();
+ return 0;
+ }
+ }
+ rcu_read_unlock();
+
+ return -EINVAL;
+}
+EXPORT_SYMBOL(hsr_get_port_type);
+
/* Default multicast address for HSR Supervision frames */
static const unsigned char def_multicast_addr[ETH_ALEN] __aligned(2) = {
0x01, 0x15, 0x4e, 0x00, 0x01, 0x00
diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
index 8177ac6c2d26d..afe06ba00ea44 100644
--- a/net/hsr/hsr_slave.c
+++ b/net/hsr/hsr_slave.c
@@ -207,14 +207,14 @@ int hsr_add_port(struct hsr_priv *hsr, struct net_device *dev,
port->type = type;
ether_addr_copy(port->original_macaddress, dev->dev_addr);
+ list_add_tail_rcu(&port->port_list, &hsr->ports);
+
if (type != HSR_PT_MASTER) {
res = hsr_portdev_setup(hsr, dev, port, extack);
if (res)
goto fail_dev_setup;
}
- list_add_tail_rcu(&port->port_list, &hsr->ports);
-
master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
netdev_update_features(master->dev);
dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
@@ -222,7 +222,8 @@ int hsr_add_port(struct hsr_priv *hsr, struct net_device *dev,
return 0;
fail_dev_setup:
- kfree(port);
+ list_del_rcu(&port->port_list);
+ kfree_rcu(port, rcu);
return res;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 521/614] net: dsa: xrs700x: reject unsupported HSR configurations
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 520/614] net: hsr: create an API to get hsr port type Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 522/614] net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Greg Kroah-Hartman
` (106 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Majewski, Vladimir Oltean,
George McCollister, Jakub Kicinski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 30296ac7642652428396222e720718f2661e9425 ]
As discussed here:
https://lore.kernel.org/netdev/20240620090210.drop6jwh7e5qw556@skbuf/
the fact is that the xrs700x.c driver only supports offloading
HSR_PT_SLAVE_A and HSR_PT_SLAVE_B (which were the only port types at the
time the offload was written, _for this driver_).
Up until now, the API did not explicitly tell offloading drivers what
port has what role. So xrs700x can get confused and think that it can
support a configuration which it actually can't. There was a table in
the attached link which gave an example:
$ ip link add name hsr0 type hsr slave1 swp0 slave2 swp1 \
interlink swp2 supervision 45 version 1
HSR_PT_SLAVE_A HSR_PT_SLAVE_B HSR_PT_INTERLINK
----------------------------------------------------------------
user
space 0 1 2
requests
----------------------------------------------------------------
XRS700X
driver 1 2 -
understands
The switch would act as if the ring ports were swp1 and swp2.
Now that we have explicit hsr_get_port_type() API, let's use that to
work around the unintended semantical changes of the offloading API
brought by the introduction of interlink ports in HSR.
Fixes: 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)")
Cc: Lukasz Majewski <lukma@denx.de>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: George McCollister <george.mccollister@gmail.com>
Link: https://patch.msgid.link/20251130131657.65080-5-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/xrs700x/xrs700x.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/net/dsa/xrs700x/xrs700x.c b/drivers/net/dsa/xrs700x/xrs700x.c
index 4dbcc49a9e526..0a05f4156ef4d 100644
--- a/drivers/net/dsa/xrs700x/xrs700x.c
+++ b/drivers/net/dsa/xrs700x/xrs700x.c
@@ -566,6 +566,7 @@ static int xrs700x_hsr_join(struct dsa_switch *ds, int port,
struct xrs700x *priv = ds->priv;
struct net_device *user;
int ret, i, hsr_pair[2];
+ enum hsr_port_type type;
enum hsr_version ver;
bool fwd = false;
@@ -589,6 +590,16 @@ static int xrs700x_hsr_join(struct dsa_switch *ds, int port,
return -EOPNOTSUPP;
}
+ ret = hsr_get_port_type(hsr, dsa_to_port(ds, port)->user, &type);
+ if (ret)
+ return ret;
+
+ if (type != HSR_PT_SLAVE_A && type != HSR_PT_SLAVE_B) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Only HSR slave ports can be offloaded");
+ return -EOPNOTSUPP;
+ }
+
dsa_hsr_foreach_port(dp, ds, hsr) {
if (dp->index != port) {
partner = dp;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 522/614] net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 521/614] net: dsa: xrs700x: reject unsupported HSR configurations Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 523/614] perf jitdump: Add sym/str-tables to build-ID generation Greg Kroah-Hartman
` (105 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei,
Toke Høiland-Jørgensen, Paolo Abeni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 9fefc78f7f02d71810776fdeb119a05a946a27cc ]
In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen
and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes
that the parent qdisc will enqueue the current packet. However, this
assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent
qdisc stops enqueuing current packet, leaving the tree qlen/backlog
accounting inconsistent. This mismatch can lead to a NULL dereference
(e.g., when the parent Qdisc is qfq_qdisc).
This patch computes the qlen/backlog delta in a more robust way by
observing the difference before and after the series of cake_drop()
calls, and then compensates the qdisc tree accounting if cake_enqueue()
returns NET_XMIT_CN.
To ensure correct compensation when ACK thinning is enabled, a new
variable is introduced to keep qlen unchanged.
Fixes: 15de71d06a40 ("net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit")
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20251128001415.377823-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_cake.c | 58 ++++++++++++++++++++++++--------------------
1 file changed, 32 insertions(+), 26 deletions(-)
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 32bacfc314c26..d325a90cde9ee 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1597,7 +1597,6 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free)
qdisc_drop_reason(skb, sch, to_free, SKB_DROP_REASON_QDISC_OVERLIMIT);
sch->q.qlen--;
- qdisc_tree_reduce_backlog(sch, 1, len);
cake_heapify(q, 0);
@@ -1743,14 +1742,14 @@ static void cake_reconfigure(struct Qdisc *sch);
static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free)
{
+ u32 idx, tin, prev_qlen, prev_backlog, drop_id;
struct cake_sched_data *q = qdisc_priv(sch);
- int len = qdisc_pkt_len(skb);
- int ret;
+ int len = qdisc_pkt_len(skb), ret;
struct sk_buff *ack = NULL;
ktime_t now = ktime_get();
struct cake_tin_data *b;
struct cake_flow *flow;
- u32 idx, tin;
+ bool same_flow = false;
/* choose flow to insert into */
idx = cake_classify(sch, &b, skb, q->flow_mode, &ret);
@@ -1823,6 +1822,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
consume_skb(skb);
} else {
/* not splitting */
+ int ack_pkt_len = 0;
+
cobalt_set_enqueue_time(skb, now);
get_cobalt_cb(skb)->adjusted_len = cake_overhead(q, skb);
flow_queue_add(flow, skb);
@@ -1833,13 +1834,13 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
if (ack) {
b->ack_drops++;
sch->qstats.drops++;
- b->bytes += qdisc_pkt_len(ack);
- len -= qdisc_pkt_len(ack);
+ ack_pkt_len = qdisc_pkt_len(ack);
+ b->bytes += ack_pkt_len;
q->buffer_used += skb->truesize - ack->truesize;
if (q->rate_flags & CAKE_FLAG_INGRESS)
cake_advance_shaper(q, b, ack, now, true);
- qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(ack));
+ qdisc_tree_reduce_backlog(sch, 1, ack_pkt_len);
consume_skb(ack);
} else {
sch->q.qlen++;
@@ -1848,11 +1849,11 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
/* stats */
b->packets++;
- b->bytes += len;
- b->backlogs[idx] += len;
- b->tin_backlog += len;
- sch->qstats.backlog += len;
- q->avg_window_bytes += len;
+ b->bytes += len - ack_pkt_len;
+ b->backlogs[idx] += len - ack_pkt_len;
+ b->tin_backlog += len - ack_pkt_len;
+ sch->qstats.backlog += len - ack_pkt_len;
+ q->avg_window_bytes += len - ack_pkt_len;
}
if (q->overflow_timeout)
@@ -1927,24 +1928,29 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
if (q->buffer_used > q->buffer_max_used)
q->buffer_max_used = q->buffer_used;
- if (q->buffer_used > q->buffer_limit) {
- bool same_flow = false;
- u32 dropped = 0;
- u32 drop_id;
+ if (q->buffer_used <= q->buffer_limit)
+ return NET_XMIT_SUCCESS;
- while (q->buffer_used > q->buffer_limit) {
- dropped++;
- drop_id = cake_drop(sch, to_free);
+ prev_qlen = sch->q.qlen;
+ prev_backlog = sch->qstats.backlog;
- if ((drop_id >> 16) == tin &&
- (drop_id & 0xFFFF) == idx)
- same_flow = true;
- }
- b->drop_overlimit += dropped;
+ while (q->buffer_used > q->buffer_limit) {
+ drop_id = cake_drop(sch, to_free);
+ if ((drop_id >> 16) == tin &&
+ (drop_id & 0xFFFF) == idx)
+ same_flow = true;
+ }
+
+ prev_qlen -= sch->q.qlen;
+ prev_backlog -= sch->qstats.backlog;
+ b->drop_overlimit += prev_qlen;
- if (same_flow)
- return NET_XMIT_CN;
+ if (same_flow) {
+ qdisc_tree_reduce_backlog(sch, prev_qlen - 1,
+ prev_backlog - len);
+ return NET_XMIT_CN;
}
+ qdisc_tree_reduce_backlog(sch, prev_qlen, prev_backlog);
return NET_XMIT_SUCCESS;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 523/614] perf jitdump: Add sym/str-tables to build-ID generation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 522/614] net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 524/614] exfat: fix refcount leak in exfat_find Greg Kroah-Hartman
` (104 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Eric Biggers,
Pablo Galindo, Fangrui Song, Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 25d498e636d1f8d138d65246cfb5b1fc3069ca56 ]
It was reported that python backtrace with JIT dump was broken after the
change to built-in SHA-1 implementation. It seems python generates the
same JIT code for each function. They will become separate DSOs but the
contents are the same. Only difference is in the symbol name.
But this caused a problem that every JIT'ed DSOs will have the same
build-ID which makes perf confused. And it resulted in no python
symbols (from JIT) in the output.
Looking back at the original code before the conversion, it used the
load_addr as well as the code section to distinguish each DSO. But it'd
be better to use contents of symtab and strtab instead as it aligns with
some linker behaviors.
This patch adds a buffer to save all the contents in a single place for
SHA-1 calculation. Probably we need to add sha1_update() or similar to
update the existing hash value with different contents and use it here.
But it's out of scope for this change and I'd like something that can be
backported to the stable trees easily.
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Pablo Galindo <pablogsal@gmail.com>
Cc: Fangrui Song <maskray@sourceware.org>
Link: https://github.com/python/cpython/issues/139544
Fixes: e3f612c1d8f3945b ("perf genelf: Remove libcrypto dependency and use built-in sha1()")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/genelf.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c
index 591548b10e34e..a1cd5196f4ec8 100644
--- a/tools/perf/util/genelf.c
+++ b/tools/perf/util/genelf.c
@@ -173,6 +173,8 @@ jit_write_elf(int fd, uint64_t load_addr __maybe_unused, const char *sym,
Elf_Shdr *shdr;
uint64_t eh_frame_base_offset;
char *strsym = NULL;
+ void *build_id_data = NULL, *tmp;
+ int build_id_data_len;
int symlen;
int retval = -1;
@@ -251,6 +253,14 @@ jit_write_elf(int fd, uint64_t load_addr __maybe_unused, const char *sym,
shdr->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
shdr->sh_entsize = 0;
+ build_id_data = malloc(csize);
+ if (build_id_data == NULL) {
+ warnx("cannot allocate build-id data");
+ goto error;
+ }
+ memcpy(build_id_data, code, csize);
+ build_id_data_len = csize;
+
/*
* Setup .eh_frame_hdr and .eh_frame
*/
@@ -334,6 +344,15 @@ jit_write_elf(int fd, uint64_t load_addr __maybe_unused, const char *sym,
shdr->sh_entsize = sizeof(Elf_Sym);
shdr->sh_link = unwinding ? 6 : 4; /* index of .strtab section */
+ tmp = realloc(build_id_data, build_id_data_len + sizeof(symtab));
+ if (tmp == NULL) {
+ warnx("cannot allocate build-id data");
+ goto error;
+ }
+ memcpy(tmp + build_id_data_len, symtab, sizeof(symtab));
+ build_id_data = tmp;
+ build_id_data_len += sizeof(symtab);
+
/*
* setup symbols string table
* 2 = 1 for 0 in 1st entry, 1 for the 0 at end of symbol for 2nd entry
@@ -376,6 +395,15 @@ jit_write_elf(int fd, uint64_t load_addr __maybe_unused, const char *sym,
shdr->sh_flags = 0;
shdr->sh_entsize = 0;
+ tmp = realloc(build_id_data, build_id_data_len + symlen);
+ if (tmp == NULL) {
+ warnx("cannot allocate build-id data");
+ goto error;
+ }
+ memcpy(tmp + build_id_data_len, strsym, symlen);
+ build_id_data = tmp;
+ build_id_data_len += symlen;
+
/*
* setup build-id section
*/
@@ -394,7 +422,7 @@ jit_write_elf(int fd, uint64_t load_addr __maybe_unused, const char *sym,
/*
* build-id generation
*/
- sha1(code, csize, bnote.build_id);
+ sha1(build_id_data, build_id_data_len, bnote.build_id);
bnote.desc.namesz = sizeof(bnote.name); /* must include 0 termination */
bnote.desc.descsz = sizeof(bnote.build_id);
bnote.desc.type = NT_GNU_BUILD_ID;
@@ -439,7 +467,7 @@ jit_write_elf(int fd, uint64_t load_addr __maybe_unused, const char *sym,
(void)elf_end(e);
free(strsym);
-
+ free(build_id_data);
return retval;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 524/614] exfat: fix refcount leak in exfat_find
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 523/614] perf jitdump: Add sym/str-tables to build-ID generation Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 525/614] exfat: fix divide-by-zero in exfat_allocate_bitmap Greg Kroah-Hartman
` (103 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuhao Fu, Yuezhang Mo, Namjae Jeon,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuhao Fu <sfual@cse.ust.hk>
[ Upstream commit 9aee8de970f18c2aaaa348e3de86c38e2d956c1d ]
Fix refcount leaks in `exfat_find` related to `exfat_get_dentry_set`.
Function `exfat_get_dentry_set` would increase the reference counter of
`es->bh` on success. Therefore, `exfat_put_dentry_set` must be called
after `exfat_get_dentry_set` to ensure refcount consistency. This patch
relocate two checks to avoid possible leaks.
Fixes: 82ebecdc74ff ("exfat: fix improper check of dentry.stream.valid_size")
Fixes: 13940cef9549 ("exfat: add a check for invalid data size")
Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/namei.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 745dce29ddb53..dfe957493d49e 100644
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -645,16 +645,6 @@ static int exfat_find(struct inode *dir, const struct qstr *qname,
info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size);
info->size = le64_to_cpu(ep2->dentry.stream.size);
- if (info->valid_size < 0) {
- exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size);
- return -EIO;
- }
-
- if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) {
- exfat_fs_error(sb, "data size is invalid(%lld)", info->size);
- return -EIO;
- }
-
info->start_clu = le32_to_cpu(ep2->dentry.stream.start_clu);
if (!is_valid_cluster(sbi, info->start_clu) && info->size) {
exfat_warn(sb, "start_clu is invalid cluster(0x%x)",
@@ -692,6 +682,16 @@ static int exfat_find(struct inode *dir, const struct qstr *qname,
0);
exfat_put_dentry_set(&es, false);
+ if (info->valid_size < 0) {
+ exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size);
+ return -EIO;
+ }
+
+ if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) {
+ exfat_fs_error(sb, "data size is invalid(%lld)", info->size);
+ return -EIO;
+ }
+
if (ei->start_clu == EXFAT_FREE_CLUSTER) {
exfat_fs_error(sb,
"non-zero size file starts with zero cluster (size : %llu, p_dir : %u, entry : 0x%08x)",
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 525/614] exfat: fix divide-by-zero in exfat_allocate_bitmap
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 524/614] exfat: fix refcount leak in exfat_find Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 526/614] perf tools: Mark split kallsyms DSOs as loaded Greg Kroah-Hartman
` (102 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiaming Zhang, Namjae Jeon,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit d70a5804c563b5e34825353ba9927509df709651 ]
The variable max_ra_count can be 0 in exfat_allocate_bitmap(),
which causes a divide-by-zero error in the subsequent modulo operation
(i % max_ra_count), leading to a system crash.
When max_ra_count is 0, it means that readahead is not used. This patch
load the bitmap without readahead.
Fixes: 9fd688678dd8 ("exfat: optimize allocation bitmap loading time")
Reported-by: Jiaming Zhang <r772577952@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/balloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c
index 2d2d510f2372c..0b6466b3490a0 100644
--- a/fs/exfat/balloc.c
+++ b/fs/exfat/balloc.c
@@ -106,7 +106,7 @@ static int exfat_allocate_bitmap(struct super_block *sb,
(PAGE_SHIFT - sb->s_blocksize_bits);
for (i = 0; i < sbi->map_sectors; i++) {
/* Trigger the next readahead in advance. */
- if (0 == (i % max_ra_count)) {
+ if (max_ra_count && 0 == (i % max_ra_count)) {
blk_start_plug(&plug);
for (j = i; j < min(max_ra_count, sbi->map_sectors - i) + i; j++)
sb_breadahead(sb, sector + j);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 526/614] perf tools: Mark split kallsyms DSOs as loaded
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 525/614] exfat: fix divide-by-zero in exfat_allocate_bitmap Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 527/614] perf tools: Fix split kallsyms DSO counting Greg Kroah-Hartman
` (101 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 7da4d60db33cccd8f4c445ab20bba71531435ee5 ]
The maps__split_kallsyms() will split symbols to module DSOs if it comes
from a module. It also handled some unusual kernel symbols after modules
by creating new kernel maps like "[kernel].0".
But they are pseudo DSOs to have those unexpected symbols. They should
not be considered as unloaded kernel DSOs. Otherwise the dso__load()
for them will end up calling dso__load_kallsyms() and then
maps__split_kallsyms() again and again.
Reviewed-by: Ian Rogers <irogers@google.com>
Fixes: 2e538c4a1847291cf ("perf tools: Improve kernel/modules symbol lookup")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 948d3e8ad782b..aed65b1abe669 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -976,6 +976,7 @@ static int maps__split_kallsyms(struct maps *kmaps, struct dso *dso, u64 delta,
return -1;
dso__set_kernel(ndso, dso__kernel(dso));
+ dso__set_loaded(ndso);
curr_map = map__new2(pos->start, ndso);
if (curr_map == NULL) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 527/614] perf tools: Fix split kallsyms DSO counting
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 526/614] perf tools: Mark split kallsyms DSOs as loaded Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 528/614] perf kvm: Fix debug assertion Greg Kroah-Hartman
` (100 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit ad0b9c4865b98dc37f4d606d26b1c19808796805 ]
It's counted twice as it's increased after calling maps__insert(). I
guess we want to increase it only after it's added properly.
Reviewed-by: Ian Rogers <irogers@google.com>
Fixes: 2e538c4a1847291cf ("perf tools: Improve kernel/modules symbol lookup")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index aed65b1abe669..f6c268c588a56 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -964,11 +964,11 @@ static int maps__split_kallsyms(struct maps *kmaps, struct dso *dso, u64 delta,
if (dso__kernel(dso) == DSO_SPACE__KERNEL_GUEST)
snprintf(dso_name, sizeof(dso_name),
"[guest.kernel].%d",
- kernel_range++);
+ kernel_range);
else
snprintf(dso_name, sizeof(dso_name),
"[kernel].%d",
- kernel_range++);
+ kernel_range);
ndso = dso__new(dso_name);
map__zput(curr_map);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 528/614] perf kvm: Fix debug assertion
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 527/614] perf tools: Fix split kallsyms DSO counting Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 529/614] perf hist: In init, ensure mem_info is put on error paths Greg Kroah-Hartman
` (99 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 27e711257902475097dea3f79cbdf241fe37ec00 ]
There are 2 slots left for kvm_add_default_arch_event, fix the
assertion so that debug builds don't fail the assert and to agree with
the comment.
Fixes: 45ff39f6e70aa55d0 ("perf tools kvm: Fix the potential out of range memory access issue")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-kvm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index f0f285763f190..c61369d54dd9d 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -2014,7 +2014,7 @@ static int __cmd_record(const char *file_name, int argc, const char **argv)
for (j = 1; j < argc; j++, i++)
rec_argv[i] = STRDUP_FAIL_EXIT(argv[j]);
- BUG_ON(i != rec_argc);
+ BUG_ON(i + 2 != rec_argc);
ret = kvm_add_default_arch_event(&i, rec_argv);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 529/614] perf hist: In init, ensure mem_info is put on error paths
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 528/614] perf kvm: Fix debug assertion Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 530/614] pinctrl: single: Fix incorrect type for error return variable Greg Kroah-Hartman
` (98 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Arnaldo Carvalho de Melo,
Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit f60efb4454b24cc944ff3eac164bb9dce9169f71 ]
Rather than exit the internal map_symbols directly, put the mem-info
that does this and also lowers the reference count on the mem-info
itself otherwise the mem-info is being leaked.
Fixes: 56e144fe98260a0f ("perf mem_info: Add and use map_symbol__exit and addr_map_symbol__exit")
Signed-off-by: Ian Rogers <irogers@google.com>
Reviewed-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/hist.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 64ff427040c34..ef4b569f7df46 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -608,10 +608,8 @@ static int hist_entry__init(struct hist_entry *he,
map_symbol__exit(&he->branch_info->to.ms);
zfree(&he->branch_info);
}
- if (he->mem_info) {
- map_symbol__exit(&mem_info__iaddr(he->mem_info)->ms);
- map_symbol__exit(&mem_info__daddr(he->mem_info)->ms);
- }
+ if (he->mem_info)
+ mem_info__zput(he->mem_info);
err:
map_symbol__exit(&he->ms);
zfree(&he->stat_acc);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 530/614] pinctrl: single: Fix incorrect type for error return variable
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 529/614] perf hist: In init, ensure mem_info is put on error paths Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 531/614] perf stat: Allow no events to open if this is a "--null" run Greg Kroah-Hartman
` (97 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Linus Walleij,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 61d1bb53547d42c6bdaec9da4496beb3a1a05264 ]
pcs_pinconf_get() and pcs_pinconf_set() declare ret as unsigned int,
but assign it the return values of pcs_get_function() that may return
negative error codes. This causes negative error codes to be
converted to large positive values.
Change ret from unsigned int to int in both functions.
Fixes: 9dddb4df90d1 ("pinctrl: single: support generic pinconf")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-single.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 6d580aa282ec9..998f23d6c3179 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -485,7 +485,8 @@ static int pcs_pinconf_get(struct pinctrl_dev *pctldev,
struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
struct pcs_function *func;
enum pin_config_param param;
- unsigned offset = 0, data = 0, i, j, ret;
+ unsigned offset = 0, data = 0, i, j;
+ int ret;
ret = pcs_get_function(pctldev, pin, &func);
if (ret)
@@ -549,9 +550,9 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
{
struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
struct pcs_function *func;
- unsigned offset = 0, shift = 0, i, data, ret;
+ unsigned offset = 0, shift = 0, i, data;
u32 arg;
- int j;
+ int j, ret;
enum pin_config_param param;
ret = pcs_get_function(pctldev, pin, &func);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 531/614] perf stat: Allow no events to open if this is a "--null" run
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 530/614] pinctrl: single: Fix incorrect type for error return variable Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 532/614] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Greg Kroah-Hartman
` (96 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ingo Molnar, Ian Rogers,
Thomas Richter, Namhyung Kim, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 6744c0b182c1f371135bc3f4e62b96ad884c9f89 ]
It is intended that a "--null" run doesn't open any events.
Fixes: 2cc7aa995ce9 ("perf stat: Refactor retry/skip/fatal error handling")
Tested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-stat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index f1c9d6c94fc50..b6533dcf5465b 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -856,7 +856,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
goto err_out;
}
}
- if (!has_supported_counters) {
+ if (!has_supported_counters && !stat_config.null_run) {
evsel__open_strerror(evlist__first(evsel_list), &target, open_err,
msg, sizeof(msg));
ui__error("No supported events found.\n%s\n", msg);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 532/614] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 531/614] perf stat: Allow no events to open if this is a "--null" run Greg Kroah-Hartman
@ 2025-12-16 11:14 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 533/614] 9p: fix cache/debug options printing in v9fs_show_options Greg Kroah-Hartman
` (95 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 164312662ae9764b83b84d97afb25c42eb2be473 ]
The page allocated for vmem using __get_free_pages() is not freed on the
error paths after it. Fix that by adding a corresponding __free_pages()
call to the error path.
Fixes: facd94bc458a ("fbdev: ssd1307fb: Allocate page aligned video memory.")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/ssd1307fb.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index aa6cc0a8151ac..83dd31fa1fab5 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -680,7 +680,7 @@ static int ssd1307fb_probe(struct i2c_client *client)
if (!ssd1307fb_defio) {
dev_err(dev, "Couldn't allocate deferred io.\n");
ret = -ENOMEM;
- goto fb_alloc_error;
+ goto fb_defio_error;
}
ssd1307fb_defio->delay = HZ / refreshrate;
@@ -757,6 +757,8 @@ static int ssd1307fb_probe(struct i2c_client *client)
regulator_disable(par->vbat_reg);
reset_oled_error:
fb_deferred_io_cleanup(info);
+fb_defio_error:
+ __free_pages(vmem, get_order(vmem_size));
fb_alloc_error:
framebuffer_release(info);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 533/614] 9p: fix cache/debug options printing in v9fs_show_options
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2025-12-16 11:14 ` [PATCH 6.18 532/614] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 534/614] sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out Greg Kroah-Hartman
` (94 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Sandeen, Remi Pommarel,
Dominique Martinet, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <sandeen@redhat.com>
[ Upstream commit f0445613314f474c1a0ec6fa8a5cd153a618f1b6 ]
commit 4eb3117888a92 changed the cache= option to accept either string
shortcuts or bitfield values. It also changed /proc/mounts to emit the
option as the hexadecimal numeric value rather than the shortcut string.
However, by printing "cache=%x" without the leading 0x, shortcuts such
as "cache=loose" will emit "cache=f" and 'f' is not a string that is
parseable by kstrtoint(), so remounting may fail if a remount with
"cache=f" is attempted.
debug=%x has had the same problem since options have been displayed in
c4fac9100456 ("9p: Implement show_options")
Fix these by adding the 0x prefix to the hexadecimal value shown in
/proc/mounts.
Fixes: 4eb3117888a92 ("fs/9p: Rework cache modes and add new options to Documentation")
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Message-ID: <54b93378-dcf1-4b04-922d-c8b4393da299@redhat.com>
[Dominique: use %#x at Al Viro's suggestion, also handle debug]
Tested-by: Remi Pommarel <repk@triplefau.lt>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/v9fs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index a020a8f00a1ac..bde3ffb0e319a 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -101,7 +101,7 @@ int v9fs_show_options(struct seq_file *m, struct dentry *root)
struct v9fs_session_info *v9ses = root->d_sb->s_fs_info;
if (v9ses->debug)
- seq_printf(m, ",debug=%x", v9ses->debug);
+ seq_printf(m, ",debug=%#x", v9ses->debug);
if (!uid_eq(v9ses->dfltuid, V9FS_DEFUID))
seq_printf(m, ",dfltuid=%u",
from_kuid_munged(&init_user_ns, v9ses->dfltuid));
@@ -117,7 +117,7 @@ int v9fs_show_options(struct seq_file *m, struct dentry *root)
if (v9ses->nodev)
seq_puts(m, ",nodevmap");
if (v9ses->cache)
- seq_printf(m, ",cache=%x", v9ses->cache);
+ seq_printf(m, ",cache=%#x", v9ses->cache);
#ifdef CONFIG_9P_FSCACHE
if (v9ses->cachetag && (v9ses->cache & CACHE_FSCACHE))
seq_printf(m, ",cachetag=%s", v9ses->cachetag);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 534/614] sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 533/614] 9p: fix cache/debug options printing in v9fs_show_options Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 535/614] sched/core: Fix psi_dequeue() for Proxy Execution Greg Kroah-Hartman
` (93 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, xupengbo, Peter Zijlstra (Intel),
Ingo Molnar, Aaron Lu, Vincent Guittot, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: xupengbo <xupengbo@oppo.com>
[ Upstream commit ca125231dd29fc0678dd3622e9cdea80a51dffe4 ]
When a task is migrated out, there is a probability that the tg->load_avg
value will become abnormal. The reason is as follows:
1. Due to the 1ms update period limitation in update_tg_load_avg(), there
is a possibility that the reduced load_avg is not updated to tg->load_avg
when a task migrates out.
2. Even though __update_blocked_fair() traverses the leaf_cfs_rq_list and
calls update_tg_load_avg() for cfs_rqs that are not fully decayed, the key
function cfs_rq_is_decayed() does not check whether
cfs->tg_load_avg_contrib is null. Consequently, in some cases,
__update_blocked_fair() removes cfs_rqs whose avg.load_avg has not been
updated to tg->load_avg.
Add a check of cfs_rq->tg_load_avg_contrib in cfs_rq_is_decayed(),
which fixes the case (2.) mentioned above.
Fixes: 1528c661c24b ("sched/fair: Ratelimit update to tg->load_avg")
Signed-off-by: xupengbo <xupengbo@oppo.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Aaron Lu <ziqianlu@bytedance.com>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Tested-by: Aaron Lu <ziqianlu@bytedance.com>
Link: https://patch.msgid.link/20250827022208.14487-1-xupengbo@oppo.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 2a4a1c6e25da0..71d3f4125b0e7 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4059,6 +4059,9 @@ static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
if (child_cfs_rq_on_list(cfs_rq))
return false;
+ if (cfs_rq->tg_load_avg_contrib)
+ return false;
+
return true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 535/614] sched/core: Fix psi_dequeue() for Proxy Execution
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 534/614] sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 536/614] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID Greg Kroah-Hartman
` (92 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, John Stultz,
Ingo Molnar, Haiyue Wang, Johannes Weiner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <jstultz@google.com>
[ Upstream commit c2ae8b0df2d1bb7a063f9e356e4e9a06cd4afe11 ]
Currently, if the sleep flag is set, psi_dequeue() doesn't
change any of the psi_flags.
This is because psi_task_switch() will clear TSK_ONCPU as well
as other potential flags (TSK_RUNNING), and the assumption is
that a voluntary sleep always consists of a task being dequeued
followed shortly there after with a psi_sched_switch() call.
Proxy Execution changes this expectation, as mutex-blocked tasks
that would normally sleep stay on the runqueue. But in the case
where the mutex-owning task goes to sleep, or the owner is on a
remote cpu, we will then deactivate the blocked task shortly
after.
In that situation, the mutex-blocked task will have had its
TSK_ONCPU cleared when it was switched off the cpu, but it will
stay TSK_RUNNING. Then if we later dequeue it (as currently done
if we hit a case find_proxy_task() can't yet handle, such as the
case of the owner being on another rq or a sleeping owner)
psi_dequeue() won't change any state (leaving it TSK_RUNNING),
as it incorrectly expects a psi_task_switch() call to
immediately follow.
Later on when the task get woken/re-enqueued, and psi_flags are
set for TSK_RUNNING, we hit an error as the task is already
TSK_RUNNING:
psi: inconsistent task state! task=188:kworker/28:0 cpu=28 psi_flags=4 clear=0 set=4
To resolve this, extend the logic in psi_dequeue() so that
if the sleep flag is set, we also check if psi_flags have
TSK_ONCPU set (meaning the psi_task_switch is imminent) before
we do the shortcut return.
If TSK_ONCPU is not set, that means we've already switched away,
and this psi_dequeue call needs to clear the flags.
Fixes: be41bde4c3a8 ("sched: Add an initial sketch of the find_proxy_task() function")
Reported-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: John Stultz <jstultz@google.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Tested-by: Haiyue Wang <haiyuewa@163.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Link: https://patch.msgid.link/20251205012721.756394-1-jstultz@google.com
Closes: https://lore.kernel.org/lkml/20251117185550.365156-1-kprateek.nayak@amd.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/stats.h | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
index 26f3fd4d34cea..73bd6bca4d310 100644
--- a/kernel/sched/stats.h
+++ b/kernel/sched/stats.h
@@ -180,8 +180,13 @@ static inline void psi_dequeue(struct task_struct *p, int flags)
* avoid walking all ancestors twice, psi_task_switch() handles
* TSK_RUNNING and TSK_IOWAIT for us when it moves TSK_ONCPU.
* Do nothing here.
+ *
+ * In the SCHED_PROXY_EXECUTION case we may do sleeping
+ * dequeues that are not followed by a task switch, so check
+ * TSK_ONCPU is set to ensure the task switch is imminent.
+ * Otherwise clear the flags as usual.
*/
- if (flags & DEQUEUE_SLEEP)
+ if ((flags & DEQUEUE_SLEEP) && (p->psi_flags & TSK_ONCPU))
return;
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 536/614] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 535/614] sched/core: Fix psi_dequeue() for Proxy Execution Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 537/614] f2fs: maintain one time GC mode is enabled during whole zoned GC cycle Greg Kroah-Hartman
` (91 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Pearson, Xi Pardee,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Pardee <xi.pardee@linux.intel.com>
[ Upstream commit 644ab3bc98ee386f178d5209ae8170b3fac591aa ]
Update ARL_PMT_DMU_GUID value. Arrow Lake PMT DMU GUID has been updated
after it was add to the driver. This updates ensures that the die C6
value is available in the debug filesystem.
Bugzilla Link: https://bugzilla.kernel.org/show_bug.cgi?id=220421
Fixes: 83f168a1a437 ("platform/x86/intel/pmc: Add Arrow Lake S support to intel_pmc_core driver")
Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
Signed-off-by: Xi Pardee <xi.pardee@linux.intel.com>
Link: https://patch.msgid.link/20251014214548.629023-2-xi.pardee@linux.intel.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/pmc/core.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/pmc/core.h b/drivers/platform/x86/intel/pmc/core.h
index f4dadb696a314..d6818bd34768e 100644
--- a/drivers/platform/x86/intel/pmc/core.h
+++ b/drivers/platform/x86/intel/pmc/core.h
@@ -282,7 +282,7 @@ enum ppfear_regs {
/* Die C6 from PUNIT telemetry */
#define MTL_PMT_DMU_DIE_C6_OFFSET 15
#define MTL_PMT_DMU_GUID 0x1A067102
-#define ARL_PMT_DMU_GUID 0x1A06A000
+#define ARL_PMT_DMU_GUID 0x1A06A102
#define LNL_PMC_MMIO_REG_LEN 0x2708
#define LNL_PMC_LTR_OSSE 0x1B88
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 537/614] f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 536/614] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 538/614] rtc: amlogic-a4: fix double free caused by devm Greg Kroah-Hartman
` (90 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daeho Jeong, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit e462fc48ceb8224811c3224650afed05cb7f0872 ]
The current version missed setting one time GC for normal zoned GC
cycle. So, valid threshold control is not working. Need to fix it to
prevent excessive GC for zoned devices.
Fixes: e791d00bd06c ("f2fs: add valid block ratio not to do excessive GC for one time GC")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/gc.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index a7708cf80c04e..8abf521530ff3 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -38,13 +38,14 @@ static int gc_thread_func(void *data)
struct f2fs_gc_control gc_control = {
.victim_segno = NULL_SEGNO,
.should_migrate_blocks = false,
- .err_gc_skipped = false };
+ .err_gc_skipped = false,
+ .one_time = false };
wait_ms = gc_th->min_sleep_time;
set_freezable();
do {
- bool sync_mode, foreground = false;
+ bool sync_mode, foreground = false, gc_boost = false;
wait_event_freezable_timeout(*wq,
kthread_should_stop() ||
@@ -52,8 +53,12 @@ static int gc_thread_func(void *data)
gc_th->gc_wake,
msecs_to_jiffies(wait_ms));
- if (test_opt(sbi, GC_MERGE) && waitqueue_active(fggc_wq))
+ if (test_opt(sbi, GC_MERGE) && waitqueue_active(fggc_wq)) {
foreground = true;
+ gc_control.one_time = false;
+ } else if (f2fs_sb_has_blkzoned(sbi)) {
+ gc_control.one_time = true;
+ }
/* give it a try one time */
if (gc_th->gc_wake)
@@ -81,8 +86,6 @@ static int gc_thread_func(void *data)
continue;
}
- gc_control.one_time = false;
-
/*
* [GC triggering condition]
* 0. GC is not conducted currently.
@@ -132,7 +135,7 @@ static int gc_thread_func(void *data)
if (need_to_boost_gc(sbi)) {
decrease_sleep_time(gc_th, &wait_ms);
if (f2fs_sb_has_blkzoned(sbi))
- gc_control.one_time = true;
+ gc_boost = true;
} else {
increase_sleep_time(gc_th, &wait_ms);
}
@@ -141,7 +144,7 @@ static int gc_thread_func(void *data)
FOREGROUND : BACKGROUND);
sync_mode = (F2FS_OPTION(sbi).bggc_mode == BGGC_MODE_SYNC) ||
- (gc_control.one_time && gc_th->boost_gc_greedy);
+ (gc_boost && gc_th->boost_gc_greedy);
/* foreground GC was been triggered via f2fs_balance_fs() */
if (foreground && !f2fs_sb_has_blkzoned(sbi))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 538/614] rtc: amlogic-a4: fix double free caused by devm
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 537/614] f2fs: maintain one time GC mode is enabled during whole zoned GC cycle Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 539/614] kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Greg Kroah-Hartman
` (89 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Xianwei Zhao,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 384150d7a5b60c1086790a8ee07b0629f906cca2 ]
The clock obtained via devm_clk_get_enabled() is automatically managed
by devres and will be disabled and freed on driver detach. Manually
calling clk_disable_unprepare() in error path and remove function
causes double free.
Remove the redundant clk_disable_unprepare() calls from the probe
error path and aml_rtc_remove(), allowing the devm framework to
automatically manage the clock lifecycle.
Fixes: c89ac9182ee2 ("rtc: support for the Amlogic on-chip RTC")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
Link: https://patch.msgid.link/20251021103559.1903-1-vulab@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-amlogic-a4.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/rtc/rtc-amlogic-a4.c b/drivers/rtc/rtc-amlogic-a4.c
index 1928b29c10454..a993d35e1d6b0 100644
--- a/drivers/rtc/rtc-amlogic-a4.c
+++ b/drivers/rtc/rtc-amlogic-a4.c
@@ -390,7 +390,6 @@ static int aml_rtc_probe(struct platform_device *pdev)
return 0;
err_clk:
- clk_disable_unprepare(rtc->sys_clk);
device_init_wakeup(dev, false);
return ret;
@@ -423,9 +422,6 @@ static SIMPLE_DEV_PM_OPS(aml_rtc_pm_ops,
static void aml_rtc_remove(struct platform_device *pdev)
{
- struct aml_rtc_data *rtc = dev_get_drvdata(&pdev->dev);
-
- clk_disable_unprepare(rtc->sys_clk);
device_init_wakeup(&pdev->dev, false);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 539/614] kbuild: install-extmod-build: Properly fix CC expansion when ccache is used
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 538/614] rtc: amlogic-a4: fix double free caused by devm Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 540/614] NFS: Avoid changing nlink when file removes and attribute updates race Greg Kroah-Hartman
` (88 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Nicolas Schier,
Nathan Chancellor, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <abel.vesa@linaro.org>
[ Upstream commit 4ab2ee307983548b29ddaab0ecaef82d526cf4c9 ]
Currently, when cross-compiling and ccache is used, the expanding of CC
turns out to be without any quotes, leading to the following error:
make[4]: *** No rule to make target 'aarch64-linux-gnu-gcc'. Stop.
make[3]: *** [Makefile:2164: run-command] Error 2
And it makes sense, because after expansion it ends up like this:
make run-command KBUILD_RUN_COMMAND=+$(MAKE) \
HOSTCC=ccache aarch64-linux-gnu-gcc VPATH= srcroot=. $(build)= ...
So add another set of double quotes to surround whatever CC expands to
to make sure the aarch64-linux-gnu-gcc isn't expanded to something that
looks like an entirely separate target.
Fixes: 140332b6ed72 ("kbuild: fix linux-headers package build when $(CC) cannot link userspace")
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Nicolas Schier <nsc@kernel.org>
Link: https://patch.msgid.link/20251111-kbuild-install-extmod-build-fix-cc-expand-third-try-v2-1-15ba1b37e71a@linaro.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/package/install-extmod-build | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/package/install-extmod-build b/scripts/package/install-extmod-build
index 054fdf45cc37a..2576cf7902dbb 100755
--- a/scripts/package/install-extmod-build
+++ b/scripts/package/install-extmod-build
@@ -63,7 +63,7 @@ if [ "${CC}" != "${HOSTCC}" ]; then
# Clear VPATH and srcroot because the source files reside in the output
# directory.
# shellcheck disable=SC2016 # $(MAKE) and $(build) will be expanded by Make
- "${MAKE}" run-command KBUILD_RUN_COMMAND='+$(MAKE) HOSTCC='"${CC}"' VPATH= srcroot=. $(build)='"$(realpath --relative-to=. "${destdir}")"/scripts
+ "${MAKE}" run-command KBUILD_RUN_COMMAND='+$(MAKE) HOSTCC="'"${CC}"'" VPATH= srcroot=. $(build)='"$(realpath --relative-to=. "${destdir}")"/scripts
rm -f "${destdir}/scripts/Kbuild"
fi
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 540/614] NFS: Avoid changing nlink when file removes and attribute updates race
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 539/614] kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 541/614] fs/nls: Fix utf16 to utf8 conversion Greg Kroah-Hartman
` (87 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aiden Lambert, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit bd4928ec799b31c492eb63f9f4a0c1e0bb4bb3f7 ]
If a file removal races with another operation that updates its
attributes, then skip the change to nlink, and just mark the attributes
as being stale.
Reported-by: Aiden Lambert <alambert48@gatech.edu>
Fixes: 59a707b0d42e ("NFS: Ensure we revalidate the inode correctly after remove or rename")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/dir.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index ea9f6ca8f30fa..d557b0443e8b0 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1894,13 +1894,15 @@ static int nfs_dentry_delete(const struct dentry *dentry)
}
/* Ensure that we revalidate inode->i_nlink */
-static void nfs_drop_nlink(struct inode *inode)
+static void nfs_drop_nlink(struct inode *inode, unsigned long gencount)
{
+ struct nfs_inode *nfsi = NFS_I(inode);
+
spin_lock(&inode->i_lock);
/* drop the inode if we're reasonably sure this is the last link */
- if (inode->i_nlink > 0)
+ if (inode->i_nlink > 0 && gencount == nfsi->attr_gencount)
drop_nlink(inode);
- NFS_I(inode)->attr_gencount = nfs_inc_attr_generation_counter();
+ nfsi->attr_gencount = nfs_inc_attr_generation_counter();
nfs_set_cache_invalid(
inode, NFS_INO_INVALID_CHANGE | NFS_INO_INVALID_CTIME |
NFS_INO_INVALID_NLINK);
@@ -1914,8 +1916,9 @@ static void nfs_drop_nlink(struct inode *inode)
static void nfs_dentry_iput(struct dentry *dentry, struct inode *inode)
{
if (dentry->d_flags & DCACHE_NFSFS_RENAMED) {
+ unsigned long gencount = READ_ONCE(NFS_I(inode)->attr_gencount);
nfs_complete_unlink(dentry, inode);
- nfs_drop_nlink(inode);
+ nfs_drop_nlink(inode, gencount);
}
iput(inode);
}
@@ -2507,9 +2510,11 @@ static int nfs_safe_remove(struct dentry *dentry)
trace_nfs_remove_enter(dir, dentry);
if (inode != NULL) {
+ unsigned long gencount = READ_ONCE(NFS_I(inode)->attr_gencount);
+
error = NFS_PROTO(dir)->remove(dir, dentry);
if (error == 0)
- nfs_drop_nlink(inode);
+ nfs_drop_nlink(inode, gencount);
} else
error = NFS_PROTO(dir)->remove(dir, dentry);
if (error == -ENOENT)
@@ -2709,6 +2714,7 @@ int nfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
{
struct inode *old_inode = d_inode(old_dentry);
struct inode *new_inode = d_inode(new_dentry);
+ unsigned long new_gencount = 0;
struct dentry *dentry = NULL;
struct rpc_task *task;
bool must_unblock = false;
@@ -2761,6 +2767,7 @@ int nfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
} else {
block_revalidate(new_dentry);
must_unblock = true;
+ new_gencount = NFS_I(new_inode)->attr_gencount;
spin_unlock(&new_dentry->d_lock);
}
@@ -2800,7 +2807,7 @@ int nfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
new_dir, new_dentry, error);
if (!error) {
if (new_inode != NULL)
- nfs_drop_nlink(new_inode);
+ nfs_drop_nlink(new_inode, new_gencount);
/*
* The d_move() should be here instead of in an async RPC completion
* handler because we need the proper locks to move the dentry. If
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 541/614] fs/nls: Fix utf16 to utf8 conversion
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 540/614] NFS: Avoid changing nlink when file removes and attribute updates race Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 542/614] NFS: Initialise verifiers for visible dentries in readdir and lookup Greg Kroah-Hartman
` (86 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Armin Wolf, Ilpo Järvinen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 25524b6190295577e4918c689644451365e6466d ]
Currently the function responsible for converting between utf16 and
utf8 strings will ignore any characters that cannot be converted. This
however also includes multi-byte characters that do not fit into the
provided string buffer.
This can cause problems if such a multi-byte character is followed by
a single-byte character. In such a case the multi-byte character might
be ignored when the provided string buffer is too small, but the
single-byte character might fit and is thus still copied into the
resulting string.
Fix this by stop filling the provided string buffer once a character
does not fit. In order to be able to do this extend utf32_to_utf8()
to return useful errno codes instead of -1.
Fixes: 74675a58507e ("NLS: update handling of Unicode")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20251111131125.3379-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nls/nls_base.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
index 18d597e49a194..d434c4463a8f7 100644
--- a/fs/nls/nls_base.c
+++ b/fs/nls/nls_base.c
@@ -94,7 +94,7 @@ int utf32_to_utf8(unicode_t u, u8 *s, int maxout)
l = u;
if (l > UNICODE_MAX || (l & SURROGATE_MASK) == SURROGATE_PAIR)
- return -1;
+ return -EILSEQ;
nc = 0;
for (t = utf8_table; t->cmask && maxout; t++, maxout--) {
@@ -110,7 +110,7 @@ int utf32_to_utf8(unicode_t u, u8 *s, int maxout)
return nc;
}
}
- return -1;
+ return -EOVERFLOW;
}
EXPORT_SYMBOL(utf32_to_utf8);
@@ -217,8 +217,16 @@ int utf16s_to_utf8s(const wchar_t *pwcs, int inlen, enum utf16_endian endian,
inlen--;
}
size = utf32_to_utf8(u, op, maxout);
- if (size == -1) {
- /* Ignore character and move on */
+ if (size < 0) {
+ if (size == -EILSEQ) {
+ /* Ignore character and move on */
+ continue;
+ }
+ /*
+ * Stop filling the buffer with data once a character
+ * does not fit anymore.
+ */
+ break;
} else {
op += size;
maxout -= size;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 542/614] NFS: Initialise verifiers for visible dentries in readdir and lookup
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 541/614] fs/nls: Fix utf16 to utf8 conversion Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 543/614] NFS: Initialise verifiers for visible dentries in nfs_atomic_open() Greg Kroah-Hartman
` (85 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Stoler, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 9bd545539b233725a3416801f7c374bff0327d6e ]
Ensure that the verifiers are initialised before calling
d_splice_alias() in both nfs_prime_dcache() and nfs_lookup().
Reported-by: Michael Stoler <michael.stoler@vastdata.com>
Fixes: a1147b8281bd ("NFS: Fix up directory verifier races")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/dir.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index d557b0443e8b0..2eead7e85be5b 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -789,16 +789,17 @@ void nfs_prime_dcache(struct dentry *parent, struct nfs_entry *entry,
goto out;
}
+ nfs_set_verifier(dentry, dir_verifier);
inode = nfs_fhget(dentry->d_sb, entry->fh, entry->fattr);
alias = d_splice_alias(inode, dentry);
d_lookup_done(dentry);
if (alias) {
if (IS_ERR(alias))
goto out;
+ nfs_set_verifier(alias, dir_verifier);
dput(dentry);
dentry = alias;
}
- nfs_set_verifier(dentry, dir_verifier);
trace_nfs_readdir_lookup(d_inode(parent), dentry, 0);
out:
dput(dentry);
@@ -1994,13 +1995,14 @@ struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned in
nfs_lookup_advise_force_readdirplus(dir, flags);
no_entry:
+ nfs_set_verifier(dentry, dir_verifier);
res = d_splice_alias(inode, dentry);
if (res != NULL) {
if (IS_ERR(res))
goto out;
+ nfs_set_verifier(res, dir_verifier);
dentry = res;
}
- nfs_set_verifier(dentry, dir_verifier);
out:
trace_nfs_lookup_exit(dir, dentry, flags, PTR_ERR_OR_ZERO(res));
nfs_free_fattr(fattr);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 543/614] NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 542/614] NFS: Initialise verifiers for visible dentries in readdir and lookup Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 544/614] NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Greg Kroah-Hartman
` (84 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Stoler, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 518c32a1bc4f8df1a8442ee8cdfea3e2fcff20a0 ]
Ensure that the verifiers are initialised before calling
d_splice_alias() in nfs_atomic_open().
Reported-by: Michael Stoler <michael.stoler@vastdata.com>
Fixes: 809fd143de88 ("NFSv4: Ensure nfs_atomic_open set the dentry verifier on ENOENT")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2eead7e85be5b..3b8250ee01412 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2144,12 +2144,12 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
d_drop(dentry);
switch (err) {
case -ENOENT:
- d_splice_alias(NULL, dentry);
if (nfs_server_capable(dir, NFS_CAP_CASE_INSENSITIVE))
dir_verifier = inode_peek_iversion_raw(dir);
else
dir_verifier = nfs_save_change_attribute(dir);
nfs_set_verifier(dentry, dir_verifier);
+ d_splice_alias(NULL, dentry);
break;
case -EISDIR:
case -ENOTDIR:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 544/614] NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 543/614] NFS: Initialise verifiers for visible dentries in nfs_atomic_open() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 545/614] NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Greg Kroah-Hartman
` (83 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Stoler, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 0f900f11002ff52391fc2aa4a75e59f26ed1c242 ]
Ensure that the verifiers are initialised before calling
d_splice_alias() in _nfs4_open_and_get_state().
Reported-by: Michael Stoler <michael.stoler@vastdata.com>
Fixes: cf5b4059ba71 ("NFSv4: Fix races between open and dentry revalidation")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 93c6ce04332b8..6f4e14fb7b9b8 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3174,18 +3174,6 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
if (opendata->o_res.rflags & NFS4_OPEN_RESULT_PRESERVE_UNLINKED)
set_bit(NFS_INO_PRESERVE_UNLINKED, &NFS_I(state->inode)->flags);
- dentry = opendata->dentry;
- if (d_really_is_negative(dentry)) {
- struct dentry *alias;
- d_drop(dentry);
- alias = d_splice_alias(igrab(state->inode), dentry);
- /* d_splice_alias() can't fail here - it's a non-directory */
- if (alias) {
- dput(ctx->dentry);
- ctx->dentry = dentry = alias;
- }
- }
-
switch(opendata->o_arg.claim) {
default:
break;
@@ -3196,7 +3184,20 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
break;
if (opendata->o_res.delegation.type != 0)
dir_verifier = nfs_save_change_attribute(dir);
- nfs_set_verifier(dentry, dir_verifier);
+ }
+
+ dentry = opendata->dentry;
+ nfs_set_verifier(dentry, dir_verifier);
+ if (d_really_is_negative(dentry)) {
+ struct dentry *alias;
+ d_drop(dentry);
+ alias = d_splice_alias(igrab(state->inode), dentry);
+ /* d_splice_alias() can't fail here - it's a non-directory */
+ if (alias) {
+ dput(ctx->dentry);
+ nfs_set_verifier(alias, dir_verifier);
+ ctx->dentry = dentry = alias;
+ }
}
/* Parse layoutget results before we check for access */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 545/614] NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 544/614] NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 546/614] drm/panthor: Prevent potential UAF in group creation Greg Kroah-Hartman
` (82 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Curley, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Curley <jcurley@purestorage.com>
[ Upstream commit e0f8058f2cb56de0b7572f51cd563ca5debce746 ]
Fixes a crash when layout is null during this call stack:
write_inode
-> nfs4_write_inode
-> pnfs_layoutcommit_inode
pnfs_set_layoutcommit relies on the lseg refcount to keep the layout
around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt
to reference a null layout.
Fixes: fe1cf9469d7bc ("pNFS: Clear all layout segment state in pnfs_mark_layout_stateid_invalid")
Signed-off-by: Jonathan Curley <jcurley@purestorage.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/pnfs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index a3135b5af7eec..7ce2e840217cf 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -464,6 +464,7 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo,
struct pnfs_layout_segment *lseg, *next;
set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+ clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(lo->plh_inode)->flags);
list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list)
pnfs_clear_lseg_state(lseg, lseg_list);
pnfs_clear_layoutreturn_info(lo);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 546/614] drm/panthor: Prevent potential UAF in group creation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 545/614] NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 547/614] Revert "nfs: ignore SB_RDONLY when remounting nfs" Greg Kroah-Hartman
` (81 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Brezillon, Akash Goel,
Steven Price, Chia-I Wu, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akash Goel <akash.goel@arm.com>
[ Upstream commit eec7e23d848d2194dd8791fcd0f4a54d4378eecd ]
This commit prevents the possibility of a use after free issue in the
GROUP_CREATE ioctl function, which arose as pointer to the group is
accessed in that ioctl function after storing it in the Xarray.
A malicious userspace can second guess the handle of a group and try
to call GROUP_DESTROY ioctl from another thread around the same time
as GROUP_CREATE ioctl.
To prevent the use after free exploit, this commit uses a mark on an
entry of group pool Xarray which is added just before returning from
the GROUP_CREATE ioctl function. The mark is checked for all ioctls
that specify the group handle and so userspace won't be abe to delete
a group that isn't marked yet.
v2: Add R-bs and fixes tags
Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block")
Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Akash Goel <akash.goel@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
Link: https://patch.msgid.link/20251127164912.3788155-1-akash.goel@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 0279e19aadae9..881a07ffbabc8 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -772,6 +772,12 @@ struct panthor_job_profiling_data {
*/
#define MAX_GROUPS_PER_POOL 128
+/*
+ * Mark added on an entry of group pool Xarray to identify if the group has
+ * been fully initialized and can be accessed elsewhere in the driver code.
+ */
+#define GROUP_REGISTERED XA_MARK_1
+
/**
* struct panthor_group_pool - Group pool
*
@@ -2900,7 +2906,7 @@ void panthor_fdinfo_gather_group_samples(struct panthor_file *pfile)
return;
xa_lock(&gpool->xa);
- xa_for_each(&gpool->xa, i, group) {
+ xa_for_each_marked(&gpool->xa, i, group, GROUP_REGISTERED) {
guard(spinlock)(&group->fdinfo.lock);
pfile->stats.cycles += group->fdinfo.data.cycles;
pfile->stats.time += group->fdinfo.data.time;
@@ -3575,6 +3581,8 @@ int panthor_group_create(struct panthor_file *pfile,
group_init_task_info(group);
+ xa_set_mark(&gpool->xa, gid, GROUP_REGISTERED);
+
return gid;
err_put_group:
@@ -3589,6 +3597,9 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)
struct panthor_scheduler *sched = ptdev->scheduler;
struct panthor_group *group;
+ if (!xa_get_mark(&gpool->xa, group_handle, GROUP_REGISTERED))
+ return -EINVAL;
+
group = xa_erase(&gpool->xa, group_handle);
if (!group)
return -EINVAL;
@@ -3614,12 +3625,12 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)
}
static struct panthor_group *group_from_handle(struct panthor_group_pool *pool,
- u32 group_handle)
+ unsigned long group_handle)
{
struct panthor_group *group;
xa_lock(&pool->xa);
- group = group_get(xa_load(&pool->xa, group_handle));
+ group = group_get(xa_find(&pool->xa, &group_handle, group_handle, GROUP_REGISTERED));
xa_unlock(&pool->xa);
return group;
@@ -3706,7 +3717,7 @@ panthor_fdinfo_gather_group_mem_info(struct panthor_file *pfile,
return;
xa_lock(&gpool->xa);
- xa_for_each(&gpool->xa, i, group) {
+ xa_for_each_marked(&gpool->xa, i, group, GROUP_REGISTERED) {
stats->resident += group->fdinfo.kbo_sizes;
if (group->csg_id >= 0)
stats->active += group->fdinfo.kbo_sizes;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 547/614] Revert "nfs: ignore SB_RDONLY when remounting nfs"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 546/614] drm/panthor: Prevent potential UAF in group creation Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 548/614] Revert "nfs: clear SB_RDONLY before getting superblock" Greg Kroah-Hartman
` (80 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alkis Georgopoulos, Li Lingfeng,
Trond Myklebust, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 400fa37afbb11a601c204b72af0f0e5bc2db695c ]
This reverts commit 80c4de6ab44c14e910117a02f2f8241ffc6ec54a.
Silently ignoring the "ro" and "rw" mount options causes user confusion,
and regressions.
Reported-by: Alkis Georgopoulos<alkisg@gmail.com>
Cc: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 80c4de6ab44c ("nfs: ignore SB_RDONLY when remounting nfs")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/super.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 72dee6f3050e6..527000f5d150c 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1051,16 +1051,6 @@ int nfs_reconfigure(struct fs_context *fc)
sync_filesystem(sb);
- /*
- * The SB_RDONLY flag has been removed from the superblock during
- * mounts to prevent interference between different filesystems.
- * Similarly, it is also necessary to ignore the SB_RDONLY flag
- * during reconfiguration; otherwise, it may also result in the
- * creation of redundant superblocks when mounting a directory with
- * different rw and ro flags multiple times.
- */
- fc->sb_flags_mask &= ~SB_RDONLY;
-
/*
* Userspace mount programs that send binary options generally send
* them populated with default values. We have no way to know which
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 548/614] Revert "nfs: clear SB_RDONLY before getting superblock"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 547/614] Revert "nfs: ignore SB_RDONLY when remounting nfs" Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 549/614] Revert "nfs: ignore SB_RDONLY when mounting nfs" Greg Kroah-Hartman
` (79 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alkis Georgopoulos, Li Lingfeng,
Trond Myklebust, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit d216b698d44e33417ad4cc796cb04ccddbb8c0ee ]
This reverts commit 8cd9b785943c57a136536250da80ba1eb6f8eb18.
Silently ignoring the "ro" and "rw" mount options causes user confusion,
and regressions.
Reported-by: Alkis Georgopoulos<alkisg@gmail.com>
Cc: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 8cd9b785943c ("nfs: clear SB_RDONLY before getting superblock")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/super.c | 9 ---------
1 file changed, 9 deletions(-)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 527000f5d150c..9b9464e70a7f0 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1308,17 +1308,8 @@ int nfs_get_tree_common(struct fs_context *fc)
if (IS_ERR(server))
return PTR_ERR(server);
- /*
- * When NFS_MOUNT_UNSHARED is not set, NFS forces the sharing of a
- * superblock among each filesystem that mounts sub-directories
- * belonging to a single exported root path.
- * To prevent interference between different filesystems, the
- * SB_RDONLY flag should be removed from the superblock.
- */
if (server->flags & NFS_MOUNT_UNSHARED)
compare_super = NULL;
- else
- fc->sb_flags &= ~SB_RDONLY;
/* -o noac implies -o sync */
if (server->flags & NFS_MOUNT_NOAC)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 549/614] Revert "nfs: ignore SB_RDONLY when mounting nfs"
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 548/614] Revert "nfs: clear SB_RDONLY before getting superblock" Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 550/614] NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Greg Kroah-Hartman
` (78 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alkis Georgopoulos, Li Lingfeng,
Trond Myklebust, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit d4a26d34f1946142f9d32e540490e4926ae9a46b ]
This reverts commit 52cb7f8f177878b4f22397b9c4d2c8f743766be3.
Silently ignoring the "ro" and "rw" mount options causes user confusion,
and regressions.
Reported-by: Alkis Georgopoulos<alkisg@gmail.com>
Cc: Li Lingfeng <lilingfeng3@huawei.com>
Fixes: 52cb7f8f1778 ("nfs: ignore SB_RDONLY when mounting nfs")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/internal.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 2ecd38e1d17a8..ffd382aa31ac0 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -13,7 +13,7 @@
#include <linux/nfslocalio.h>
#include <linux/wait_bit.h>
-#define NFS_SB_MASK (SB_NOSUID|SB_NODEV|SB_NOEXEC|SB_SYNCHRONOUS)
+#define NFS_SB_MASK (SB_RDONLY|SB_NOSUID|SB_NODEV|SB_NOEXEC|SB_SYNCHRONOUS)
extern const struct export_operations nfs_export_ops;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 550/614] NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 549/614] Revert "nfs: ignore SB_RDONLY when mounting nfs" Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 551/614] NFS: Fix inheritance of the block sizes when automounting Greg Kroah-Hartman
` (77 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Lingfeng, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 8675c69816e4276b979ff475ee5fac4688f80125 ]
When a filesystem is being automounted, it needs to preserve the
user-set superblock mount options, such as the "ro" flag.
Reported-by: Li Lingfeng <lilingfeng3@huawei.com>
Link: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.com/
Fixes: f2aedb713c28 ("NFS: Add fs_context support.")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/namespace.c | 6 ++++++
fs/nfs/super.c | 4 ----
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 5a4d193da1a98..dca055676c4f3 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -149,6 +149,7 @@ struct vfsmount *nfs_d_automount(struct path *path)
struct vfsmount *mnt = ERR_PTR(-ENOMEM);
struct nfs_server *server = NFS_SB(path->dentry->d_sb);
struct nfs_client *client = server->nfs_client;
+ unsigned long s_flags = path->dentry->d_sb->s_flags;
int timeout = READ_ONCE(nfs_mountpoint_expiry_timeout);
int ret;
@@ -174,6 +175,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
fc->net_ns = get_net(client->cl_net);
}
+ /* Inherit the flags covered by NFS_SB_MASK */
+ fc->sb_flags_mask |= NFS_SB_MASK;
+ fc->sb_flags &= ~NFS_SB_MASK;
+ fc->sb_flags |= s_flags & NFS_SB_MASK;
+
/* for submounts we want the same server; referrals will reassign */
memcpy(&ctx->nfs_server._address, &client->cl_addr, client->cl_addrlen);
ctx->nfs_server.addrlen = client->cl_addrlen;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 9b9464e70a7f0..66413133b43e3 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1315,10 +1315,6 @@ int nfs_get_tree_common(struct fs_context *fc)
if (server->flags & NFS_MOUNT_NOAC)
fc->sb_flags |= SB_SYNCHRONOUS;
- if (ctx->clone_data.sb)
- if (ctx->clone_data.sb->s_flags & SB_SYNCHRONOUS)
- fc->sb_flags |= SB_SYNCHRONOUS;
-
/* Get a superblock - note that we may end up sharing one that already exists */
fc->s_fs_info = server;
s = sget_fc(fc, compare_super, nfs_set_super);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 551/614] NFS: Fix inheritance of the block sizes when automounting
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 550/614] NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 552/614] fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Greg Kroah-Hartman
` (76 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 2b092175f5e301cdaa935093edfef2be9defb6df ]
Only inherit the block sizes that were actually specified as mount
parameters for the parent mount.
Fixes: 62a55d088cd8 ("NFS: Additional refactoring for fs_context conversion")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/client.c | 21 +++++++++++++++++----
fs/nfs/internal.h | 1 -
fs/nfs/namespace.c | 5 ++++-
fs/nfs/nfs4client.c | 18 ++++++++++++++----
fs/nfs/super.c | 10 +++-------
include/linux/nfs_fs_sb.h | 5 +++++
6 files changed, 43 insertions(+), 17 deletions(-)
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 54699299d5b16..2aaea9c98c2cd 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -784,10 +784,18 @@ static int nfs_init_server(struct nfs_server *server,
server->fattr_valid = NFS_ATTR_FATTR_V4;
}
- if (ctx->rsize)
+ if (ctx->bsize) {
+ server->bsize = ctx->bsize;
+ server->automount_inherit |= NFS_AUTOMOUNT_INHERIT_BSIZE;
+ }
+ if (ctx->rsize) {
server->rsize = nfs_io_size(ctx->rsize, clp->cl_proto);
- if (ctx->wsize)
+ server->automount_inherit |= NFS_AUTOMOUNT_INHERIT_RSIZE;
+ }
+ if (ctx->wsize) {
server->wsize = nfs_io_size(ctx->wsize, clp->cl_proto);
+ server->automount_inherit |= NFS_AUTOMOUNT_INHERIT_WSIZE;
+ }
server->acregmin = ctx->acregmin * HZ;
server->acregmax = ctx->acregmax * HZ;
@@ -977,8 +985,13 @@ EXPORT_SYMBOL_GPL(nfs_probe_server);
void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source)
{
target->flags = source->flags;
- target->rsize = source->rsize;
- target->wsize = source->wsize;
+ target->automount_inherit = source->automount_inherit;
+ if (source->automount_inherit & NFS_AUTOMOUNT_INHERIT_BSIZE)
+ target->bsize = source->bsize;
+ if (source->automount_inherit & NFS_AUTOMOUNT_INHERIT_RSIZE)
+ target->rsize = source->rsize;
+ if (source->automount_inherit & NFS_AUTOMOUNT_INHERIT_WSIZE)
+ target->wsize = source->wsize;
target->acregmin = source->acregmin;
target->acregmax = source->acregmax;
target->acdirmin = source->acdirmin;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index ffd382aa31ac0..2e596244799f3 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -152,7 +152,6 @@ struct nfs_fs_context {
struct super_block *sb;
struct dentry *dentry;
struct nfs_fattr *fattr;
- unsigned int inherited_bsize;
} clone_data;
};
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index dca055676c4f3..9e4d94f41fc67 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -190,6 +190,10 @@ struct vfsmount *nfs_d_automount(struct path *path)
ctx->nfs_mod = client->cl_nfs_mod;
get_nfs_version(ctx->nfs_mod);
+ /* Inherit block sizes if they were specified as mount parameters */
+ if (server->automount_inherit & NFS_AUTOMOUNT_INHERIT_BSIZE)
+ ctx->bsize = server->bsize;
+
ret = client->rpc_ops->submount(fc, server);
if (ret < 0) {
mnt = ERR_PTR(ret);
@@ -289,7 +293,6 @@ int nfs_do_submount(struct fs_context *fc)
return -ENOMEM;
ctx->internal = true;
- ctx->clone_data.inherited_bsize = ctx->clone_data.sb->s_blocksize_bits;
p = nfs_devname(dentry, buffer, 4096);
if (IS_ERR(p)) {
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 3a4baed993c96..4ff0e9dd1145e 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1174,10 +1174,20 @@ static int nfs4_init_server(struct nfs_server *server, struct fs_context *fc)
if (error < 0)
return error;
- if (ctx->rsize)
- server->rsize = nfs_io_size(ctx->rsize, server->nfs_client->cl_proto);
- if (ctx->wsize)
- server->wsize = nfs_io_size(ctx->wsize, server->nfs_client->cl_proto);
+ if (ctx->bsize) {
+ server->bsize = ctx->bsize;
+ server->automount_inherit |= NFS_AUTOMOUNT_INHERIT_BSIZE;
+ }
+ if (ctx->rsize) {
+ server->rsize =
+ nfs_io_size(ctx->rsize, server->nfs_client->cl_proto);
+ server->automount_inherit |= NFS_AUTOMOUNT_INHERIT_RSIZE;
+ }
+ if (ctx->wsize) {
+ server->wsize =
+ nfs_io_size(ctx->wsize, server->nfs_client->cl_proto);
+ server->automount_inherit |= NFS_AUTOMOUNT_INHERIT_WSIZE;
+ }
server->acregmin = ctx->acregmin * HZ;
server->acregmax = ctx->acregmax * HZ;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 66413133b43e3..57d372db03b93 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1091,8 +1091,9 @@ static void nfs_fill_super(struct super_block *sb, struct nfs_fs_context *ctx)
sb->s_blocksize = 0;
sb->s_xattr = server->nfs_client->cl_nfs_mod->xattr;
sb->s_op = server->nfs_client->cl_nfs_mod->sops;
- if (ctx->bsize)
- sb->s_blocksize = nfs_block_size(ctx->bsize, &sb->s_blocksize_bits);
+ if (server->bsize)
+ sb->s_blocksize =
+ nfs_block_size(server->bsize, &sb->s_blocksize_bits);
switch (server->nfs_client->rpc_ops->version) {
case 2:
@@ -1338,13 +1339,8 @@ int nfs_get_tree_common(struct fs_context *fc)
}
if (!s->s_root) {
- unsigned bsize = ctx->clone_data.inherited_bsize;
/* initial superblock/root creation */
nfs_fill_super(s, ctx);
- if (bsize) {
- s->s_blocksize_bits = bsize;
- s->s_blocksize = 1U << bsize;
- }
error = nfs_get_cache_cookie(s, ctx);
if (error < 0)
goto error_splat_super;
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index d30c0245031c0..30ac384e011a4 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -172,6 +172,11 @@ struct nfs_server {
#define NFS_MOUNT_FORCE_RDIRPLUS 0x20000000
#define NFS_MOUNT_NETUNREACH_FATAL 0x40000000
+ unsigned int automount_inherit; /* Properties inherited by automount */
+#define NFS_AUTOMOUNT_INHERIT_BSIZE 0x0001
+#define NFS_AUTOMOUNT_INHERIT_RSIZE 0x0002
+#define NFS_AUTOMOUNT_INHERIT_WSIZE 0x0004
+
unsigned int caps; /* server capabilities */
__u64 fattr_valid; /* Valid attributes */
unsigned int rsize; /* read size */
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 552/614] fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 551/614] NFS: Fix inheritance of the block sizes when automounting Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 553/614] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Greg Kroah-Hartman
` (75 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Armin Wolf,
Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit c36f9d7b2869a003a2f7d6ff2c6bac9e62fd7d68 ]
After commit 25524b619029 ("fs/nls: Fix utf16 to utf8 conversion"),
the return values of utf8_to_utf32() and utf32_to_utf8() are
inconsistent when encountering an error: utf8_to_utf32() returns -1,
while utf32_to_utf8() returns errno codes. Fix this inconsistency
by modifying utf8_to_utf32() to return errno codes as well.
Fixes: 25524b619029 ("fs/nls: Fix utf16 to utf8 conversion")
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20251129111535.8984-1-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nls/nls_base.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
index d434c4463a8f7..a5c3a9f1b8dc5 100644
--- a/fs/nls/nls_base.c
+++ b/fs/nls/nls_base.c
@@ -67,19 +67,22 @@ int utf8_to_utf32(const u8 *s, int inlen, unicode_t *pu)
l &= t->lmask;
if (l < t->lval || l > UNICODE_MAX ||
(l & SURROGATE_MASK) == SURROGATE_PAIR)
- return -1;
+ return -EILSEQ;
+
*pu = (unicode_t) l;
return nc;
}
if (inlen <= nc)
- return -1;
+ return -EOVERFLOW;
+
s++;
c = (*s ^ 0x80) & 0xFF;
if (c & 0xC0)
- return -1;
+ return -EILSEQ;
+
l = (l << 6) | c;
}
- return -1;
+ return -EILSEQ;
}
EXPORT_SYMBOL(utf8_to_utf32);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 553/614] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 552/614] fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 554/614] ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() Greg Kroah-Hartman
` (74 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anton Khirnov, Andy Shevchenko,
Denis Benato, Ilpo Järvinen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Khirnov <anton@khirnov.net>
[ Upstream commit ccb61a328321ba3f8567e350664c9ca7a42b6c70 ]
kbd_led_set() can sleep, and so may not be used as the brightness_set()
callback.
Otherwise using this led with a trigger leads to system hangs
accompanied by:
BUG: scheduling while atomic: acpi_fakekeyd/2588/0x00000003
CPU: 4 UID: 0 PID: 2588 Comm: acpi_fakekeyd Not tainted 6.17.9+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.9-1
Hardware name: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B9403CVAR/B9403CVAR, BIOS B9403CVAR.311 12/24/2024
Call Trace:
<TASK>
[...]
schedule_timeout+0xbd/0x100
__down_common+0x175/0x290
down_timeout+0x67/0x70
acpi_os_wait_semaphore+0x57/0x90
[...]
asus_wmi_evaluate_method3+0x87/0x190 [asus_wmi]
led_trigger_event+0x3f/0x60
[...]
Fixes: 9fe44fc98ce4 ("platform/x86: asus-wmi: Simplify the keyboard brightness updating process")
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Denis Benato <benato.denis96@gmail.com>
Link: https://patch.msgid.link/20251129101307.18085-3-anton@khirnov.net
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/asus-wmi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index e72a2b5d158e9..8e3300f5c2943 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -1619,14 +1619,14 @@ static void do_kbd_led_set(struct led_classdev *led_cdev, int value)
kbd_led_update(asus);
}
-static void kbd_led_set(struct led_classdev *led_cdev,
- enum led_brightness value)
+static int kbd_led_set(struct led_classdev *led_cdev, enum led_brightness value)
{
/* Prevent disabling keyboard backlight on module unregister */
if (led_cdev->flags & LED_UNREGISTERING)
- return;
+ return 0;
do_kbd_led_set(led_cdev, value);
+ return 0;
}
static void kbd_led_set_by_kbd(struct asus_wmi *asus, enum led_brightness value)
@@ -1802,7 +1802,7 @@ static int asus_wmi_led_init(struct asus_wmi *asus)
asus->kbd_led_wk = led_val;
asus->kbd_led.name = "asus::kbd_backlight";
asus->kbd_led.flags = LED_BRIGHT_HW_CHANGED;
- asus->kbd_led.brightness_set = kbd_led_set;
+ asus->kbd_led.brightness_set_blocking = kbd_led_set;
asus->kbd_led.brightness_get = kbd_led_get;
asus->kbd_led.max_brightness = 3;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 554/614] ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 553/614] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 555/614] ASoC: amd: acp: Audio is not resuming after s0ix Greg Kroah-Hartman
` (73 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 0ebbd45c33d0049ebf5a22c1434567f0c420b333 ]
bcm63xx_soc_pcm_new() does not check the return value of
of_dma_configure(), which may fail with -EPROBE_DEFER or
other errors, allowing PCM setup to continue with incomplete
DMA configuration.
Add error checking for of_dma_configure() and return on failure.
Fixes: 88eb404ccc3e ("ASoC: brcm: Add DSL/PON SoC audio driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251202101642.492-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/bcm/bcm63xx-pcm-whistler.c b/sound/soc/bcm/bcm63xx-pcm-whistler.c
index e3a4fcc63a56d..efeb06ddabeb3 100644
--- a/sound/soc/bcm/bcm63xx-pcm-whistler.c
+++ b/sound/soc/bcm/bcm63xx-pcm-whistler.c
@@ -358,7 +358,9 @@ static int bcm63xx_soc_pcm_new(struct snd_soc_component *component,
i2s_priv = dev_get_drvdata(snd_soc_rtd_to_cpu(rtd, 0)->dev);
- of_dma_configure(pcm->card->dev, pcm->card->dev->of_node, 1);
+ ret = of_dma_configure(pcm->card->dev, pcm->card->dev->of_node, 1);
+ if (ret)
+ return ret;
ret = dma_coerce_mask_and_coherent(pcm->card->dev, DMA_BIT_MASK(32));
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 555/614] ASoC: amd: acp: Audio is not resuming after s0ix
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 554/614] ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 556/614] ASoC: ak4458: Disable regulator when error happens Greg Kroah-Hartman
` (72 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hemalatha Pinnamreddy,
Raghavendra Prasad Mallela, Mario Limonciello (AMD), Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
[ Upstream commit 3ee257aba1d56c3f0f1028669a8ad0f1a477f05b ]
Audio fails to resume after system exits suspend mode
due to accessing incorrect ring buffer address during
resume. This patch resolves issue by selecting correct
address based on the ACP version.
Fixes: f6f7d25b11033 ("ASoC: amd: acp: Add pte configuration for ACP7.0 platform")
Signed-off-by: Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
Signed-off-by: Raghavendra Prasad Mallela <raghavendraprasad.mallela@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20251203064650.2554625-1-raghavendraprasad.mallela@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/acp/acp-legacy-common.c | 30 +++++++++++++++++++++------
1 file changed, 24 insertions(+), 6 deletions(-)
diff --git a/sound/soc/amd/acp/acp-legacy-common.c b/sound/soc/amd/acp/acp-legacy-common.c
index 3078f459e0050..4e477c48d4bdd 100644
--- a/sound/soc/amd/acp/acp-legacy-common.c
+++ b/sound/soc/amd/acp/acp-legacy-common.c
@@ -219,7 +219,10 @@ static int set_acp_i2s_dma_fifo(struct snd_pcm_substream *substream,
SP_PB_FIFO_ADDR_OFFSET;
reg_fifo_addr = ACP_I2S_TX_FIFOADDR(chip);
reg_fifo_size = ACP_I2S_TX_FIFOSIZE(chip);
- phy_addr = I2S_SP_TX_MEM_WINDOW_START + stream->reg_offset;
+ if (chip->acp_rev >= ACP70_PCI_ID)
+ phy_addr = ACP7x_I2S_SP_TX_MEM_WINDOW_START;
+ else
+ phy_addr = I2S_SP_TX_MEM_WINDOW_START + stream->reg_offset;
writel(phy_addr, chip->base + ACP_I2S_TX_RINGBUFADDR(chip));
} else {
reg_dma_size = ACP_I2S_RX_DMA_SIZE(chip);
@@ -227,7 +230,10 @@ static int set_acp_i2s_dma_fifo(struct snd_pcm_substream *substream,
SP_CAPT_FIFO_ADDR_OFFSET;
reg_fifo_addr = ACP_I2S_RX_FIFOADDR(chip);
reg_fifo_size = ACP_I2S_RX_FIFOSIZE(chip);
- phy_addr = I2S_SP_RX_MEM_WINDOW_START + stream->reg_offset;
+ if (chip->acp_rev >= ACP70_PCI_ID)
+ phy_addr = ACP7x_I2S_SP_RX_MEM_WINDOW_START;
+ else
+ phy_addr = I2S_SP_RX_MEM_WINDOW_START + stream->reg_offset;
writel(phy_addr, chip->base + ACP_I2S_RX_RINGBUFADDR(chip));
}
break;
@@ -238,7 +244,10 @@ static int set_acp_i2s_dma_fifo(struct snd_pcm_substream *substream,
BT_PB_FIFO_ADDR_OFFSET;
reg_fifo_addr = ACP_BT_TX_FIFOADDR(chip);
reg_fifo_size = ACP_BT_TX_FIFOSIZE(chip);
- phy_addr = I2S_BT_TX_MEM_WINDOW_START + stream->reg_offset;
+ if (chip->acp_rev >= ACP70_PCI_ID)
+ phy_addr = ACP7x_I2S_BT_TX_MEM_WINDOW_START;
+ else
+ phy_addr = I2S_BT_TX_MEM_WINDOW_START + stream->reg_offset;
writel(phy_addr, chip->base + ACP_BT_TX_RINGBUFADDR(chip));
} else {
reg_dma_size = ACP_BT_RX_DMA_SIZE(chip);
@@ -246,7 +255,10 @@ static int set_acp_i2s_dma_fifo(struct snd_pcm_substream *substream,
BT_CAPT_FIFO_ADDR_OFFSET;
reg_fifo_addr = ACP_BT_RX_FIFOADDR(chip);
reg_fifo_size = ACP_BT_RX_FIFOSIZE(chip);
- phy_addr = I2S_BT_TX_MEM_WINDOW_START + stream->reg_offset;
+ if (chip->acp_rev >= ACP70_PCI_ID)
+ phy_addr = ACP7x_I2S_BT_RX_MEM_WINDOW_START;
+ else
+ phy_addr = I2S_BT_RX_MEM_WINDOW_START + stream->reg_offset;
writel(phy_addr, chip->base + ACP_BT_RX_RINGBUFADDR(chip));
}
break;
@@ -257,7 +269,10 @@ static int set_acp_i2s_dma_fifo(struct snd_pcm_substream *substream,
HS_PB_FIFO_ADDR_OFFSET;
reg_fifo_addr = ACP_HS_TX_FIFOADDR;
reg_fifo_size = ACP_HS_TX_FIFOSIZE;
- phy_addr = I2S_HS_TX_MEM_WINDOW_START + stream->reg_offset;
+ if (chip->acp_rev >= ACP70_PCI_ID)
+ phy_addr = ACP7x_I2S_HS_TX_MEM_WINDOW_START;
+ else
+ phy_addr = I2S_HS_TX_MEM_WINDOW_START + stream->reg_offset;
writel(phy_addr, chip->base + ACP_HS_TX_RINGBUFADDR);
} else {
reg_dma_size = ACP_HS_RX_DMA_SIZE;
@@ -265,7 +280,10 @@ static int set_acp_i2s_dma_fifo(struct snd_pcm_substream *substream,
HS_CAPT_FIFO_ADDR_OFFSET;
reg_fifo_addr = ACP_HS_RX_FIFOADDR;
reg_fifo_size = ACP_HS_RX_FIFOSIZE;
- phy_addr = I2S_HS_RX_MEM_WINDOW_START + stream->reg_offset;
+ if (chip->acp_rev >= ACP70_PCI_ID)
+ phy_addr = ACP7x_I2S_HS_RX_MEM_WINDOW_START;
+ else
+ phy_addr = I2S_HS_RX_MEM_WINDOW_START + stream->reg_offset;
writel(phy_addr, chip->base + ACP_HS_RX_RINGBUFADDR);
}
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 556/614] ASoC: ak4458: Disable regulator when error happens
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 555/614] ASoC: amd: acp: Audio is not resuming after s0ix Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 557/614] ASoC: ak5558: " Greg Kroah-Hartman
` (71 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit ae585fabb9713a43e358cf606451386757225c95 ]
Disable regulator in runtime resume when error happens to balance
the reference count of regulator.
Fixes: 7e3096e8f823 ("ASoC: ak4458: Add regulator support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20251203100529.3841203-2-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/ak4458.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
index 57cf601d3df35..a6c04dd3de3ed 100644
--- a/sound/soc/codecs/ak4458.c
+++ b/sound/soc/codecs/ak4458.c
@@ -671,7 +671,15 @@ static int ak4458_runtime_resume(struct device *dev)
regcache_cache_only(ak4458->regmap, false);
regcache_mark_dirty(ak4458->regmap);
- return regcache_sync(ak4458->regmap);
+ ret = regcache_sync(ak4458->regmap);
+ if (ret)
+ goto err;
+
+ return 0;
+err:
+ regcache_cache_only(ak4458->regmap, true);
+ regulator_bulk_disable(ARRAY_SIZE(ak4458->supplies), ak4458->supplies);
+ return ret;
}
static const struct snd_soc_component_driver soc_codec_dev_ak4458 = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 557/614] ASoC: ak5558: Disable regulator when error happens
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 556/614] ASoC: ak4458: Disable regulator when error happens Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 558/614] f2fs: revert summary entry count from 2048 to 512 in 16kb block support Greg Kroah-Hartman
` (70 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit 1f8f726a2a29c28f65b30880335a1610c5e63594 ]
Disable regulator in runtime resume when error happens to balance
the reference count of regulator.
Fixes: 2ff6d5a108c6 ("ASoC: ak5558: Add regulator support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20251203100529.3841203-3-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/ak5558.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/ak5558.c b/sound/soc/codecs/ak5558.c
index 683f3e472f500..73684fc5beb1a 100644
--- a/sound/soc/codecs/ak5558.c
+++ b/sound/soc/codecs/ak5558.c
@@ -372,7 +372,15 @@ static int ak5558_runtime_resume(struct device *dev)
regcache_cache_only(ak5558->regmap, false);
regcache_mark_dirty(ak5558->regmap);
- return regcache_sync(ak5558->regmap);
+ ret = regcache_sync(ak5558->regmap);
+ if (ret)
+ goto err;
+
+ return 0;
+err:
+ regcache_cache_only(ak5558->regmap, true);
+ regulator_bulk_disable(ARRAY_SIZE(ak5558->supplies), ak5558->supplies);
+ return ret;
}
static const struct dev_pm_ops ak5558_pm = {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 558/614] f2fs: revert summary entry count from 2048 to 512 in 16kb block support
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 557/614] ASoC: ak5558: " Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 559/614] blk-mq: Abort suspend when wakeup events are pending Greg Kroah-Hartman
` (69 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daeho Jeong, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
[ Upstream commit 7ee8bc3942f20964ad730871b885688ea3a2961a ]
The recent increase in the number of Segment Summary Area (SSA) entries
from 512 to 2048 was an unintentional change in logic of 16kb block
support. This commit corrects the issue.
To better utilize the space available from the erroneous 2048-entry
calculation, we are implementing a solution to share the currently
unused SSA space with neighboring segments. This enhances overall
SSA utilization without impacting the established 8MB segment size.
Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/f2fs.h | 2 +
fs/f2fs/gc.c | 117 +++++++++++++++++++++++-----------------
fs/f2fs/recovery.c | 2 +-
fs/f2fs/segment.c | 38 +++++++++----
fs/f2fs/segment.h | 8 ++-
fs/f2fs/super.c | 14 +++++
fs/f2fs/sysfs.c | 7 +++
include/linux/f2fs_fs.h | 5 +-
8 files changed, 130 insertions(+), 63 deletions(-)
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 5b4e9548a231f..5149f351f03d2 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -245,6 +245,7 @@ struct f2fs_mount_info {
#define F2FS_FEATURE_COMPRESSION 0x00002000
#define F2FS_FEATURE_RO 0x00004000
#define F2FS_FEATURE_DEVICE_ALIAS 0x00008000
+#define F2FS_FEATURE_PACKED_SSA 0x00010000
#define __F2FS_HAS_FEATURE(raw_super, mask) \
((raw_super->feature & cpu_to_le32(mask)) != 0)
@@ -4710,6 +4711,7 @@ F2FS_FEATURE_FUNCS(casefold, CASEFOLD);
F2FS_FEATURE_FUNCS(compression, COMPRESSION);
F2FS_FEATURE_FUNCS(readonly, RO);
F2FS_FEATURE_FUNCS(device_alias, DEVICE_ALIAS);
+F2FS_FEATURE_FUNCS(packed_ssa, PACKED_SSA);
#ifdef CONFIG_BLK_DEV_ZONED
static inline bool f2fs_zone_is_seq(struct f2fs_sb_info *sbi, int devi,
diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index 8abf521530ff3..af2f4d28462c0 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1732,7 +1732,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
unsigned char type = IS_DATASEG(get_seg_entry(sbi, segno)->type) ?
SUM_TYPE_DATA : SUM_TYPE_NODE;
unsigned char data_type = (type == SUM_TYPE_DATA) ? DATA : NODE;
- int submitted = 0;
+ int submitted = 0, sum_blk_cnt;
if (__is_large_section(sbi)) {
sec_end_segno = rounddown(end_segno, SEGS_PER_SEC(sbi));
@@ -1766,22 +1766,28 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
sanity_check_seg_type(sbi, get_seg_entry(sbi, segno)->type);
+ segno = rounddown(segno, SUMS_PER_BLOCK);
+ sum_blk_cnt = DIV_ROUND_UP(end_segno - segno, SUMS_PER_BLOCK);
/* readahead multi ssa blocks those have contiguous address */
if (__is_large_section(sbi))
f2fs_ra_meta_pages(sbi, GET_SUM_BLOCK(sbi, segno),
- end_segno - segno, META_SSA, true);
+ sum_blk_cnt, META_SSA, true);
/* reference all summary page */
while (segno < end_segno) {
- struct folio *sum_folio = f2fs_get_sum_folio(sbi, segno++);
+ struct folio *sum_folio = f2fs_get_sum_folio(sbi, segno);
+
+ segno += SUMS_PER_BLOCK;
if (IS_ERR(sum_folio)) {
int err = PTR_ERR(sum_folio);
- end_segno = segno - 1;
- for (segno = start_segno; segno < end_segno; segno++) {
+ end_segno = segno - SUMS_PER_BLOCK;
+ segno = rounddown(start_segno, SUMS_PER_BLOCK);
+ while (segno < end_segno) {
sum_folio = filemap_get_folio(META_MAPPING(sbi),
GET_SUM_BLOCK(sbi, segno));
folio_put_refs(sum_folio, 2);
+ segno += SUMS_PER_BLOCK;
}
return err;
}
@@ -1790,68 +1796,83 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
blk_start_plug(&plug);
- for (segno = start_segno; segno < end_segno; segno++) {
- struct f2fs_summary_block *sum;
+ segno = start_segno;
+ while (segno < end_segno) {
+ unsigned int cur_segno;
/* find segment summary of victim */
struct folio *sum_folio = filemap_get_folio(META_MAPPING(sbi),
GET_SUM_BLOCK(sbi, segno));
+ unsigned int block_end_segno = rounddown(segno, SUMS_PER_BLOCK)
+ + SUMS_PER_BLOCK;
+
+ if (block_end_segno > end_segno)
+ block_end_segno = end_segno;
if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno))) {
f2fs_err(sbi, "%s: segment %u is used by log",
__func__, segno);
f2fs_bug_on(sbi, 1);
- goto skip;
+ goto next_block;
}
- if (get_valid_blocks(sbi, segno, false) == 0)
- goto freed;
- if (gc_type == BG_GC && __is_large_section(sbi) &&
- migrated >= sbi->migration_granularity)
- goto skip;
if (!folio_test_uptodate(sum_folio) ||
unlikely(f2fs_cp_error(sbi)))
- goto skip;
+ goto next_block;
- sum = folio_address(sum_folio);
- if (type != GET_SUM_TYPE((&sum->footer))) {
- f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SIT and SSA",
- segno, type, GET_SUM_TYPE((&sum->footer)));
- f2fs_stop_checkpoint(sbi, false,
- STOP_CP_REASON_CORRUPTED_SUMMARY);
- goto skip;
- }
+ for (cur_segno = segno; cur_segno < block_end_segno;
+ cur_segno++) {
+ struct f2fs_summary_block *sum;
- /*
- * this is to avoid deadlock:
- * - lock_page(sum_page) - f2fs_replace_block
- * - check_valid_map() - down_write(sentry_lock)
- * - down_read(sentry_lock) - change_curseg()
- * - lock_page(sum_page)
- */
- if (type == SUM_TYPE_NODE)
- submitted += gc_node_segment(sbi, sum->entries, segno,
- gc_type);
- else
- submitted += gc_data_segment(sbi, sum->entries, gc_list,
- segno, gc_type,
- force_migrate);
+ if (get_valid_blocks(sbi, cur_segno, false) == 0)
+ goto freed;
+ if (gc_type == BG_GC && __is_large_section(sbi) &&
+ migrated >= sbi->migration_granularity)
+ continue;
- stat_inc_gc_seg_count(sbi, data_type, gc_type);
- sbi->gc_reclaimed_segs[sbi->gc_mode]++;
- migrated++;
+ sum = SUM_BLK_PAGE_ADDR(sum_folio, cur_segno);
+ if (type != GET_SUM_TYPE((&sum->footer))) {
+ f2fs_err(sbi, "Inconsistent segment (%u) type "
+ "[%d, %d] in SSA and SIT",
+ cur_segno, type,
+ GET_SUM_TYPE((&sum->footer)));
+ f2fs_stop_checkpoint(sbi, false,
+ STOP_CP_REASON_CORRUPTED_SUMMARY);
+ continue;
+ }
-freed:
- if (gc_type == FG_GC &&
- get_valid_blocks(sbi, segno, false) == 0)
- seg_freed++;
+ /*
+ * this is to avoid deadlock:
+ * - lock_page(sum_page) - f2fs_replace_block
+ * - check_valid_map() - down_write(sentry_lock)
+ * - down_read(sentry_lock) - change_curseg()
+ * - lock_page(sum_page)
+ */
+ if (type == SUM_TYPE_NODE)
+ submitted += gc_node_segment(sbi, sum->entries,
+ cur_segno, gc_type);
+ else
+ submitted += gc_data_segment(sbi, sum->entries,
+ gc_list, cur_segno,
+ gc_type, force_migrate);
- if (__is_large_section(sbi))
- sbi->next_victim_seg[gc_type] =
- (segno + 1 < sec_end_segno) ?
- segno + 1 : NULL_SEGNO;
-skip:
+ stat_inc_gc_seg_count(sbi, data_type, gc_type);
+ sbi->gc_reclaimed_segs[sbi->gc_mode]++;
+ migrated++;
+
+freed:
+ if (gc_type == FG_GC &&
+ get_valid_blocks(sbi, cur_segno, false) == 0)
+ seg_freed++;
+
+ if (__is_large_section(sbi))
+ sbi->next_victim_seg[gc_type] =
+ (cur_segno + 1 < sec_end_segno) ?
+ cur_segno + 1 : NULL_SEGNO;
+ }
+next_block:
folio_put_refs(sum_folio, 2);
+ segno = block_end_segno;
}
if (submitted)
diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
index 215e442db72c8..af72309b9bfc6 100644
--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -519,7 +519,7 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi,
sum_folio = f2fs_get_sum_folio(sbi, segno);
if (IS_ERR(sum_folio))
return PTR_ERR(sum_folio);
- sum_node = folio_address(sum_folio);
+ sum_node = SUM_BLK_PAGE_ADDR(sum_folio, segno);
sum = sum_node->entries[blkoff];
f2fs_folio_put(sum_folio, true);
got_it:
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index b45eace879d74..ac84559dc2693 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -2712,7 +2712,15 @@ struct folio *f2fs_get_sum_folio(struct f2fs_sb_info *sbi, unsigned int segno)
void f2fs_update_meta_page(struct f2fs_sb_info *sbi,
void *src, block_t blk_addr)
{
- struct folio *folio = f2fs_grab_meta_folio(sbi, blk_addr);
+ struct folio *folio;
+
+ if (SUMS_PER_BLOCK == 1)
+ folio = f2fs_grab_meta_folio(sbi, blk_addr);
+ else
+ folio = f2fs_get_meta_folio_retry(sbi, blk_addr);
+
+ if (IS_ERR(folio))
+ return;
memcpy(folio_address(folio), src, PAGE_SIZE);
folio_mark_dirty(folio);
@@ -2720,9 +2728,21 @@ void f2fs_update_meta_page(struct f2fs_sb_info *sbi,
}
static void write_sum_page(struct f2fs_sb_info *sbi,
- struct f2fs_summary_block *sum_blk, block_t blk_addr)
+ struct f2fs_summary_block *sum_blk, unsigned int segno)
{
- f2fs_update_meta_page(sbi, (void *)sum_blk, blk_addr);
+ struct folio *folio;
+
+ if (SUMS_PER_BLOCK == 1)
+ return f2fs_update_meta_page(sbi, (void *)sum_blk,
+ GET_SUM_BLOCK(sbi, segno));
+
+ folio = f2fs_get_sum_folio(sbi, segno);
+ if (IS_ERR(folio))
+ return;
+
+ memcpy(SUM_BLK_PAGE_ADDR(folio, segno), sum_blk, sizeof(*sum_blk));
+ folio_mark_dirty(folio);
+ f2fs_folio_put(folio, true);
}
static void write_current_sum_page(struct f2fs_sb_info *sbi,
@@ -2987,7 +3007,7 @@ static int new_curseg(struct f2fs_sb_info *sbi, int type, bool new_sec)
int ret;
if (curseg->inited)
- write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, segno));
+ write_sum_page(sbi, curseg->sum_blk, segno);
segno = __get_next_segno(sbi, type);
ret = get_new_segment(sbi, &segno, new_sec, pinning);
@@ -3046,7 +3066,7 @@ static int change_curseg(struct f2fs_sb_info *sbi, int type)
struct folio *sum_folio;
if (curseg->inited)
- write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, curseg->segno));
+ write_sum_page(sbi, curseg->sum_blk, curseg->segno);
__set_test_and_inuse(sbi, new_segno);
@@ -3065,7 +3085,7 @@ static int change_curseg(struct f2fs_sb_info *sbi, int type)
memset(curseg->sum_blk, 0, SUM_ENTRY_SIZE);
return PTR_ERR(sum_folio);
}
- sum_node = folio_address(sum_folio);
+ sum_node = SUM_BLK_PAGE_ADDR(sum_folio, new_segno);
memcpy(curseg->sum_blk, sum_node, SUM_ENTRY_SIZE);
f2fs_folio_put(sum_folio, true);
return 0;
@@ -3154,8 +3174,7 @@ static void __f2fs_save_inmem_curseg(struct f2fs_sb_info *sbi, int type)
goto out;
if (get_valid_blocks(sbi, curseg->segno, false)) {
- write_sum_page(sbi, curseg->sum_blk,
- GET_SUM_BLOCK(sbi, curseg->segno));
+ write_sum_page(sbi, curseg->sum_blk, curseg->segno);
} else {
mutex_lock(&DIRTY_I(sbi)->seglist_lock);
__set_test_and_free(sbi, curseg->segno, true);
@@ -3833,8 +3852,7 @@ int f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct folio *folio,
if (segment_full) {
if (type == CURSEG_COLD_DATA_PINNED &&
!((curseg->segno + 1) % sbi->segs_per_sec)) {
- write_sum_page(sbi, curseg->sum_blk,
- GET_SUM_BLOCK(sbi, curseg->segno));
+ write_sum_page(sbi, curseg->sum_blk, curseg->segno);
reset_curseg_fields(curseg);
goto skip_new_segment;
}
diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
index 1ce2c8abaf488..e883f14c228f2 100644
--- a/fs/f2fs/segment.h
+++ b/fs/f2fs/segment.h
@@ -85,8 +85,12 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi,
#define GET_ZONE_FROM_SEG(sbi, segno) \
GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno))
-#define GET_SUM_BLOCK(sbi, segno) \
- ((sbi)->sm_info->ssa_blkaddr + (segno))
+#define SUMS_PER_BLOCK (F2FS_BLKSIZE / F2FS_SUM_BLKSIZE)
+#define GET_SUM_BLOCK(sbi, segno) \
+ (SM_I(sbi)->ssa_blkaddr + (segno / SUMS_PER_BLOCK))
+#define GET_SUM_BLKOFF(segno) (segno % SUMS_PER_BLOCK)
+#define SUM_BLK_PAGE_ADDR(folio, segno) \
+ (folio_address(folio) + GET_SUM_BLKOFF(segno) * F2FS_SUM_BLKSIZE)
#define GET_SUM_TYPE(footer) ((footer)->entry_type)
#define SET_SUM_TYPE(footer, type) ((footer)->entry_type = (type))
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index db7afb8064115..9085b4a511a48 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4051,6 +4051,20 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
if (sanity_check_area_boundary(sbi, folio, index))
return -EFSCORRUPTED;
+ /*
+ * Check for legacy summary layout on 16KB+ block devices.
+ * Modern f2fs-tools packs multiple 4KB summary areas into one block,
+ * whereas legacy versions used one block per summary, leading
+ * to a much larger SSA.
+ */
+ if (SUMS_PER_BLOCK > 1 &&
+ !(__F2FS_HAS_FEATURE(raw_super, F2FS_FEATURE_PACKED_SSA))) {
+ f2fs_info(sbi, "Error: Device formatted with a legacy version. "
+ "Please reformat with a tool supporting the packed ssa "
+ "feature for block sizes larger than 4kb.");
+ return -EOPNOTSUPP;
+ }
+
return 0;
}
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index 6d2a4fba68a29..5685b454bfd12 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -235,6 +235,9 @@ static ssize_t features_show(struct f2fs_attr *a,
if (f2fs_sb_has_compression(sbi))
len += sysfs_emit_at(buf, len, "%s%s",
len ? ", " : "", "compression");
+ if (f2fs_sb_has_packed_ssa(sbi))
+ len += sysfs_emit_at(buf, len, "%s%s",
+ len ? ", " : "", "packed_ssa");
len += sysfs_emit_at(buf, len, "%s%s",
len ? ", " : "", "pin_file");
len += sysfs_emit_at(buf, len, "\n");
@@ -1296,6 +1299,7 @@ F2FS_FEATURE_RO_ATTR(pin_file);
#ifdef CONFIG_UNICODE
F2FS_FEATURE_RO_ATTR(linear_lookup);
#endif
+F2FS_FEATURE_RO_ATTR(packed_ssa);
#define ATTR_LIST(name) (&f2fs_attr_##name.attr)
static struct attribute *f2fs_attrs[] = {
@@ -1455,6 +1459,7 @@ static struct attribute *f2fs_feat_attrs[] = {
#ifdef CONFIG_UNICODE
BASE_ATTR_LIST(linear_lookup),
#endif
+ BASE_ATTR_LIST(packed_ssa),
NULL,
};
ATTRIBUTE_GROUPS(f2fs_feat);
@@ -1490,6 +1495,7 @@ F2FS_SB_FEATURE_RO_ATTR(casefold, CASEFOLD);
F2FS_SB_FEATURE_RO_ATTR(compression, COMPRESSION);
F2FS_SB_FEATURE_RO_ATTR(readonly, RO);
F2FS_SB_FEATURE_RO_ATTR(device_alias, DEVICE_ALIAS);
+F2FS_SB_FEATURE_RO_ATTR(packed_ssa, PACKED_SSA);
static struct attribute *f2fs_sb_feat_attrs[] = {
ATTR_LIST(sb_encryption),
@@ -1507,6 +1513,7 @@ static struct attribute *f2fs_sb_feat_attrs[] = {
ATTR_LIST(sb_compression),
ATTR_LIST(sb_readonly),
ATTR_LIST(sb_device_alias),
+ ATTR_LIST(sb_packed_ssa),
NULL,
};
ATTRIBUTE_GROUPS(f2fs_sb_feat);
diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
index 6afb4a13b81d6..a7880787cad36 100644
--- a/include/linux/f2fs_fs.h
+++ b/include/linux/f2fs_fs.h
@@ -17,6 +17,7 @@
#define F2FS_LOG_SECTORS_PER_BLOCK (PAGE_SHIFT - 9) /* log number for sector/blk */
#define F2FS_BLKSIZE PAGE_SIZE /* support only block == page */
#define F2FS_BLKSIZE_BITS PAGE_SHIFT /* bits for F2FS_BLKSIZE */
+#define F2FS_SUM_BLKSIZE 4096 /* only support 4096 byte sum block */
#define F2FS_MAX_EXTENSION 64 /* # of extension entries */
#define F2FS_EXTENSION_LEN 8 /* max size of extension */
@@ -441,7 +442,7 @@ struct f2fs_sit_block {
* from node's page's beginning to get a data block address.
* ex) data_blkaddr = (block_t)(nodepage_start_address + ofs_in_node)
*/
-#define ENTRIES_IN_SUM (F2FS_BLKSIZE / 8)
+#define ENTRIES_IN_SUM (F2FS_SUM_BLKSIZE / 8)
#define SUMMARY_SIZE (7) /* sizeof(struct f2fs_summary) */
#define SUM_FOOTER_SIZE (5) /* sizeof(struct summary_footer) */
#define SUM_ENTRY_SIZE (SUMMARY_SIZE * ENTRIES_IN_SUM)
@@ -467,7 +468,7 @@ struct summary_footer {
__le32 check_sum; /* summary checksum */
} __packed;
-#define SUM_JOURNAL_SIZE (F2FS_BLKSIZE - SUM_FOOTER_SIZE -\
+#define SUM_JOURNAL_SIZE (F2FS_SUM_BLKSIZE - SUM_FOOTER_SIZE -\
SUM_ENTRY_SIZE)
#define NAT_JOURNAL_ENTRIES ((SUM_JOURNAL_SIZE - 2) /\
sizeof(struct nat_journal_entry))
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 559/614] blk-mq: Abort suspend when wakeup events are pending
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 558/614] f2fs: revert summary entry count from 2048 to 512 in 16kb block support Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 560/614] drm/panel: novatek-nt35560: avoid on-stack device structure Greg Kroah-Hartman
` (68 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cong Zhang, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Zhang <cong.zhang@oss.qualcomm.com>
[ Upstream commit c196bf43d706592d8801a7513603765080e495fb ]
During system suspend, wakeup capable IRQs for block device can be
delayed, which can cause blk_mq_hctx_notify_offline() to hang
indefinitely while waiting for pending request to complete.
Skip the request waiting loop and abort suspend when wakeup events are
pending to prevent the deadlock.
Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline")
Signed-off-by: Cong Zhang <cong.zhang@oss.qualcomm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index d626d32f6e576..33a0062f9e56d 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -23,6 +23,7 @@
#include <linux/cache.h>
#include <linux/sched/topology.h>
#include <linux/sched/signal.h>
+#include <linux/suspend.h>
#include <linux/delay.h>
#include <linux/crash_dump.h>
#include <linux/prefetch.h>
@@ -3707,6 +3708,7 @@ static int blk_mq_hctx_notify_offline(unsigned int cpu, struct hlist_node *node)
{
struct blk_mq_hw_ctx *hctx = hlist_entry_safe(node,
struct blk_mq_hw_ctx, cpuhp_online);
+ int ret = 0;
if (blk_mq_hctx_has_online_cpu(hctx, cpu))
return 0;
@@ -3727,12 +3729,24 @@ static int blk_mq_hctx_notify_offline(unsigned int cpu, struct hlist_node *node)
* frozen and there are no requests.
*/
if (percpu_ref_tryget(&hctx->queue->q_usage_counter)) {
- while (blk_mq_hctx_has_requests(hctx))
+ while (blk_mq_hctx_has_requests(hctx)) {
+ /*
+ * The wakeup capable IRQ handler of block device is
+ * not called during suspend. Skip the loop by checking
+ * pm_wakeup_pending to prevent the deadlock and improve
+ * suspend latency.
+ */
+ if (pm_wakeup_pending()) {
+ clear_bit(BLK_MQ_S_INACTIVE, &hctx->state);
+ ret = -EBUSY;
+ break;
+ }
msleep(5);
+ }
percpu_ref_put(&hctx->queue->q_usage_counter);
}
- return 0;
+ return ret;
}
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 560/614] drm/panel: novatek-nt35560: avoid on-stack device structure
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 559/614] blk-mq: Abort suspend when wakeup events are pending Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 561/614] block: fix comment for op_is_zone_mgmt() to include RESET_ALL Greg Kroah-Hartman
` (67 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Douglas Anderson,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 1a7a7b80a22448dff55e1ad69a4681fd8b760b85 ]
A cleanup patch apparently by accident used a local device structure
instead of a pointer to one in the nt35560_read_id() function, causing
a warning about stack usage:
drivers/gpu/drm/panel/panel-novatek-nt35560.c: In function 'nt35560_read_id':
drivers/gpu/drm/panel/panel-novatek-nt35560.c:249:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
Change this to a pointer as was liley intended here.
Fixes: 5fbc0dbb92d6 ("drm/panel: novatek-nt35560: Clean up driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20251204094550.1030506-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-novatek-nt35560.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
index 561e6643dcbb6..6e5173f98a226 100644
--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
@@ -213,7 +213,7 @@ static const struct backlight_properties nt35560_bl_props = {
static void nt35560_read_id(struct mipi_dsi_multi_context *dsi_ctx)
{
- struct device dev = dsi_ctx->dsi->dev;
+ struct device *dev = &dsi_ctx->dsi->dev;
u8 vendor, version, panel;
u16 val;
@@ -225,7 +225,7 @@ static void nt35560_read_id(struct mipi_dsi_multi_context *dsi_ctx)
return;
if (vendor == 0x00) {
- dev_err(&dev, "device vendor ID is zero\n");
+ dev_err(dev, "device vendor ID is zero\n");
dsi_ctx->accum_err = -ENODEV;
return;
}
@@ -236,12 +236,12 @@ static void nt35560_read_id(struct mipi_dsi_multi_context *dsi_ctx)
case DISPLAY_SONY_ACX424AKP_ID2:
case DISPLAY_SONY_ACX424AKP_ID3:
case DISPLAY_SONY_ACX424AKP_ID4:
- dev_info(&dev,
+ dev_info(dev,
"MTP vendor: %02x, version: %02x, panel: %02x\n",
vendor, version, panel);
break;
default:
- dev_info(&dev,
+ dev_info(dev,
"unknown vendor: %02x, version: %02x, panel: %02x\n",
vendor, version, panel);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 561/614] block: fix comment for op_is_zone_mgmt() to include RESET_ALL
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 560/614] drm/panel: novatek-nt35560: avoid on-stack device structure Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 562/614] block: fix memory leak in __blkdev_issue_zero_pages Greg Kroah-Hartman
` (66 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, shechenglong, Damien Le Moal,
Johannes Thumshirn, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: shechenglong <shechenglong@xfusion.com>
[ Upstream commit 8a32282175c964eb15638e8dfe199fc13c060f67 ]
REQ_OP_ZONE_RESET_ALL is a zone management request, and op_is_zone_mgmt()
has returned true for it.
Update the comment to remove the misleading exception note so
the documentation matches the implementation.
Fixes: 12a1c9353c47 ("block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL")
Signed-off-by: shechenglong <shechenglong@xfusion.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/blk_types.h | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 44c30183ecc34..4e2e3aed32f5f 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -469,10 +469,7 @@ static inline bool op_is_discard(blk_opf_t op)
}
/*
- * Check if a bio or request operation is a zone management operation, with
- * the exception of REQ_OP_ZONE_RESET_ALL which is treated as a special case
- * due to its different handling in the block layer and device response in
- * case of command failure.
+ * Check if a bio or request operation is a zone management operation.
*/
static inline bool op_is_zone_mgmt(enum req_op op)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 562/614] block: fix memory leak in __blkdev_issue_zero_pages
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 561/614] block: fix comment for op_is_zone_mgmt() to include RESET_ALL Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 563/614] nvme-auth: use kvfree() for memory allocated with kvcalloc() Greg Kroah-Hartman
` (65 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+527a7e48a3d3d315d862,
Shaurya Rane, Keith Busch, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
[ Upstream commit f7e3f852a42d7cd8f1af2c330d9d153e30c8adcf ]
Move the fatal signal check before bio_alloc() to prevent a memory
leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending.
Previously, the bio was allocated before checking for a fatal signal.
If a signal was pending, the code would break out of the loop without
freeing or chaining the just-allocated bio, causing a memory leak.
This matches the pattern already used in __blkdev_issue_write_zeroes()
where the signal check precedes the allocation.
Fixes: bf86bcdb4012 ("blk-lib: check for kill signal in ioctl BLKZEROOUT")
Reported-by: syzbot+527a7e48a3d3d315d862@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=527a7e48a3d3d315d862
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Tested-by: syzbot+527a7e48a3d3d315d862@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-lib.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/block/blk-lib.c b/block/blk-lib.c
index 3030a772d3aa0..352e3c0f8a7d7 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -202,13 +202,13 @@ static void __blkdev_issue_zero_pages(struct block_device *bdev,
unsigned int nr_vecs = __blkdev_sectors_to_bio_pages(nr_sects);
struct bio *bio;
- bio = bio_alloc(bdev, nr_vecs, REQ_OP_WRITE, gfp_mask);
- bio->bi_iter.bi_sector = sector;
-
if ((flags & BLKDEV_ZERO_KILLABLE) &&
fatal_signal_pending(current))
break;
+ bio = bio_alloc(bdev, nr_vecs, REQ_OP_WRITE, gfp_mask);
+ bio->bi_iter.bi_sector = sector;
+
do {
unsigned int len;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 563/614] nvme-auth: use kvfree() for memory allocated with kvcalloc()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 562/614] block: fix memory leak in __blkdev_issue_zero_pages Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 564/614] io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Greg Kroah-Hartman
` (64 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Israel Rukshin, Max Gurtovoy,
Christoph Hellwig, Keith Busch, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Israel Rukshin <israelr@nvidia.com>
[ Upstream commit bb9f4cca7c031de6f0e85f7ba24abf0172829f85 ]
Memory allocated by kvcalloc() may come from vmalloc or kmalloc,
so use kvfree() instead of kfree() for proper deallocation.
Fixes: aa36d711e945 ("nvme-auth: convert dhchap_auth_list to an array")
Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index a01178caf15bb..8f3ccb317e4de 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -1122,7 +1122,7 @@ void nvme_auth_free(struct nvme_ctrl *ctrl)
if (ctrl->dhchap_ctxs) {
for (i = 0; i < ctrl_max_dhchaps(ctrl); i++)
nvme_auth_free_dhchap(&ctrl->dhchap_ctxs[i]);
- kfree(ctrl->dhchap_ctxs);
+ kvfree(ctrl->dhchap_ctxs);
}
if (ctrl->host_key) {
nvme_auth_free_key(ctrl->host_key);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 564/614] io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 563/614] nvme-auth: use kvfree() for memory allocated with kvcalloc() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 565/614] drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() Greg Kroah-Hartman
` (63 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Caleb Sander Mateos, Joanne Koong,
Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Caleb Sander Mateos <csander@purestorage.com>
[ Upstream commit 78385c7299f7514697d196b3233a91bd5e485591 ]
The struct io_uring_buf elements in a buffer ring are in a memory region
accessible from userspace. A malicious/buggy userspace program could
therefore write to them at any time, so they should be accessed with
READ_ONCE() in the kernel. Commit 98b6fa62c84f ("io_uring/kbuf: always
use READ_ONCE() to read ring provided buffer lengths") already switched
the reads of the len field to READ_ONCE(). Do the same for bid and addr.
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Cc: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
io_uring/kbuf.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index a727e020fe036..d974381d93ff7 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -44,7 +44,7 @@ static bool io_kbuf_inc_commit(struct io_buffer_list *bl, int len)
buf_len -= this_len;
/* Stop looping for invalid buffer length of 0 */
if (buf_len || !this_len) {
- buf->addr += this_len;
+ buf->addr = READ_ONCE(buf->addr) + this_len;
buf->len = buf_len;
return false;
}
@@ -198,9 +198,9 @@ static struct io_br_sel io_ring_buffer_select(struct io_kiocb *req, size_t *len,
if (*len == 0 || *len > buf_len)
*len = buf_len;
req->flags |= REQ_F_BUFFER_RING | REQ_F_BUFFERS_COMMIT;
- req->buf_index = buf->bid;
+ req->buf_index = READ_ONCE(buf->bid);
sel.buf_list = bl;
- sel.addr = u64_to_user_ptr(buf->addr);
+ sel.addr = u64_to_user_ptr(READ_ONCE(buf->addr));
if (io_should_commit(req, issue_flags)) {
io_kbuf_commit(req, sel.buf_list, *len, 1);
@@ -280,7 +280,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
if (!arg->max_len)
arg->max_len = INT_MAX;
- req->buf_index = buf->bid;
+ req->buf_index = READ_ONCE(buf->bid);
do {
u32 len = READ_ONCE(buf->len);
@@ -295,7 +295,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
}
}
- iov->iov_base = u64_to_user_ptr(buf->addr);
+ iov->iov_base = u64_to_user_ptr(READ_ONCE(buf->addr));
iov->iov_len = len;
iov++;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 565/614] drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 564/614] io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 566/614] regulator: fixed: Rely on the core freeing the enable GPIO Greg Kroah-Hartman
` (62 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter,
Javier Martinez Canillas, Zack Rusin, Maxime Ripard, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 479acb9db3199cdb70e5478a6f633b5f20c7d8df ]
The drm_property_create_signed_range() function doesn't return error
pointers it returns NULL on error. Fix the error checking to match.
Fixes: 8f7179a1027d ("drm/atomic: Add support for mouse hotspots")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/aTB023cfcIPkCsFS@stanley.mountain
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_plane.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index a30493ed97157..4cadea997129d 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -338,14 +338,14 @@ static int drm_plane_create_hotspot_properties(struct drm_plane *plane)
prop_x = drm_property_create_signed_range(plane->dev, 0, "HOTSPOT_X",
INT_MIN, INT_MAX);
- if (IS_ERR(prop_x))
- return PTR_ERR(prop_x);
+ if (!prop_x)
+ return -ENOMEM;
prop_y = drm_property_create_signed_range(plane->dev, 0, "HOTSPOT_Y",
INT_MIN, INT_MAX);
- if (IS_ERR(prop_y)) {
+ if (!prop_y) {
drm_property_destroy(plane->dev, prop_x);
- return PTR_ERR(prop_y);
+ return -ENOMEM;
}
drm_object_attach_property(&plane->base, prop_x, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 566/614] regulator: fixed: Rely on the core freeing the enable GPIO
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 565/614] drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 567/614] ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events Greg Kroah-Hartman
` (61 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diederik de Haas, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
[ Upstream commit 79a45ddcdbba330f5139c7c7ff7042d69cf147b2 ]
In order to simplify ownership rules for enable GPIOs supplied by drivers
regulator_register() always takes ownership of them, even if it ends up
failing for some other reason. We therefore should not free the GPIO if
registration fails but just let the core worry about things.
Fixes: 636f4618b1cd (regulator: fixed: fix GPIO descriptor leak on register failure)
Reported-by: Diederik de Haas <diederik@cknow-tech.com>
Closes: https://lore.kernel.org/r/DEPEYUF5BRGY.UKFBWRRE8HNP@cknow-tech.com
Tested-by: Diederik de Haas <diederik@cknow-tech.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://patch.msgid.link/20251204-regulator-fixed-fix-gpiod-leak-v1-1-48efea5b82c2@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/fixed.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index a2d16e9abfb58..254c0a8a45559 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -330,13 +330,10 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
drvdata->dev = devm_regulator_register(&pdev->dev, &drvdata->desc,
&cfg);
- if (IS_ERR(drvdata->dev)) {
- ret = dev_err_probe(&pdev->dev, PTR_ERR(drvdata->dev),
- "Failed to register regulator: %ld\n",
- PTR_ERR(drvdata->dev));
- gpiod_put(cfg.ena_gpiod);
- return ret;
- }
+ if (IS_ERR(drvdata->dev))
+ return dev_err_probe(&pdev->dev, PTR_ERR(drvdata->dev),
+ "Failed to register regulator: %ld\n",
+ PTR_ERR(drvdata->dev));
platform_set_drvdata(pdev, drvdata);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 567/614] ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 566/614] regulator: fixed: Rely on the core freeing the enable GPIO Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 568/614] drm/nouveau: refactor deprecated strcpy Greg Kroah-Hartman
` (60 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Takashi Iwai, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 210d77cca3d0494ed30a5c628b20c1d95fa04fb1 ]
The DSP event handling code in hwdep_read() could write more bytes to
the user buffer than requested, when a user provides a buffer smaller
than the event header size (8 bytes).
Fix by using min_t() to clamp the copy size, This ensures we never copy
more than the user requested.
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB78810656377E79E58350D951AFD9A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/firewire/motu/motu-hwdep.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c
index 981c19430cb0f..6675b23aad69e 100644
--- a/sound/firewire/motu/motu-hwdep.c
+++ b/sound/firewire/motu/motu-hwdep.c
@@ -83,10 +83,11 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
event.motu_register_dsp_change.type = SNDRV_FIREWIRE_EVENT_MOTU_REGISTER_DSP_CHANGE;
event.motu_register_dsp_change.count =
(consumed - sizeof(event.motu_register_dsp_change)) / 4;
- if (copy_to_user(buf, &event, sizeof(event.motu_register_dsp_change)))
+ if (copy_to_user(buf, &event,
+ min_t(long, count, sizeof(event.motu_register_dsp_change))))
return -EFAULT;
- count = consumed;
+ count = min_t(long, count, consumed);
} else {
spin_unlock_irq(&motu->lock);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 568/614] drm/nouveau: refactor deprecated strcpy
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 567/614] ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 569/614] drm/nouveau: fix circular dep oops from vendored i2c encoder Greg Kroah-Hartman
` (59 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Madhur Kumar, Lyude Paul,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhur Kumar <madhurkumar004@gmail.com>
[ Upstream commit 2bdc2c0e12fac56e41ec05fb771ead986ea6dac0 ]
strcpy() has been deprecated because it performs no bounds checking on the
destination buffer, which can lead to buffer overflows. Use the safer
strscpy() instead.
Signed-off-by: Madhur Kumar <madhurkumar004@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Fixes: 15a996bbb697 ("drm/nouveau: assign fence_chan->name correctly")
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20251204120822.17502-1-madhurkumar004@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_fence.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 869d4335c0f45..4a193b7d6d9e4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -183,11 +183,11 @@ nouveau_fence_context_new(struct nouveau_channel *chan, struct nouveau_fence_cha
fctx->context = drm->runl[chan->runlist].context_base + chan->chid;
if (chan == drm->cechan)
- strcpy(fctx->name, "copy engine channel");
+ strscpy(fctx->name, "copy engine channel");
else if (chan == drm->channel)
- strcpy(fctx->name, "generic kernel channel");
+ strscpy(fctx->name, "generic kernel channel");
else
- strcpy(fctx->name, cli->name);
+ strscpy(fctx->name, cli->name);
kref_init(&fctx->fence_ref);
if (!priv->uevent)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 569/614] drm/nouveau: fix circular dep oops from vendored i2c encoder
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 568/614] drm/nouveau: refactor deprecated strcpy Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 570/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 Greg Kroah-Hartman
` (58 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, René Rebe, Lyude Paul,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <rene@exactco.de>
[ Upstream commit d84e47edf156a953ed340ba6a202dcd3ea39ba0a ]
Since commit a73583107af9 ("drm/nouveau: vendor in drm_encoder_slave API")
nouveau appears to be broken for all dispnv04 GPUs (before NV50). Depending
on the kernel version, either having no display output and hanging in
kernel for a long time, or even oopsing in the cleanup path like:
Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac
...
nouveau 0000:0a:00.0: drm: 0x14C5: Parsing digital output script table
BUG: Unable to handle kernel data access on read at 0x00041520
Faulting instruction address: 0xc0003d0001be0844
Oops: Kernel access of bad area, sig: 11 [#1]
BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=8 NUMA PowerMac
Modules linked in: windfarm_cpufreq_clamp windfarm_smu_sensors windfarm_smu_controls windfarm_pm112 snd_aoa_codec_onyx snd_aoa_fabric_layout snd_aoa windfarm_pid jo
apple_mfi_fastcharge rndis_host cdc_ether usbnet mii snd_aoa_i2sbus snd_aoa_soundbus snd_pcm snd_timer snd soundcore rack_meter windfarm_smu_sat windfarm_max6690_s
m75_sensor windfarm_core gpu_sched drm_gpuvm drm_exec drm_client_lib drm_ttm_helper ttm drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks syscopyar
_sys_fops i2c_algo_bit backlight uio_pdrv_genirq uio uninorth_agp agpgart zram dm_mod dax ipv6 nfsv4 dns_resolver nfs lockd grace sunrpc offb cfbfillrect cfbimgblt
ont input_leds sr_mod cdrom sd_mod uas ata_generic hid_apple hid_generic usbhid hid usb_storage pata_macio sata_svw libata firewire_ohci scsi_mod firewire_core ohci
ehci_pci ehci_hcd tg3 ohci_hcd libphy usbcore usb_common nls_base
led_class
CPU: 0 UID: 0 PID: 245 Comm: (udev-worker) Not tainted 6.14.0-09584-g7d06015d936c #7 PREEMPTLAZY
Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac
NIP: c0003d0001be0844 LR: c0003d0001be0830 CTR: 0000000000000000
REGS: c0000000053f70e0 TRAP: 0300 Not tainted (6.14.0-09584-g7d06015d936c)
MSR: 9000000000009032 <SF,HV,EE,ME,IR,DR,RI> CR: 24222220 XER: 00000000
DAR: 0000000000041520 DSISR: 40000000 IRQMASK: 0 \x0aGPR00: c0003d0001be0830 c0000000053f7380 c0003d0000911900 c000000007bc6800 \x0aGPR04: 0000000000000000 0000000000000000 c000000007bc6e70 0000000000000001 \x0aGPR08: 01f3040000000000 0000000000041520 0000000000000000 c0003d0000813958 \x0aGPR12: c000000000071a48 c000000000e28000 0000000000000020 0000000000000000 \x0aGPR16: 0000000000000000 0000000000f52630 0000000000000000 0000000000000000 \x0aGPR20: 0000000000000000 0000000000000000 0000000000000001 c0003d0000928528 \x0aGPR24: c0003d0000928598 0000000000000000 c000000007025480 c000000007025480 \x0aGPR28: c0000000010b4000 0000000000000000 c000000007bc1800 c000000007bc6800
NIP [c0003d0001be0844] nv_crtc_destroy+0x44/0xd4 [nouveau]
LR [c0003d0001be0830] nv_crtc_destroy+0x30/0xd4 [nouveau]
Call Trace:
[c0000000053f7380] [c0003d0001be0830] nv_crtc_destroy+0x30/0xd4 [nouveau] (unreliable)
[c0000000053f73c0] [c0003d00007f7bf4] drm_mode_config_cleanup+0x27c/0x30c [drm]
[c0000000053f7490] [c0003d0001bdea50] nouveau_display_create+0x1cc/0x550 [nouveau]
[c0000000053f7500] [c0003d0001bcc29c] nouveau_drm_device_init+0x1c8/0x844 [nouveau]
[c0000000053f75e0] [c0003d0001bcc9ec] nouveau_drm_probe+0xd4/0x1e0 [nouveau]
[c0000000053f7670] [c000000000557d24] local_pci_probe+0x50/0xa8
[c0000000053f76f0] [c000000000557fa8] pci_device_probe+0x22c/0x240
[c0000000053f7760] [c0000000005fff3c] really_probe+0x188/0x31c
[c0000000053f77e0] [c000000000600204] __driver_probe_device+0x134/0x13c
[c0000000053f7860] [c0000000006002c0] driver_probe_device+0x3c/0xb4
[c0000000053f78a0] [c000000000600534] __driver_attach+0x118/0x128
[c0000000053f78e0] [c0000000005fe038] bus_for_each_dev+0xa8/0xf4
[c0000000053f7950] [c0000000005ff460] driver_attach+0x2c/0x40
[c0000000053f7970] [c0000000005fea68] bus_add_driver+0x130/0x278
[c0000000053f7a00] [c00000000060117c] driver_register+0x9c/0x1a0
[c0000000053f7a80] [c00000000055623c] __pci_register_driver+0x5c/0x70
[c0000000053f7aa0] [c0003d0001c058a0] nouveau_drm_init+0x254/0x278 [nouveau]
[c0000000053f7b10] [c00000000000e9bc] do_one_initcall+0x84/0x268
[c0000000053f7bf0] [c0000000001a0ba0] do_init_module+0x70/0x2d8
[c0000000053f7c70] [c0000000001a42bc] init_module_from_file+0xb4/0x108
[c0000000053f7d50] [c0000000001a4504] sys_finit_module+0x1ac/0x478
[c0000000053f7e10] [c000000000023230] system_call_exception+0x1a4/0x20c
[c0000000053f7e50] [c00000000000c554] system_call_common+0xf4/0x258
--- interrupt: c00 at 0xfd5f988
NIP: 000000000fd5f988 LR: 000000000ff9b148 CTR: 0000000000000000
REGS: c0000000053f7e80 TRAP: 0c00 Not tainted (6.14.0-09584-g7d06015d936c)
MSR: 100000000000d032 <HV,EE,PR,ME,IR,DR,RI> CR: 28222244 XER: 00000000
IRQMASK: 0 \x0aGPR00: 0000000000000161 00000000ffcdc2d0 00000000405db160 0000000000000020 \x0aGPR04: 000000000ffa2c9c 0000000000000000 000000000000001f 0000000000000045 \x0aGPR08: 0000000011a13770 0000000000000000 0000000000000000 0000000000000000 \x0aGPR12: 0000000000000000 0000000010249d8c 0000000000000020 0000000000000000 \x0aGPR16: 0000000000000000 0000000000f52630 0000000000000000 0000000000000000 \x0aGPR20: 0000000000000000 0000000000000000 0000000000000000 0000000011a11a70 \x0aGPR24: 0000000011a13580 0000000011a11950 0000000011a11a70 0000000000020000 \x0aGPR28: 000000000ffa2c9c 0000000000000000 000000000ffafc40 0000000011a11a70
NIP [000000000fd5f988] 0xfd5f988
LR [000000000ff9b148] 0xff9b148
--- interrupt: c00
Code: f821ffc1 418200ac e93f0000 e9290038 e9291468 eba90000 48026c0d e8410018 e93f06aa 3d290001 392982a4 79291f24 <7fdd482a> 2c3e0000 41820030 7fc3f378
---[ end trace 0000000000000000 ]---
This is caused by the i2c encoder modules vendored into nouveau/ now
depending on the equally vendored nouveau_i2c_encoder_destroy
function. Trying to auto-load this modules hangs on nouveau
initialization until timeout, and nouveau continues without i2c video
encoders.
Fix by avoiding nouveau dependency by __always_inlining that helper
functions into those i2c video encoder modules.
Fixes: a73583107af9 ("drm/nouveau: vendor in drm_encoder_slave API")
Signed-off-by: René Rebe <rene@exactco.de>
Reviewed-by: Lyude Paul <lyude@redhat.com>
[Lyude: fixed commit reference in description]
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20251202.164952.2216481867721531616.rene@exactco.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../nouveau/dispnv04/nouveau_i2c_encoder.c | 20 -------------------
.../include/dispnv04/i2c/encoder_i2c.h | 19 +++++++++++++++++-
2 files changed, 18 insertions(+), 21 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c b/drivers/gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c
index e2bf99c433366..a60209097a20a 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c
@@ -94,26 +94,6 @@ int nouveau_i2c_encoder_init(struct drm_device *dev,
return err;
}
-/**
- * nouveau_i2c_encoder_destroy - Unregister the I2C device backing an encoder
- * @drm_encoder: Encoder to be unregistered.
- *
- * This should be called from the @destroy method of an I2C slave
- * encoder driver once I2C access is no longer needed.
- */
-void nouveau_i2c_encoder_destroy(struct drm_encoder *drm_encoder)
-{
- struct nouveau_i2c_encoder *encoder = to_encoder_i2c(drm_encoder);
- struct i2c_client *client = nouveau_i2c_encoder_get_client(drm_encoder);
- struct module *module = client->dev.driver->owner;
-
- i2c_unregister_device(client);
- encoder->i2c_client = NULL;
-
- module_put(module);
-}
-EXPORT_SYMBOL(nouveau_i2c_encoder_destroy);
-
/*
* Wrapper fxns which can be plugged in to drm_encoder_helper_funcs:
*/
diff --git a/drivers/gpu/drm/nouveau/include/dispnv04/i2c/encoder_i2c.h b/drivers/gpu/drm/nouveau/include/dispnv04/i2c/encoder_i2c.h
index 31334aa90781b..869820701a56e 100644
--- a/drivers/gpu/drm/nouveau/include/dispnv04/i2c/encoder_i2c.h
+++ b/drivers/gpu/drm/nouveau/include/dispnv04/i2c/encoder_i2c.h
@@ -202,7 +202,24 @@ static inline struct i2c_client *nouveau_i2c_encoder_get_client(struct drm_encod
return to_encoder_i2c(encoder)->i2c_client;
}
-void nouveau_i2c_encoder_destroy(struct drm_encoder *encoder);
+/**
+ * nouveau_i2c_encoder_destroy - Unregister the I2C device backing an encoder
+ * @drm_encoder: Encoder to be unregistered.
+ *
+ * This should be called from the @destroy method of an I2C slave
+ * encoder driver once I2C access is no longer needed.
+ */
+static __always_inline void nouveau_i2c_encoder_destroy(struct drm_encoder *drm_encoder)
+{
+ struct nouveau_i2c_encoder *encoder = to_encoder_i2c(drm_encoder);
+ struct i2c_client *client = nouveau_i2c_encoder_get_client(drm_encoder);
+ struct module *module = client->dev.driver->owner;
+
+ i2c_unregister_device(client);
+ encoder->i2c_client = NULL;
+
+ module_put(module);
+}
/*
* Wrapper fxns which can be plugged in to drm_encoder_helper_funcs:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 570/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 569/614] drm/nouveau: fix circular dep oops from vendored i2c encoder Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 571/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 Greg Kroah-Hartman
` (57 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells,
Paulo Alcantara (Red Hat), Shyam Prasad N, linux-cifs, netfs,
linux-fsdevel, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 9d85ac939d52e93d80efb01a299c6f0bedb30487 ]
If a DIO read or an unbuffered read request extends beyond the EOF, the
server will return a short read and a status code indicating that EOF was
hit, which gets translated to -ENODATA. Note that the client does not cap
the request at i_size, but asks for the amount requested in case there's a
race on the server with a third party.
Now, on the client side, the request will get split into multiple
subrequests if rsize is smaller than the full request size. A subrequest
that starts before or at the EOF and returns short data up to the EOF will
be correctly handled, with the NETFS_SREQ_HIT_EOF flag being set,
indicating to netfslib that we can't read more.
If a subrequest, however, starts after the EOF and not at it, HIT_EOF will
not be flagged, its error will be set to -ENODATA and it will be abandoned.
This will cause the request as a whole to fail with -ENODATA.
Fix this by setting NETFS_SREQ_HIT_EOF on any subrequest that lies beyond
the EOF marker.
This can be reproduced by mounting with "cache=none,sign,vers=1.0" and
doing a read of a file that's significantly bigger than the size of the
file (e.g. attempting to read 64KiB from a 16KiB file).
Fixes: a68c74865f51 ("cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/cifssmb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c
index dcc50a2bfa4b2..bfc9b1ea76fac 100644
--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
@@ -1374,7 +1374,7 @@ cifs_readv_callback(struct mid_q_entry *mid)
} else {
size_t trans = rdata->subreq.transferred + rdata->got_bytes;
if (trans < rdata->subreq.len &&
- rdata->subreq.start + trans == ictx->remote_i_size) {
+ rdata->subreq.start + trans >= ictx->remote_i_size) {
rdata->result = 0;
__set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags);
} else if (rdata->got_bytes > 0) {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 571/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 570/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 572/614] nfs/localio: remove alignment size checking in nfs_is_local_dio_possible Greg Kroah-Hartman
` (56 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells,
Paulo Alcantara (Red Hat), Shyam Prasad N, linux-cifs, netfs,
linux-fsdevel, Steve French, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 4ae4dde6f34a4124c65468ae4fa1f915fb40f900 ]
If a DIO read or an unbuffered read request extends beyond the EOF, the
server will return a short read and a status code indicating that EOF was
hit, which gets translated to -ENODATA. Note that the client does not cap
the request at i_size, but asks for the amount requested in case there's a
race on the server with a third party.
Now, on the client side, the request will get split into multiple
subrequests if rsize is smaller than the full request size. A subrequest
that starts before or at the EOF and returns short data up to the EOF will
be correctly handled, with the NETFS_SREQ_HIT_EOF flag being set,
indicating to netfslib that we can't read more.
If a subrequest, however, starts after the EOF and not at it, HIT_EOF will
not be flagged, its error will be set to -ENODATA and it will be abandoned.
This will cause the request as a whole to fail with -ENODATA.
Fix this by setting NETFS_SREQ_HIT_EOF on any subrequest that lies beyond
the EOF marker.
Fixes: 1da29f2c39b6 ("netfs, cifs: Fix handling of short DIO read")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 8b4a4573e9c37..e661d40213eab 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -4629,7 +4629,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
} else {
size_t trans = rdata->subreq.transferred + rdata->got_bytes;
if (trans < rdata->subreq.len &&
- rdata->subreq.start + trans == ictx->remote_i_size) {
+ rdata->subreq.start + trans >= ictx->remote_i_size) {
__set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags);
rdata->result = 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 572/614] nfs/localio: remove alignment size checking in nfs_is_local_dio_possible
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 571/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 573/614] nfs/localio: remove 61 byte hole from needless ____cacheline_aligned Greg Kroah-Hartman
` (55 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@hammerspace.com>
[ Upstream commit f50d0328d02fe38ba196a73c143e5d87e341d4f7 ]
This check to ensure dio_offset_align isn't larger than PAGE_SIZE is
no longer relevant (older iterations of NFS Direct was allocating
misaligned head and tail pages but no longer does, so this check isn't
needed).
Fixes: c817248fc831 ("nfs/localio: add proper O_DIRECT support for READ and WRITE")
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/localio.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index 656976b4f42ce..512d9c5ff608a 100644
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -339,8 +339,6 @@ nfs_is_local_dio_possible(struct nfs_local_kiocb *iocb, int rw,
if (unlikely(!nf_dio_mem_align || !nf_dio_offset_align))
return false;
- if (unlikely(nf_dio_offset_align > PAGE_SIZE))
- return false;
if (unlikely(len < nf_dio_offset_align))
return false;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 573/614] nfs/localio: remove 61 byte hole from needless ____cacheline_aligned
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 572/614] nfs/localio: remove alignment size checking in nfs_is_local_dio_possible Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 574/614] gpio: tb10x: fix OF_GPIO dependency Greg Kroah-Hartman
` (54 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Trond Myklebust,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 0b873de2c02f9cc655bef6bee0eb9e404126ed6c ]
struct nfs_local_kiocb used ____cacheline_aligned on its iters[] array
and as the structure evolved it caused a 61 byte hole to form. Fix
this by removing ____cacheline_aligned and reordering iters[] before
iter_is_dio_aligned[].
Fixes: 6a218b9c3183 ("nfs/localio: do not issue misaligned DIO out-of-order")
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/localio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
index 512d9c5ff608a..b98bb292fef0c 100644
--- a/fs/nfs/localio.c
+++ b/fs/nfs/localio.c
@@ -43,8 +43,8 @@ struct nfs_local_kiocb {
size_t end_len;
short int end_iter_index;
atomic_t n_iters;
+ struct iov_iter iters[NFSLOCAL_MAX_IOS];
bool iter_is_dio_aligned[NFSLOCAL_MAX_IOS];
- struct iov_iter iters[NFSLOCAL_MAX_IOS] ____cacheline_aligned;
/* End mostly DIO-specific members */
};
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 574/614] gpio: tb10x: fix OF_GPIO dependency
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 573/614] nfs/localio: remove 61 byte hole from needless ____cacheline_aligned Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 575/614] docs: hwmon: fix link to g762 devicetree binding Greg Kroah-Hartman
` (53 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Bartosz Golaszewski,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit dd44d4d0c55a4ecf5eabf7856f96ed47e0684780 ]
Selecting OF_GPIO is generally not allowed, it always gets enabled
when both GPIOLIB and OF are turned on.
The tb10x driver now warns about this after it was enabled for
compile-testing:
WARNING: unmet direct dependencies detected for OF_GPIO
Depends on [n]: GPIOLIB [=y] && OF [=n] && HAS_IOMEM [=y]
Selected by [y]:
- GPIO_TB10X [=y] && GPIOLIB [=y] && HAS_IOMEM [=y] && (ARC_PLAT_TB10X || COMPILE_TEST [=y])
OF_GPIO is not required for compile-testing and is already enabled
when the driver is usable, so just drop the 'select' line.
Fixes: 682fbb18e14c ("gpio: tb10x: allow building the module with COMPILE_TEST=y")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20251205095429.1291866-1-arnd@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 7ee3afbc2b05d..e053524c5e35f 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -738,7 +738,6 @@ config GPIO_TB10X
depends on ARC_PLAT_TB10X || COMPILE_TEST
select GPIO_GENERIC
select GENERIC_IRQ_CHIP
- select OF_GPIO
config GPIO_TEGRA
tristate "NVIDIA Tegra GPIO support"
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 575/614] docs: hwmon: fix link to g762 devicetree binding
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 574/614] gpio: tb10x: fix OF_GPIO dependency Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 576/614] i2c: spacemit: fix detect issue Greg Kroah-Hartman
` (52 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kathara Sasikumar, Guenter Roeck,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kathara Sasikumar <katharasasikumar007@gmail.com>
[ Upstream commit 08bfcf4ff9d39228150a757803fc02dffce84ab0 ]
The devicetree binding for g762 was converted to YAML to match vendor
prefix conventions. Update the reference accordingly.
Signed-off-by: Kathara Sasikumar <katharasasikumar007@gmail.com>
Link: https://lore.kernel.org/r/20251205215835.783273-1-katharasasikumar007@gmail.com
Fixes: 3d8e25372417 ("dt-bindings: hwmon: g762: Convert to yaml schema")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/hwmon/g762.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/hwmon/g762.rst b/Documentation/hwmon/g762.rst
index 0371b3365c48c..f224552a2d3cc 100644
--- a/Documentation/hwmon/g762.rst
+++ b/Documentation/hwmon/g762.rst
@@ -17,7 +17,7 @@ done via a userland daemon like fancontrol.
Note that those entries do not provide ways to setup the specific
hardware characteristics of the system (reference clock, pulses per
fan revolution, ...); Those can be modified via devicetree bindings
-documented in Documentation/devicetree/bindings/hwmon/g762.txt or
+documented in Documentation/devicetree/bindings/hwmon/gmt,g762.yaml or
using a specific platform_data structure in board initialization
file (see include/linux/platform_data/g762.h).
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 576/614] i2c: spacemit: fix detect issue
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 575/614] docs: hwmon: fix link to g762 devicetree binding Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 577/614] dma/pool: eliminate alloc_pages warning in atomic_pool_expand Greg Kroah-Hartman
` (51 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurelien Jarno, Troy Mitchell,
Michael Opdenacker, Andi Shyti, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
[ Upstream commit 25faa5364638b86ec0d0edb4486daa9d40a0be8f ]
This commit addresses two issues causing i2c detect to fail.
The identified issues are:
1. Incorrect error handling for BED (Bus Error No ACK/NAK):
Before this commit, Both ALD (Arbitration Loss Detected) and
BED returned -EAGAIN.
2. Missing interrupt status clear after initialization in xfer():
On the K1 SoC, simply fixing the first issue changed the error
from -EAGAIN to -ETIMEOUT. Through tracing, it was determined that
this is likely due to MSD (Master Stop Detected) latency issues.
That means the MSD bit in the ISR may still be set on the next transfer.
As a result, the controller won't work — we can see from the scope that
it doesn't issue any signal.
(This only occurs during rapid consecutive I2C transfers.
That explains why the issue only shows up with i2cdetect.)
With these two fixes, i2c device detection now functions correctly on the K1 SoC.
Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Tested-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20251113-fix-k1-detect-failure-v2-1-b02a9a74f65a@linux.spacemit.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-k1.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index 6b918770e612e..d42c03ef5db59 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -158,11 +158,16 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c)
{
dev_dbg(i2c->dev, "i2c error status: 0x%08x\n", i2c->status);
- if (i2c->status & (SPACEMIT_SR_BED | SPACEMIT_SR_ALD)) {
+ /* Arbitration Loss Detected */
+ if (i2c->status & SPACEMIT_SR_ALD) {
spacemit_i2c_reset(i2c);
return -EAGAIN;
}
+ /* Bus Error No ACK/NAK */
+ if (i2c->status & SPACEMIT_SR_BED)
+ spacemit_i2c_reset(i2c);
+
return i2c->status & SPACEMIT_SR_ACKNAK ? -ENXIO : -EIO;
}
@@ -224,6 +229,12 @@ static void spacemit_i2c_check_bus_release(struct spacemit_i2c_dev *i2c)
}
}
+static inline void
+spacemit_i2c_clear_int_status(struct spacemit_i2c_dev *i2c, u32 mask)
+{
+ writel(mask & SPACEMIT_I2C_INT_STATUS_MASK, i2c->base + SPACEMIT_ISR);
+}
+
static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
{
u32 val;
@@ -267,12 +278,8 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
val = readl(i2c->base + SPACEMIT_IRCR);
val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX;
writel(val, i2c->base + SPACEMIT_IRCR);
-}
-static inline void
-spacemit_i2c_clear_int_status(struct spacemit_i2c_dev *i2c, u32 mask)
-{
- writel(mask & SPACEMIT_I2C_INT_STATUS_MASK, i2c->base + SPACEMIT_ISR);
+ spacemit_i2c_clear_int_status(i2c, SPACEMIT_I2C_INT_STATUS_MASK);
}
static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 577/614] dma/pool: eliminate alloc_pages warning in atomic_pool_expand
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 576/614] i2c: spacemit: fix detect issue Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 578/614] ALSA: uapi: Fix typo in asound.h comment Greg Kroah-Hartman
` (50 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Kleikamp, Robin Murphy,
Marek Szyprowski, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Kleikamp <dave.kleikamp@oracle.com>
[ Upstream commit 463d439becb81383f3a5a5d840800131f265a09c ]
atomic_pool_expand iteratively tries the allocation while decrementing
the page order. There is no need to issue a warning if an attempted
allocation fails.
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Fixes: d7e673ec2c8e ("dma-pool: Only allocate from CMA when in same memory zone")
[mszyprow: fixed typo]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20251202152810.142370-1-dave.kleikamp@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/dma/pool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/dma/pool.c b/kernel/dma/pool.c
index ee45dee33d491..26392badc36b0 100644
--- a/kernel/dma/pool.c
+++ b/kernel/dma/pool.c
@@ -93,7 +93,7 @@ static int atomic_pool_expand(struct gen_pool *pool, size_t pool_size,
page = dma_alloc_from_contiguous(NULL, 1 << order,
order, false);
if (!page)
- page = alloc_pages(gfp, order);
+ page = alloc_pages(gfp | __GFP_NOWARN, order);
} while (!page && order-- > 0);
if (!page)
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 578/614] ALSA: uapi: Fix typo in asound.h comment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 577/614] dma/pool: eliminate alloc_pages warning in atomic_pool_expand Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 579/614] drm/amdkfd: Use huge page size to check split svm range alignment Greg Kroah-Hartman
` (49 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andres J Rosa, Takashi Iwai,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andres J Rosa <andyrosa@gmail.com>
[ Upstream commit 9a97857db0c5655b8932f86b5d18bb959079b0ee ]
Fix 'level-shit' to 'level-shift' in struct snd_cea_861_aud_if comment.
Fixes: 7ba1c40b536e ("ALSA: Add definitions for CEA-861 Audio InfoFrames")
Signed-off-by: Andres J Rosa <andyrosa@gmail.com>
Link: https://patch.msgid.link/20251203162509.1822-1-andyrosa@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/sound/asound.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h
index 5a049eeaeccea..d3ce75ba938a8 100644
--- a/include/uapi/sound/asound.h
+++ b/include/uapi/sound/asound.h
@@ -60,7 +60,7 @@ struct snd_cea_861_aud_if {
unsigned char db2_sf_ss; /* sample frequency and size */
unsigned char db3; /* not used, all zeros */
unsigned char db4_ca; /* channel allocation code */
- unsigned char db5_dminh_lsv; /* downmix inhibit & level-shit values */
+ unsigned char db5_dminh_lsv; /* downmix inhibit & level-shift values */
};
/****************************************************************************
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 579/614] drm/amdkfd: Use huge page size to check split svm range alignment
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 578/614] ALSA: uapi: Fix typo in asound.h comment Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 580/614] rtc: gamecube: Check the return value of ioremap() Greg Kroah-Hartman
` (48 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaogang Chen, Philip Yang,
Alex Deucher, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaogang Chen <xiaogang.chen@amd.com>
[ Upstream commit bf2084a7b1d75d093b6a79df4c10142d49fbaa0e ]
When split svm ranges that have been mapped using huge page should use huge
page size(2MB) to check split range alignment, not prange->granularity that
means migration granularity.
Fixes: 7ef6b2d4b7e5 ("drm/amdkfd: remap unaligned svm ranges that have split")
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Philip Yang <Philip.Yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 448ee45353ef9fb1a34f5f26eb3f48923c6f0898)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 +++++++++++++++++++---------
1 file changed, 32 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 74a1d3e1d52be..49dd0a81114e4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -1144,30 +1144,48 @@ static int
svm_range_split_tail(struct svm_range *prange, uint64_t new_last,
struct list_head *insert_list, struct list_head *remap_list)
{
+ unsigned long last_align_down = ALIGN_DOWN(prange->last, 512);
+ unsigned long start_align = ALIGN(prange->start, 512);
+ bool huge_page_mapping = last_align_down > start_align;
struct svm_range *tail = NULL;
- int r = svm_range_split(prange, prange->start, new_last, &tail);
+ int r;
- if (!r) {
- list_add(&tail->list, insert_list);
- if (!IS_ALIGNED(new_last + 1, 1UL << prange->granularity))
- list_add(&tail->update_list, remap_list);
- }
- return r;
+ r = svm_range_split(prange, prange->start, new_last, &tail);
+
+ if (r)
+ return r;
+
+ list_add(&tail->list, insert_list);
+
+ if (huge_page_mapping && tail->start > start_align &&
+ tail->start < last_align_down && (!IS_ALIGNED(tail->start, 512)))
+ list_add(&tail->update_list, remap_list);
+
+ return 0;
}
static int
svm_range_split_head(struct svm_range *prange, uint64_t new_start,
struct list_head *insert_list, struct list_head *remap_list)
{
+ unsigned long last_align_down = ALIGN_DOWN(prange->last, 512);
+ unsigned long start_align = ALIGN(prange->start, 512);
+ bool huge_page_mapping = last_align_down > start_align;
struct svm_range *head = NULL;
- int r = svm_range_split(prange, new_start, prange->last, &head);
+ int r;
- if (!r) {
- list_add(&head->list, insert_list);
- if (!IS_ALIGNED(new_start, 1UL << prange->granularity))
- list_add(&head->update_list, remap_list);
- }
- return r;
+ r = svm_range_split(prange, new_start, prange->last, &head);
+
+ if (r)
+ return r;
+
+ list_add(&head->list, insert_list);
+
+ if (huge_page_mapping && head->last + 1 > start_align &&
+ head->last + 1 < last_align_down && (!IS_ALIGNED(head->last, 512)))
+ list_add(&head->update_list, remap_list);
+
+ return 0;
}
static void
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 580/614] rtc: gamecube: Check the return value of ioremap()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 579/614] drm/amdkfd: Use huge page size to check split svm range alignment Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 581/614] rtc: max31335: Fix ignored return value in set_alarm Greg Kroah-Hartman
` (47 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Link Mauve,
Alexandre Belloni, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit d1220e47e4bd2be8b84bc158f4dea44f2f88b226 ]
The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail
and return NULL, which is dereferenced without checking, leading to a
NULL pointer dereference.
Add a check for the return value of ioremap() and return -ENOMEM on
failure.
Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Link Mauve <kernel@linkmauve.fr>
Link: https://patch.msgid.link/20251126080625.1752-1-vulab@iscas.ac.cn
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-gamecube.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/rtc/rtc-gamecube.c b/drivers/rtc/rtc-gamecube.c
index c828bc8e05b9c..045d5d45ab4b0 100644
--- a/drivers/rtc/rtc-gamecube.c
+++ b/drivers/rtc/rtc-gamecube.c
@@ -242,6 +242,10 @@ static int gamecube_rtc_read_offset_from_sram(struct priv *d)
}
hw_srnprot = ioremap(res.start, resource_size(&res));
+ if (!hw_srnprot) {
+ pr_err("failed to ioremap hw_srnprot\n");
+ return -ENOMEM;
+ }
old = ioread32be(hw_srnprot);
/* TODO: figure out why we use this magic constant. I obtained it by
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 581/614] rtc: max31335: Fix ignored return value in set_alarm
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 580/614] rtc: gamecube: Check the return value of ioremap() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 582/614] regulator: spacemit: Align input supply name with the DT binding Greg Kroah-Hartman
` (46 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Sá, Alexandre Belloni,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sá <nuno.sa@analog.com>
[ Upstream commit f07640f9fb8df2158199da1da1f8282948385a84 ]
Return the result from regmap_update_bits() instead of ignoring it
and always returning 0.
Fixes: dedaf03b99d6 ("rtc: max31335: add driver support")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://patch.msgid.link/20251128-max31335-handler-error-v1-1-6b6f7f78dbda@analog.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-max31335.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/rtc/rtc-max31335.c b/drivers/rtc/rtc-max31335.c
index dfb5bad3a3691..23b7bf16b4cd5 100644
--- a/drivers/rtc/rtc-max31335.c
+++ b/drivers/rtc/rtc-max31335.c
@@ -391,10 +391,8 @@ static int max31335_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
if (ret)
return ret;
- ret = regmap_update_bits(max31335->regmap, max31335->chip->int_status_reg,
- MAX31335_STATUS1_A1F, 0);
-
- return 0;
+ return regmap_update_bits(max31335->regmap, max31335->chip->int_status_reg,
+ MAX31335_STATUS1_A1F, 0);
}
static int max31335_alarm_irq_enable(struct device *dev, unsigned int enabled)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 582/614] regulator: spacemit: Align input supply name with the DT binding
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 581/614] rtc: max31335: Fix ignored return value in set_alarm Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 583/614] ALSA: firewire-motu: add bounds check in put_user loop for DSP events Greg Kroah-Hartman
` (45 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Martinez Canillas, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Martinez Canillas <javierm@redhat.com>
[ Upstream commit 99f0c3a654c4a762aca4fadc8d9f8636b36d570a ]
The Device Tree binding schema for the SpacemiT P1 PMIC defines the main
input supply property as "vin-supply", but the driver defines the supply
name for BUCK and ALDO regulators as "vcc".
This causes the regulator core to lookup for a non-existent "vcc-supply".
Rename the supply from "vcc" to "vin", to match the DT binding and ensure
that the regulators input supplies are correctly resolved.
After this change, the regulators supply hierarchy is correctly reported:
$ cat /sys/kernel/debug/regulator/regulator_summary
regulator use open bypass opmode voltage current min max
---------------------------------------------------------------------------------------
regulator-dummy 1 0 0 unknown 0mV 0mA 0mV 0mV
dc_in_12v 2 1 0 unknown 12000mV 0mA 12000mV 12000mV
vcc_4v 7 10 0 unknown 4000mV 0mA 4000mV 4000mV
buck1 1 0 0 unknown 1050mV 0mA 500mV 3425mV
buck2 1 0 0 unknown 900mV 0mA 500mV 3425mV
buck3 1 0 0 unknown 1800mV 0mA 500mV 1800mV
buck4 1 0 0 unknown 3300mV 0mA 500mV 3300mV
buck5 3 7 0 unknown 2100mV 0mA 500mV 3425mV
dldo1 0 0 0 unknown 1200mV 0mA 500mV 3125mV
dldo2 0 0 0 unknown 500mV 0mA 500mV 3125mV
dldo3 0 0 0 unknown 500mV 0mA 500mV 3125mV
dldo4 1 0 0 unknown 1800mV 0mA 500mV 3125mV
dldo5 0 0 0 unknown 500mV 0mA 500mV 3125mV
dldo6 1 0 0 unknown 1800mV 0mA 500mV 3125mV
dldo7 0 0 0 unknown 500mV 0mA 500mV 3125mV
buck6 1 0 0 unknown 1100mV 0mA 500mV 3425mV
aldo1 0 0 0 unknown 1800mV 0mA 500mV 3125mV
aldo2 0 0 0 unknown 500mV 0mA 500mV 3125mV
aldo3 0 0 0 unknown 500mV 0mA 500mV 3125mV
aldo4 0 0 0 unknown 500mV 0mA 500mV 3125mV
Fixes: 8b84d712ad84 ("regulator: spacemit: support SpacemiT P1 regulators")
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20251206133852.1739475-1-javierm@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/spacemit-p1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/regulator/spacemit-p1.c b/drivers/regulator/spacemit-p1.c
index d437e6738ea1e..2bf9137e12b1d 100644
--- a/drivers/regulator/spacemit-p1.c
+++ b/drivers/regulator/spacemit-p1.c
@@ -87,10 +87,10 @@ static const struct linear_range p1_ldo_ranges[] = {
}
#define P1_BUCK_DESC(_n) \
- P1_REG_DESC(BUCK, buck, _n, "vcc", 0x47, BUCK_MASK, 254, p1_buck_ranges)
+ P1_REG_DESC(BUCK, buck, _n, "vin", 0x47, BUCK_MASK, 254, p1_buck_ranges)
#define P1_ALDO_DESC(_n) \
- P1_REG_DESC(ALDO, aldo, _n, "vcc", 0x5b, LDO_MASK, 117, p1_ldo_ranges)
+ P1_REG_DESC(ALDO, aldo, _n, "vin", 0x5b, LDO_MASK, 117, p1_ldo_ranges)
#define P1_DLDO_DESC(_n) \
P1_REG_DESC(DLDO, dldo, _n, "buck5", 0x67, LDO_MASK, 117, p1_ldo_ranges)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 583/614] ALSA: firewire-motu: add bounds check in put_user loop for DSP events
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 582/614] regulator: spacemit: Align input supply name with the DT binding Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 584/614] ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Greg Kroah-Hartman
` (44 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Junrui Luo,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
[ Upstream commit 298e753880b6ea99ac30df34959a7a03b0878eed ]
In the DSP event handling code, a put_user() loop copies event data.
When the user buffer size is not aligned to 4 bytes, it could overwrite
beyond the buffer boundary.
Fix by adding a bounds check before put_user().
Suggested-by: Takashi Iwai <tiwai@suse.de>
Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB788112C72AF8A1C8C448B4B8AFA3A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/firewire/motu/motu-hwdep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c
index 6675b23aad69e..89dc436a06529 100644
--- a/sound/firewire/motu/motu-hwdep.c
+++ b/sound/firewire/motu/motu-hwdep.c
@@ -75,7 +75,7 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
while (consumed < count &&
snd_motu_register_dsp_message_parser_copy_event(motu, &ev)) {
ptr = (u32 __user *)(buf + consumed);
- if (put_user(ev, ptr))
+ if (consumed + sizeof(ev) > count || put_user(ev, ptr))
return -EFAULT;
consumed += sizeof(ev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 584/614] ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 583/614] ALSA: firewire-motu: add bounds check in put_user loop for DSP events Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 585/614] drm/xe/fbdev: use the same 64-byte stride alignment as i915 Greg Kroah-Hartman
` (43 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xie Yuanbin, Liyuan Pang,
Russell King (Oracle), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liyuan Pang <pangliyuan1@huawei.com>
[ Upstream commit edb924a7211c9aa7a4a415e03caee4d875e46b8e ]
In the inline assembly inside load_unaligned_zeropad(), the "addr" is
constrained as input-only operand. The compiler assumes that on exit
from the asm statement these operands contain the same values as they
had before executing the statement, but when kernel page fault happened, the assembly fixup code "bic %2 %2, #0x3" modify the value of "addr", which may lead to an unexpected behavior.
Use a temporary variable "tmp" to handle it, instead of modifying the
input-only operand, just like what arm64's load_unaligned_zeropad()
does.
Fixes: b9a50f74905a ("ARM: 7450/1: dcache: select DCACHE_WORD_ACCESS for little-endian ARMv6+ CPUs")
Co-developed-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Liyuan Pang <pangliyuan1@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/include/asm/word-at-a-time.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/arm/include/asm/word-at-a-time.h b/arch/arm/include/asm/word-at-a-time.h
index f9a3897b06e7f..5023f98d8293d 100644
--- a/arch/arm/include/asm/word-at-a-time.h
+++ b/arch/arm/include/asm/word-at-a-time.h
@@ -67,7 +67,7 @@ static inline unsigned long find_zero(unsigned long mask)
*/
static inline unsigned long load_unaligned_zeropad(const void *addr)
{
- unsigned long ret, offset;
+ unsigned long ret, tmp;
/* Load word from unaligned pointer addr */
asm(
@@ -75,9 +75,9 @@ static inline unsigned long load_unaligned_zeropad(const void *addr)
"2:\n"
" .pushsection .text.fixup,\"ax\"\n"
" .align 2\n"
- "3: and %1, %2, #0x3\n"
- " bic %2, %2, #0x3\n"
- " ldr %0, [%2]\n"
+ "3: bic %1, %2, #0x3\n"
+ " ldr %0, [%1]\n"
+ " and %1, %2, #0x3\n"
" lsl %1, %1, #0x3\n"
#ifndef __ARMEB__
" lsr %0, %0, %1\n"
@@ -90,7 +90,7 @@ static inline unsigned long load_unaligned_zeropad(const void *addr)
" .align 3\n"
" .long 1b, 3b\n"
" .popsection"
- : "=&r" (ret), "=&r" (offset)
+ : "=&r" (ret), "=&r" (tmp)
: "r" (addr), "Qo" (*(unsigned long *)addr));
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 585/614] drm/xe/fbdev: use the same 64-byte stride alignment as i915
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 584/614] ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 586/614] drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit Greg Kroah-Hartman
` (42 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Jani Nikula,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
[ Upstream commit 4a36b339a14ae6f2a366125e3d64f0c165193293 ]
For reasons unknown, xe uses XE_PAGE_SIZE alignment for
stride. Presumably it's just a confusion between stride alignment and bo
allocation size alignment. Switch to 64 byte alignment to, uh, align
with i915.
This will also be helpful in deduplicating and unifying the xe and i915
framebuffer allocation.
Link: https://lore.kernel.org/r/aLqsC87Ol_zCXOkN@intel.com
Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://lore.kernel.org/r/7f4972104de8b179d5724ae83892ee294d3f3fd3.1758184771.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Stable-dep-of: 460b31720369 ("drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/display/intel_fbdev_fb.c b/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
index 8ea9a472113c4..bce4cb16f6820 100644
--- a/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
+++ b/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
@@ -33,7 +33,7 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
mode_cmd.height = sizes->surface_height;
mode_cmd.pitches[0] = ALIGN(mode_cmd.width *
- DIV_ROUND_UP(sizes->surface_bpp, 8), XE_PAGE_SIZE);
+ DIV_ROUND_UP(sizes->surface_bpp, 8), 64);
mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
sizes->surface_depth);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 586/614] drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 585/614] drm/xe/fbdev: use the same 64-byte stride alignment as i915 Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 587/614] drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() Greg Kroah-Hartman
` (41 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Jani Nikula,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
[ Upstream commit 6979d2c80c2a5b1f04157c4d6eb038bb32861cfa ]
It's sketchy to pass error pointers via to_intel_framebuffer(). It
probably works as long as struct intel_framebuffer embeds struct
drm_framebuffer at offset 0, but be explicit about it.
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://lore.kernel.org/r/17631db227d527d6c67f5d6b67adec1ff8dc6f8d.1758184771.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Stable-dep-of: 460b31720369 ("drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev_fb.c b/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
index 210aee9ae88b8..b9dfd00a7d05b 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
@@ -67,9 +67,16 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
mode_cmd.pixel_format,
mode_cmd.modifier[0]),
&mode_cmd);
+ if (IS_ERR(fb)) {
+ i915_gem_object_put(obj);
+ goto err;
+ }
+
i915_gem_object_put(obj);
return to_intel_framebuffer(fb);
+err:
+ return ERR_CAST(fb);
}
int intel_fbdev_fb_fill_info(struct intel_display *display, struct fb_info *info,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 587/614] drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 586/614] drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 588/614] drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Greg Kroah-Hartman
` (40 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Jani Nikula,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
[ Upstream commit 9e5cf822a207ee8c9856024c047abaccb4d185e5 ]
The function doesn't actually need struct drm_fb_helper for anything,
just pass struct drm_device.
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://lore.kernel.org/r/16360584f80cdc5ee35fd94cfd92fd3955588dfd.1758184771.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Stable-dep-of: 460b31720369 ("drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_fbdev.c | 2 +-
drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 10 +++++-----
drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 4 ++--
drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 7 +++----
4 files changed, 11 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
index 7c4709d58aa34..46c6de5f60888 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev.c
@@ -237,7 +237,7 @@ int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
if (!fb || drm_WARN_ON(display->drm, !intel_fb_bo(&fb->base))) {
drm_dbg_kms(display->drm,
"no BIOS fb, allocating a new one\n");
- fb = intel_fbdev_fb_alloc(helper, sizes);
+ fb = intel_fbdev_fb_alloc(display->drm, sizes);
if (IS_ERR(fb))
return PTR_ERR(fb);
} else {
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev_fb.c b/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
index b9dfd00a7d05b..4de13d1a4c7a7 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
@@ -13,11 +13,11 @@
#include "intel_fb.h"
#include "intel_fbdev_fb.h"
-struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
+struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
struct drm_fb_helper_surface_size *sizes)
{
- struct intel_display *display = to_intel_display(helper->dev);
- struct drm_i915_private *dev_priv = to_i915(display->drm);
+ struct intel_display *display = to_intel_display(drm);
+ struct drm_i915_private *dev_priv = to_i915(drm);
struct drm_framebuffer *fb;
struct drm_mode_fb_cmd2 mode_cmd = {};
struct drm_i915_gem_object *obj;
@@ -58,12 +58,12 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
}
if (IS_ERR(obj)) {
- drm_err(display->drm, "failed to allocate framebuffer (%pe)\n", obj);
+ drm_err(drm, "failed to allocate framebuffer (%pe)\n", obj);
return ERR_PTR(-ENOMEM);
}
fb = intel_framebuffer_create(intel_bo_to_drm_bo(obj),
- drm_get_format_info(display->drm,
+ drm_get_format_info(drm,
mode_cmd.pixel_format,
mode_cmd.modifier[0]),
&mode_cmd);
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev_fb.h b/drivers/gpu/drm/i915/display/intel_fbdev_fb.h
index cb79572727150..668ae355f5e5b 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev_fb.h
+++ b/drivers/gpu/drm/i915/display/intel_fbdev_fb.h
@@ -6,14 +6,14 @@
#ifndef __INTEL_FBDEV_FB_H__
#define __INTEL_FBDEV_FB_H__
-struct drm_fb_helper;
+struct drm_device;
struct drm_fb_helper_surface_size;
struct drm_gem_object;
struct fb_info;
struct i915_vma;
struct intel_display;
-struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
+struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
struct drm_fb_helper_surface_size *sizes);
int intel_fbdev_fb_fill_info(struct intel_display *display, struct fb_info *info,
struct drm_gem_object *obj, struct i915_vma *vma);
diff --git a/drivers/gpu/drm/xe/display/intel_fbdev_fb.c b/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
index bce4cb16f6820..5c0874bfa6ab1 100644
--- a/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
+++ b/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
@@ -15,12 +15,11 @@
#include <generated/xe_wa_oob.h>
-struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
+struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
struct drm_fb_helper_surface_size *sizes)
{
struct drm_framebuffer *fb;
- struct drm_device *dev = helper->dev;
- struct xe_device *xe = to_xe_device(dev);
+ struct xe_device *xe = to_xe_device(drm);
struct drm_mode_fb_cmd2 mode_cmd = {};
struct xe_bo *obj;
int size;
@@ -67,7 +66,7 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_fb_helper *helper,
}
fb = intel_framebuffer_create(&obj->ttm.base,
- drm_get_format_info(dev,
+ drm_get_format_info(drm,
mode_cmd.pixel_format,
mode_cmd.modifier[0]),
&mode_cmd);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 588/614] drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 587/614] drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 589/614] drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Greg Kroah-Hartman
` (39 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Jani Nikula,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
[ Upstream commit f9ff39f940f5ddd1d4ffcff602de7206aa1ff05d ]
Pull struct drm_mode_fb_cmd2 initialization out of the driver dependent
code into shared display code.
v2: Rebase on xe stride alignment change
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://lore.kernel.org/r/e922e47bfd39f9c5777f869ff23c23309ebbb380.1758184771.git.jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Stable-dep-of: 460b31720369 ("drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_fbdev.c | 32 ++++++++++++++++++-
drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 25 ++++-----------
drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 4 +--
drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 25 ++++-----------
4 files changed, 45 insertions(+), 41 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
index 46c6de5f60888..e46c08762b847 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev.c
@@ -207,6 +207,35 @@ static const struct drm_fb_helper_funcs intel_fb_helper_funcs = {
.fb_set_suspend = intelfb_set_suspend,
};
+static void intel_fbdev_fill_mode_cmd(struct drm_fb_helper_surface_size *sizes,
+ struct drm_mode_fb_cmd2 *mode_cmd)
+{
+ /* we don't do packed 24bpp */
+ if (sizes->surface_bpp == 24)
+ sizes->surface_bpp = 32;
+
+ mode_cmd->width = sizes->surface_width;
+ mode_cmd->height = sizes->surface_height;
+
+ mode_cmd->pitches[0] = ALIGN(mode_cmd->width * DIV_ROUND_UP(sizes->surface_bpp, 8), 64);
+ mode_cmd->pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
+ sizes->surface_depth);
+}
+
+static struct intel_framebuffer *
+__intel_fbdev_fb_alloc(struct intel_display *display,
+ struct drm_fb_helper_surface_size *sizes)
+{
+ struct drm_mode_fb_cmd2 mode_cmd = {};
+ struct intel_framebuffer *fb;
+
+ intel_fbdev_fill_mode_cmd(sizes, &mode_cmd);
+
+ fb = intel_fbdev_fb_alloc(display->drm, &mode_cmd);
+
+ return fb;
+}
+
int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
struct drm_fb_helper_surface_size *sizes)
{
@@ -237,7 +266,8 @@ int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
if (!fb || drm_WARN_ON(display->drm, !intel_fb_bo(&fb->base))) {
drm_dbg_kms(display->drm,
"no BIOS fb, allocating a new one\n");
- fb = intel_fbdev_fb_alloc(display->drm, sizes);
+
+ fb = __intel_fbdev_fb_alloc(display, sizes);
if (IS_ERR(fb))
return PTR_ERR(fb);
} else {
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev_fb.c b/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
index 4de13d1a4c7a7..685612e6afc53 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev_fb.c
@@ -3,7 +3,7 @@
* Copyright © 2023 Intel Corporation
*/
-#include <drm/drm_fb_helper.h>
+#include <linux/fb.h>
#include "gem/i915_gem_lmem.h"
@@ -14,28 +14,15 @@
#include "intel_fbdev_fb.h"
struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
- struct drm_fb_helper_surface_size *sizes)
+ struct drm_mode_fb_cmd2 *mode_cmd)
{
struct intel_display *display = to_intel_display(drm);
struct drm_i915_private *dev_priv = to_i915(drm);
struct drm_framebuffer *fb;
- struct drm_mode_fb_cmd2 mode_cmd = {};
struct drm_i915_gem_object *obj;
int size;
- /* we don't do packed 24bpp */
- if (sizes->surface_bpp == 24)
- sizes->surface_bpp = 32;
-
- mode_cmd.width = sizes->surface_width;
- mode_cmd.height = sizes->surface_height;
-
- mode_cmd.pitches[0] = ALIGN(mode_cmd.width *
- DIV_ROUND_UP(sizes->surface_bpp, 8), 64);
- mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
- sizes->surface_depth);
-
- size = mode_cmd.pitches[0] * mode_cmd.height;
+ size = mode_cmd->pitches[0] * mode_cmd->height;
size = PAGE_ALIGN(size);
obj = ERR_PTR(-ENODEV);
@@ -64,9 +51,9 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
fb = intel_framebuffer_create(intel_bo_to_drm_bo(obj),
drm_get_format_info(drm,
- mode_cmd.pixel_format,
- mode_cmd.modifier[0]),
- &mode_cmd);
+ mode_cmd->pixel_format,
+ mode_cmd->modifier[0]),
+ mode_cmd);
if (IS_ERR(fb)) {
i915_gem_object_put(obj);
goto err;
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev_fb.h b/drivers/gpu/drm/i915/display/intel_fbdev_fb.h
index 668ae355f5e5b..83454ffbf79cd 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev_fb.h
+++ b/drivers/gpu/drm/i915/display/intel_fbdev_fb.h
@@ -7,14 +7,14 @@
#define __INTEL_FBDEV_FB_H__
struct drm_device;
-struct drm_fb_helper_surface_size;
struct drm_gem_object;
+struct drm_mode_fb_cmd2;
struct fb_info;
struct i915_vma;
struct intel_display;
struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
- struct drm_fb_helper_surface_size *sizes);
+ struct drm_mode_fb_cmd2 *mode_cmd);
int intel_fbdev_fb_fill_info(struct intel_display *display, struct fb_info *info,
struct drm_gem_object *obj, struct i915_vma *vma);
diff --git a/drivers/gpu/drm/xe/display/intel_fbdev_fb.c b/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
index 5c0874bfa6ab1..8eaf1cc7fdf93 100644
--- a/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
+++ b/drivers/gpu/drm/xe/display/intel_fbdev_fb.c
@@ -3,7 +3,7 @@
* Copyright © 2023 Intel Corporation
*/
-#include <drm/drm_fb_helper.h>
+#include <linux/fb.h>
#include "intel_display_core.h"
#include "intel_display_types.h"
@@ -16,27 +16,14 @@
#include <generated/xe_wa_oob.h>
struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
- struct drm_fb_helper_surface_size *sizes)
+ struct drm_mode_fb_cmd2 *mode_cmd)
{
struct drm_framebuffer *fb;
struct xe_device *xe = to_xe_device(drm);
- struct drm_mode_fb_cmd2 mode_cmd = {};
struct xe_bo *obj;
int size;
- /* we don't do packed 24bpp */
- if (sizes->surface_bpp == 24)
- sizes->surface_bpp = 32;
-
- mode_cmd.width = sizes->surface_width;
- mode_cmd.height = sizes->surface_height;
-
- mode_cmd.pitches[0] = ALIGN(mode_cmd.width *
- DIV_ROUND_UP(sizes->surface_bpp, 8), 64);
- mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
- sizes->surface_depth);
-
- size = mode_cmd.pitches[0] * mode_cmd.height;
+ size = mode_cmd->pitches[0] * mode_cmd->height;
size = PAGE_ALIGN(size);
obj = ERR_PTR(-ENODEV);
@@ -67,9 +54,9 @@ struct intel_framebuffer *intel_fbdev_fb_alloc(struct drm_device *drm,
fb = intel_framebuffer_create(&obj->ttm.base,
drm_get_format_info(drm,
- mode_cmd.pixel_format,
- mode_cmd.modifier[0]),
- &mode_cmd);
+ mode_cmd->pixel_format,
+ mode_cmd->modifier[0]),
+ mode_cmd);
if (IS_ERR(fb)) {
xe_bo_unpin_map_no_vm(obj);
goto err;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 589/614] drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 588/614] drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 590/614] block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Greg Kroah-Hartman
` (38 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jani Nikula,
Dibin Moolakadan Subrahmanian, Jouni Högander,
Ankit Nautiyal, Jani Nikula, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
[ Upstream commit 460b31720369fc77c23301708641cfa1bf2fcb8f ]
During fbdev probe, the xe driver allocates and pins a framebuffer
BO (via xe_bo_create_pin_map_novm() → xe_ggtt_insert_bo()).
Without a runtime PM reference, xe_pm_runtime_get_noresume() warns about
missing outer PM protection as below:
xe 0000:03:00.0: [drm] Missing outer runtime PM protection
Acquire a runtime PM reference before framebuffer allocation to ensure
xe_ggtt_insert_bo() executes under active runtime PM context.
Changes in v2:
- Update commit message to add Fixes tag (Jani Nikula)
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6350
Fixes: 44e694958b95 ("drm/xe/display: Implement display support")
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://patch.msgid.link/20251111135403.3415947-1-dibin.moolakadan.subrahmanian@intel.com
(cherry picked from commit 37fc7b7b3ab0e3bb900657199cd3770a4fda03fb)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_fbdev.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_fbdev.c b/drivers/gpu/drm/i915/display/intel_fbdev.c
index e46c08762b847..7daf72b69bae4 100644
--- a/drivers/gpu/drm/i915/display/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/display/intel_fbdev.c
@@ -263,13 +263,18 @@ int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
drm_framebuffer_put(&fb->base);
fb = NULL;
}
+
+ wakeref = intel_display_rpm_get(display);
+
if (!fb || drm_WARN_ON(display->drm, !intel_fb_bo(&fb->base))) {
drm_dbg_kms(display->drm,
"no BIOS fb, allocating a new one\n");
fb = __intel_fbdev_fb_alloc(display, sizes);
- if (IS_ERR(fb))
- return PTR_ERR(fb);
+ if (IS_ERR(fb)) {
+ ret = PTR_ERR(fb);
+ goto out_unlock;
+ }
} else {
drm_dbg_kms(display->drm, "re-using BIOS fb\n");
prealloc = true;
@@ -277,8 +282,6 @@ int intel_fbdev_driver_fbdev_probe(struct drm_fb_helper *helper,
sizes->fb_height = fb->base.height;
}
- wakeref = intel_display_rpm_get(display);
-
/* Pin the GGTT vma for our access via info->screen_base.
* This also validates that any existing fb inherited from the
* BIOS is suitable for own access.
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 590/614] block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 589/614] drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 591/614] ASoC: amd: acp: update tdm channels for specific DAI Greg Kroah-Hartman
` (37 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohamed Khalfella, Ming Lei,
Bart Van Assche, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <mkhalfella@purestorage.com>
[ Upstream commit 59e25ef2b413c72da6686d431e7759302cfccafa ]
blk_mq_{add,del}_queue_tag_set() functions add and remove queues from
tagset, the functions make sure that tagset and queues are marked as
shared when two or more queues are attached to the same tagset.
Initially a tagset starts as unshared and when the number of added
queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along
with all the queues attached to it. When the number of attached queues
drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and
the remaining queues as unshared.
Both functions need to freeze current queues in tagset before setting on
unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions
hold set->tag_list_lock mutex, which makes sense as we do not want
queues to be added or deleted in the process. This used to work fine
until commit 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset")
made the nvme driver quiesce tagset instead of quiscing individual
queues. blk_mq_quiesce_tagset() does the job and quiesce the queues in
set->tag_list while holding set->tag_list_lock also.
This results in deadlock between two threads with these stacktraces:
__schedule+0x47c/0xbb0
? timerqueue_add+0x66/0xb0
schedule+0x1c/0xa0
schedule_preempt_disabled+0xa/0x10
__mutex_lock.constprop.0+0x271/0x600
blk_mq_quiesce_tagset+0x25/0xc0
nvme_dev_disable+0x9c/0x250
nvme_timeout+0x1fc/0x520
blk_mq_handle_expired+0x5c/0x90
bt_iter+0x7e/0x90
blk_mq_queue_tag_busy_iter+0x27e/0x550
? __blk_mq_complete_request_remote+0x10/0x10
? __blk_mq_complete_request_remote+0x10/0x10
? __call_rcu_common.constprop.0+0x1c0/0x210
blk_mq_timeout_work+0x12d/0x170
process_one_work+0x12e/0x2d0
worker_thread+0x288/0x3a0
? rescuer_thread+0x480/0x480
kthread+0xb8/0xe0
? kthread_park+0x80/0x80
ret_from_fork+0x2d/0x50
? kthread_park+0x80/0x80
ret_from_fork_asm+0x11/0x20
__schedule+0x47c/0xbb0
? xas_find+0x161/0x1a0
schedule+0x1c/0xa0
blk_mq_freeze_queue_wait+0x3d/0x70
? destroy_sched_domains_rcu+0x30/0x30
blk_mq_update_tag_set_shared+0x44/0x80
blk_mq_exit_queue+0x141/0x150
del_gendisk+0x25a/0x2d0
nvme_ns_remove+0xc9/0x170
nvme_remove_namespaces+0xc7/0x100
nvme_remove+0x62/0x150
pci_device_remove+0x23/0x60
device_release_driver_internal+0x159/0x200
unbind_store+0x99/0xa0
kernfs_fop_write_iter+0x112/0x1e0
vfs_write+0x2b1/0x3d0
ksys_write+0x4e/0xb0
do_syscall_64+0x5b/0x160
entry_SYSCALL_64_after_hwframe+0x4b/0x53
The top stacktrace is showing nvme_timeout() called to handle nvme
command timeout. timeout handler is trying to disable the controller and
as a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not
to call queue callback handlers. The thread is stuck waiting for
set->tag_list_lock as it tries to walk the queues in set->tag_list.
The lock is held by the second thread in the bottom stack which is
waiting for one of queues to be frozen. The queue usage counter will
drop to zero after nvme_timeout() finishes, and this will not happen
because the thread will wait for this mutex forever.
Given that [un]quiescing queue is an operation that does not need to
sleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking
set->tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU
safe list operations. Also, delete INIT_LIST_HEAD(&q->tag_set_list)
in blk_mq_del_queue_tag_set() because we can not re-initialize it while
the list is being traversed under RCU. The deleted queue will not be
added/deleted to/from a tagset and it will be freed in blk_free_queue()
after the end of RCU grace period.
Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Fixes: 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset")
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-mq.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 33a0062f9e56d..f901aeba85522 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -336,12 +336,12 @@ void blk_mq_quiesce_tagset(struct blk_mq_tag_set *set)
{
struct request_queue *q;
- mutex_lock(&set->tag_list_lock);
- list_for_each_entry(q, &set->tag_list, tag_set_list) {
+ rcu_read_lock();
+ list_for_each_entry_rcu(q, &set->tag_list, tag_set_list) {
if (!blk_queue_skip_tagset_quiesce(q))
blk_mq_quiesce_queue_nowait(q);
}
- mutex_unlock(&set->tag_list_lock);
+ rcu_read_unlock();
blk_mq_wait_quiesce_done(set);
}
@@ -351,12 +351,12 @@ void blk_mq_unquiesce_tagset(struct blk_mq_tag_set *set)
{
struct request_queue *q;
- mutex_lock(&set->tag_list_lock);
- list_for_each_entry(q, &set->tag_list, tag_set_list) {
+ rcu_read_lock();
+ list_for_each_entry_rcu(q, &set->tag_list, tag_set_list) {
if (!blk_queue_skip_tagset_quiesce(q))
blk_mq_unquiesce_queue(q);
}
- mutex_unlock(&set->tag_list_lock);
+ rcu_read_unlock();
}
EXPORT_SYMBOL_GPL(blk_mq_unquiesce_tagset);
@@ -4308,7 +4308,7 @@ static void blk_mq_del_queue_tag_set(struct request_queue *q)
struct blk_mq_tag_set *set = q->tag_set;
mutex_lock(&set->tag_list_lock);
- list_del(&q->tag_set_list);
+ list_del_rcu(&q->tag_set_list);
if (list_is_singular(&set->tag_list)) {
/* just transitioned to unshared */
set->flags &= ~BLK_MQ_F_TAG_QUEUE_SHARED;
@@ -4316,7 +4316,6 @@ static void blk_mq_del_queue_tag_set(struct request_queue *q)
blk_mq_update_tag_set_shared(set, false);
}
mutex_unlock(&set->tag_list_lock);
- INIT_LIST_HEAD(&q->tag_set_list);
}
static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set,
@@ -4335,7 +4334,7 @@ static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set,
}
if (set->flags & BLK_MQ_F_TAG_QUEUE_SHARED)
queue_set_hctx_shared(q, true);
- list_add_tail(&q->tag_set_list, &set->tag_list);
+ list_add_tail_rcu(&q->tag_set_list, &set->tag_list);
mutex_unlock(&set->tag_list_lock);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 591/614] ASoC: amd: acp: update tdm channels for specific DAI
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 590/614] block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 592/614] dm-raid: fix possible NULL dereference with undefined raid type Greg Kroah-Hartman
` (36 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hemalatha Pinnamreddy,
Raghavendra Prasad Mallela, Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
[ Upstream commit f34836a8ddf9216ff919927cddb705022bf30aab ]
TDM channel updates were applied to all DAIs, causing configurations
to overwrite for unrelated streams. The logic is modified to update
channels only for targeted DAI. This prevents corruption of other DAI
settings and resolves audio issues observed during system suspend and
resume cycles.
Fixes: 12229b7e50cf ("ASoC: amd: acp: Add TDM support for acp i2s stream")
Signed-off-by: Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
Signed-off-by: Raghavendra Prasad Mallela <raghavendraprasad.mallela@amd.com>
Link: https://patch.msgid.link/20251203120136.2591395-1-raghavendraprasad.mallela@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/acp/acp-i2s.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/amd/acp/acp-i2s.c b/sound/soc/amd/acp/acp-i2s.c
index 4ba0a66981ea9..283a674c7e2c3 100644
--- a/sound/soc/amd/acp/acp-i2s.c
+++ b/sound/soc/amd/acp/acp-i2s.c
@@ -157,6 +157,8 @@ static int acp_i2s_set_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask, u32 rx_mas
spin_lock_irq(&chip->acp_lock);
list_for_each_entry(stream, &chip->stream_list, list) {
+ if (dai->id != stream->dai_id)
+ continue;
switch (chip->acp_rev) {
case ACP_RN_PCI_ID:
case ACP_RMB_PCI_ID:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 592/614] dm-raid: fix possible NULL dereference with undefined raid type
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 591/614] ASoC: amd: acp: update tdm channels for specific DAI Greg Kroah-Hartman
@ 2025-12-16 11:15 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 593/614] dm log-writes: Add missing set_freezable() for freezable kthread Greg Kroah-Hartman
` (35 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Simakov, Mikulas Patocka,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Simakov <bigalex934@gmail.com>
[ Upstream commit 2f6cfd6d7cb165a7af8877b838a9f6aab4159324 ]
rs->raid_type is assigned from get_raid_type_by_ll(), which may return
NULL. This NULL value could be dereferenced later in the condition
'if (!(rs_is_raid10(rs) && rt_is_raid0(rs->raid_type)))'.
Add a fail-fast check to return early with an error if raid_type is NULL,
similar to other uses of this function.
Found by Linux Verification Center (linuxtesting.org) with Svace.
Fixes: 33e53f06850f ("dm raid: introduce extended superblock and new raid types to support takeover/reshaping")
Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-raid.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index c6f7129e43d34..4bacdc499984b 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -2287,6 +2287,8 @@ static int super_init_validation(struct raid_set *rs, struct md_rdev *rdev)
mddev->reshape_position = le64_to_cpu(sb->reshape_position);
rs->raid_type = get_raid_type_by_ll(mddev->level, mddev->layout);
+ if (!rs->raid_type)
+ return -EINVAL;
}
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 593/614] dm log-writes: Add missing set_freezable() for freezable kthread
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2025-12-16 11:15 ` [PATCH 6.18 592/614] dm-raid: fix possible NULL dereference with undefined raid type Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 594/614] scsi: imm: Fix use-after-free bug caused by unfinished delayed work Greg Kroah-Hartman
` (34 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Benjamin Marzinski,
Mikulas Patocka, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit ab08f9c8b363297cafaf45475b08f78bf19b88ef ]
The log_writes_kthread() calls try_to_freeze() but lacks set_freezable(),
rendering the freeze attempt ineffective since kernel threads are
non-freezable by default. This prevents proper thread suspension during
system suspend/hibernate.
Add set_freezable() to explicitly mark the thread as freezable.
Fixes: 0e9cebe72459 ("dm: add log writes target")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-log-writes.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
index 7bb7174f8f4f8..f0c84e7a5daa6 100644
--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -432,6 +432,7 @@ static int log_writes_kthread(void *arg)
struct log_writes_c *lc = arg;
sector_t sector = 0;
+ set_freezable();
while (!kthread_should_stop()) {
bool super = false;
bool logging_enabled;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 594/614] scsi: imm: Fix use-after-free bug caused by unfinished delayed work
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 593/614] dm log-writes: Add missing set_freezable() for freezable kthread Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 595/614] scsi: ufs: core: Fix an error handler crash Greg Kroah-Hartman
` (33 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Duoming Zhou, Martin K. Petersen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit ab58153ec64fa3fc9aea09ca09dc9322e0b54a7c ]
The delayed work item 'imm_tq' is initialized in imm_attach() and
scheduled via imm_queuecommand() for processing SCSI commands. When the
IMM parallel port SCSI host adapter is detached through imm_detach(),
the imm_struct device instance is deallocated.
However, the delayed work might still be pending or executing
when imm_detach() is called, leading to use-after-free bugs
when the work function imm_interrupt() accesses the already
freed imm_struct memory.
The race condition can occur as follows:
CPU 0(detach thread) | CPU 1
| imm_queuecommand()
| imm_queuecommand_lck()
imm_detach() | schedule_delayed_work()
kfree(dev) //FREE | imm_interrupt()
| dev = container_of(...) //USE
dev-> //USE
Add disable_delayed_work_sync() in imm_detach() to guarantee proper
cancellation of the delayed work item before imm_struct is deallocated.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://patch.msgid.link/20251028100149.40721-1-duoming@zju.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/imm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/imm.c b/drivers/scsi/imm.c
index 5c602c0577989..45b0e33293a59 100644
--- a/drivers/scsi/imm.c
+++ b/drivers/scsi/imm.c
@@ -1260,6 +1260,7 @@ static void imm_detach(struct parport *pb)
imm_struct *dev;
list_for_each_entry(dev, &imm_hosts, list) {
if (dev->dev->port == pb) {
+ disable_delayed_work_sync(&dev->imm_tq);
list_del_init(&dev->list);
scsi_remove_host(dev->host);
scsi_host_put(dev->host);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 595/614] scsi: ufs: core: Fix an error handler crash
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 594/614] scsi: imm: Fix use-after-free bug caused by unfinished delayed work Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 596/614] perf/core: Fix missing read event generation on task exit Greg Kroah-Hartman
` (32 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Wang, Nitin Rawat,
Bart Van Assche, Martin K. Petersen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 14be351e5cd07349377010e457a58fac99201832 ]
The UFS error handler may be activated before SCSI scanning has started
and hence before hba->ufs_device_wlun has been set. Check the
hba->ufs_device_wlun pointer before using it.
Cc: Peter Wang <peter.wang@mediatek.com>
Cc: Nitin Rawat <nitin.rawat@oss.qualcomm.com>
Fixes: e23ef4f22db3 ("scsi: ufs: core: Fix error handler host_sem issue")
Fixes: f966e02ae521 ("scsi: ufs: core: Fix runtime suspend error deadlock")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Reviewed-by: Nitin Rawat <nitin.rawat@oss.qualcomm.com>
Tested-by: Nitin Rawat <nitin.rawat@oss.qualcomm.com> #SM8750
Link: https://patch.msgid.link/20251204170457.994851-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 12f5a7a973128..a921a9098a291 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -6670,19 +6670,22 @@ static void ufshcd_err_handler(struct work_struct *work)
hba->saved_uic_err, hba->force_reset,
ufshcd_is_link_broken(hba) ? "; link is broken" : "");
- /*
- * Use ufshcd_rpm_get_noresume() here to safely perform link recovery
- * even if an error occurs during runtime suspend or runtime resume.
- * This avoids potential deadlocks that could happen if we tried to
- * resume the device while a PM operation is already in progress.
- */
- ufshcd_rpm_get_noresume(hba);
- if (hba->pm_op_in_progress) {
- ufshcd_link_recovery(hba);
+ if (hba->ufs_device_wlun) {
+ /*
+ * Use ufshcd_rpm_get_noresume() here to safely perform link
+ * recovery even if an error occurs during runtime suspend or
+ * runtime resume. This avoids potential deadlocks that could
+ * happen if we tried to resume the device while a PM operation
+ * is already in progress.
+ */
+ ufshcd_rpm_get_noresume(hba);
+ if (hba->pm_op_in_progress) {
+ ufshcd_link_recovery(hba);
+ ufshcd_rpm_put(hba);
+ return;
+ }
ufshcd_rpm_put(hba);
- return;
}
- ufshcd_rpm_put(hba);
down(&hba->host_sem);
spin_lock_irqsave(hba->host->host_lock, flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 596/614] perf/core: Fix missing read event generation on task exit
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 595/614] scsi: ufs: core: Fix an error handler crash Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 597/614] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Greg Kroah-Hartman
` (31 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thaumy Cheng, Ingo Molnar,
Peter Zijlstra, Adrian Hunter, Alexander Shishkin,
Arnaldo Carvalho de Melo, Ian Rogers, James Clark, Jiri Olsa,
Mark Rutland, Namhyung Kim, linux-perf-users, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thaumy Cheng <thaumy.love@gmail.com>
[ Upstream commit c418d8b4d7a43a86b82ee39cb52ece3034383530 ]
For events with inherit_stat enabled, a "read" event will be generated
to collect per task event counts on task exit.
The call chain is as follows:
do_exit
-> perf_event_exit_task
-> perf_event_exit_task_context
-> perf_event_exit_event
-> perf_remove_from_context
-> perf_child_detach
-> sync_child_event
-> perf_event_read_event
However, the child event context detaches the task too early in
perf_event_exit_task_context, which causes sync_child_event to never
generate the read event in this case, since child_event->ctx->task is
always set to TASK_TOMBSTONE. Fix that by moving context lock section
backward to ensure ctx->task is not set to TASK_TOMBSTONE before
generating the read event.
Because perf_event_free_task calls perf_event_exit_task_context with
exit = false to tear down all child events from the context, and the
task never lived, accessing the task PID can lead to a use-after-free.
To fix that, let sync_child_event read task from argument and move the
call to the only place it should be triggered to avoid the effect of
setting ctx->task to TASK_TOMESTONE, and add a task parameter to
perf_event_exit_event to trigger the sync_child_event properly when
needed.
This bug can be reproduced by running "perf record -s" and attaching to
any program that generates perf events in its child tasks. If we check
the result with "perf report -T", the last line of the report will leave
an empty table like "# PID TID", which is expected to contain the
per-task event counts by design.
Fixes: ef54c1a476ae ("perf: Rework perf_event_exit_event()")
Signed-off-by: Thaumy Cheng <thaumy.love@gmail.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: linux-perf-users@vger.kernel.org
Link: https://patch.msgid.link/20251209041600.963586-1-thaumy.love@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/core.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 2c35acc2722b0..413b88a4e00fb 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2316,8 +2316,6 @@ static void perf_group_detach(struct perf_event *event)
perf_event__header_size(leader);
}
-static void sync_child_event(struct perf_event *child_event);
-
static void perf_child_detach(struct perf_event *event)
{
struct perf_event *parent_event = event->parent;
@@ -2336,7 +2334,6 @@ static void perf_child_detach(struct perf_event *event)
lockdep_assert_held(&parent_event->child_mutex);
*/
- sync_child_event(event);
list_del_init(&event->child_list);
}
@@ -4587,6 +4584,7 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
static void perf_remove_from_owner(struct perf_event *event);
static void perf_event_exit_event(struct perf_event *event,
struct perf_event_context *ctx,
+ struct task_struct *task,
bool revoke);
/*
@@ -4614,7 +4612,7 @@ static void perf_event_remove_on_exec(struct perf_event_context *ctx)
modified = true;
- perf_event_exit_event(event, ctx, false);
+ perf_event_exit_event(event, ctx, ctx->task, false);
}
raw_spin_lock_irqsave(&ctx->lock, flags);
@@ -12447,7 +12445,7 @@ static void __pmu_detach_event(struct pmu *pmu, struct perf_event *event,
/*
* De-schedule the event and mark it REVOKED.
*/
- perf_event_exit_event(event, ctx, true);
+ perf_event_exit_event(event, ctx, ctx->task, true);
/*
* All _free_event() bits that rely on event->pmu:
@@ -14004,14 +14002,13 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu)
}
EXPORT_SYMBOL_GPL(perf_pmu_migrate_context);
-static void sync_child_event(struct perf_event *child_event)
+static void sync_child_event(struct perf_event *child_event,
+ struct task_struct *task)
{
struct perf_event *parent_event = child_event->parent;
u64 child_val;
if (child_event->attr.inherit_stat) {
- struct task_struct *task = child_event->ctx->task;
-
if (task && task != TASK_TOMBSTONE)
perf_event_read_event(child_event, task);
}
@@ -14030,7 +14027,9 @@ static void sync_child_event(struct perf_event *child_event)
static void
perf_event_exit_event(struct perf_event *event,
- struct perf_event_context *ctx, bool revoke)
+ struct perf_event_context *ctx,
+ struct task_struct *task,
+ bool revoke)
{
struct perf_event *parent_event = event->parent;
unsigned long detach_flags = DETACH_EXIT;
@@ -14053,6 +14052,9 @@ perf_event_exit_event(struct perf_event *event,
mutex_lock(&parent_event->child_mutex);
/* PERF_ATTACH_ITRACE might be set concurrently */
attach_state = READ_ONCE(event->attach_state);
+
+ if (attach_state & PERF_ATTACH_CHILD)
+ sync_child_event(event, task);
}
if (revoke)
@@ -14144,7 +14146,7 @@ static void perf_event_exit_task_context(struct task_struct *task, bool exit)
perf_event_task(task, ctx, 0);
list_for_each_entry_safe(child_event, next, &ctx->event_list, event_entry)
- perf_event_exit_event(child_event, ctx, false);
+ perf_event_exit_event(child_event, ctx, exit ? task : NULL, false);
mutex_unlock(&ctx->mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 597/614] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 596/614] perf/core: Fix missing read event generation on task exit Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 598/614] cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Greg Kroah-Hartman
` (30 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Thomas Gleixner,
Claudiu Beznea, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 7dbc0d40d8347bd9de55c904f59ea44bcc8dedb7 ]
If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then
it results in an out of bounds access.
The code checks for invalid values, but doesn't set the error code. Return
-EINVAL in that case, instead of returning success.
Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Link: https://patch.msgid.link/aTfHmOz6IBpTIPU5@stanley.mountain
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-mchp-eic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index b513a899c0853..979bb86929f8e 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -166,7 +166,7 @@ static int mchp_eic_domain_alloc(struct irq_domain *domain, unsigned int virq,
ret = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type);
if (ret || hwirq >= MCHP_EIC_NIRQ)
- return ret;
+ return ret ?: -EINVAL;
switch (type) {
case IRQ_TYPE_EDGE_RISING:
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 598/614] cpu: Make atomic hotplug callbacks run with interrupts disabled on UP
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 597/614] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 599/614] ocfs2: fix memory leak in ocfs2_merge_rec_left() Greg Kroah-Hartman
` (29 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Thomas Gleixner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit c94291914b200e10c72cef23c8e4c67eb4fdbcd9 ]
On SMP systems the CPU hotplug callbacks in the "starting" range are
invoked while the CPU is brought up and interrupts are still
disabled. Callbacks which are added later are invoked via the
hotplug-thread on the target CPU and interrupts are explicitly disabled.
In the UP case callbacks which are added later are invoked directly without
the thread indirection. This is in principle okay since there is just one
CPU but those callbacks are invoked with interrupt disabled code. That's
incorrect as those callbacks assume interrupt disabled context.
Disable interrupts before invoking the callbacks on UP if the state is
atomic and interrupts are expected to be disabled. The "save" part is
required because this is also invoked early in the boot process while
interrupts are disabled and must not be enabled prematurely.
Fixes: 06ddd17521bf1 ("sched/smp: Always define is_percpu_thread() and scheduler_ipi()")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251127144723.ev9DuXXR@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cpu.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index db9f6c539b28c..15000c7abc659 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -249,6 +249,14 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
return ret;
}
+/*
+ * The former STARTING/DYING states, ran with IRQs disabled and must not fail.
+ */
+static bool cpuhp_is_atomic_state(enum cpuhp_state state)
+{
+ return CPUHP_AP_IDLE_DEAD <= state && state < CPUHP_AP_ONLINE;
+}
+
#ifdef CONFIG_SMP
static bool cpuhp_is_ap_state(enum cpuhp_state state)
{
@@ -271,14 +279,6 @@ static inline void complete_ap_thread(struct cpuhp_cpu_state *st, bool bringup)
complete(done);
}
-/*
- * The former STARTING/DYING states, ran with IRQs disabled and must not fail.
- */
-static bool cpuhp_is_atomic_state(enum cpuhp_state state)
-{
- return CPUHP_AP_IDLE_DEAD <= state && state < CPUHP_AP_ONLINE;
-}
-
/* Synchronization state management */
enum cpuhp_sync_state {
SYNC_STATE_DEAD,
@@ -2364,7 +2364,14 @@ static int cpuhp_issue_call(int cpu, enum cpuhp_state state, bool bringup,
else
ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
#else
- ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
+ if (cpuhp_is_atomic_state(state)) {
+ guard(irqsave)();
+ ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
+ /* STARTING/DYING must not fail! */
+ WARN_ON_ONCE(ret);
+ } else {
+ ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
+ }
#endif
BUG_ON(ret && !bringup);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 599/614] ocfs2: fix memory leak in ocfs2_merge_rec_left()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 598/614] cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 600/614] perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() Greg Kroah-Hartman
` (28 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov,
syzbot+cfc7cab3bb6eaa7c4de2, Heming Zhao, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Andrew Morton,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 2214ec4bf89d0fd27717322d3983a2f3b469c7f3 ]
In 'ocfs2_merge_rec_left()', do not reset 'left_path' to NULL after
move, thus allowing 'ocfs2_free_path()' to free it before return.
Link: https://lkml.kernel.org/r/20251205065159.392749-1-dmantipov@yandex.ru
Fixes: 677b975282e4 ("ocfs2: Add support for cross extent block")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+cfc7cab3bb6eaa7c4de2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cfc7cab3bb6eaa7c4de2
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/alloc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 162711cc5b201..a0ced11e0c24a 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -3654,7 +3654,6 @@ static int ocfs2_merge_rec_left(struct ocfs2_path *right_path,
* So we use the new rightmost path.
*/
ocfs2_mv_path(right_path, left_path);
- left_path = NULL;
} else
ocfs2_complete_edge_insert(handle, left_path,
right_path, subtree_index);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 600/614] perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 599/614] ocfs2: fix memory leak in ocfs2_merge_rec_left() Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 601/614] efi/cper: Add a new helper function to print bitmasks Greg Kroah-Hartman
` (27 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kitta, Evan Li, Ingo Molnar,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Evan Li <evan.li@linux.alibaba.com>
[ Upstream commit 9415f749d34b926b9e4853da1462f4d941f89a0d ]
handle_pmi_common() may observe an active bit set in cpuc->active_mask
while the corresponding cpuc->events[] entry has already been cleared,
which leads to a NULL pointer dereference.
This can happen when interrupt throttling stops all events in a group
while PEBS processing is still in progress. perf_event_overflow() can
trigger perf_event_throttle_group(), which stops the group and clears
the cpuc->events[] entry, but the active bit may still be set when
handle_pmi_common() iterates over the events.
The following recent fix:
7e772a93eb61 ("perf/x86: Fix NULL event access and potential PEBS record loss")
moved the cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
relied on cpuc->active_mask/pebs_enabled checks. However,
handle_pmi_common() can still encounter a NULL cpuc->events[] entry
despite the active bit being set.
Add an explicit NULL check on the event pointer before using it,
to cover this legitimate scenario and avoid the NULL dereference crash.
Fixes: 7e772a93eb61 ("perf/x86: Fix NULL event access and potential PEBS record loss")
Reported-by: kitta <kitta@linux.alibaba.com>
Co-developed-by: kitta <kitta@linux.alibaba.com>
Signed-off-by: Evan Li <evan.li@linux.alibaba.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://patch.msgid.link/20251212084943.2124787-1-evan.li@linux.alibaba.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220855
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 9b824ed6fc1de..32d551f2646a7 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3249,6 +3249,9 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status)
if (!test_bit(bit, cpuc->active_mask))
continue;
+ /* Event may have already been cleared: */
+ if (!event)
+ continue;
/*
* There may be unprocessed PEBS records in the PEBS buffer,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 601/614] efi/cper: Add a new helper function to print bitmasks
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 600/614] perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 602/614] efi/cper: Adjust infopfx size to accept an extra space Greg Kroah-Hartman
` (26 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonathan Cameron,
Mauro Carvalho Chehab, Borislav Petkov (AMD), Ard Biesheuvel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit a976d790f49499ccaa0f991788ad8ebf92e7fd5c ]
Add a helper function to print a string with names associated
to each bit field.
A typical example is:
const char * const bits[] = {
"bit 3 name",
"bit 4 name",
"bit 5 name",
};
char str[120];
unsigned int bitmask = BIT(3) | BIT(5);
#define MASK GENMASK(5,3)
cper_bits_to_str(str, sizeof(str), FIELD_GET(MASK, bitmask),
bits, ARRAY_SIZE(bits));
The above code fills string "str" with "bit 3 name|bit 5 name".
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/cper.c | 60 +++++++++++++++++++++++++++++++++++++
include/linux/cper.h | 2 ++
2 files changed, 62 insertions(+)
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index 928409199a1a4..79ba688a64f8d 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -12,6 +12,7 @@
* Specification version 2.4.
*/
+#include <linux/bitmap.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/time.h>
@@ -106,6 +107,65 @@ void cper_print_bits(const char *pfx, unsigned int bits,
printk("%s\n", buf);
}
+/**
+ * cper_bits_to_str - return a string for set bits
+ * @buf: buffer to store the output string
+ * @buf_size: size of the output string buffer
+ * @bits: bit mask
+ * @strs: string array, indexed by bit position
+ * @strs_size: size of the string array: @strs
+ *
+ * Add to @buf the bitmask in hexadecimal. Then, for each set bit in @bits,
+ * add the corresponding string describing the bit in @strs to @buf.
+ *
+ * A typical example is::
+ *
+ * const char * const bits[] = {
+ * "bit 3 name",
+ * "bit 4 name",
+ * "bit 5 name",
+ * };
+ * char str[120];
+ * unsigned int bitmask = BIT(3) | BIT(5);
+ * #define MASK GENMASK(5,3)
+ *
+ * cper_bits_to_str(str, sizeof(str), FIELD_GET(MASK, bitmask),
+ * bits, ARRAY_SIZE(bits));
+ *
+ * The above code fills the string ``str`` with ``bit 3 name|bit 5 name``.
+ *
+ * Return: number of bytes stored or an error code if lower than zero.
+ */
+int cper_bits_to_str(char *buf, int buf_size, unsigned long bits,
+ const char * const strs[], unsigned int strs_size)
+{
+ int len = buf_size;
+ char *str = buf;
+ int i, size;
+
+ *buf = '\0';
+
+ for_each_set_bit(i, &bits, strs_size) {
+ if (!(bits & BIT_ULL(i)))
+ continue;
+
+ if (*buf && len > 0) {
+ *str = '|';
+ len--;
+ str++;
+ }
+
+ size = strscpy(str, strs[i], len);
+ if (size < 0)
+ return size;
+
+ len -= size;
+ str += size;
+ }
+ return len - buf_size;
+}
+EXPORT_SYMBOL_GPL(cper_bits_to_str);
+
static const char * const proc_type_strs[] = {
"IA32/X64",
"IA64",
diff --git a/include/linux/cper.h b/include/linux/cper.h
index 0ed60a91eca9d..58f40477c824e 100644
--- a/include/linux/cper.h
+++ b/include/linux/cper.h
@@ -588,6 +588,8 @@ const char *cper_mem_err_type_str(unsigned int);
const char *cper_mem_err_status_str(u64 status);
void cper_print_bits(const char *prefix, unsigned int bits,
const char * const strs[], unsigned int strs_size);
+int cper_bits_to_str(char *buf, int buf_size, unsigned long bits,
+ const char * const strs[], unsigned int strs_size);
void cper_mem_err_pack(const struct cper_sec_mem_err *,
struct cper_mem_err_compact *);
const char *cper_mem_err_unpack(struct trace_seq *,
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 602/614] efi/cper: Adjust infopfx size to accept an extra space
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 601/614] efi/cper: Add a new helper function to print bitmasks Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 603/614] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Greg Kroah-Hartman
` (25 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mauro Carvalho Chehab,
Jonathan Cameron, Borislav Petkov (AMD), Ard Biesheuvel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit 8ad2c72e21efb3dc76c5b14089fa7984cdd87898 ]
Compiling with W=1 with werror enabled produces an error:
drivers/firmware/efi/cper-arm.c: In function ‘cper_print_proc_arm’:
drivers/firmware/efi/cper-arm.c:298:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
298 | snprintf(infopfx, sizeof(infopfx), "%s ", newpfx);
| ^
drivers/firmware/efi/cper-arm.c:298:25: note: ‘snprintf’ output between 2 and 65 bytes into a destination of size 64
298 | snprintf(infopfx, sizeof(infopfx), "%s ", newpfx);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
As the logic there adds an space at the end of infopx buffer.
Add an extra space to avoid such warning.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/cper-arm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
index f0a63d09d3c49..6ff781e47147c 100644
--- a/drivers/firmware/efi/cper-arm.c
+++ b/drivers/firmware/efi/cper-arm.c
@@ -240,7 +240,7 @@ void cper_print_proc_arm(const char *pfx,
int i, len, max_ctx_type;
struct cper_arm_err_info *err_info;
struct cper_arm_ctx_info *ctx_info;
- char newpfx[64], infopfx[64];
+ char newpfx[64], infopfx[ARRAY_SIZE(newpfx) + 1];
printk("%sMIDR: 0x%016llx\n", pfx, proc->midr);
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 603/614] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 602/614] efi/cper: Adjust infopfx size to accept an extra space Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 604/614] usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Greg Kroah-Hartman
` (24 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mauro Carvalho Chehab,
Jonathan Cameron, Borislav Petkov (AMD), Ard Biesheuvel,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
[ Upstream commit 96b010536ee020e716d28d9b359a4bcd18800aeb ]
Up to UEFI spec 2.9, the type byte of CPER struct for ARM processor
was defined simply as:
Type at byte offset 4:
- Cache error
- TLB Error
- Bus Error
- Micro-architectural Error
All other values are reserved
Yet, there was no information about how this would be encoded.
Spec 2.9A errata corrected it by defining:
- Bit 1 - Cache Error
- Bit 2 - TLB Error
- Bit 3 - Bus Error
- Bit 4 - Micro-architectural Error
All other values are reserved
That actually aligns with the values already defined on older
versions at N.2.4.1. Generic Processor Error Section.
Spec 2.10 also preserve the same encoding as 2.9A.
Adjust CPER and GHES handling code for both generic and ARM
processors to properly handle UEFI 2.9A and 2.10 encoding.
Link: https://uefi.org/specs/UEFI/2.10/Apx_N_Common_Platform_Error_Record.html#arm-processor-error-information
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 16 +++++++----
drivers/firmware/efi/cper-arm.c | 50 ++++++++++++++++-----------------
include/linux/cper.h | 10 +++----
3 files changed, 39 insertions(+), 37 deletions(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 7d2466b515046..56107aa002744 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -22,6 +22,7 @@
#include <linux/moduleparam.h>
#include <linux/init.h>
#include <linux/acpi.h>
+#include <linux/bitfield.h>
#include <linux/io.h>
#include <linux/interrupt.h>
#include <linux/timer.h>
@@ -556,6 +557,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
{
struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
int flags = sync ? MF_ACTION_REQUIRED : 0;
+ char error_type[120];
bool queued = false;
int sec_sev, i;
char *p;
@@ -568,9 +570,8 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
p = (char *)(err + 1);
for (i = 0; i < err->err_info_num; i++) {
struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p;
- bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR);
+ bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR;
bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR);
- const char *error_type = "unknown error";
/*
* The field (err_info->error_info & BIT(26)) is fixed to set to
@@ -584,12 +585,15 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
continue;
}
- if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs))
- error_type = cper_proc_error_type_strs[err_info->type];
+ cper_bits_to_str(error_type, sizeof(error_type),
+ FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type),
+ cper_proc_error_type_strs,
+ ARRAY_SIZE(cper_proc_error_type_strs));
pr_warn_ratelimited(FW_WARN GHES_PFX
- "Unhandled processor error type: %s\n",
- error_type);
+ "Unhandled processor error type 0x%02x: %s%s\n",
+ err_info->type, error_type,
+ (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : "");
p += err_info->length;
}
diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c
index 6ff781e47147c..76542a53e2027 100644
--- a/drivers/firmware/efi/cper-arm.c
+++ b/drivers/firmware/efi/cper-arm.c
@@ -93,15 +93,11 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
bool proc_context_corrupt, corrected, precise_pc, restartable_pc;
bool time_out, access_mode;
- /* If the type is unknown, bail. */
- if (type > CPER_ARM_MAX_TYPE)
- return;
-
/*
* Vendor type errors have error information values that are vendor
* specific.
*/
- if (type == CPER_ARM_VENDOR_ERROR)
+ if (type & CPER_ARM_VENDOR_ERROR)
return;
if (error_info & CPER_ARM_ERR_VALID_TRANSACTION_TYPE) {
@@ -116,43 +112,38 @@ static void cper_print_arm_err_info(const char *pfx, u32 type,
if (error_info & CPER_ARM_ERR_VALID_OPERATION_TYPE) {
op_type = ((error_info >> CPER_ARM_ERR_OPERATION_SHIFT)
& CPER_ARM_ERR_OPERATION_MASK);
- switch (type) {
- case CPER_ARM_CACHE_ERROR:
+ if (type & CPER_ARM_CACHE_ERROR) {
if (op_type < ARRAY_SIZE(arm_cache_err_op_strs)) {
- printk("%soperation type: %s\n", pfx,
+ printk("%scache error, operation type: %s\n", pfx,
arm_cache_err_op_strs[op_type]);
}
- break;
- case CPER_ARM_TLB_ERROR:
+ }
+ if (type & CPER_ARM_TLB_ERROR) {
if (op_type < ARRAY_SIZE(arm_tlb_err_op_strs)) {
- printk("%soperation type: %s\n", pfx,
+ printk("%sTLB error, operation type: %s\n", pfx,
arm_tlb_err_op_strs[op_type]);
}
- break;
- case CPER_ARM_BUS_ERROR:
+ }
+ if (type & CPER_ARM_BUS_ERROR) {
if (op_type < ARRAY_SIZE(arm_bus_err_op_strs)) {
- printk("%soperation type: %s\n", pfx,
+ printk("%sbus error, operation type: %s\n", pfx,
arm_bus_err_op_strs[op_type]);
}
- break;
}
}
if (error_info & CPER_ARM_ERR_VALID_LEVEL) {
level = ((error_info >> CPER_ARM_ERR_LEVEL_SHIFT)
& CPER_ARM_ERR_LEVEL_MASK);
- switch (type) {
- case CPER_ARM_CACHE_ERROR:
+ if (type & CPER_ARM_CACHE_ERROR)
printk("%scache level: %d\n", pfx, level);
- break;
- case CPER_ARM_TLB_ERROR:
+
+ if (type & CPER_ARM_TLB_ERROR)
printk("%sTLB level: %d\n", pfx, level);
- break;
- case CPER_ARM_BUS_ERROR:
+
+ if (type & CPER_ARM_BUS_ERROR)
printk("%saffinity level at which the bus error occurred: %d\n",
pfx, level);
- break;
- }
}
if (error_info & CPER_ARM_ERR_VALID_PROC_CONTEXT_CORRUPT) {
@@ -241,6 +232,7 @@ void cper_print_proc_arm(const char *pfx,
struct cper_arm_err_info *err_info;
struct cper_arm_ctx_info *ctx_info;
char newpfx[64], infopfx[ARRAY_SIZE(newpfx) + 1];
+ char error_type[120];
printk("%sMIDR: 0x%016llx\n", pfx, proc->midr);
@@ -289,9 +281,15 @@ void cper_print_proc_arm(const char *pfx,
newpfx);
}
- printk("%serror_type: %d, %s\n", newpfx, err_info->type,
- err_info->type < ARRAY_SIZE(cper_proc_error_type_strs) ?
- cper_proc_error_type_strs[err_info->type] : "unknown");
+ cper_bits_to_str(error_type, sizeof(error_type),
+ FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type),
+ cper_proc_error_type_strs,
+ ARRAY_SIZE(cper_proc_error_type_strs));
+
+ printk("%serror_type: 0x%02x: %s%s\n", newpfx, err_info->type,
+ error_type,
+ (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : "");
+
if (err_info->validation_bits & CPER_ARM_INFO_VALID_ERR_INFO) {
printk("%serror_info: 0x%016llx\n", newpfx,
err_info->error_info);
diff --git a/include/linux/cper.h b/include/linux/cper.h
index 58f40477c824e..5b1236d8c65bb 100644
--- a/include/linux/cper.h
+++ b/include/linux/cper.h
@@ -297,11 +297,11 @@ enum {
#define CPER_ARM_INFO_FLAGS_PROPAGATED BIT(2)
#define CPER_ARM_INFO_FLAGS_OVERFLOW BIT(3)
-#define CPER_ARM_CACHE_ERROR 0
-#define CPER_ARM_TLB_ERROR 1
-#define CPER_ARM_BUS_ERROR 2
-#define CPER_ARM_VENDOR_ERROR 3
-#define CPER_ARM_MAX_TYPE CPER_ARM_VENDOR_ERROR
+#define CPER_ARM_ERR_TYPE_MASK GENMASK(4,1)
+#define CPER_ARM_CACHE_ERROR BIT(1)
+#define CPER_ARM_TLB_ERROR BIT(2)
+#define CPER_ARM_BUS_ERROR BIT(3)
+#define CPER_ARM_VENDOR_ERROR BIT(4)
#define CPER_ARM_ERR_VALID_TRANSACTION_TYPE BIT(0)
#define CPER_ARM_ERR_VALID_OPERATION_TYPE BIT(1)
--
2.51.0
^ permalink raw reply related [flat|nested] 647+ messages in thread
* [PATCH 6.18 604/614] usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 603/614] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 605/614] usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() Greg Kroah-Hartman
` (23 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Haotien Hsu, Wayne Chang
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotien Hsu <haotienh@nvidia.com>
commit 2585973c7f9ee31d21e5848c996fab2521fd383d upstream.
The driver previously skipped handling ClearFeature(ENDPOINT_HALT)
when the endpoint was already not halted. This prevented the
controller from resetting the data sequence number and reinitializing
the endpoint state.
According to USB 3.2 specification Rev. 1.1, section 9.4.5,
ClearFeature(ENDPOINT_HALT) must always reset the data sequence and
set the stream state machine to Disabled, regardless of whether the
endpoint was halted.
Remove the early return so that ClearFeature(ENDPOINT_HALT) always
resets the endpoint sequence state as required by the specification.
Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller")
Cc: stable <stable@kernel.org>
Signed-off-by: Haotien Hsu <haotienh@nvidia.com>
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Link: https://patch.msgid.link/20251127033540.2287517-1-waynec@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/tegra-xudc.c | 6 ------
1 file changed, 6 deletions(-)
--- a/drivers/usb/gadget/udc/tegra-xudc.c
+++ b/drivers/usb/gadget/udc/tegra-xudc.c
@@ -1558,12 +1558,6 @@ static int __tegra_xudc_ep_set_halt(stru
return -ENOTSUPP;
}
- if (!!(xudc_readl(xudc, EP_HALT) & BIT(ep->index)) == halt) {
- dev_dbg(xudc->dev, "EP %u already %s\n", ep->index,
- halt ? "halted" : "not halted");
- return 0;
- }
-
if (halt) {
ep_halt(xudc, ep->index);
} else {
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 605/614] usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 604/614] usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 606/614] usb: phy: Initialize struct usb_phy list_head Greg Kroah-Hartman
` (22 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Duoming Zhou,
Heikki Krogerus, Pengyu Luo
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <duoming@zju.edu.cn>
commit 6b120ef99fbcba9e413783561f8cc160719db589 upstream.
The gaokun_ucsi_probe() uses ucsi_create() to allocate a UCSI instance.
The ucsi_create() validates whether ops->poll_cci is defined, and if not,
it directly returns -EINVAL. However, the gaokun_ucsi_ops structure does
not define the poll_cci, causing ucsi_create() always fail with -EINVAL.
This issue can be observed in the kernel log with the following error:
ucsi_huawei_gaokun.ucsi huawei_gaokun_ec.ucsi.0: probe with driver
ucsi_huawei_gaokun.ucsi failed with error -22
Fix the issue by adding the missing poll_cci callback to gaokun_ucsi_ops.
Fixes: 00327d7f2c8c ("usb: typec: ucsi: add Huawei Matebook E Go ucsi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Pengyu Luo <mitltlatltl@gmail.com>
Link: https://patch.msgid.link/4d077d6439d728be68646bb8c8678436a3a0885e.1764065838.git.duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
+++ b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
@@ -196,6 +196,7 @@ static void gaokun_ucsi_connector_status
const struct ucsi_operations gaokun_ucsi_ops = {
.read_version = gaokun_ucsi_read_version,
.read_cci = gaokun_ucsi_read_cci,
+ .poll_cci = gaokun_ucsi_read_cci,
.read_message_in = gaokun_ucsi_read_message_in,
.sync_control = ucsi_sync_control_common,
.async_control = gaokun_ucsi_async_control,
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 606/614] usb: phy: Initialize struct usb_phy list_head
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 605/614] usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 607/614] usb: typec: ucsi: fix use-after-free caused by uec->work Greg Kroah-Hartman
` (21 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Diogo Ivo
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
commit c69ff68b097b0f53333114f1b2c3dc128f389596 upstream.
As part of the registration of a new 'struct usb_phy' with the USB PHY core
via either usb_add_phy(struct usb_phy *x, ...) or usb_add_phy_dev(struct
usb_phy *x) these functions call list_add_tail(&x->head, phy_list) in
order for the new instance x to be stored in phy_list, a static list
kept internally by the core.
After 7d21114dc6a2 ("usb: phy: Introduce one extcon device into usb phy")
when executing either of the registration functions above it is possible
that usb_add_extcon() fails, leading to either function returning before
the call to list_add_tail(), leaving x->head uninitialized.
Then, when a driver tries to undo the failed registration by calling
usb_remove_phy(struct usb_phy *x) there will be an unconditional call to
list_del(&x->head) acting on an uninitialized variable, and thus a
possible NULL pointer dereference.
Fix this by initializing x->head before usb_add_extcon() has a
chance to fail. Note that this was not needed before 7d21114dc6a2 since
list_add_phy() was executed unconditionally and it guaranteed that x->head
was initialized.
Fixes: 7d21114dc6a2 ("usb: phy: Introduce one extcon device into usb phy")
Cc: stable <stable@kernel.org>
Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
Link: https://patch.msgid.link/20251121-diogo-smaug_typec-v2-1-5c37c1169d57@tecnico.ulisboa.pt
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -646,6 +646,8 @@ int usb_add_phy(struct usb_phy *x, enum
return -EINVAL;
}
+ INIT_LIST_HEAD(&x->head);
+
usb_charger_init(x);
ret = usb_add_extcon(x);
if (ret)
@@ -696,6 +698,8 @@ int usb_add_phy_dev(struct usb_phy *x)
return -EINVAL;
}
+ INIT_LIST_HEAD(&x->head);
+
usb_charger_init(x);
ret = usb_add_extcon(x);
if (ret)
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 607/614] usb: typec: ucsi: fix use-after-free caused by uec->work
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 606/614] usb: phy: Initialize struct usb_phy list_head Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 608/614] usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required Greg Kroah-Hartman
` (20 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Duoming Zhou,
Heikki Krogerus
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <duoming@zju.edu.cn>
commit 2b7a0f47aaf2439d517ba0a6b29c66a535302154 upstream.
The delayed work uec->work is scheduled in gaokun_ucsi_probe()
but never properly canceled in gaokun_ucsi_remove(). This creates
use-after-free scenarios where the ucsi and gaokun_ucsi structure
are freed after ucsi_destroy() completes execution, while the
gaokun_ucsi_register_worker() might be either currently executing
or still pending in the work queue. The already-freed gaokun_ucsi
or ucsi structure may then be accessed.
Furthermore, the race window is 3 seconds, which is sufficiently
long to make this bug easily reproducible. The following is the
trace captured by KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in __run_timers+0x5ec/0x630
Write of size 8 at addr ffff00000ec28cc8 by task swapper/0/0
...
Call trace:
show_stack+0x18/0x24 (C)
dump_stack_lvl+0x78/0x90
print_report+0x114/0x580
kasan_report+0xa4/0xf0
__asan_report_store8_noabort+0x20/0x2c
__run_timers+0x5ec/0x630
run_timer_softirq+0xe8/0x1cc
handle_softirqs+0x294/0x720
__do_softirq+0x14/0x20
____do_softirq+0x10/0x1c
call_on_irq_stack+0x30/0x48
do_softirq_own_stack+0x1c/0x28
__irq_exit_rcu+0x27c/0x364
irq_exit_rcu+0x10/0x1c
el1_interrupt+0x40/0x60
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x6c/0x70
arch_local_irq_enable+0x4/0x8 (P)
do_idle+0x334/0x458
cpu_startup_entry+0x60/0x70
rest_init+0x158/0x174
start_kernel+0x2f8/0x394
__primary_switched+0x8c/0x94
Allocated by task 72 on cpu 0 at 27.510341s:
kasan_save_stack+0x2c/0x54
kasan_save_track+0x24/0x5c
kasan_save_alloc_info+0x40/0x54
__kasan_kmalloc+0xa0/0xb8
__kmalloc_node_track_caller_noprof+0x1c0/0x588
devm_kmalloc+0x7c/0x1c8
gaokun_ucsi_probe+0xa0/0x840 auxiliary_bus_probe+0x94/0xf8
really_probe+0x17c/0x5b8
__driver_probe_device+0x158/0x2c4
driver_probe_device+0x10c/0x264
__device_attach_driver+0x168/0x2d0
bus_for_each_drv+0x100/0x188
__device_attach+0x174/0x368
device_initial_probe+0x14/0x20
bus_probe_device+0x120/0x150
device_add+0xb3c/0x10fc
__auxiliary_device_add+0x88/0x130
...
Freed by task 73 on cpu 1 at 28.910627s:
kasan_save_stack+0x2c/0x54
kasan_save_track+0x24/0x5c
__kasan_save_free_info+0x4c/0x74
__kasan_slab_free+0x60/0x8c
kfree+0xd4/0x410
devres_release_all+0x140/0x1f0
device_unbind_cleanup+0x20/0x190
device_release_driver_internal+0x344/0x460
device_release_driver+0x18/0x24
bus_remove_device+0x198/0x274
device_del+0x310/0xa84
...
The buggy address belongs to the object at ffff00000ec28c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 200 bytes inside of
freed 512-byte region
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ec28
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x3fffe0000000040(head|node=0|zone=0|lastcpupid=0x1ffff)
page_type: f5(slab)
raw: 03fffe0000000040 ffff000008801c80 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 03fffe0000000040 ffff000008801c80 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 03fffe0000000002 fffffdffc03b0a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff00000ec28b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff00000ec28c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff00000ec28c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff00000ec28d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff00000ec28d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Add disable_delayed_work_sync() in gaokun_ucsi_remove() to ensure
that uec->work is properly canceled and prevented from executing
after the ucsi and gaokun_ucsi structure have been deallocated.
Fixes: 00327d7f2c8c ("usb: typec: ucsi: add Huawei Matebook E Go ucsi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/cc31e12ef9ffbf86676585b02233165fd33f0d8e.1764065838.git.duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
+++ b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
@@ -503,6 +503,7 @@ static void gaokun_ucsi_remove(struct au
{
struct gaokun_ucsi *uec = auxiliary_get_drvdata(adev);
+ disable_delayed_work_sync(&uec->work);
gaokun_ec_unregister_notify(uec->ec, &uec->nb);
ucsi_unregister(uec->ucsi);
ucsi_destroy(uec->ucsi);
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 608/614] usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 607/614] usb: typec: ucsi: fix use-after-free caused by uec->work Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 609/614] ALSA: dice: fix buffer overflow in detect_stream_formats() Greg Kroah-Hartman
` (19 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Thinh Nguyen, Neal Gompa,
Sven Peter
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Peter <sven@kernel.org>
commit 5ed9cc71432a8adf3c42223c935f714aac29901b upstream.
On Apple Silicon machines we can't use ioremap() / Device-nGnRE to map most
regions but must use ioremap_np() / Device-nGnRnE whenever
IORESOURCE_MEM_NONPOSTED is set. Make sure this is also done inside
dwc3_power_off_all_roothub_ports to prevent SErrors.
Fixes: 2d2a3349521d ("usb: dwc3: Add workaround for host mode VBUS glitch when boot")
Cc: stable@kernel.org
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Sven Peter <sven@kernel.org>
Link: https://patch.msgid.link/20251015-b4-aplpe-dwc3-v2-2-cbd65a2d511a@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/host.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/host.c
+++ b/drivers/usb/dwc3/host.c
@@ -37,7 +37,10 @@ static void dwc3_power_off_all_roothub_p
/* xhci regs are not mapped yet, do it temporarily here */
if (dwc->xhci_resources[0].start) {
- xhci_regs = ioremap(dwc->xhci_resources[0].start, DWC3_XHCI_REGS_END);
+ if (dwc->xhci_resources[0].flags & IORESOURCE_MEM_NONPOSTED)
+ xhci_regs = ioremap_np(dwc->xhci_resources[0].start, DWC3_XHCI_REGS_END);
+ else
+ xhci_regs = ioremap(dwc->xhci_resources[0].start, DWC3_XHCI_REGS_END);
if (!xhci_regs) {
dev_err(dwc->dev, "Failed to ioremap xhci_regs\n");
return;
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 609/614] ALSA: dice: fix buffer overflow in detect_stream_formats()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 608/614] usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 610/614] ALSA: hda/realtek: Add match for ASUS Xbox Ally projects Greg Kroah-Hartman
` (18 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Takashi Sakamoto, Takashi Iwai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit 324f3e03e8a85931ce0880654e3c3eb38b0f0bba upstream.
The function detect_stream_formats() reads the stream_count value directly
from a FireWire device without validating it. This can lead to
out-of-bounds writes when a malicious device provides a stream_count value
greater than MAX_STREAMS.
Fix by applying the same validation to both TX and RX stream counts in
detect_stream_formats().
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 58579c056c1c ("ALSA: dice: use extended protocol to detect available stream formats")
Cc: stable@vger.kernel.org
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881B043FC68B4C0DA40B73DAFDCA@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/dice/dice-extension.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/firewire/dice/dice-extension.c
+++ b/sound/firewire/dice/dice-extension.c
@@ -116,7 +116,7 @@ static int detect_stream_formats(struct
break;
base_offset += EXT_APP_STREAM_ENTRIES;
- stream_count = be32_to_cpu(reg[0]);
+ stream_count = min_t(unsigned int, be32_to_cpu(reg[0]), MAX_STREAMS);
err = read_stream_entries(dice, section_addr, base_offset,
stream_count, mode,
dice->tx_pcm_chs,
@@ -125,7 +125,7 @@ static int detect_stream_formats(struct
break;
base_offset += stream_count * EXT_APP_STREAM_ENTRY_SIZE;
- stream_count = be32_to_cpu(reg[1]);
+ stream_count = min_t(unsigned int, be32_to_cpu(reg[1]), MAX_STREAMS);
err = read_stream_entries(dice, section_addr, base_offset,
stream_count,
mode, dice->rx_pcm_chs,
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 610/614] ALSA: hda/realtek: Add match for ASUS Xbox Ally projects
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 609/614] ALSA: dice: fix buffer overflow in detect_stream_formats() Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 611/614] ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Greg Kroah-Hartman
` (17 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Antheas Kapenekakis, Takashi Iwai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <lkml@antheas.dev>
commit 18a4895370a79a3efb4a53ccd1efffef6c5b634e upstream.
Bind the realtek codec to TAS2781 I2C audio amps on ASUS Xbox Ally
projects. While these projects work without a quirk, adding it increases
the output volume significantly.
Cc: stable@vger.kernel.org # 6.17
Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20251026191635.2447593-2-lkml@antheas.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/realtek/alc269.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/hda/codecs/realtek/alc269.c
+++ b/sound/hda/codecs/realtek/alc269.c
@@ -6736,6 +6736,8 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1314, "ASUS GA605K", ALC285_FIXUP_ASUS_GA605K_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1384, "ASUS RC73XA", ALC287_FIXUP_TXNW2781_I2C),
+ SND_PCI_QUIRK(0x1043, 0x1394, "ASUS RC73YA", ALC287_FIXUP_TXNW2781_I2C),
SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650PY/PZ/PV/PU/PYV/PZV/PIV/PVV", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 611/614] ALSA: hda/tas2781: fix speaker id retrieval for multiple probes
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 610/614] ALSA: hda/realtek: Add match for ASUS Xbox Ally projects Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 612/614] ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Greg Kroah-Hartman
` (16 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antheas Kapenekakis, Baojun Xu,
Takashi Iwai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <lkml@antheas.dev>
commit 945865a0ddf3e3950aea32e23e10d815ee9b21bc upstream.
Currently, on ASUS projects, the TAS2781 codec attaches the speaker GPIO
to the first tasdevice_priv instance using devm. This causes
tas2781_read_acpi to fail on subsequent probes since the GPIO is already
managed by the first device. This causes a failure on Xbox Ally X,
because it has two amplifiers, and prevents us from quirking both the
Xbox Ally and Xbox Ally X in the realtek codec driver.
It is unnecessary to attach the GPIO to a device as it is static.
Therefore, instead of attaching it and then reading it when loading the
firmware, read its value directly in tas2781_read_acpi and store it in
the private data structure. Then, make reading the value non-fatal so
that ASUS projects that miss a speaker pin can still work, perhaps using
fallback firmware.
Fixes: 4e7035a75da9 ("ALSA: hda/tas2781: Add speaker id check for ASUS projects")
Cc: stable@vger.kernel.org # 6.17
Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
Reviewed-by: Baojun Xu <baojun.xu@ti.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20251026191635.2447593-1-lkml@antheas.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/tas2781.h | 2 -
sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 ++++++++++++++-----------
2 files changed, 26 insertions(+), 20 deletions(-)
--- a/include/sound/tas2781.h
+++ b/include/sound/tas2781.h
@@ -197,7 +197,6 @@ struct tasdevice_priv {
struct acoustic_data acou_data;
#endif
struct tasdevice_fw *fmw;
- struct gpio_desc *speaker_id;
struct gpio_desc *reset;
struct mutex codec_lock;
struct regmap *regmap;
@@ -215,6 +214,7 @@ struct tasdevice_priv {
unsigned int magic_num;
unsigned int chip_id;
unsigned int sysclk;
+ int speaker_id;
int irq;
int cur_prog;
--- a/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
+++ b/sound/hda/codecs/side-codecs/tas2781_hda_i2c.c
@@ -87,6 +87,7 @@ static const struct acpi_gpio_mapping ta
static int tas2781_read_acpi(struct tasdevice_priv *p, const char *hid)
{
+ struct gpio_desc *speaker_id;
struct acpi_device *adev;
struct device *physdev;
LIST_HEAD(resources);
@@ -119,19 +120,31 @@ static int tas2781_read_acpi(struct tasd
/* Speaker id was needed for ASUS projects. */
ret = kstrtou32(sub, 16, &subid);
if (!ret && upper_16_bits(subid) == PCI_VENDOR_ID_ASUSTEK) {
- ret = devm_acpi_dev_add_driver_gpios(p->dev,
- tas2781_speaker_id_gpios);
- if (ret < 0)
+ ret = acpi_dev_add_driver_gpios(adev, tas2781_speaker_id_gpios);
+ if (ret < 0) {
dev_err(p->dev, "Failed to add driver gpio %d.\n",
ret);
- p->speaker_id = devm_gpiod_get(p->dev, "speakerid", GPIOD_IN);
- if (IS_ERR(p->speaker_id)) {
- dev_err(p->dev, "Failed to get Speaker id.\n");
- ret = PTR_ERR(p->speaker_id);
- goto err;
+ p->speaker_id = -1;
+ goto end_2563;
+ }
+
+ speaker_id = fwnode_gpiod_get_index(acpi_fwnode_handle(adev),
+ "speakerid", 0, GPIOD_IN, NULL);
+ if (!IS_ERR(speaker_id)) {
+ p->speaker_id = gpiod_get_value_cansleep(speaker_id);
+ dev_dbg(p->dev, "Got speaker id gpio from ACPI: %d.\n",
+ p->speaker_id);
+ gpiod_put(speaker_id);
+ } else {
+ p->speaker_id = -1;
+ ret = PTR_ERR(speaker_id);
+ dev_err(p->dev, "Get speaker id gpio failed %d.\n",
+ ret);
}
+
+ acpi_dev_remove_driver_gpios(adev);
} else {
- p->speaker_id = NULL;
+ p->speaker_id = -1;
}
end_2563:
@@ -432,23 +445,16 @@ static void tasdevice_dspfw_init(void *c
struct tas2781_hda *tas_hda = dev_get_drvdata(tas_priv->dev);
struct tas2781_hda_i2c_priv *hda_priv = tas_hda->hda_priv;
struct hda_codec *codec = tas_priv->codec;
- int ret, spk_id;
+ int ret;
tasdevice_dsp_remove(tas_priv);
tas_priv->fw_state = TASDEVICE_DSP_FW_PENDING;
- if (tas_priv->speaker_id != NULL) {
- // Speaker id need to be checked for ASUS only.
- spk_id = gpiod_get_value(tas_priv->speaker_id);
- if (spk_id < 0) {
- // Speaker id is not valid, use default.
- dev_dbg(tas_priv->dev, "Wrong spk_id = %d\n", spk_id);
- spk_id = 0;
- }
+ if (tas_priv->speaker_id >= 0) {
snprintf(tas_priv->coef_binaryname,
sizeof(tas_priv->coef_binaryname),
"TAS2XXX%04X%d.bin",
lower_16_bits(codec->core.subsystem_id),
- spk_id);
+ tas_priv->speaker_id);
} else {
snprintf(tas_priv->coef_binaryname,
sizeof(tas_priv->coef_binaryname),
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 612/614] ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 611/614] ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 613/614] ALSA: wavefront: Clear substream pointers on close Greg Kroah-Hartman
` (15 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Denis Arefev, Richard Fitzgerald,
Takashi Iwai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <arefev@swemel.ru>
commit c34b04cc6178f33c08331568c7fd25c5b9a39f66 upstream.
The acpi_get_first_physical_node() function can return NULL, in which
case the get_device() function also returns NULL, but this value is
then dereferenced without checking,so add a check to prevent a crash.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 7b2f3eb492da ("ALSA: hda: cs35l41: Add support for CS35L41 in HDA systems")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20251202101338.11437-1-arefev@swemel.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/hda/codecs/side-codecs/cs35l41_hda.c
+++ b/sound/hda/codecs/side-codecs/cs35l41_hda.c
@@ -1901,6 +1901,8 @@ static int cs35l41_hda_read_acpi(struct
cs35l41->dacpi = adev;
physdev = get_device(acpi_get_first_physical_node(adev));
+ if (!physdev)
+ return -ENODEV;
sub = acpi_get_subsystem_id(ACPI_HANDLE(physdev));
if (IS_ERR(sub))
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 613/614] ALSA: wavefront: Clear substream pointers on close
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 612/614] ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 614/614] ALSA: wavefront: Fix integer overflow in sample size validation Greg Kroah-Hartman
` (14 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Takashi Iwai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit e11c5c13ce0ab2325d38fe63500be1dd88b81e38 upstream.
Clear substream pointers in close functions to avoid leaving dangling
pointers, helping to improve code safety and
prevents potential issues.
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881DF762CAB45EE42F6D812AFC2A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/isa/wavefront/wavefront_midi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/isa/wavefront/wavefront_midi.c
+++ b/sound/isa/wavefront/wavefront_midi.c
@@ -278,6 +278,7 @@ static int snd_wavefront_midi_input_clos
return -EIO;
guard(spinlock_irqsave)(&midi->open);
+ midi->substream_input[mpu] = NULL;
midi->mode[mpu] &= ~MPU401_MODE_INPUT;
return 0;
@@ -300,6 +301,7 @@ static int snd_wavefront_midi_output_clo
return -EIO;
guard(spinlock_irqsave)(&midi->open);
+ midi->substream_output[mpu] = NULL;
midi->mode[mpu] &= ~MPU401_MODE_OUTPUT;
return 0;
}
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 614/614] ALSA: wavefront: Fix integer overflow in sample size validation
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 613/614] ALSA: wavefront: Clear substream pointers on close Greg Kroah-Hartman
@ 2025-12-16 11:16 ` Greg Kroah-Hartman
2025-12-16 16:06 ` [PATCH 6.18 000/614] 6.18.2-rc1 review Ronald Warsow
` (13 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-16 11:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junrui Luo, Takashi Iwai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit 0c4a13ba88594fd4a27292853e736c6b4349823d upstream.
The wavefront_send_sample() function has an integer overflow issue
when validating sample size. The header->size field is u32 but gets
cast to int for comparison with dev->freemem
Fix by using unsigned comparison to avoid integer overflow.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881B47789D1B060CE8BF4C3AFC2A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/isa/wavefront/wavefront_synth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -950,9 +950,9 @@ wavefront_send_sample (snd_wavefront_t *
if (header->size) {
dev->freemem = wavefront_freemem (dev);
- if (dev->freemem < (int)header->size) {
+ if (dev->freemem < 0 || dev->freemem < header->size) {
dev_err(dev->card->dev,
- "insufficient memory to load %d byte sample.\n",
+ "insufficient memory to load %u byte sample.\n",
header->size);
return -ENOMEM;
}
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 200/614] drm/xe: Enforce correct user fence signaling order using
2025-12-16 11:09 ` [PATCH 6.18 200/614] drm/xe: Enforce correct user fence signaling order using Greg Kroah-Hartman
@ 2025-12-16 13:35 ` Thomas Hellström
0 siblings, 0 replies; 647+ messages in thread
From: Thomas Hellström @ 2025-12-16 13:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, Matthew Brost, Sasha Levin
Hi Folks,
This is an incorrect merge resolution followed by the patch already
been applied.
Please skip this patch.
Thanks,
Thomas
On Tue, 2025-12-16 at 12:09 +0100, Greg Kroah-Hartman wrote:
> 6.18-stable review patch. If anyone has any objections, please let
> me know.
>
> ------------------
>
> From: Matthew Brost <matthew.brost@intel.com>
>
> [ Upstream commit adda4e855ab6409a3edaa585293f1f2069ab7299 ]
>
> Prevent application hangs caused by out-of-order fence signaling when
> user fences are attached. Use drm_syncobj (via dma-fence-chain) to
> guarantee that each user fence signals in order, regardless of the
> signaling order of the attached fences. Ensure user fence writebacks
> to
> user space occur in the correct sequence.
>
> v7:
> - Skip drm_syncbj create of error (CI)
>
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel
> GPUs")
> Signed-off-by: Matthew Brost <matthew.brost@intel.com>
> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Link:
> https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/gpu/drm/xe/xe_exec_queue.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c
> b/drivers/gpu/drm/xe/xe_exec_queue.c
> index cb5f204c08ed6..a6efe4e8ab556 100644
> --- a/drivers/gpu/drm/xe/xe_exec_queue.c
> +++ b/drivers/gpu/drm/xe/xe_exec_queue.c
> @@ -344,6 +344,9 @@ void xe_exec_queue_destroy(struct kref *ref)
> struct xe_exec_queue *q = container_of(ref, struct
> xe_exec_queue, refcount);
> struct xe_exec_queue *eq, *next;
>
> + if (q->ufence_syncobj)
> + drm_syncobj_put(q->ufence_syncobj);
> +
> if (q->ufence_syncobj)
> drm_syncobj_put(q->ufence_syncobj);
>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2025-12-16 11:16 ` [PATCH 6.18 614/614] ALSA: wavefront: Fix integer overflow in sample size validation Greg Kroah-Hartman
@ 2025-12-16 16:06 ` Ronald Warsow
2025-12-17 5:47 ` Greg Kroah-Hartman
2025-12-16 17:29 ` Brett A C Sheffield
` (12 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Ronald Warsow @ 2025-12-16 16:06 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
Hi
no regressions here on x86_64 (RKL, Intel 11th Gen. CPU), but *only*
when running GPU driver i915.
with GPU driver xe I get here:
[ 14.391631] rfkill: input handler disabled
[ 14.787149] ------------[ cut here ]------------
[ 14.787153] refcount_t: underflow; use-after-free.
[ 14.787167] WARNING: CPU: 10 PID: 2463 at lib/refcount.c:28
refcount_warn_saturate+0xbe/0x110
[ 14.787174] Modules linked in: vboxnetadp(OE) vboxnetflt(OE)
vboxdrv(OE) rfcomm nf_conntrack_netbios_ns nf_conntrack_broadcast
nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet
nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables bnep iwlmvm
mac80211 mei_hdcp mei_pxp btusb kvm_intel btintel iwlwifi bluetooth kvm
cfg80211 ecdh_generic irqbypass mei_me wmi_bmof mei nfnetlink xe
intel_vsec drm_suballoc_helper gpu_sched drm_gpuvm drm_exec i915
i2c_algo_bit drm_buddy drm_display_helper video wmi
[ 14.787203] CPU: 10 UID: 60578 PID: 2463 Comm: pool-8 Tainted: G
U OE 6.18.2-rc1_MY #1 PREEMPT(lazy)
[ 14.787205] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 14.787206] Hardware name: ASUS System Product Name/ROG STRIX B560-G
GAMING WIFI, BIOS 2302 11/13/2024
[ 14.787207] RIP: 0010:refcount_warn_saturate+0xbe/0x110
[ 14.787210] Code: 02 01 e8 05 de 52 ff 0f 0b e9 7e ba a1 00 80 3d 8d
16 41 02 00 75 85 48 c7 c7 00 d5 f5 9e c6 05 7d 16 41 02 01 e8 e2 dd 52
ff <0f> 0b e9 5b ba a1 00 80 3d 6b 16 41 02 00 0f 85 5e ff ff ff 48 c7
[ 14.787211] RSP: 0018:ffffa0ba88dbf918 EFLAGS: 00010246
[ 14.787213] RAX: 0000000000000000 RBX: ffff900804a13800 RCX:
0000000000000027
[ 14.787214] RDX: ffff900b4f917a88 RSI: 0000000000000001 RDI:
ffff900b4f917a80
[ 14.787215] RBP: ffff90082578c000 R08: 0000000000000000 R09:
ffffa0ba88dbf7b0
[ 14.787215] R10: ffffffff9fb451e8 R11: ffffffff9fa951e0 R12:
0000000000000000
[ 14.787216] R13: ffffa0ba88dbf970 R14: ffff9008213f0218 R15:
0000000000000000
[ 14.787217] FS: 0000000000000000(0000) GS:ffff900baedd9000(0000)
knlGS:0000000000000000
[ 14.787218] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.787219] CR2: 00007fc6a725fed0 CR3: 000000011f3c5001 CR4:
0000000000770ef0
[ 14.787220] PKRU: 55555554
[ 14.787220] Call Trace:
[ 14.787222] <TASK>
[ 14.787224] xe_exec_queue_destroy+0x165/0x1a0 [xe]
[ 14.787326] xe_vm_close_and_put+0x1e3/0x950 [xe]
[ 14.787414] xe_file_close+0x108/0x1e0 [xe]
[ 14.787463] drm_file_free+0x238/0x2a0
[ 14.787466] drm_release_noglobal+0x78/0xc0
[ 14.787468] __fput+0xe6/0x2a0
[ 14.787471] task_work_run+0x5d/0x90
[ 14.787473] do_exit+0x273/0xa60
[ 14.787476] ? timerqueue_del+0x2e/0x60
[ 14.787478] ? __remove_hrtimer+0x41/0xb0
[ 14.787480] do_group_exit+0x2e/0xb0
[ 14.787482] ? hrtimer_cancel+0x21/0x40
[ 14.787484] get_signal+0x8b0/0x8f0
[ 14.787485] arch_do_signal_or_restart+0x8d/0x2a0
[ 14.787489] exit_to_user_mode_loop+0x80/0x170
[ 14.787492] do_syscall_64+0x1c5/0xfa0
[ 14.787494] ? __pfx_hrtimer_wakeup+0x10/0x10
[ 14.787496] ? __rseq_handle_notify_resume+0xa4/0x4d0
[ 14.787499] ? switch_fpu_return+0x4e/0xd0
[ 14.787501] ? do_syscall_64+0x1f8/0xfa0
[ 14.787503] ? __rseq_handle_notify_resume+0xa4/0x4d0
[ 14.787504] ? f_dupfd+0x62/0xa0
[ 14.787506] ? switch_fpu_return+0x4e/0xd0
[ 14.787507] ? do_syscall_64+0x1f8/0xfa0
[ 14.787509] ? __x64_sys_fcntl+0x96/0x110
[ 14.787512] ? do_syscall_64+0x7c/0xfa0
[ 14.787514] ? flush_tlb_func+0x119/0x380
[ 14.787516] ? sched_clock+0x10/0x30
[ 14.787518] ? sched_clock_cpu+0xf/0x230
[ 14.787520] ? __flush_smp_call_function_queue+0xae/0x410
[ 14.787522] ? sched_clock_cpu+0xf/0x230
[ 14.787523] ? irqtime_account_irq+0x3c/0xc0
[ 14.787525] ? clear_bhb_loop+0x40/0x90
[ 14.787527] ? clear_bhb_loop+0x40/0x90
[ 14.787528] ? clear_bhb_loop+0x40/0x90
[ 14.787529] ? clear_bhb_loop+0x40/0x90
[ 14.787530] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 14.787532] RIP: 0033:0x7fa07a4ff34d
[ 14.787540] Code: Unable to access opcode bytes at 0x7fa07a4ff323.
[ 14.787541] RSP: 002b:00007f9f8bffe478 EFLAGS: 00000246 ORIG_RAX:
00000000000000ca
[ 14.787543] RAX: fffffffffffffdfc RBX: 0000000000000001 RCX:
00007fa07a4ff34d
[ 14.787544] RDX: 0000000000000002 RSI: 0000000000000080 RDI:
000055c50d821a20
[ 14.787544] RBP: 00007f9f8bffe4e0 R08: 00007fa07b3c7000 R09:
000000000000000e
[ 14.787545] R10: 00007f9f8bffe4a0 R11: 0000000000000246 R12:
00000000018ae951
[ 14.787546] R13: 0000000000000001 R14: 0000000000000002 R15:
000055c50d821a10
[ 14.787548] </TASK>
[ 14.787548] ---[ end trace 0000000000000000 ]---
====
If I did the bisect correct, bisect-log:
# status: waiting for both good and bad commits
# good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
# status: waiting for bad commit, 1 good commit known
# bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
# bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL
pointer dereference in crashstate_get_vm_logs()
git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd
Thanks
Tested-by: Ronald Warsow <rwarsow@gmx.de>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 447/614] kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node
2025-12-16 11:13 ` [PATCH 6.18 447/614] kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node Greg Kroah-Hartman
@ 2025-12-16 16:52 ` Will Rosenberg
0 siblings, 0 replies; 647+ messages in thread
From: Will Rosenberg @ 2025-12-16 16:52 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: stable, patches, Oliver Rosenberg, Sasha Levin
On Tue, Dec 16, 2025 at 12:13:34PM +0100, Greg Kroah-Hartman wrote:
> 6.18-stable review patch. If anyone has any objections, please let me know.
Please see https://lkml.org/lkml/2025/12/16/1248.
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2025-12-16 16:06 ` [PATCH 6.18 000/614] 6.18.2-rc1 review Ronald Warsow
@ 2025-12-16 17:29 ` Brett A C Sheffield
2025-12-16 19:17 ` Achill Gilgenast
` (11 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Brett A C Sheffield @ 2025-12-16 17:29 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.18.2-rc1-g103c79e44ce7 #1 SMP PREEMPT_DYNAMIC Tue Dec 16 17:27:35 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2025-12-16 17:29 ` Brett A C Sheffield
@ 2025-12-16 19:17 ` Achill Gilgenast
2025-12-16 19:35 ` Dileep malepu
` (10 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Achill Gilgenast @ 2025-12-16 19:17 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On Tue Dec 16, 2025 at 12:06 PM CET, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Thanks! Tested on all Alpine architectures & boot tested on x86_64.
Tested-by: Achill Gilgenast <achill@achill.org>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2025-12-16 19:17 ` Achill Gilgenast
@ 2025-12-16 19:35 ` Dileep malepu
2025-12-16 19:52 ` Naresh Kamboju
` (9 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Dileep malepu @ 2025-12-16 19:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Tue, Dec 16, 2025 at 6:32 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
The Linux kernel version 6.18.2 was built and boot-tested using qemu-x86_64
and qemu-arm64 with the default configuration (defconfig).
Both build and boot processes completed successfully on arm64 and x86_64.
The kernel operated as expected in the virtualized environments, and no issues
were observed. No dmesg regressions were found.
Build details:
Architectures: arm64, x86_64
Kernel version: 6.18.2
Configuration: defconfig
Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit: 103c79e44ce7c81882928abab98b96517a8bce88
Tested-by: Dileep Malepu dileep.debian@gmail.com
Best regards,
Dileep Malepu
^ permalink raw reply [flat|nested] 647+ messages in thread
* [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2025-12-16 19:35 ` Dileep malepu
@ 2025-12-16 19:52 ` Naresh Kamboju
2025-12-17 6:30 ` Greg KH
2025-12-16 21:48 ` Florian Fainelli
` (8 subsequent siblings)
627 siblings, 1 reply; 647+ messages in thread
From: Naresh Kamboju @ 2025-12-16 19:52 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
dan.carpenter, nathan, llvm, perex, lgirdwood,
Linux Kernel Functional Testing
I'm seeing the following allmodconfig and allyesconfig build
failures on arm, arm64, riscv and x86_64.
## Build error
sound/soc/codecs/nau8325.c:430:13: error: variable 'n2_max' is uninitialized when used here [-Werror,-Wuninitialized]
430 | *n2_sel = n2_max;
| ^~~~~~
sound/soc/codecs/nau8325.c:389:52: note: initialize the variable 'n2_max' to silence this warning
389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
| ^
| = 0
sound/soc/codecs/nau8325.c:431:11: error: variable 'ratio_sel' is uninitialized when used here [-Werror,-Wuninitialized]
431 | ratio = ratio_sel;
| ^~~~~~~~~
sound/soc/codecs/nau8325.c:389:44: note: initialize the variable 'ratio_sel' to silence this warning
389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
| ^
| = 0
2 errors generated.
make[6]: *** [scripts/Makefile.build:287: sound/soc/codecs/nau8325.o] Error 1
First seen on 6.18.2-rc1
Good: 6.18.1-rc1
Bad: 6.18.2-rc1
And these build regressions also seen on 6.17.13-rc2.
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 6.18.2-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 103c79e44ce7c81882928abab98b96517a8bce88
* git describe: v6.18-645-g103c79e44ce7
* test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.18.y/build/v6.18-645-g103c79e44ce7
## Test Regressions (compared to v6.18-30-g7d4c06f4000f)
* Build,
- clang-21-allmodconfig
- clang-21-allyesconfig
- clang-nightly-allyesconfig
## Metric Regressions (compared to v6.18-30-g7d4c06f4000f)
## Test Fixes (compared to v6.18-30-g7d4c06f4000f)
## Metric Fixes (compared to v6.18-30-g7d4c06f4000f)
## Test result summary
total: 101371, pass: 83553, fail: 3486, skip: 14332, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 139 total, 138 passed, 1 failed
* arm64: 57 total, 51 passed, 6 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 25 total, 24 passed, 1 failed
* s390: 22 total, 21 passed, 1 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 49 total, 46 passed, 3 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-rust
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
* rt-tests-cyclicdeadline
* rt-tests-pi-stress
* rt-tests-pmqtest
* rt-tests-rt-migrate-test
* rt-tests-signaltest
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2025-12-16 19:52 ` Naresh Kamboju
@ 2025-12-16 21:48 ` Florian Fainelli
2025-12-17 5:04 ` Ron Economos
` (7 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Florian Fainelli @ 2025-12-16 21:48 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 12/16/25 03:06, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2025-12-16 21:48 ` Florian Fainelli
@ 2025-12-17 5:04 ` Ron Economos
2025-12-17 6:17 ` Jeffrin Thalakkottoor
` (6 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Ron Economos @ 2025-12-17 5:04 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 12/16/25 03:06, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 16:06 ` [PATCH 6.18 000/614] 6.18.2-rc1 review Ronald Warsow
@ 2025-12-17 5:47 ` Greg Kroah-Hartman
2025-12-17 8:27 ` Ronald Warsow
0 siblings, 1 reply; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-17 5:47 UTC (permalink / raw)
To: Ronald Warsow
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr
On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
> Hi
>
> no regressions here on x86_64 (RKL, Intel 11th Gen. CPU), but *only* when
> running GPU driver i915.
>
> with GPU driver xe I get here:
>
> [ 14.391631] rfkill: input handler disabled
> [ 14.787149] ------------[ cut here ]------------
> [ 14.787153] refcount_t: underflow; use-after-free.
> [ 14.787167] WARNING: CPU: 10 PID: 2463 at lib/refcount.c:28
> refcount_warn_saturate+0xbe/0x110
> [ 14.787174] Modules linked in: vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE)
> rfcomm nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet
> nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4
> nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack
> nf_defrag_ipv6 nf_defrag_ipv4 nf_tables bnep iwlmvm mac80211 mei_hdcp
> mei_pxp btusb kvm_intel btintel iwlwifi bluetooth kvm cfg80211 ecdh_generic
> irqbypass mei_me wmi_bmof mei nfnetlink xe intel_vsec drm_suballoc_helper
> gpu_sched drm_gpuvm drm_exec i915 i2c_algo_bit drm_buddy drm_display_helper
> video wmi
> [ 14.787203] CPU: 10 UID: 60578 PID: 2463 Comm: pool-8 Tainted: G U OE
> 6.18.2-rc1_MY #1 PREEMPT(lazy)
> [ 14.787205] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 14.787206] Hardware name: ASUS System Product Name/ROG STRIX B560-G
> GAMING WIFI, BIOS 2302 11/13/2024
> [ 14.787207] RIP: 0010:refcount_warn_saturate+0xbe/0x110
> [ 14.787210] Code: 02 01 e8 05 de 52 ff 0f 0b e9 7e ba a1 00 80 3d 8d 16
> 41 02 00 75 85 48 c7 c7 00 d5 f5 9e c6 05 7d 16 41 02 01 e8 e2 dd 52 ff <0f>
> 0b e9 5b ba a1 00 80 3d 6b 16 41 02 00 0f 85 5e ff ff ff 48 c7
> [ 14.787211] RSP: 0018:ffffa0ba88dbf918 EFLAGS: 00010246
> [ 14.787213] RAX: 0000000000000000 RBX: ffff900804a13800 RCX:
> 0000000000000027
> [ 14.787214] RDX: ffff900b4f917a88 RSI: 0000000000000001 RDI:
> ffff900b4f917a80
> [ 14.787215] RBP: ffff90082578c000 R08: 0000000000000000 R09:
> ffffa0ba88dbf7b0
> [ 14.787215] R10: ffffffff9fb451e8 R11: ffffffff9fa951e0 R12:
> 0000000000000000
> [ 14.787216] R13: ffffa0ba88dbf970 R14: ffff9008213f0218 R15:
> 0000000000000000
> [ 14.787217] FS: 0000000000000000(0000) GS:ffff900baedd9000(0000)
> knlGS:0000000000000000
> [ 14.787218] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 14.787219] CR2: 00007fc6a725fed0 CR3: 000000011f3c5001 CR4:
> 0000000000770ef0
> [ 14.787220] PKRU: 55555554
> [ 14.787220] Call Trace:
> [ 14.787222] <TASK>
> [ 14.787224] xe_exec_queue_destroy+0x165/0x1a0 [xe]
> [ 14.787326] xe_vm_close_and_put+0x1e3/0x950 [xe]
> [ 14.787414] xe_file_close+0x108/0x1e0 [xe]
> [ 14.787463] drm_file_free+0x238/0x2a0
> [ 14.787466] drm_release_noglobal+0x78/0xc0
> [ 14.787468] __fput+0xe6/0x2a0
> [ 14.787471] task_work_run+0x5d/0x90
> [ 14.787473] do_exit+0x273/0xa60
> [ 14.787476] ? timerqueue_del+0x2e/0x60
> [ 14.787478] ? __remove_hrtimer+0x41/0xb0
> [ 14.787480] do_group_exit+0x2e/0xb0
> [ 14.787482] ? hrtimer_cancel+0x21/0x40
> [ 14.787484] get_signal+0x8b0/0x8f0
> [ 14.787485] arch_do_signal_or_restart+0x8d/0x2a0
> [ 14.787489] exit_to_user_mode_loop+0x80/0x170
> [ 14.787492] do_syscall_64+0x1c5/0xfa0
> [ 14.787494] ? __pfx_hrtimer_wakeup+0x10/0x10
> [ 14.787496] ? __rseq_handle_notify_resume+0xa4/0x4d0
> [ 14.787499] ? switch_fpu_return+0x4e/0xd0
> [ 14.787501] ? do_syscall_64+0x1f8/0xfa0
> [ 14.787503] ? __rseq_handle_notify_resume+0xa4/0x4d0
> [ 14.787504] ? f_dupfd+0x62/0xa0
> [ 14.787506] ? switch_fpu_return+0x4e/0xd0
> [ 14.787507] ? do_syscall_64+0x1f8/0xfa0
> [ 14.787509] ? __x64_sys_fcntl+0x96/0x110
> [ 14.787512] ? do_syscall_64+0x7c/0xfa0
> [ 14.787514] ? flush_tlb_func+0x119/0x380
> [ 14.787516] ? sched_clock+0x10/0x30
> [ 14.787518] ? sched_clock_cpu+0xf/0x230
> [ 14.787520] ? __flush_smp_call_function_queue+0xae/0x410
> [ 14.787522] ? sched_clock_cpu+0xf/0x230
> [ 14.787523] ? irqtime_account_irq+0x3c/0xc0
> [ 14.787525] ? clear_bhb_loop+0x40/0x90
> [ 14.787527] ? clear_bhb_loop+0x40/0x90
> [ 14.787528] ? clear_bhb_loop+0x40/0x90
> [ 14.787529] ? clear_bhb_loop+0x40/0x90
> [ 14.787530] entry_SYSCALL_64_after_hwframe+0x71/0x79
> [ 14.787532] RIP: 0033:0x7fa07a4ff34d
> [ 14.787540] Code: Unable to access opcode bytes at 0x7fa07a4ff323.
> [ 14.787541] RSP: 002b:00007f9f8bffe478 EFLAGS: 00000246 ORIG_RAX:
> 00000000000000ca
> [ 14.787543] RAX: fffffffffffffdfc RBX: 0000000000000001 RCX:
> 00007fa07a4ff34d
> [ 14.787544] RDX: 0000000000000002 RSI: 0000000000000080 RDI:
> 000055c50d821a20
> [ 14.787544] RBP: 00007f9f8bffe4e0 R08: 00007fa07b3c7000 R09:
> 000000000000000e
> [ 14.787545] R10: 00007f9f8bffe4a0 R11: 0000000000000246 R12:
> 00000000018ae951
> [ 14.787546] R13: 0000000000000001 R14: 0000000000000002 R15:
> 000055c50d821a10
> [ 14.787548] </TASK>
> [ 14.787548] ---[ end trace 0000000000000000 ]---
>
> ====
>
> If I did the bisect correct, bisect-log:
>
> # status: waiting for both good and bad commits
> # good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
> git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
> # status: waiting for bad commit, 1 good commit known
> # bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
> git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
> # bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL pointer
> dereference in crashstate_get_vm_logs()
> git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd
Is this also an issue with 6.19-rc1? Are we missing something here?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2025-12-17 5:04 ` Ron Economos
@ 2025-12-17 6:17 ` Jeffrin Thalakkottoor
2025-12-17 11:29 ` Takeshi Ogasawara
` (5 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Jeffrin Thalakkottoor @ 2025-12-17 6:17 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
hello
Compiled and booted 6.18.2-rc1+
No typical new regressions from dmesg.
As per dmidecode command.
Version: AMD Ryzen 3 3250U with Radeon Graphics
Processor Information
Socket Designation: FP5
Type: Central Processor
Family: Zen
Manufacturer: Advanced Micro Devices, Inc.
ID: 81 0F 81 00 FF FB 8B 17
Signature: Family 23, Model 24, Stepping 1
Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
--
software engineer
rajagiri school of engineering and technology
On Tue, Dec 16, 2025 at 9:53 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.18.2-rc1
>
> Junrui Luo <moonafterrain@outlook.com>
> ALSA: wavefront: Fix integer overflow in sample size validation
>
> Junrui Luo <moonafterrain@outlook.com>
> ALSA: wavefront: Clear substream pointers on close
>
> Denis Arefev <arefev@swemel.ru>
> ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
>
> Antheas Kapenekakis <lkml@antheas.dev>
> ALSA: hda/tas2781: fix speaker id retrieval for multiple probes
>
> Antheas Kapenekakis <lkml@antheas.dev>
> ALSA: hda/realtek: Add match for ASUS Xbox Ally projects
>
> Junrui Luo <moonafterrain@outlook.com>
> ALSA: dice: fix buffer overflow in detect_stream_formats()
>
> Sven Peter <sven@kernel.org>
> usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required
>
> Duoming Zhou <duoming@zju.edu.cn>
> usb: typec: ucsi: fix use-after-free caused by uec->work
>
> Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
> usb: phy: Initialize struct usb_phy list_head
>
> Duoming Zhou <duoming@zju.edu.cn>
> usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe()
>
> Haotien Hsu <haotienh@nvidia.com>
> usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt
>
> Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs
>
> Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> efi/cper: Adjust infopfx size to accept an extra space
>
> Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
> efi/cper: Add a new helper function to print bitmasks
>
> Evan Li <evan.li@linux.alibaba.com>
> perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common()
>
> Dmitry Antipov <dmantipov@yandex.ru>
> ocfs2: fix memory leak in ocfs2_merge_rec_left()
>
> Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> cpu: Make atomic hotplug callbacks run with interrupts disabled on UP
>
> Dan Carpenter <dan.carpenter@linaro.org>
> irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
>
> Thaumy Cheng <thaumy.love@gmail.com>
> perf/core: Fix missing read event generation on task exit
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: ufs: core: Fix an error handler crash
>
> Duoming Zhou <duoming@zju.edu.cn>
> scsi: imm: Fix use-after-free bug caused by unfinished delayed work
>
> Haotian Zhang <vulab@iscas.ac.cn>
> dm log-writes: Add missing set_freezable() for freezable kthread
>
> Alexey Simakov <bigalex934@gmail.com>
> dm-raid: fix possible NULL dereference with undefined raid type
>
> Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
> ASoC: amd: acp: update tdm channels for specific DAI
>
> Mohamed Khalfella <mkhalfella@purestorage.com>
> block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
>
> Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
> drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation
>
> Jani Nikula <jani.nikula@intel.com>
> drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init
>
> Jani Nikula <jani.nikula@intel.com>
> drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc()
>
> Jani Nikula <jani.nikula@intel.com>
> drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit
>
> Jani Nikula <jani.nikula@intel.com>
> drm/xe/fbdev: use the same 64-byte stride alignment as i915
>
> Liyuan Pang <pangliyuan1@huawei.com>
> ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
>
> Junrui Luo <moonafterrain@outlook.com>
> ALSA: firewire-motu: add bounds check in put_user loop for DSP events
>
> Javier Martinez Canillas <javierm@redhat.com>
> regulator: spacemit: Align input supply name with the DT binding
>
> Nuno Sá <nuno.sa@analog.com>
> rtc: max31335: Fix ignored return value in set_alarm
>
> Haotian Zhang <vulab@iscas.ac.cn>
> rtc: gamecube: Check the return value of ioremap()
>
> Xiaogang Chen <xiaogang.chen@amd.com>
> drm/amdkfd: Use huge page size to check split svm range alignment
>
> Andres J Rosa <andyrosa@gmail.com>
> ALSA: uapi: Fix typo in asound.h comment
>
> Dave Kleikamp <dave.kleikamp@oracle.com>
> dma/pool: eliminate alloc_pages warning in atomic_pool_expand
>
> Troy Mitchell <troy.mitchell@linux.spacemit.com>
> i2c: spacemit: fix detect issue
>
> Kathara Sasikumar <katharasasikumar007@gmail.com>
> docs: hwmon: fix link to g762 devicetree binding
>
> Arnd Bergmann <arnd@arndb.de>
> gpio: tb10x: fix OF_GPIO dependency
>
> Mike Snitzer <snitzer@kernel.org>
> nfs/localio: remove 61 byte hole from needless ____cacheline_aligned
>
> Mike Snitzer <snitzer@hammerspace.com>
> nfs/localio: remove alignment size checking in nfs_is_local_dio_possible
>
> David Howells <dhowells@redhat.com>
> cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2
>
> David Howells <dhowells@redhat.com>
> cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
>
> René Rebe <rene@exactco.de>
> drm/nouveau: fix circular dep oops from vendored i2c encoder
>
> Madhur Kumar <madhurkumar004@gmail.com>
> drm/nouveau: refactor deprecated strcpy
>
> Junrui Luo <moonafterrain@outlook.com>
> ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
>
> Mark Brown <broonie@kernel.org>
> regulator: fixed: Rely on the core freeing the enable GPIO
>
> Dan Carpenter <dan.carpenter@linaro.org>
> drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties()
>
> Caleb Sander Mateos <csander@purestorage.com>
> io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
>
> Israel Rukshin <israelr@nvidia.com>
> nvme-auth: use kvfree() for memory allocated with kvcalloc()
>
> Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
> block: fix memory leak in __blkdev_issue_zero_pages
>
> shechenglong <shechenglong@xfusion.com>
> block: fix comment for op_is_zone_mgmt() to include RESET_ALL
>
> Arnd Bergmann <arnd@arndb.de>
> drm/panel: novatek-nt35560: avoid on-stack device structure
>
> Cong Zhang <cong.zhang@oss.qualcomm.com>
> blk-mq: Abort suspend when wakeup events are pending
>
> Daeho Jeong <daehojeong@google.com>
> f2fs: revert summary entry count from 2048 to 512 in 16kb block support
>
> Shengjiu Wang <shengjiu.wang@nxp.com>
> ASoC: ak5558: Disable regulator when error happens
>
> Shengjiu Wang <shengjiu.wang@nxp.com>
> ASoC: ak4458: Disable regulator when error happens
>
> Hemalatha Pinnamreddy <hemalatha.pinnamreddy2@amd.com>
> ASoC: amd: acp: Audio is not resuming after s0ix
>
> Haotian Zhang <vulab@iscas.ac.cn>
> ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()
>
> Anton Khirnov <anton@khirnov.net>
> platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
>
> Armin Wolf <W_Armin@gmx.de>
> fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Fix inheritance of the block sizes when automounting
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> Revert "nfs: ignore SB_RDONLY when mounting nfs"
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> Revert "nfs: clear SB_RDONLY before getting superblock"
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> Revert "nfs: ignore SB_RDONLY when remounting nfs"
>
> Akash Goel <akash.goel@arm.com>
> drm/panthor: Prevent potential UAF in group creation
>
> Jonathan Curley <jcurley@purestorage.com>
> NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Initialise verifiers for visible dentries in nfs_atomic_open()
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Initialise verifiers for visible dentries in readdir and lookup
>
> Armin Wolf <W_Armin@gmx.de>
> fs/nls: Fix utf16 to utf8 conversion
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Avoid changing nlink when file removes and attribute updates race
>
> Abel Vesa <abel.vesa@linaro.org>
> kbuild: install-extmod-build: Properly fix CC expansion when ccache is used
>
> Haotian Zhang <vulab@iscas.ac.cn>
> rtc: amlogic-a4: fix double free caused by devm
>
> Daeho Jeong <daehojeong@google.com>
> f2fs: maintain one time GC mode is enabled during whole zoned GC cycle
>
> Xi Pardee <xi.pardee@linux.intel.com>
> platform/x86:intel/pmc: Update Arrow Lake telemetry GUID
>
> John Stultz <jstultz@google.com>
> sched/core: Fix psi_dequeue() for Proxy Execution
>
> xupengbo <xupengbo@oppo.com>
> sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out
>
> Eric Sandeen <sandeen@redhat.com>
> 9p: fix cache/debug options printing in v9fs_show_options
>
> Abdun Nihaal <nihaal@cse.iitm.ac.in>
> fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()
>
> Ian Rogers <irogers@google.com>
> perf stat: Allow no events to open if this is a "--null" run
>
> Haotian Zhang <vulab@iscas.ac.cn>
> pinctrl: single: Fix incorrect type for error return variable
>
> Ian Rogers <irogers@google.com>
> perf hist: In init, ensure mem_info is put on error paths
>
> Ian Rogers <irogers@google.com>
> perf kvm: Fix debug assertion
>
> Namhyung Kim <namhyung@kernel.org>
> perf tools: Fix split kallsyms DSO counting
>
> Namhyung Kim <namhyung@kernel.org>
> perf tools: Mark split kallsyms DSOs as loaded
>
> Namjae Jeon <linkinjeon@kernel.org>
> exfat: fix divide-by-zero in exfat_allocate_bitmap
>
> Shuhao Fu <sfual@cse.ust.hk>
> exfat: fix refcount leak in exfat_find
>
> Namhyung Kim <namhyung@kernel.org>
> perf jitdump: Add sym/str-tables to build-ID generation
>
> Xiang Mei <xmei5@asu.edu>
> net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: xrs700x: reject unsupported HSR configurations
>
> Xiaoliang Yang <xiaoliang.yang_1@nxp.com>
> net: hsr: create an API to get hsr port type
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix BCM5325/65 ARL entry VIDs
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: add support for bcm63xx ARL entry format
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix CPU port unicast ARL entries for BCM5325/65
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: use same ARL search result offset for BCM5325/65
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: add support for 5389/5397/5398 ARL entry format
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: move ARL entry functions into ops struct
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: split reading search entry into their own functions
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: move writing ARL entries into their own functions
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: move reading ARL entries into their own function
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix extracting VID from entry for BCM5325/65
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65
>
> Christophe Leroy (CS GROUP) <chleroy@kernel.org>
> um: Disable KASAN_INLINE when STATIC_LINK is selected
>
> Stefan Metzmacher <metze@samba.org>
> smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall()
>
> Stefan Metzmacher <metze@samba.org>
> smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler()
>
> Stefan Metzmacher <metze@samba.org>
> smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}()
>
> Stefan Metzmacher <metze@samba.org>
> smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper
>
> Johan Hovold <johan@kernel.org>
> clk: keystone: fix compile testing
>
> Yu Kuai <yukuai@fnnas.com>
> md/raid5: fix IO hang when array is broken with IO inflight
>
> Alexandru Gagniuc <mr.nuke.me@gmail.com>
> remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs
>
> Kumar Kartikeya Dwivedi <memxor@gmail.com>
> rqspinlock: Use trylock fallback when per-CPU rqnode is busy
>
> Kumar Kartikeya Dwivedi <memxor@gmail.com>
> rqspinlock: Enclose lock/unlock within lock entry acquisitions
>
> Ivan Stepchenko <sid@itb.spb.ru>
> mtd: lpddr_cmds: fix signed shifts in lpddr_cmds
>
> Breno Leitao <leitao@debian.org>
> net: netpoll: initialize work queue before error checks
>
> Hangbin Liu <liuhangbin@gmail.com>
> selftests: bonding: add delay before each xvlan_over_bond connectivity check
>
> Robert Marko <robimarko@gmail.com>
> net: phy: aquantia: check for NVMEM deferral
>
> Mickaël Salaün <mic@digikod.net>
> landlock: Fix handling of disconnected directories
>
> Alex Williamson <alex.williamson@nvidia.com>
> vfio/pci: Use RCU for error/request triggers to avoid circular locking
>
> Dev Jain <dev.jain@arm.com>
> arm64/pageattr: Propagate return value from __change_memory_common
>
> Tianchu Chen <flynnnchen@tencent.com>
> spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
>
> Haotian Zhang <vulab@iscas.ac.cn>
> mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors
>
> Alexey Kodanev <aleksei.kodanev@bell-sw.com>
> net: stmmac: fix rx limit check in stmmac_rx_zc()
>
> Antoine Tenart <atenart@kernel.org>
> net: vxlan: prevent NULL deref in vxlan_xmit_one
>
> Michal Schmidt <mschmidt@redhat.com>
> iavf: Implement settime64 with -EOPNOTSUPP
>
> Fernando Fernandez Mancera <fmancera@suse.de>
> netfilter: nft_connlimit: update the count if add was skipped
>
> Fernando Fernandez Mancera <fmancera@suse.de>
> netfilter: nf_conncount: rework API to use sk_buff directly
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: flowtable: check for maximum number of encapsulations in bridge vlan
>
> Ilias Stamatis <ilstam@amazon.com>
> Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"
>
> Chen-Yu Tsai <wenst@chromium.org>
> arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1
>
> sparkhuang <huangshaobo3@xiaomi.com>
> regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
>
> Marek Szyprowski <m.szyprowski@samsung.com>
> ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend
>
> Marek Szyprowski <m.szyprowski@samsung.com>
> ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend
>
> Marek Szyprowski <m.szyprowski@samsung.com>
> ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend
>
> Marek Szyprowski <m.szyprowski@samsung.com>
> ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend
>
> Marek Szyprowski <m.szyprowski@samsung.com>
> soc: samsung: exynos-pmu: Fix structure initialization
>
> Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
> spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND
>
> Cezary Rojewski <cezary.rojewski@intel.com>
> ASoC: Intel: catpt: Fix error path in hw_params()
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: clean up features qword/dword terms
>
> Alok Tiwari <alok.a.tiwari@oracle.com>
> vdpa/pds: use %pe for ERR_PTR() in event handler registration
>
> Mike Christie <michael.christie@oracle.com>
> vhost: Fix kthread worker cgroup failure handling
>
> Alok Tiwari <alok.a.tiwari@oracle.com>
> vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: fix map ops comment
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: fix virtqueue_set_affinity() docs
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: standardize Returns documentation style
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: fix grammar in virtio_map_ops docs
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: fix grammar in virtio_queue_info docs
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: fix whitespace in virtio_config_ops
>
> Michael S. Tsirkin <mst@redhat.com>
> virtio: fix typo in virtio_device_ready() comment
>
> Kriish Sharma <kriish.sharma2006@gmail.com>
> virtio: fix kernel-doc for mapping/free_coherent functions
>
> Alok Tiwari <alok.a.tiwari@oracle.com>
> virtio_vdpa: fix misleading return in void function
>
> Guenter Roeck <linux@roeck-us.net>
> of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node
>
> Willem de Bruijn <willemb@google.com>
> selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests
>
> Yongjian Sun <sunyongjian1@huawei.com>
> ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation
>
> Edward Adam Davis <eadavis@qq.com>
> bpf: Fix exclusive map memory leak
>
> Matthieu Buffet <matthieu@buffet.re>
> selftests/landlock: Fix makefile header list
>
> Kevin Brodsky <kevin.brodsky@arm.com>
> ublk: prevent invalid access with DEBUG
>
> René Rebe <rene@exactco.de>
> ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4
>
> Haotian Zhang <vulab@iscas.ac.cn>
> hwmon: sy7636a: Fix regulator_enable resource leak on error path
>
> Eric Huang <jinhuieric.huang@amd.com>
> drm/amdkfd: assign AID to uuid in topology for SPX mode
>
> Dan Carpenter <dan.carpenter@linaro.org>
> drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()
>
> Will Rosenberg <whrosenb@asu.edu>
> kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> misc: rp1: Fix an error handling path in rp1_probe()
>
> Christoph Hellwig <hch@lst.de>
> fs: lift the FMODE_NOCMTIME check into file_update_time_flags
>
> Christoph Hellwig <hch@lst.de>
> fs: refactor file timestamp update logic
>
> Haotian Zhang <vulab@iscas.ac.cn>
> greybus: gb-beagleplay: Fix timeout handling in bootloader functions
>
> Alexandre Courbot <acourbot@nvidia.com>
> firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER
>
> Shengjiu Wang <shengjiu.wang@nxp.com>
> ASoC: fsl_xcvr: clear the channel status control memory
>
> Andreas Gruenbacher <agruenba@redhat.com>
> gfs2: Prevent recursive memory reclaim
>
> Jaroslav Kysela <perex@perex.cz>
> ASoC: nau8325: add missing build config
>
> Jaroslav Kysela <perex@perex.cz>
> ASoC: nau8325: use simple i2c probe function
>
> Johan Hovold <johan@kernel.org>
> clocksource/drivers/nxp-stm: Prevent driver unbind
>
> Johan Hovold <johan@kernel.org>
> clocksource/drivers/nxp-stm: Fix section mismatches
>
> Johan Hovold <johan@kernel.org>
> clocksource/drivers/nxp-pit: Prevent driver unbind
>
> Johan Hovold <johan@kernel.org>
> clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind
>
> Johan Hovold <johan@kernel.org>
> clocksource/drivers/stm: Fix double deregistration on probe failure
>
> Haotian Zhang <vulab@iscas.ac.cn>
> clocksource/drivers/ralink: Fix resource leaks in init error path
>
> Akash Goel <akash.goel@arm.com>
> drm/panthor: Avoid adding of kernel BOs to extobj list
>
> Guillaume La Roque <glaroque@baylibre.com>
> arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs
>
> Jijun Wang <jijun.wang@intel.com>
> RDMA/irdma: Fix SRQ shadow area address initialization
>
> Jacob Moroni <jmoroni@google.com>
> RDMA/irdma: Remove doorbell elision logic
>
> Jacob Moroni <jmoroni@google.com>
> RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+
>
> Jacob Moroni <jmoroni@google.com>
> RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY
>
> Anil Samal <anil.samal@intel.com>
> RDMA/irdma: Add missing mutex destroy
>
> Krzysztof Czurylo <krzysztof.czurylo@intel.com>
> RDMA/irdma: Fix SIGBUS in AEQ destroy
>
> Tatyana Nikolova <tatyana.e.nikolova@intel.com>
> RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2
>
> Krzysztof Czurylo <krzysztof.czurylo@intel.com>
> RDMA/irdma: Fix data race in irdma_free_pble
>
> Krzysztof Czurylo <krzysztof.czurylo@intel.com>
> RDMA/irdma: Fix data race in irdma_sc_ccq_arm
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal
>
> Randy Dunlap <rdunlap@infradead.org>
> backlight: lp855x: Fix lp855x.h kernel-doc warnings
>
> Luca Ceresoli <luca.ceresoli@bootlin.com>
> backlight: led-bl: Add devlink to supplier LEDs
>
> Ria Thomas <ria.thomas@morsemicro.com>
> wifi: ieee80211: correct FILS status codes
>
> Christoph Hellwig <hch@lst.de>
> iomap: allocate s_dio_done_wq for async reads as well
>
> Christoph Hellwig <hch@lst.de>
> iomap: always run error completions in user context
>
> David Gow <davidgow@google.com>
> um: Don't rename vmap to kernel_vmap
>
> Timur Tabi <ttabi@nvidia.com>
> drm/nouveau: restrict the flush page to a 32-bit address
>
> Shawn Lin <shawn.lin@rock-chips.com>
> PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix leaf leak in an error path in btrfs_del_items()
>
> Qu Wenruo <wqu@suse.com>
> btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe()
>
> Boris Burkov <boris@bur.io>
> btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
>
> Miquel Sabaté Solà <mssola@mssola.com>
> btrfs: fix double free of qgroup record after failure to add delayed ref head
>
> Alan Maguire <alan.maguire@oracle.com>
> selftests/bpf: Allow selftests to build with older xxd
>
> Alan Maguire <alan.maguire@oracle.com>
> bpftool: Allow bpftool to build with openssl < 3
>
> Ryan Huang <tzukui@google.com>
> iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables
>
> Jianglei Nie <niejianglei2021@163.com>
> staging: fbtft: core: fix potential memory leak in fbtft_probe_common()
>
> Dinh Nguyen <dinguyen@kernel.org>
> firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc
>
> Zilin Guan <zilin@seu.edu.cn>
> mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work()
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: mt7996: skip deflink accounting for offchannel links
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: Move mt76_abort_scan out of mt76_reset_device()
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event()
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: fix EMI rings for RRO
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart()
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: fix MLO set key and group key issues
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: fix MLD group index assignment
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: set link_valid field when initializing wcid
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: fix teardown command for an MLD peer
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv()
>
> Howard Hsu <howard-yh.hsu@mediatek.com>
> wifi: mt76: mt7996: fix implicit beamforming support for mt7992
>
> StanleyYP Wang <StanleyYP.Wang@mediatek.com>
> wifi: mt76: mt7996: fix max nss value when getting rx chainmask
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> Revert "wifi: mt76: mt792x: improve monitor interface handling"
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
>
> Felix Fietkau <nbd@nbd.name>
> wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
>
> Shenghao Ding <shenghao-ding@ti.com>
> ASoC: tas2781: correct the wrong period
>
> Baojun Xu <baojun.xu@ti.com>
> ASoC: tas2781: Correct the wrong chip ID for reset variable check
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: ahash - Zero positive err value in ahash_update_finish
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: ahash - Fix crypto_ahash_import with partial block data
>
> Selvin Xavier <selvin.xavier@broadcom.com>
> RDMA/bnxt_re: Pass correct flag for dma mr creation
>
> Selvin Xavier <selvin.xavier@broadcom.com>
> RDMA/bnxt_re: Fix the inline size for GenP7 devices
>
> Gao Xiang <xiang@kernel.org>
> erofs: limit the level of fs stacking for file-backed mounts
>
> Gao Xiang <xiang@kernel.org>
> erofs: correct FSDAX detection
>
> Fangyu Yu <fangyu.yu@linux.alibaba.com>
> RISC-V: KVM: Fix guest page fault within HLV* instructions
>
> Pengjie Zhang <zhangpengjie2@huawei.com>
> PM / devfreq: hisi: Fix potential UAF in OPP handling
>
> Haotian Zhang <vulab@iscas.ac.cn>
> crypto: ccree - Correctly handle return of sg_nents_for_len
>
> Haotian Zhang <vulab@iscas.ac.cn>
> crypto: starfive - Correctly handle return of sg_nents_for_len
>
> Martin Teichmann <martin.teichmann@xfel.eu>
> bpf: properly verify tail call behavior
>
> Xing Guo <higuoxing@gmail.com>
> selftests/bpf: Update test_tag to use sha256
>
> Matt Bobrowski <mattbobrowski@google.com>
> selftests/bpf: Improve reliability of test_perf_branches_no_hw()
>
> Matt Bobrowski <mattbobrowski@google.com>
> selftests/bpf: skip test_perf_branches_hw() on unsupported platforms
>
> Dan Carpenter <dan.carpenter@linaro.org>
> regulator: pca9450: Fix error code in probe()
>
> Gopi Krishna Menon <krishnagopi487@gmail.com>
> usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE
>
> Jisheng Zhang <jszhang@kernel.org>
> usb: dwc2: fix hang during suspend if set as peripheral
>
> Jisheng Zhang <jszhang@kernel.org>
> usb: dwc2: fix hang during shutdown if set as peripheral
>
> Oliver Neukum <oneukum@suse.com>
> usb: chaoskey: fix locking for O_NONBLOCK
>
> Zhao Yipeng <zhaoyipeng5@huawei.com>
> ima: Handle error code returned by ima_filter_rule_match()
>
> Ivan Pravdin <ipravdin.official@gmail.com>
> rtla: Fix -a overriding -t argument
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/tests: Fix osnoise test calling timerlat
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/tests: Extend action tests to 5s
>
> Jason Tian <jason@os.amperecomputing.com>
> RAS: Report all ARM processor CPER information to userspace
>
> Seungjin Bae <eeodqql09@gmail.com>
> wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
>
> Charles Mirabile <cmirabil@redhat.com>
> clk: spacemit: Set clk_hw_onecell_data::num before using flex array
>
> Chen Ridong <chenridong@huawei.com>
> cpuset: Treat cpusets in attaching as populated
>
> Alexander Dahl <ada@thorsis.com>
> net: phy: adin1100: Fix software power-down ready condition
>
> Matt Bobrowski <mattbobrowski@google.com>
> selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names
>
> Charles Keepax <ckeepax@opensource.cirrus.com>
> ASoC: SDCA: Fix missing dash in HIDE DisCo property
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth
>
> Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
> phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode
>
> Xiaolei Wang <xiaolei.wang@windriver.com>
> phy: freescale: Initialize priv->lock
>
> Shawn Lin <shawn.lin@rock-chips.com>
> phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562
>
> Shawn Lin <shawn.lin@rock-chips.com>
> phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()
>
> Fenglin Wu <fenglin.wu@oss.qualcomm.com>
> leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM
>
> Yuntao Wang <yuntao.wang@linux.dev>
> of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho()
>
> Yuntao Wang <yuntao.wang@linux.dev>
> of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range()
>
> Yuntao Wang <yuntao.wang@linux.dev>
> of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr()
>
> Yuntao Wang <yuntao.wang@linux.dev>
> of/fdt: Consolidate duplicate code into helper functions
>
> Haotian Zhang <vulab@iscas.ac.cn>
> mfd: mt6358-irq: Fix missing irq_domain_remove() in error path
>
> Haotian Zhang <vulab@iscas.ac.cn>
> mfd: mt6397-irq: Fix missing irq_domain_remove() in error path
>
> Tomas Glozar <tglozar@redhat.com>
> tools/rtla: Fix --on-threshold always triggering
>
> Costa Shulyupin <costa.shul@redhat.com>
> tools/rtla: Fix unassigned nr_cpus
>
> Chien Wong <m@xv97.com>
> wifi: mac80211: fix CMAC functions not handling errors
>
> Aashish Sharma <aashish@aashishsharma.net>
> iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb
>
> Vineeth Pillai (Google) <vineeth@bitbyteword.org>
> iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: phy: realtek: create rtl8211f_config_rgmii_delay()
>
> Zilin Guan <zilin@seu.edu.cn>
> scsi: qla2xxx: Fix improper freeing of purex item
>
> Shawn Lin <shawn.lin@rock-chips.com>
> scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify
>
> Uwe Kleine-König <u.kleine-koenig@baylibre.com>
> pwm: bcm2835: Make sure the channel is enabled after pwm_request()
>
> Leo Yan <leo.yan@arm.com>
> perf arm_spe: Fix memset subclass in operation
>
> Fernando Fernandez Mancera <fmancera@suse.de>
> ipv6: clear RA flags when adding a static route
>
> Longbin Li <looong.bin@gmail.com>
> spi: sophgo: Fix incorrect use of bus width value macros
>
> Akhil P Oommen <akhilpo@oss.qualcomm.com>
> drm/msm/a6xx: Improve MX rail fallback in RPMH vote init
>
> Akhil P Oommen <akhilpo@oss.qualcomm.com>
> drm/msm/a6xx: Fix the gemnoc workaround
>
> Akhil P Oommen <akhilpo@oss.qualcomm.com>
> drm/msm/a6xx: Flush LRZ cache before PT switch
>
> Jay Liu <jay.liu@mediatek.com>
> drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue
>
> Edward Adam Davis <eadavis@qq.com>
> fs/ntfs3: Prevent memory leaks in add sub record
>
> Edward Adam Davis <eadavis@qq.com>
> fs/ntfs3: out1 also needs to put mi
>
> Ovidiu Panait <ovidiu.panait.rb@renesas.com>
> net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr()
>
> Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format
>
> Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit
>
> Pu Lehui <pulehui@huawei.com>
> bpf: Fix invalid prog->stats access when update_effective_progs fails
>
> Inochi Amaoto <inochiama@gmail.com>
> net: stmmac: dwmac-sophgo: Add phy interface filter
>
> Inochi Amaoto <inochiama@gmail.com>
> net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay
>
> Abdun Nihaal <nihaal@cse.iitm.ac.in>
> wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
>
> Christian Bruel <christian.bruel@foss.st.com>
> PCI: stm32: Fix EP page_size alignment
>
> Christian Bruel <christian.bruel@foss.st.com>
> PCI: stm32: Fix LTSSM EP race with start link
>
> Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> drm/msm/a2xx: stop over-complaining about the legacy firmware
>
> Huiwen He <hehuiwen@kylinos.cn>
> drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()
>
> Huiwen He <hehuiwen@kylinos.cn>
> drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs()
>
> Guenter Roeck <linux@roeck-us.net>
> block/blk-throttle: Fix throttle slice time for SSDs
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz
>
> Markus Niebel <Markus.Niebel@ew.tq-group.com>
> arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name
>
> Sergey Bashirov <sergeybashirov@gmail.com>
> NFSD/blocklayout: Fix minlength check in proc_layoutget
>
> Al Viro <viro@zeniv.linux.org.uk>
> tracefs: fix a leak in eventfs_create_events_dir()
>
> Al Viro <viro@zeniv.linux.org.uk>
> fuse_ctl_add_conn(): fix nlink breakage in case of early failure
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> iio: core: Clean up device correctly on iio_device_alloc() failure
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> iio: core: add missing mutex_destroy in iio_dev_release()
>
> Haotian Zhang <vulab@iscas.ac.cn>
> watchdog: starfive: Fix resource leak in probe error path
>
> Haotian Zhang <vulab@iscas.ac.cn>
> watchdog: wdat_wdt: Fix ACPI table leak in probe function
>
> Nuno Das Neves <nunodasneves@linux.microsoft.com>
> mshv: Fix create memory region overlap check
>
> Nuno Das Neves <nunodasneves@linux.microsoft.com>
> mshv: Fix deposit memory in MSHV_ROOT_HVCALL
>
> Martin KaFai Lau <martin.lau@kernel.org>
> bpf: Check skb->transport_header is set in bpf_skb_check_mtu
>
> Alexei Starovoitov <ast@kernel.org>
> selftests/bpf: Fix failure paths in send_signal test
>
> Menglong Dong <menglong8.dong@gmail.com>
> bpf: Handle return value of ftrace_set_filter_ip in register_fentry
>
> Sahil Chandna <chandna.sahil@gmail.com>
> bpf: Prevent nesting overflow in bpf_try_get_buffers
>
> Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> kbuild: don't enable CC_CAN_LINK if the dummy program generates warnings
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> PCI: Prevent resource tree corruption when BAR resize fails
>
> Aaron Kling <webgeek1234@gmail.com>
> soc/tegra: fuse: speedo-tegra210: Update speedo IDs
>
> Rene Rebe <rene@exactco.de>
> ps3disk: use memcpy_{from,to}_bvec index
>
> Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype
>
> Praveen Talari <praveen.talari@oss.qualcomm.com>
> arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm
>
> Uwe Kleine-König <u.kleine-koenig@baylibre.com>
> pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id
>
> Uwe Kleine-König <u.kleine-koenig@baylibre.com>
> pwm: Simplify printf to emit chip->npwm in $debugfs/pwm
>
> Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
> s390/fpu: Fix false-positive kmsan report in fpu_vstl()
>
> Zilin Guan <zilin@seu.edu.cn>
> crypto: iaa - Fix incorrect return value in save_iaa_wq()
>
> Ian Rogers <irogers@google.com>
> perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
>
> FUKAUMI Naoki <naoki@radxa.com>
> arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C
>
> FUKAUMI Naoki <naoki@radxa.com>
> arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A
>
> FUKAUMI Naoki <naoki@radxa.com>
> arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A
>
> Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config
>
> Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> soc: renesas: r9a09g056-sys: Populate max_register
>
> Siddharth Vadapalli <s-vadapalli@ti.com>
> PCI: keystone: Exit ks_pcie_probe() for invalid mode
>
> Leon Hwang <leon.hwang@linux.dev>
> bpf: Free special fields when update [lru_,]percpu_hash maps
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Fix deadlock between context destroy and job timeout
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Clear mailbox interrupt register during channel creation
>
> Chaitanya S Prakash <chaitanyas.prakash@arm.com>
> arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors
>
> Haotian Zhang <vulab@iscas.ac.cn>
> leds: netxbig: Fix GPIO descriptor leak in error paths
>
> Haotian Zhang <vulab@iscas.ac.cn>
> scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls
>
> Tony Battersby <tonyb@cybernetics.com>
> scsi: qla2xxx: Clear cmds after chip reset
>
> Haotian Zhang <vulab@iscas.ac.cn>
> ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()
>
> Joseph Qi <joseph.qi@linux.alibaba.com>
> ocfs2: use correct endian in ocfs2_dinode_has_extents
>
> Dmitry Antipov <dmantipov@yandex.ru>
> ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> lib/vsprintf: Check pointer before dereferencing in time_and_date()
>
> Haotian Zhang <vulab@iscas.ac.cn>
> clk: renesas: r9a06g032: Fix memory leak in error path
>
> Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
> clk: renesas: r9a09g077: Propagate rate changes to parent clocks
>
> Jayesh Choudhary <j-choudhary@ti.com>
> drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook
>
> Jayesh Choudhary <j-choudhary@ti.com>
> drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features
>
> Namhyung Kim <namhyung@kernel.org>
> perf tools: Fix missing feature check for inherit + SAMPLE_READ
>
> Leo Yan <leo.yan@arm.com>
> coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF
>
> Leo Yan <leo.yan@arm.com>
> coresight: etm4x: Add context synchronization before enabling trace
>
> Leo Yan <leo.yan@arm.com>
> coresight: etm4x: Correct polling IDLE bit
>
> Leo Yan <leo.yan@arm.com>
> coresight: etm3x: Always set tracer's device mode on target CPU
>
> Leo Yan <leo.yan@arm.com>
> coresight: etm4x: Always set tracer's device mode on target CPU
>
> Leo Yan <leo.yan@arm.com>
> coresight: Change device mode to atomic type
>
> Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
> fs/ntfs3: Initialize allocated memory before use
>
> David Wei <dw@davidwei.uk>
> io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock
>
> David Wei <dw@davidwei.uk>
> net: export netdev_get_by_index_lock()
>
> Zheng Qixing <zhengqixing@huawei.com>
> nbd: defer config unlock in nbd_genl_connect
>
> Abdun Nihaal <nihaal@cse.iitm.ac.in>
> wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
>
> Long Li <leo.lilong@huawei.com>
> macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/32: Fix unpaired stwcx. on interrupt exit
>
> Sourabh Jain <sourabhjain@linux.ibm.com>
> powerpc/kdump: Fix size calculation for hot-removed memory ranges
>
> Gautham R. Shenoy <gautham.shenoy@amd.com>
> cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs
>
> Li Nan <linan122@huawei.com>
> md: init bioset in mddev_init
>
> Li Nan <linan122@huawei.com>
> md: delete md_redundancy_group when array is becoming inactive
>
> Bean Huo <beanhuo@micron.com>
> scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()
>
> Akash Goel <akash.goel@arm.com>
> drm/panthor: Fix potential memleak of vma structure
>
> Edward Adam Davis <eadavis@qq.com>
> ntfs3: init run lock for extend inode
>
> Carl Worth <carl@os.amperecomputing.com>
> coresight: tmc: add the handle of the event to the path
>
> Jihed Chaibi <jihed.chaibi.dev@gmail.com>
> ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties
>
> Ma Ke <make24@iscas.ac.cn>
> RDMA/rtrs: server: Fix error handling in get_or_create_srv
>
> Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
> dt-bindings: PCI: amlogic: Fix the register name of the DBI region
>
> Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
> iio: imu: bmi270: fix dev_err_probe error msg
>
> Johan Hovold <johan@kernel.org>
> staging: most: remove broken i2c driver
>
> Mike McGowen <mike.mcgowen@microchip.com>
> scsi: smartpqi: Fix device resources accessed after device removal
>
> Haotian Zhang <vulab@iscas.ac.cn>
> scsi: stex: Fix reboot_notifier leak in probe error path
>
> Zheng Qixing <zhengqixing@huawei.com>
> nbd: defer config put in recv_work
>
> Xiao Ni <xni@redhat.com>
> md: avoid repeated calls to del_gendisk
>
> Yun Zhou <yun.zhou@windriver.com>
> md: fix rcu protection in md_wakeup_thread
>
> Xiao Ni <xni@redhat.com>
> md: delete mddev kobj before deleting gendisk kobj
>
> Gabor Juhos <j4g8y7@gmail.com>
> regulator: core: disable supply if enabling main regulator fails
>
> Dapeng Mi <dapeng1.mi@linux.intel.com>
> perf/x86/intel: Correct large PEBS flag check
>
> Dapeng Mi <dapeng1.mi@linux.intel.com>
> perf/x86: Fix NULL event access and potential PEBS record loss
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: use WRITE_ONCE for user shared memory
>
> FUKAUMI Naoki <naoki@radxa.com>
> arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T
>
> Dan Carpenter <dan.carpenter@linaro.org>
> hfs: fix potential use after free in hfs_correct_next_unused_CNID()
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Fix dma_fence leak when job is canceled
>
> Zhang Yi <yi.zhang@huawei.com>
> ext4: correct the checking of quota files before moving extents
>
> Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
> wifi: ath12k: Fix timeout error during beacon stats retrieval
>
> Haotian Zhang <vulab@iscas.ac.cn>
> mfd: da9055: Fix missing regmap_del_irq_chip() in error path
>
> Namhyung Kim <namhyung@kernel.org>
> perf annotate: Fix build with NO_SLANG=1
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: rtw89: usb: fix leak in rtw89_usb_write_port()
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler()
>
> Wang Liang <wangliang74@huawei.com>
> locktorture: Fix memory leak in param_set_cpumask()
>
> Usama Arif <usamaarif642@gmail.com>
> efi/libstub: Fix page table access in 5-level to 4-level paging transition
>
> Usama Arif <usamaarif642@gmail.com>
> x86/boot: Fix page table access in 5-level to 4-level paging transition
>
> Xiaoqi Zhuang <xiaoqi.zhuang@oss.qualcomm.com>
> coresight: ETR: Fix ETR buffer use-after-free issue
>
> Niklas Cassel <cassel@kernel.org>
> arm64: tegra: Add pinctrl definitions for pcie-ep nodes
>
> Peter Zijlstra <peterz@infradead.org>
> entry,unwind/deferred: Fix unwind_reset_info() placement
>
> Jihed Chaibi <jihed.chaibi.dev@gmail.com>
> ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible
>
> Jihed Chaibi <jihed.chaibi.dev@gmail.com>
> ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible
>
> Yegor Yefremov <yegorslists@googlemail.com>
> ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> ARM: dts: am33xx: Add missing serial console speed
>
> Alan Maguire <alan.maguire@oracle.com>
> libbpf: Fix parsing of multi-split BTF
>
> Vishwaroop A <va@nvidia.com>
> spi: tegra210-quad: Fix timeout handling
>
> Matthew Brost <matthew.brost@intel.com>
> drm/xe: Enforce correct user fence signaling order using
>
> Christian Brauner <brauner@kernel.org>
> cleanup: fix scoped_class()
>
> Songtang Liu <liusongtang@bytedance.com>
> iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show
>
> Christian Brauner <brauner@kernel.org>
> ns: initialize ns_list_node for initial namespaces
>
> Christian Brauner <brauner@kernel.org>
> ns: add NS_COMMON_INIT()
>
> Thomas Richard (TI.com) <thomas.richard@bootlin.com>
> firmware: ti_sci: Set IO Isolation only if the firmware is capable
>
> Boris Brezillon <boris.brezillon@collabora.com>
> drm/panthor: Fix UAF on kernel BO VA nodes
>
> Ketil Johnsen <ketil.johnsen@arm.com>
> drm/panthor: Fix race with suspend during unplug
>
> Ketil Johnsen <ketil.johnsen@arm.com>
> drm/panthor: Fix UAF race between device unplug and FW event processing
>
> Boris Brezillon <boris.brezillon@collabora.com>
> drm/panthor: Fix group_free_queue() for partially initialized queues
>
> Boris Brezillon <boris.brezillon@collabora.com>
> drm/panthor: Handle errors returned by drm_sched_entity_init()
>
> Tingmao Wang <m@maowtm.org>
> fs/9p: Don't open remote file with APPEND mode when writeback cache is used
>
> Mike Christie <michael.christie@oracle.com>
> scsi: target: Fix LUN/device R/W and total command stats
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: target: Do not write NUL characters into ASCII configfs output
>
> Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
> power: supply: apm_power: only unset own apm_get_power_status
>
> Val Packett <val@packett.cool>
> power: supply: qcom_battmgr: support disabling charge control
>
> Val Packett <val@packett.cool>
> power: supply: qcom_battmgr: clamp charge control thresholds
>
> Ivan Abramov <i.abramov@mt-integration.ru>
> power: supply: wm831x: Check wm831x_set_bits() return value
>
> Murad Masimov <m.masimov@mt-integration.ru>
> power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()
>
> Ivan Abramov <i.abramov@mt-integration.ru>
> power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()
>
> Ivan Abramov <i.abramov@mt-integration.ru>
> power: supply: max17040: Check iio_read_channel_processed() return code
>
> Ivan Abramov <i.abramov@mt-integration.ru>
> power: supply: cw2015: Check devm_delayed_work_autocancel() return code
>
> Haotian Zhang <vulab@iscas.ac.cn>
> power: supply: rt5033_charger: Fix device node reference leaks
>
> Frederic Weisbecker <frederic@kernel.org>
> timers/migration: Fix imbalanced NUMA trees
>
> Frederic Weisbecker <frederic@kernel.org>
> timers/migration: Remove locking on group connection
>
> Frederic Weisbecker <frederic@kernel.org>
> timers/migration: Convert "while" loops to use "for"
>
> Taniya Das <taniya.das@oss.qualcomm.com>
> clk: qcom: tcsrcc-glymur: Update register offsets for clock refs
>
> Shuai Xue <xueshuai@linux.alibaba.com>
> perf record: skip synthesize event when open evsel failed
>
> Namhyung Kim <namhyung@kernel.org>
> perf lock contention: Load kernel map before lookup
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource()
>
> Christian Brauner <brauner@kernel.org>
> cgroup: add cgroup namespace to tree after owner is set
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels
>
> Kuan-Wei Chiu <visitorckw@gmail.com>
> interconnect: debugfs: Fix incorrect error handling for NULL path
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Fix incorrect command state for timed out job
>
> Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller
>
> Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS
>
> Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
> wifi: ath12k: unassign arvif on scan vdev create failure
>
> Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
> wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath12k: fix error handling in creating hardware group
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath12k: fix reusing m3 memory
>
> Abdun Nihaal <nihaal@cse.iitm.ac.in>
> wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
>
> Jacob Keller <jacob.e.keller@intel.com>
> docs: kdoc: fix duplicate section warning message
>
> Arnd Bergmann <arnd@arndb.de>
> random: use offstack cpumask when necessary
>
> Stanley Chu <yschu@nuvoton.com>
> i3c: master: svc: Prevent incomplete IBI transaction
>
> Frank Li <Frank.Li@nxp.com>
> i3c: fix refcount inconsistency in i3c_master_register
>
> Aniket Limaye <a-limaye@ti.com>
> arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration
>
> Christian Brauner <brauner@kernel.org>
> pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info
>
> Christian Brauner <brauner@kernel.org>
> pidfs: add missing PIDFD_INFO_SIZE_VER1
>
> Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
> accel/ivpu: Fix race condition when unbinding BOs
>
> Danilo Krummrich <dakr@kernel.org>
> drm: nova: select NOVA_CORE
>
> Haotian Zhang <vulab@iscas.ac.cn>
> pinctrl: stm32: fix hwspinlock resource leak in probe function
>
> Haotian Zhang <vulab@iscas.ac.cn>
> soc: qcom: smem: fix hwspinlock resource leak in probe error paths
>
> Taniya Das <taniya.das@oss.qualcomm.com>
> clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops
>
> Benjamin Berg <benjamin.berg@intel.com>
> tools/nolibc/dirent: avoid errno in readdir_r
>
> Benjamin Berg <benjamin.berg@intel.com>
> tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set
>
> Maciej Falkowski <maciej.falkowski@linux.intel.com>
> accel/ivpu: Remove skip of dma unmap for imported buffers
>
> Tengda Wu <wutengda@huaweicloud.com>
> x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros
>
> Peter Zijlstra <peterz@infradead.org>
> task_work: Fix NMI race condition
>
> Zhang Rui <rui.zhang@intel.com>
> perf/x86/intel/cstate: Remove PC3 support from LunarLake
>
> Arnaud Lecomte <contact@arnaud-lcm.com>
> bpf: Fix stackmap overflow check in __bpf_get_stackid()
>
> Arnaud Lecomte <contact@arnaud-lcm.com>
> bpf: Refactor stack map trace depth calculation into helper function
>
> Haotian Zhang <vulab@iscas.ac.cn>
> mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove
>
> Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
> mtd: nand: relax ECC parameter validation check
>
> Aryan Srivastava <aryan.srivastava@alliedtelesis.co.nz>
> Revert "mtd: rawnand: marvell: fix layouts"
>
> Li Qiang <liqiang01@kylinos.cn>
> wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload()
>
> Alex Deucher <alexander.deucher@amd.com>
> drm/amdgpu/userq: fix SDMA and compute validation
>
> Prike Liang <Prike.Liang@amd.com>
> drm/amdgpu: add userq object va track helpers
>
> Wolfram Sang <wsa+renesas@sang-engineering.com>
> ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties
>
> Wolfram Sang <wsa+renesas@sang-engineering.com>
> ARM: dts: renesas: gose: Remove superfluous port property
>
> Zhu Yanjun <yanjun.zhu@linux.dev>
> RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
>
> Loic Poulain <loic.poulain@oss.qualcomm.com>
> arm64: dts: qcom: qcm2290: Fix camss register prop ordering
>
> Kuniyuki Iwashima <kuniyu@google.com>
> sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
>
> Horatiu Vultur <horatiu.vultur@microchip.com>
> phy: mscc: Fix PTP for VSC8574 and VSC8572
>
> Michal Suchanek <msuchanek@suse.de>
> perf hwmon_pmu: Fix uninitialized variable warning
>
> Eric Gonçalves <ghatto404@gmail.com>
> arm64: dts: qcom: sm8250-samsung-common: correct reserved pins
>
> Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name
>
> Pengyu Luo <mitltlatltl@gmail.com>
> arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels
>
> Val Packett <val@packett.cool>
> arm64: dts: qcom: x1-dell-thena: remove dp data-lanes
>
> Val Packett <val@packett.cool>
> arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD
>
> Alexander Martinz <amartinz@shiftphones.com>
> arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory
>
> Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
> arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node
>
> Neil Armstrong <neil.armstrong@linaro.org>
> arm64: dts: qcom: sm8650: set ufs as dma coherent
>
> Luca Weiss <luca.weiss@fairphone.com>
> arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node
>
> Gergo Koteles <soyer@irl.hu>
> arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider
>
> Dzmitry Sankouski <dsankouski@gmail.com>
> arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts
>
> Dzmitry Sankouski <dsankouski@gmail.com>
> arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells
>
> Willy Tarreau <w@1wt.eu>
> tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions
>
> Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
> arm64: dts: qcom: lemans: Add missing quirk for HS only USB controller
>
> Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
> arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller
>
> Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
> arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller
>
> Peng Fan <peng.fan@nxp.com>
> firmware: imx: scu-irq: fix OF node leak in
>
> Randolph Sapp <rs@ti.com>
> arm64: dts: ti: k3-am62p: Fix memory ranges for GPU
>
> Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
> PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context
>
> Thomas Richard <thomas.richard@bootlin.com>
> leds: upboard: Fix module alias
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: remove duplicate call to ice_deinit_hw() on error paths
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: move ice_deinit_dev() to the end of deinit paths
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: extract ice_init_dev() from ice_init()
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: move ice_init_pf() out of ice_init_dev()
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf()
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: move ice_init_interrupt_scheme() prior ice_init_pf()
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: move service task start out of ice_init_pf()
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Fix uninitialized return value
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath12k: restore register window after global reset
>
> Len Brown <len.brown@intel.com>
> tools/power turbostat: Regression fix Uncore MHz printed in hex
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/ap: Don't leak debug feature files if AP instructions are not available
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: ufs: core: Move the ufshcd_enable_intr() declaration
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/smp: Fix fallback CPU detection
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath11k: fix peer HE MCS assignment
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath11k: fix VHT MCS assignment
>
> nieweiqiang <nieweiqiang@huawei.com>
> crypto: hisilicon/qm - restore original qos values
>
> Thorsten Blum <thorsten.blum@linux.dev>
> crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
>
> Haotian Zhang <vulab@iscas.ac.cn>
> soc: qcom: gsbi: fix double disable caused by devm
>
> Luca Weiss <luca.weiss@fairphone.com>
> clk: qcom: camcc-sm7150: Fix PLL config of PLL2
>
> Luca Weiss <luca.weiss@fairphone.com>
> clk: qcom: camcc-sm6350: Fix PLL config of PLL2
>
> Luo Jie <quic_luoj@quicinc.com>
> clk: qcom: gcc-ipq5424: Correct the icc_first_node_id
>
> Taniya Das <taniya.das@oss.qualcomm.com>
> clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks
>
> Taniya Das <taniya.das@oss.qualcomm.com>
> clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock
>
> Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615
>
> Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
> clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other
>
> Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
> clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other
>
> Sherry Sun <sherry.sun@nxp.com>
> tty: serial: imx: Only configure the wake register when device is set as wakeup source
>
> Li Qiang <liqiang01@kylinos.cn>
> uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2
>
> Peter Griffin <peter.griffin@linaro.org>
> arm64: dts: exynos: gs101: fix sysreg_apm reg property
>
> Peter Griffin <peter.griffin@linaro.org>
> arm64: dts: exynos: gs101: fix clock module unit reg sizes
>
> Tianyou Li <tianyou.li@intel.com>
> perf annotate: Check return value of evsel__get_arch() properly
>
> Joy Zou <joy.zou@nxp.com>
> arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan
>
> Tim Harvey <tharvey@gateworks.com>
> arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1
>
> Tim Harvey <tharvey@gateworks.com>
> arm64: dts: imx8mp-venice-gw702x: remove off-board uart
>
> Tim Harvey <tharvey@gateworks.com>
> arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl
>
> Tim Harvey <tharvey@gateworks.com>
> arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props
>
> Daniel Borkmann <daniel@iogearbox.net>
> bpf: Do not let BPF test infra emit invalid GSO types to stack
>
> Bart Van Assche <bvanassche@acm.org>
> block/mq-deadline: Switch back to a single dispatch list
>
> Bart Van Assche <bvanassche@acm.org>
> block/mq-deadline: Introduce dd_start_request()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove()
>
> T Pratham <t-pratham@ti.com>
> crypto: aead - Fix reqsize handling
>
> Ian Rogers <irogers@google.com>
> perf parse-events: Make X modifier more respectful of groups
>
> Randy Dunlap <rdunlap@infradead.org>
> firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc
>
> Francesco Lavra <flavra@baylibre.com>
> iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member
>
> Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
> arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K
>
> Sidharth Seela <sidharthseela@gmail.com>
> ntfs3: Fix uninit buffer allocated by __getname()
>
> Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
> ntfs3: fix uninit memory after failed mi_read in mi_format_new
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: authenc - Correctly pass EINPROGRESS back up to the caller
>
> Johan Hovold <johan@kernel.org>
> irqchip: Pass platform device to platform drivers
>
> Johan Hovold <johan@kernel.org>
> irqchip: Drop leftover brackets
>
> Johan Hovold <johan@kernel.org>
> irqchip/qcom-irq-combiner: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/starfive-jh8100: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/renesas-rzg2l: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/imx-mu-msi: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/irq-brcmstb-l2: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/irq-bcm7120-l2: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/irq-bcm7038-l1: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/bcm2712-mip: Fix section mismatch
>
> Johan Hovold <johan@kernel.org>
> irqchip/bcm2712-mip: Fix OF node reference imbalance
>
> Fernand Sieber <sieberf@amazon.com>
> sched/fair: Forfeit vruntime on yield
>
> Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
> wifi: ath12k: fix TX and RX MCS rate configurations in HE mode
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath12k: fix VHT MCS assignment
>
> Sarika Sharma <sarika.sharma@oss.qualcomm.com>
> wifi: ath12k: Fix MSDU buffer types handling in RX error path
>
> Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> wifi: ath11k: restore register window after global reset
>
> Kang Yang <kang.yang@oss.qualcomm.com>
> wifi: ath10k: move recovery check logic into a new work
>
> Danilo Krummrich <dakr@kernel.org>
> gpu: nova-core: gsp: do not unwrap() SGEntry
>
> Danilo Krummrich <dakr@kernel.org>
> gpu: nova-core: gsp: remove useless conversion
>
> Ian Rogers <irogers@google.com>
> perf parse-events: Fix legacy cache events if event is duplicated in a PMU
>
> Wludzik, Jozef <jozef.wludzik@intel.com>
> accel/ivpu: Fix race condition when mapping dmabuf
>
> Josh Poimboeuf <jpoimboe@kernel.org>
> objtool: Fix weak symbol detection
>
> Dylan Hatch <dylanbhatch@google.com>
> objtool: Fix standalone --hacks=jump_label
>
> Peng Fan <peng.fan@nxp.com>
> remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path
>
> Mavroudis Chatzilazaridis <mavchatz@protonmail.com>
> HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()
>
> Cyrille Pitchen <cyrille.pitchen@microchip.com>
> drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler()
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> clk: renesas: cpg-mssr: Read back reset registers to assure values latched
>
> Marek Vasut <marek.vasut+renesas@mailbox.org>
> clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback
>
> Biju Das <biju.das.jz@bp.renesas.com>
> pinctrl: renesas: rzg2l: Fix PMC restore
>
> Roberto Sassu <roberto.sassu@huawei.com>
> ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook
>
> Abel Vesa <abel.vesa@linaro.org>
> pinctrl: qcom: glymur: Fix the gpio and egpio pin functions
>
> Abel Vesa <abel.vesa@linaro.org>
> pinctrl: qcom: glymur: Drop unnecessary platform data from match table
>
> Ian Rogers <irogers@google.com>
> perf bpf_counter: Fix opening of "any"(-1) CPU events
>
> Seungjin Bae <eeodqql09@gmail.com>
> USB: Fix descriptor count when handling invalid MBIM extended descriptor
>
> Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> tools/nolibc: handle NULL wstatus argument to waitpid()
>
> Mykyta Yatsenko <yatsenko@meta.com>
> bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq
>
> Kumar Kartikeya Dwivedi <memxor@gmail.com>
> bpf: Fix sleepable context for async callbacks
>
> Siddharth Chintamaneni <sidchintamaneni@gmail.com>
> bpf: Cleanup unused func args in rqspinlock implementation
>
> Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> drm/vgem-fence: Fix potential deadlock on release
>
> Karol Wachowski <karol.wachowski@linux.intel.com>
> accel/ivpu: Fix DCT active percent format
>
> Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
>
> Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> accel/ivpu: Rework bind/unbind of imported buffers
>
> Guido Günther <agx@sigxcpu.org>
> drm/panel: visionox-rm69299: Don't clear all mode flags
>
> Guido Günther <agx@sigxcpu.org>
> drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq
>
> Karol Wachowski <karol.wachowski@linux.intel.com>
> accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object
>
> Lizhi Hou <lizhi.hou@amd.com>
> accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array()
>
> Mainak Sen <msen@nvidia.com>
> gpu: host1x: Fix race in syncpt alloc/free
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: fix bug: setting task label silently ignores input garbage
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: fix bug: unprivileged task can create labels
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: fix bug: invalid label of unix socket file
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: always "instantiate" inode in smack_inode_init_security()
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: deduplicate xattr setting in smack_inode_init_security()
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: deduplicate "does access rule request transmutation"
>
> Konstantin Andreev <andreev@swemel.ru>
> smack: fix bug: SMACK64TRANSMUTE set on non-directory
>
>
> -------------
>
> Diffstat:
>
> Documentation/admin-guide/LSM/Smack.rst | 16 +-
> .../devicetree/bindings/pci/amlogic,axg-pcie.yaml | 6 +-
> Documentation/hwmon/g762.rst | 2 +-
> Makefile | 4 +-
> arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 -
> .../arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts | 2 -
> arch/arm/boot/dts/samsung/exynos4210-i9100.dts | 1 +
> arch/arm/boot/dts/samsung/exynos4210-trats.dts | 1 +
> .../boot/dts/samsung/exynos4210-universal_c210.dts | 1 +
> arch/arm/boot/dts/samsung/exynos4412-midas.dtsi | 1 +
> .../dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi | 8 +-
> arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-boneblue.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-chiliboard.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-evm.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-evmsk.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-guardian.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-icev2.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-myirtech-myd.dts | 2 +-
> .../boot/dts/ti/omap/am335x-netcom-plus-2xx.dts | 8 +-
> .../arm/boot/dts/ti/omap/am335x-osd3358-sm-red.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-pdu001.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-pocketbeagle.dts | 2 +-
> arch/arm/boot/dts/ti/omap/am335x-sl50.dts | 2 +-
> arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts | 2 +-
> arch/arm/boot/dts/ti/omap/omap3-n900.dts | 2 +-
> arch/arm/include/asm/word-at-a-time.h | 10 +-
> arch/arm64/boot/dts/amlogic/meson-g12b.dtsi | 4 +-
> arch/arm64/boot/dts/exynos/google/gs101.dtsi | 18 +-
> .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi | 11 -
> .../boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 51 ---
> .../boot/dts/freescale/imx8mp-venice-gw72xx.dtsi | 11 -
> arch/arm64/boot/dts/freescale/imx95-15x15-evk.dts | 1 +
> .../arm64/boot/dts/freescale/imx95-tqma9596sa.dtsi | 4 +-
> arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +-
> arch/arm64/boot/dts/nvidia/tegra234.dtsi | 61 ++++
> arch/arm64/boot/dts/qcom/ipq5424.dtsi | 2 +-
> arch/arm64/boot/dts/qcom/lemans.dtsi | 1 +
> arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +
> arch/arm64/boot/dts/qcom/qcm2290.dtsi | 10 +-
> arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 2 +
> arch/arm64/boot/dts/qcom/qcm6490-shift-otter.dts | 5 +
> arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 2 +-
> arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 170 +++++-----
> .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 +-
> .../boot/dts/qcom/sdm845-samsung-starqltechn.dts | 16 +-
> .../arm64/boot/dts/qcom/sm8250-samsung-common.dtsi | 3 +-
> arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +
> arch/arm64/boot/dts/qcom/sm8750-mtp.dts | 6 +-
> arch/arm64/boot/dts/qcom/x1-dell-thena.dtsi | 5 +-
> arch/arm64/boot/dts/qcom/x1e80100.dtsi | 12 +-
> .../boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 6 +-
> arch/arm64/boot/dts/rockchip/rk3566-rock-3c.dts | 1 +
> .../boot/dts/rockchip/rk3588-rock-5b-5bp-5t.dtsi | 4 +-
> .../boot/dts/rockchip/rk3588-rock-5b-plus.dts | 5 +
> arch/arm64/boot/dts/rockchip/rk3588-rock-5b.dts | 4 +
> arch/arm64/boot/dts/rockchip/rk3588-rock-5t.dts | 4 +
> arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts | 15 +-
> arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +-
> arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 +-
> .../boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 4 +-
> arch/arm64/mm/mmu.c | 214 +++++++-----
> arch/arm64/mm/pageattr.c | 5 +-
> arch/powerpc/kernel/entry_32.S | 10 +-
> arch/powerpc/kexec/ranges.c | 2 +-
> arch/powerpc/mm/book3s64/hash_utils.c | 10 +-
> arch/powerpc/mm/ptdump/hashpagetable.c | 6 +
> arch/riscv/kvm/vcpu_insn.c | 22 ++
> arch/s390/include/asm/fpu-insn.h | 3 +
> arch/s390/kernel/smp.c | 1 +
> arch/um/Kconfig | 1 +
> arch/um/Makefile | 12 +-
> arch/um/include/asm/kasan.h | 4 -
> arch/x86/boot/compressed/pgtable_64.c | 11 +-
> arch/x86/events/core.c | 5 +-
> arch/x86/events/intel/core.c | 7 +-
> arch/x86/events/intel/cstate.c | 3 +-
> arch/x86/kernel/dumpstack.c | 23 +-
> block/blk-lib.c | 6 +-
> block/blk-mq.c | 35 +-
> block/blk-throttle.c | 9 +-
> block/mq-deadline.c | 129 ++++---
> crypto/aead.c | 1 +
> crypto/ahash.c | 18 +-
> crypto/asymmetric_keys/asymmetric_type.c | 12 +-
> crypto/authenc.c | 75 +++--
> drivers/accel/amdxdna/aie2_ctx.c | 22 +-
> drivers/accel/amdxdna/aie2_pci.c | 10 +-
> drivers/accel/amdxdna/amdxdna_ctx.c | 1 +
> drivers/accel/amdxdna/amdxdna_ctx.h | 1 +
> drivers/accel/amdxdna/amdxdna_gem.c | 47 ++-
> drivers/accel/amdxdna/amdxdna_mailbox.c | 1 +
> drivers/accel/ivpu/ivpu_gem.c | 97 ++++--
> drivers/accel/ivpu/ivpu_gem.h | 2 +-
> drivers/accel/ivpu/ivpu_hw_btrs.c | 2 +-
> drivers/accel/ivpu/ivpu_hw_btrs.h | 2 +-
> drivers/accel/ivpu/ivpu_job.c | 6 +-
> drivers/accel/ivpu/ivpu_pm.c | 9 +-
> drivers/acpi/apei/ghes.c | 27 +-
> drivers/acpi/processor_core.c | 2 +-
> drivers/acpi/property.c | 1 +
> drivers/base/firmware_loader/Kconfig | 2 +-
> drivers/block/nbd.c | 5 +-
> drivers/block/ps3disk.c | 4 +
> drivers/block/ublk_drv.c | 4 +-
> drivers/char/random.c | 19 +-
> drivers/clk/Makefile | 3 +-
> drivers/clk/qcom/camcc-sm6350.c | 13 +-
> drivers/clk/qcom/camcc-sm7150.c | 6 +-
> drivers/clk/qcom/camcc-sm8550.c | 10 +
> drivers/clk/qcom/clk-rpmh.c | 1 +
> drivers/clk/qcom/gcc-glymur.c | 24 +-
> drivers/clk/qcom/gcc-ipq5424.c | 3 +-
> drivers/clk/qcom/gcc-qcs615.c | 6 +-
> drivers/clk/qcom/gcc-sm8750.c | 1 +
> drivers/clk/qcom/tcsrcc-glymur.c | 54 +--
> drivers/clk/renesas/r9a06g032-clocks.c | 6 +-
> drivers/clk/renesas/r9a09g077-cpg.c | 4 +-
> drivers/clk/renesas/renesas-cpg-mssr.c | 57 ++--
> drivers/clk/spacemit/ccu-k1.c | 4 +-
> drivers/clocksource/arm_arch_timer_mmio.c | 2 +
> drivers/clocksource/timer-nxp-pit.c | 3 +-
> drivers/clocksource/timer-nxp-stm.c | 23 +-
> drivers/clocksource/timer-ralink.c | 11 +-
> drivers/cpufreq/amd-pstate.c | 2 +-
> drivers/crypto/ccree/cc_buffer_mgr.c | 6 +-
> drivers/crypto/hisilicon/qm.c | 14 +-
> drivers/crypto/intel/iaa/iaa_crypto_main.c | 2 +-
> drivers/crypto/starfive/jh7110-hash.c | 6 +-
> drivers/devfreq/hisi_uncore_freq.c | 3 +-
> drivers/firmware/efi/cper-arm.c | 52 ++-
> drivers/firmware/efi/cper.c | 60 ++++
> drivers/firmware/efi/libstub/x86-5lvl.c | 4 +-
> drivers/firmware/imx/imx-scu-irq.c | 4 +-
> drivers/firmware/stratix10-svc.c | 1 +
> drivers/firmware/ti_sci.c | 21 +-
> drivers/firmware/ti_sci.h | 2 +
> drivers/gpio/Kconfig | 1 -
> drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 44 ++-
> drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 12 +-
> drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 31 +-
> drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 46 ++-
> drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 4 +-
> drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +-
> drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c | 27 +-
> drivers/gpu/drm/drm_plane.c | 8 +-
> drivers/gpu/drm/i915/display/intel_fbdev.c | 43 ++-
> drivers/gpu/drm/i915/display/intel_fbdev_fb.c | 42 +--
> drivers/gpu/drm/i915/display/intel_fbdev_fb.h | 8 +-
> drivers/gpu/drm/imagination/pvr_device.c | 2 +-
> drivers/gpu/drm/mediatek/mtk_disp_ccorr.c | 23 +-
> drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 2 +-
> drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 34 +-
> drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 10 +-
> drivers/gpu/drm/msm/disp/dpu1/dpu_hw_dsc.h | 6 -
> drivers/gpu/drm/msm/msm_gpu.c | 21 +-
> .../gpu/drm/nouveau/dispnv04/nouveau_i2c_encoder.c | 20 --
> .../drm/nouveau/include/dispnv04/i2c/encoder_i2c.h | 19 +-
> drivers/gpu/drm/nouveau/nouveau_fence.c | 6 +-
> drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c | 2 +-
> drivers/gpu/drm/nova/Kconfig | 1 +
> drivers/gpu/drm/panel/panel-novatek-nt35560.c | 8 +-
> drivers/gpu/drm/panel/panel-visionox-rm69299.c | 4 +-
> drivers/gpu/drm/panthor/panthor_device.c | 4 +-
> drivers/gpu/drm/panthor/panthor_gem.c | 20 +-
> drivers/gpu/drm/panthor/panthor_mmu.c | 18 +-
> drivers/gpu/drm/panthor/panthor_sched.c | 25 +-
> .../gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 4 +-
> drivers/gpu/drm/tidss/tidss_dispc.c | 93 +++--
> drivers/gpu/drm/tidss/tidss_dispc.h | 3 -
> drivers/gpu/drm/tidss/tidss_drv.h | 2 +
> drivers/gpu/drm/tidss/tidss_oldi.c | 22 ++
> drivers/gpu/drm/vgem/vgem_fence.c | 2 +-
> drivers/gpu/drm/xe/display/intel_fbdev_fb.c | 32 +-
> drivers/gpu/drm/xe/xe_exec_queue.c | 3 +
> drivers/gpu/host1x/syncpt.c | 4 +-
> drivers/gpu/nova-core/firmware/gsp.rs | 8 +-
> drivers/greybus/gb-beagleplay.c | 12 +-
> drivers/hid/hid-logitech-hidpp.c | 9 +-
> drivers/hv/mshv_root_main.c | 89 +++--
> drivers/hwmon/sy7636a-hwmon.c | 7 +-
> drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
> drivers/hwtracing/coresight/coresight-etm3x-core.c | 59 ++--
> drivers/hwtracing/coresight/coresight-etm4x-core.c | 103 ++++--
> drivers/hwtracing/coresight/coresight-etm4x.h | 3 -
> drivers/hwtracing/coresight/coresight-tmc-etr.c | 10 +-
> drivers/i2c/busses/i2c-k1.c | 19 +-
> drivers/i3c/master.c | 8 +-
> drivers/i3c/master/svc-i3c-master.c | 22 +-
> drivers/iio/imu/bmi270/bmi270_spi.c | 2 +-
> drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 2 +-
> drivers/iio/industrialio-core.c | 17 +-
> drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 +-
> drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +-
> drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 +-
> drivers/infiniband/hw/irdma/cm.c | 2 +-
> drivers/infiniband/hw/irdma/ctrl.c | 6 +-
> drivers/infiniband/hw/irdma/icrdma_if.c | 6 +-
> drivers/infiniband/hw/irdma/ig3rdma_if.c | 4 +
> drivers/infiniband/hw/irdma/main.h | 2 +-
> drivers/infiniband/hw/irdma/pble.c | 6 +-
> drivers/infiniband/hw/irdma/puda.c | 1 -
> drivers/infiniband/hw/irdma/uk.c | 31 +-
> drivers/infiniband/hw/irdma/user.h | 1 -
> drivers/infiniband/hw/irdma/verbs.c | 24 +-
> drivers/infiniband/hw/irdma/verbs.h | 3 +-
> drivers/infiniband/sw/rxe/rxe_srq.c | 7 +-
> drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +-
> drivers/interconnect/debugfs-client.c | 7 +-
> drivers/interconnect/qcom/msm8996.c | 1 +
> drivers/iommu/amd/debugfs.c | 2 +-
> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
> drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 27 +-
> drivers/iommu/intel/Kconfig | 2 +-
> drivers/iommu/intel/iommu.h | 2 +-
> drivers/irqchip/irq-bcm2712-mip.c | 11 +-
> drivers/irqchip/irq-bcm7038-l1.c | 11 +-
> drivers/irqchip/irq-bcm7120-l2.c | 31 +-
> drivers/irqchip/irq-brcmstb-l2.c | 25 +-
> drivers/irqchip/irq-imx-mu-msi.c | 28 +-
> drivers/irqchip/irq-mchp-eic.c | 7 +-
> drivers/irqchip/irq-meson-gpio.c | 5 +-
> drivers/irqchip/irq-qcom-mpm.c | 6 +-
> drivers/irqchip/irq-renesas-rzg2l.c | 37 +-
> drivers/irqchip/irq-renesas-rzv2h.c | 32 +-
> drivers/irqchip/irq-starfive-jh8100-intc.c | 6 +-
> drivers/irqchip/irqchip.c | 10 +-
> drivers/irqchip/qcom-irq-combiner.c | 2 +-
> drivers/irqchip/qcom-pdc.c | 5 +-
> drivers/leds/leds-netxbig.c | 36 +-
> drivers/leds/leds-upboard.c | 2 +-
> drivers/leds/rgb/leds-qcom-lpg.c | 4 +-
> drivers/macintosh/mac_hid.c | 3 +-
> drivers/md/dm-log-writes.c | 1 +
> drivers/md/dm-raid.c | 2 +
> drivers/md/md.c | 92 ++---
> drivers/md/md.h | 9 +-
> drivers/md/raid5.c | 6 +-
> drivers/mfd/da9055-core.c | 1 +
> drivers/mfd/mt6358-irq.c | 1 +
> drivers/mfd/mt6397-irq.c | 1 +
> drivers/misc/rp1/rp1_pci.c | 3 +
> drivers/mtd/lpddr/lpddr_cmds.c | 8 +-
> drivers/mtd/nand/raw/lpc32xx_slc.c | 2 +
> drivers/mtd/nand/raw/marvell_nand.c | 13 +-
> drivers/mtd/nand/raw/nand_base.c | 13 +-
> drivers/mtd/nand/raw/renesas-nand-controller.c | 5 +-
> drivers/net/dsa/b53/b53_common.c | 331 ++++++++++++------
> drivers/net/dsa/b53/b53_priv.h | 111 +++++-
> drivers/net/dsa/b53/b53_regs.h | 41 ++-
> drivers/net/dsa/xrs700x/xrs700x.c | 11 +
> drivers/net/ethernet/intel/iavf/iavf_ptp.c | 7 +
> drivers/net/ethernet/intel/ice/devlink/devlink.c | 21 +-
> drivers/net/ethernet/intel/ice/ice.h | 4 +
> drivers/net/ethernet/intel/ice/ice_common.c | 3 +
> drivers/net/ethernet/intel/ice/ice_main.c | 169 +++++-----
> drivers/net/ethernet/stmicro/stmmac/dwmac-sophgo.c | 20 +-
> drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
> drivers/net/ethernet/stmicro/stmmac/stmmac_vlan.c | 3 +-
> drivers/net/phy/adin1100.c | 2 +-
> drivers/net/phy/aquantia/aquantia_firmware.c | 2 +-
> drivers/net/phy/mscc/mscc_main.c | 6 +-
> drivers/net/phy/phy-core.c | 43 +++
> drivers/net/phy/realtek/realtek_main.c | 65 ++--
> drivers/net/vxlan/vxlan_core.c | 18 +-
> drivers/net/wireless/ath/ath10k/core.c | 20 +-
> drivers/net/wireless/ath/ath10k/core.h | 2 +-
> drivers/net/wireless/ath/ath10k/mac.c | 2 +-
> drivers/net/wireless/ath/ath11k/mac.c | 8 +-
> drivers/net/wireless/ath/ath11k/pci.c | 20 +-
> drivers/net/wireless/ath/ath11k/wmi.c | 20 +-
> drivers/net/wireless/ath/ath11k/wmi.h | 2 +
> drivers/net/wireless/ath/ath12k/core.c | 24 +-
> drivers/net/wireless/ath/ath12k/core.h | 1 -
> drivers/net/wireless/ath/ath12k/dp_rx.c | 70 +++-
> drivers/net/wireless/ath/ath12k/hal_rx.c | 10 +-
> drivers/net/wireless/ath/ath12k/mac.c | 28 +-
> drivers/net/wireless/ath/ath12k/pci.c | 20 +-
> drivers/net/wireless/ath/ath12k/qmi.c | 11 +-
> drivers/net/wireless/ath/ath12k/qmi.h | 5 +-
> drivers/net/wireless/ath/ath12k/wmi.c | 23 +-
> drivers/net/wireless/ath/ath12k/wmi.h | 2 +
> drivers/net/wireless/ath/ath12k/wow.c | 1 +
> drivers/net/wireless/intel/iwlwifi/mld/d3.c | 4 +
> drivers/net/wireless/mediatek/mt76/mac80211.c | 2 -
> drivers/net/wireless/mediatek/mt76/mt76.h | 9 +
> drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 4 +-
> drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 2 +
> drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 -
> drivers/net/wireless/mediatek/mt76/mt7996/dma.c | 15 +-
> drivers/net/wireless/mediatek/mt76/mt7996/init.c | 19 +-
> drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 18 +-
> drivers/net/wireless/mediatek/mt76/mt7996/main.c | 115 ++++---
> drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 69 ++--
> drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 +
> drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +-
> drivers/net/wireless/mediatek/mt76/wed.c | 10 +-
> drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 +-
> drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 27 +-
> drivers/net/wireless/realtek/rtw89/usb.c | 13 +-
> drivers/net/wireless/st/cw1200/bh.c | 6 +-
> drivers/nvme/host/auth.c | 2 +-
> drivers/of/fdt.c | 85 +++--
> drivers/of/of_kunit_helpers.c | 5 +-
> drivers/pci/controller/Kconfig | 7 +-
> drivers/pci/controller/cadence/pcie-sg2042.c | 3 -
> drivers/pci/controller/dwc/pci-keystone.c | 2 +
> drivers/pci/controller/dwc/pcie-designware.h | 2 +-
> drivers/pci/controller/dwc/pcie-stm32-ep.c | 41 +--
> drivers/pci/endpoint/functions/pci-epf-test.c | 5 +-
> drivers/pci/setup-bus.c | 5 +
> drivers/phy/freescale/phy-fsl-imx8qm-hsio.c | 5 +-
> drivers/phy/renesas/phy-rcar-gen3-usb2.c | 20 +-
> drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 15 +
> drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c | 27 +-
> drivers/pinctrl/pinctrl-single.c | 7 +-
> drivers/pinctrl/qcom/pinctrl-glymur.c | 6 +-
> drivers/pinctrl/renesas/pinctrl-rzg2l.c | 6 +-
> drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +-
> drivers/platform/x86/asus-wmi.c | 8 +-
> drivers/platform/x86/intel/pmc/core.h | 2 +-
> drivers/power/supply/apm_power.c | 3 +-
> drivers/power/supply/cw2015_battery.c | 8 +-
> drivers/power/supply/max17040_battery.c | 6 +-
> drivers/power/supply/qcom_battmgr.c | 26 +-
> drivers/power/supply/rt5033_charger.c | 2 +
> drivers/power/supply/rt9467-charger.c | 6 +-
> drivers/power/supply/wm831x_power.c | 10 +-
> drivers/pwm/core.c | 5 +-
> drivers/pwm/pwm-bcm2835.c | 28 +-
> drivers/ras/ras.c | 40 ++-
> drivers/regulator/core.c | 37 +-
> drivers/regulator/fixed.c | 11 +-
> drivers/regulator/pca9450-regulator.c | 7 +-
> drivers/regulator/spacemit-p1.c | 4 +-
> drivers/remoteproc/imx_rproc.c | 9 +-
> drivers/remoteproc/qcom_q6v5_wcss.c | 8 +-
> drivers/rtc/rtc-amlogic-a4.c | 4 -
> drivers/rtc/rtc-gamecube.c | 4 +
> drivers/rtc/rtc-max31335.c | 6 +-
> drivers/s390/crypto/ap_bus.c | 8 +-
> drivers/scsi/imm.c | 1 +
> drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
> drivers/scsi/qla2xxx/qla_os.c | 20 +-
> drivers/scsi/qla2xxx/qla_target.c | 5 +-
> drivers/scsi/qla2xxx/qla_target.h | 1 +
> drivers/scsi/sim710.c | 2 +
> drivers/scsi/smartpqi/smartpqi_init.c | 19 ++
> drivers/scsi/stex.c | 1 +
> drivers/soc/qcom/qcom_gsbi.c | 8 -
> drivers/soc/qcom/smem.c | 3 +-
> drivers/soc/renesas/r9a08g045-sysc.c | 69 ++++
> drivers/soc/renesas/r9a09g047-sys.c | 79 +++++
> drivers/soc/renesas/r9a09g056-sys.c | 69 ++++
> drivers/soc/renesas/r9a09g057-sys.c | 101 ++++++
> drivers/soc/renesas/rz-sysc.c | 2 +
> drivers/soc/renesas/rz-sysc.h | 4 +
> drivers/soc/samsung/exynos-pmu.c | 7 +-
> drivers/soc/tegra/fuse/speedo-tegra210.c | 58 +++-
> drivers/spi/spi-airoha-snfi.c | 25 +-
> drivers/spi/spi-ch341.c | 2 +-
> drivers/spi/spi-sg2044-nor.c | 4 +-
> drivers/spi/spi-tegra210-quad.c | 22 +-
> drivers/staging/fbtft/fbtft-core.c | 4 +-
> drivers/staging/most/Kconfig | 2 -
> drivers/staging/most/Makefile | 1 -
> drivers/staging/most/i2c/Kconfig | 13 -
> drivers/staging/most/i2c/Makefile | 4 -
> drivers/staging/most/i2c/i2c.c | 374 ---------------------
> drivers/target/target_core_configfs.c | 1 -
> drivers/target/target_core_stat.c | 24 +-
> drivers/tty/serial/imx.c | 14 +
> drivers/ufs/core/ufshcd-priv.h | 2 +
> drivers/ufs/core/ufshcd.c | 27 +-
> drivers/ufs/host/ufs-rockchip.c | 19 +-
> drivers/uio/uio_fsl_elbc_gpcm.c | 7 +
> drivers/usb/core/message.c | 2 +-
> drivers/usb/dwc2/platform.c | 17 +-
> drivers/usb/dwc3/host.c | 5 +-
> drivers/usb/gadget/legacy/raw_gadget.c | 3 +
> drivers/usb/gadget/udc/tegra-xudc.c | 6 -
> drivers/usb/misc/chaoskey.c | 16 +-
> drivers/usb/phy/phy.c | 4 +
> drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 2 +
> drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +-
> drivers/vdpa/pds/vdpa_dev.c | 2 +-
> drivers/vfio/pci/vfio_pci_core.c | 68 ++--
> drivers/vfio/pci/vfio_pci_intrs.c | 52 +--
> drivers/vfio/pci/vfio_pci_priv.h | 4 +
> drivers/vhost/net.c | 12 +-
> drivers/vhost/vhost.c | 4 +-
> drivers/video/backlight/led_bl.c | 13 +
> drivers/video/fbdev/ssd1307fb.c | 4 +-
> drivers/virtio/virtio.c | 12 +-
> drivers/virtio/virtio_debug.c | 10 +-
> drivers/virtio/virtio_pci_modern_dev.c | 6 +-
> drivers/virtio/virtio_ring.c | 7 +-
> drivers/virtio/virtio_vdpa.c | 2 +-
> drivers/watchdog/starfive-wdt.c | 4 +-
> drivers/watchdog/wdat_wdt.c | 64 ++--
> fs/9p/v9fs.c | 4 +-
> fs/9p/vfs_file.c | 11 +-
> fs/9p/vfs_inode.c | 3 +-
> fs/9p/vfs_inode_dotl.c | 2 +-
> fs/btrfs/block-group.c | 6 +-
> fs/btrfs/ctree.c | 2 +-
> fs/btrfs/delayed-ref.c | 43 ++-
> fs/btrfs/scrub.c | 2 +-
> fs/btrfs/space-info.c | 22 +-
> fs/btrfs/space-info.h | 6 +-
> fs/erofs/super.c | 38 ++-
> fs/exfat/balloc.c | 2 +-
> fs/exfat/namei.c | 20 +-
> fs/ext4/mballoc.c | 49 ++-
> fs/ext4/move_extent.c | 2 +-
> fs/f2fs/f2fs.h | 2 +
> fs/f2fs/gc.c | 132 +++++---
> fs/f2fs/recovery.c | 2 +-
> fs/f2fs/segment.c | 38 ++-
> fs/f2fs/segment.h | 8 +-
> fs/f2fs/super.c | 14 +
> fs/f2fs/sysfs.c | 7 +
> fs/fuse/control.c | 19 +-
> fs/gfs2/glock.c | 5 +-
> fs/gfs2/inode.c | 15 +
> fs/gfs2/inode.h | 1 +
> fs/gfs2/ops_fstype.c | 2 +-
> fs/hfs/catalog.c | 2 +-
> fs/inode.c | 58 ++--
> fs/iomap/direct-io.c | 23 +-
> fs/kernfs/dir.c | 5 +-
> fs/nfs/client.c | 21 +-
> fs/nfs/dir.c | 27 +-
> fs/nfs/internal.h | 3 +-
> fs/nfs/localio.c | 4 +-
> fs/nfs/namespace.c | 11 +-
> fs/nfs/nfs4client.c | 18 +-
> fs/nfs/nfs4proc.c | 27 +-
> fs/nfs/pnfs.c | 1 +
> fs/nfs/super.c | 33 +-
> fs/nfsd/blocklayout.c | 4 +-
> fs/nls/nls_base.c | 27 +-
> fs/ntfs3/frecord.c | 8 +-
> fs/ntfs3/fsntfs.c | 9 +-
> fs/ntfs3/inode.c | 7 +-
> fs/ocfs2/alloc.c | 1 -
> fs/ocfs2/inode.c | 10 +-
> fs/ocfs2/move_extents.c | 8 +-
> fs/pidfs.c | 2 +
> fs/smb/client/cifssmb.c | 2 +-
> fs/smb/client/smb2pdu.c | 2 +-
> fs/smb/client/smbdirect.c | 28 +-
> fs/smb/common/smbdirect/smbdirect_socket.h | 51 +++
> fs/smb/server/transport_rdma.c | 40 ++-
> fs/tracefs/event_inode.c | 3 +-
> include/asm-generic/mshyperv.h | 17 +-
> include/asm-generic/rqspinlock.h | 60 ++--
> include/linux/blk_types.h | 5 +-
> include/linux/cleanup.h | 15 +-
> include/linux/coresight.h | 35 +-
> include/linux/cper.h | 12 +-
> include/linux/f2fs_fs.h | 5 +-
> include/linux/filter.h | 12 +-
> include/linux/firmware/qcom/qcom_tzmem.h | 15 +-
> include/linux/ieee80211.h | 4 +-
> include/linux/if_hsr.h | 9 +
> include/linux/irq-entry-common.h | 2 +-
> include/linux/irqchip.h | 8 +-
> include/linux/netdevice.h | 1 +
> include/linux/nfs_fs_sb.h | 5 +
> include/linux/ns_common.h | 11 +
> include/linux/of_fdt.h | 9 +
> include/linux/phy.h | 3 +
> include/linux/platform_data/lp855x.h | 4 +-
> include/linux/ras.h | 16 +-
> include/linux/soc/mediatek/mtk_wed.h | 1 +
> include/linux/vfio_pci_core.h | 10 +-
> include/linux/virtio.h | 2 +-
> include/linux/virtio_config.h | 24 +-
> include/linux/virtio_features.h | 29 +-
> include/linux/virtio_pci_modern.h | 8 +-
> include/net/netfilter/nf_conntrack_count.h | 15 +-
> include/ras/ras_event.h | 49 ++-
> include/sound/tas2781.h | 2 +-
> include/target/target_core_base.h | 12 +-
> include/uapi/linux/pidfd.h | 1 +
> include/uapi/sound/asound.h | 2 +-
> include/ufs/ufshcd.h | 1 -
> io_uring/io_uring.c | 10 +-
> io_uring/kbuf.c | 10 +-
> io_uring/zcrx.c | 16 +-
> kernel/bpf/hashtab.c | 10 +-
> kernel/bpf/helpers.c | 3 +
> kernel/bpf/rqspinlock.c | 36 +-
> kernel/bpf/stackmap.c | 62 ++--
> kernel/bpf/syscall.c | 6 +-
> kernel/bpf/trampoline.c | 4 +-
> kernel/bpf/verifier.c | 89 +++--
> kernel/cgroup/cpuset.c | 35 +-
> kernel/cgroup/namespace.c | 2 +-
> kernel/cpu.c | 25 +-
> kernel/dma/pool.c | 2 +-
> kernel/events/core.c | 22 +-
> kernel/locking/locktorture.c | 8 +-
> kernel/resource.c | 10 +-
> kernel/sched/fair.c | 17 +-
> kernel/sched/stats.h | 7 +-
> kernel/task_work.c | 8 +-
> kernel/time/timer_migration.c | 264 ++++++++-------
> lib/vsprintf.c | 6 +-
> net/bpf/test_run.c | 5 +
> net/core/dev.h | 1 -
> net/core/filter.c | 16 +-
> net/core/netpoll.c | 2 +-
> net/hsr/hsr_device.c | 20 ++
> net/hsr/hsr_slave.c | 7 +-
> net/ipv6/ip6_fib.c | 4 +
> net/mac80211/aes_cmac.c | 63 +++-
> net/mac80211/aes_cmac.h | 8 +-
> net/mac80211/wpa.c | 20 +-
> net/netfilter/nf_conncount.c | 195 +++++++----
> net/netfilter/nft_connlimit.c | 34 +-
> net/netfilter/nft_flow_offload.c | 9 +-
> net/netfilter/xt_connlimit.c | 14 +-
> net/openvswitch/conntrack.c | 16 +-
> net/sched/sch_cake.c | 60 ++--
> net/sctp/socket.c | 5 +-
> scripts/cc-can-link.sh | 2 +-
> scripts/lib/kdoc/kdoc_parser.py | 16 +-
> scripts/package/install-extmod-build | 2 +-
> security/integrity/ima/ima_main.c | 40 ++-
> security/integrity/ima/ima_policy.c | 2 +-
> security/landlock/errata/abi-1.h | 16 +
> security/landlock/fs.c | 40 ++-
> security/smack/smack.h | 3 +
> security/smack/smack_access.c | 93 +++--
> security/smack/smack_lsm.c | 277 ++++++++++-----
> sound/firewire/dice/dice-extension.c | 4 +-
> sound/firewire/motu/motu-hwdep.c | 7 +-
> sound/hda/codecs/realtek/alc269.c | 2 +
> sound/hda/codecs/side-codecs/cs35l41_hda.c | 2 +
> sound/hda/codecs/side-codecs/tas2781_hda_i2c.c | 44 +--
> sound/isa/wavefront/wavefront_midi.c | 2 +
> sound/isa/wavefront/wavefront_synth.c | 4 +-
> sound/soc/amd/acp/acp-i2s.c | 2 +
> sound/soc/amd/acp/acp-legacy-common.c | 30 +-
> sound/soc/bcm/bcm63xx-pcm-whistler.c | 4 +-
> sound/soc/codecs/Kconfig | 5 +
> sound/soc/codecs/Makefile | 2 +
> sound/soc/codecs/ak4458.c | 10 +-
> sound/soc/codecs/ak5558.c | 10 +-
> sound/soc/codecs/nau8325.c | 3 +-
> sound/soc/codecs/tas2781-comlib-i2c.c | 2 +-
> sound/soc/codecs/tas2781-i2c.c | 2 +-
> sound/soc/fsl/fsl_xcvr.c | 2 +-
> sound/soc/intel/catpt/pcm.c | 4 +-
> sound/soc/sdca/sdca_functions.c | 2 +-
> tools/bpf/bpftool/sign.c | 6 +
> tools/include/nolibc/arch-x86.h | 6 +-
> tools/include/nolibc/dirent.h | 6 +-
> tools/include/nolibc/stdio.h | 4 +
> tools/include/nolibc/sys/wait.h | 18 +-
> tools/lib/bpf/btf.c | 4 +-
> tools/objtool/check.c | 3 +-
> tools/objtool/elf.c | 8 +-
> tools/perf/builtin-kvm.c | 2 +-
> tools/perf/builtin-record.c | 2 +-
> tools/perf/builtin-stat.c | 15 +-
> .../pmu-events/arch/s390/cf_z16/transaction.json | 8 +-
> .../pmu-events/arch/s390/cf_z17/transaction.json | 8 +-
> tools/perf/util/annotate.c | 2 +-
> .../util/arm-spe-decoder/arm-spe-pkt-decoder.c | 25 +-
> .../util/arm-spe-decoder/arm-spe-pkt-decoder.h | 15 +-
> tools/perf/util/bpf_counter.c | 7 +-
> tools/perf/util/bpf_lock_contention.c | 6 +-
> tools/perf/util/evsel.c | 2 +-
> tools/perf/util/genelf.c | 32 +-
> tools/perf/util/hist.c | 6 +-
> tools/perf/util/hist.h | 8 +-
> tools/perf/util/hwmon_pmu.c | 3 +-
> tools/perf/util/parse-events.c | 44 ++-
> tools/perf/util/parse-events.h | 3 +-
> tools/perf/util/parse-events.y | 2 +-
> tools/perf/util/symbol.c | 5 +-
> tools/power/x86/turbostat/turbostat.c | 12 +-
> tools/testing/selftests/bpf/.gitignore | 1 +
> tools/testing/selftests/bpf/Makefile | 6 +-
> .../selftests/bpf/prog_tests/kmem_cache_iter.c | 3 +-
> .../selftests/bpf/prog_tests/perf_branches.c | 22 +-
> .../testing/selftests/bpf/prog_tests/send_signal.c | 5 +
> .../selftests/bpf/progs/test_perf_branches.c | 3 +
> tools/testing/selftests/bpf/test_tag.c | 2 +-
> .../drivers/net/bonding/bond_macvlan_ipvlan.sh | 1 +
> tools/testing/selftests/landlock/Makefile | 2 +-
> .../tcp_syscall_bad_arg_sendmsg-empty-iov.pkt | 4 +
> .../net/packetdrill/tcp_zerocopy_basic.pkt | 2 +
> .../net/packetdrill/tcp_zerocopy_batch.pkt | 2 +
> .../net/packetdrill/tcp_zerocopy_client.pkt | 2 +
> .../net/packetdrill/tcp_zerocopy_closed.pkt | 2 +
> .../net/packetdrill/tcp_zerocopy_epoll_edge.pkt | 3 +
> .../packetdrill/tcp_zerocopy_epoll_exclusive.pkt | 3 +
> .../net/packetdrill/tcp_zerocopy_epoll_oneshot.pkt | 3 +
> .../packetdrill/tcp_zerocopy_fastopen-client.pkt | 2 +
> .../packetdrill/tcp_zerocopy_fastopen-server.pkt | 2 +
> .../net/packetdrill/tcp_zerocopy_maxfrags.pkt | 2 +
> .../net/packetdrill/tcp_zerocopy_small.pkt | 2 +
> tools/tracing/rtla/Makefile.rtla | 2 +-
> tools/tracing/rtla/src/common.c | 24 +-
> tools/tracing/rtla/src/osnoise_hist.c | 3 +-
> tools/tracing/rtla/src/osnoise_top.c | 3 +-
> tools/tracing/rtla/src/timerlat.c | 3 +-
> tools/tracing/rtla/src/timerlat_hist.c | 3 +-
> tools/tracing/rtla/src/timerlat_top.c | 3 +-
> tools/tracing/rtla/tests/osnoise.t | 6 +-
> tools/tracing/rtla/tests/timerlat.t | 4 +-
> 616 files changed, 6319 insertions(+), 3850 deletions(-)
>
>
>
--
software engineer
rajagiri school of engineering and technology
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 19:52 ` Naresh Kamboju
@ 2025-12-17 6:30 ` Greg KH
2025-12-17 8:06 ` Naresh Kamboju
0 siblings, 1 reply; 647+ messages in thread
From: Greg KH @ 2025-12-17 6:30 UTC (permalink / raw)
To: Naresh Kamboju
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
dan.carpenter, nathan, llvm, perex, lgirdwood,
Linux Kernel Functional Testing
On Wed, Dec 17, 2025 at 01:22:55AM +0530, Naresh Kamboju wrote:
> I'm seeing the following allmodconfig and allyesconfig build
> failures on arm, arm64, riscv and x86_64.
>
> ## Build error
> sound/soc/codecs/nau8325.c:430:13: error: variable 'n2_max' is uninitialized when used here [-Werror,-Wuninitialized]
> 430 | *n2_sel = n2_max;
> | ^~~~~~
> sound/soc/codecs/nau8325.c:389:52: note: initialize the variable 'n2_max' to silence this warning
> 389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
> | ^
> | = 0
> sound/soc/codecs/nau8325.c:431:11: error: variable 'ratio_sel' is uninitialized when used here [-Werror,-Wuninitialized]
> 431 | ratio = ratio_sel;
> | ^~~~~~~~~
> sound/soc/codecs/nau8325.c:389:44: note: initialize the variable 'ratio_sel' to silence this warning
> 389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
> | ^
> | = 0
> 2 errors generated.
> make[6]: *** [scripts/Makefile.build:287: sound/soc/codecs/nau8325.o] Error 1
>
> First seen on 6.18.2-rc1
> Good: 6.18.1-rc1
> Bad: 6.18.2-rc1
>
> And these build regressions also seen on 6.17.13-rc2.
Thanks, I'll go queue up the fix for this.
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 6:30 ` Greg KH
@ 2025-12-17 8:06 ` Naresh Kamboju
2025-12-17 9:25 ` Greg KH
0 siblings, 1 reply; 647+ messages in thread
From: Naresh Kamboju @ 2025-12-17 8:06 UTC (permalink / raw)
To: Greg KH
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
dan.carpenter, nathan, llvm, perex, lgirdwood,
Linux Kernel Functional Testing
On Wed, 17 Dec 2025 at 12:00, Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Dec 17, 2025 at 01:22:55AM +0530, Naresh Kamboju wrote:
> > I'm seeing the following allmodconfig and allyesconfig build
> > failures on arm, arm64, riscv and x86_64.
> >
> > ## Build error
> > sound/soc/codecs/nau8325.c:430:13: error: variable 'n2_max' is uninitialized when used here [-Werror,-Wuninitialized]
> > 430 | *n2_sel = n2_max;
> > | ^~~~~~
> > sound/soc/codecs/nau8325.c:389:52: note: initialize the variable 'n2_max' to silence this warning
> > 389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
> > | ^
> > | = 0
> > sound/soc/codecs/nau8325.c:431:11: error: variable 'ratio_sel' is uninitialized when used here [-Werror,-Wuninitialized]
> > 431 | ratio = ratio_sel;
> > | ^~~~~~~~~
> > sound/soc/codecs/nau8325.c:389:44: note: initialize the variable 'ratio_sel' to silence this warning
> > 389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
> > | ^
> > | = 0
> > 2 errors generated.
> > make[6]: *** [scripts/Makefile.build:287: sound/soc/codecs/nau8325.o] Error 1
> >
> > First seen on 6.18.2-rc1
> > Good: 6.18.1-rc1
> > Bad: 6.18.2-rc1
> >
> > And these build regressions also seen on 6.17.13-rc2.
>
> Thanks, I'll go queue up the fix for this.
This build regression is across the 6.18.2-rc1, 6.17.13-rc2 and 6.12.63-rc1.
>
> greg k-h
- Naresh
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 5:47 ` Greg Kroah-Hartman
@ 2025-12-17 8:27 ` Ronald Warsow
2025-12-17 9:36 ` Greg Kroah-Hartman
0 siblings, 1 reply; 647+ messages in thread
From: Ronald Warsow @ 2025-12-17 8:27 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr
On 17.12.25 06:47, Greg Kroah-Hartman wrote:
> On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
>> Hi
>>
>> no regressions here on x86_64 (RKL, Intel 11th Gen. CPU), but *only* when
>> running GPU driver i915.
>>
>> with GPU driver xe I get here:
>>
>> [ 14.391631] rfkill: input handler disabled
>> [ 14.787149] ------------[ cut here ]------------
>> [ 14.787153] refcount_t: underflow; use-after-free.
>> [ 14.787167] WARNING: CPU: 10 PID: 2463 at lib/refcount.c:28
....
>> ====
>>
>> If I did the bisect correct, bisect-log:
>>
>> # status: waiting for both good and bad commits
>> # good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
>> git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
>> # status: waiting for bad commit, 1 good commit known
>> # bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
>> git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
>> # bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL pointer
>> dereference in crashstate_get_vm_logs()
>> git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd
>
> Is this also an issue with 6.19-rc1? Are we missing something here?
>
6.19-rc1 is okay here
> thanks,
>
> greg k-h
>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 8:06 ` Naresh Kamboju
@ 2025-12-17 9:25 ` Greg KH
0 siblings, 0 replies; 647+ messages in thread
From: Greg KH @ 2025-12-17 9:25 UTC (permalink / raw)
To: Naresh Kamboju
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
dan.carpenter, nathan, llvm, perex, lgirdwood,
Linux Kernel Functional Testing
On Wed, Dec 17, 2025 at 01:36:31PM +0530, Naresh Kamboju wrote:
> On Wed, 17 Dec 2025 at 12:00, Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Dec 17, 2025 at 01:22:55AM +0530, Naresh Kamboju wrote:
> > > I'm seeing the following allmodconfig and allyesconfig build
> > > failures on arm, arm64, riscv and x86_64.
> > >
> > > ## Build error
> > > sound/soc/codecs/nau8325.c:430:13: error: variable 'n2_max' is uninitialized when used here [-Werror,-Wuninitialized]
> > > 430 | *n2_sel = n2_max;
> > > | ^~~~~~
> > > sound/soc/codecs/nau8325.c:389:52: note: initialize the variable 'n2_max' to silence this warning
> > > 389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
> > > | ^
> > > | = 0
> > > sound/soc/codecs/nau8325.c:431:11: error: variable 'ratio_sel' is uninitialized when used here [-Werror,-Wuninitialized]
> > > 431 | ratio = ratio_sel;
> > > | ^~~~~~~~~
> > > sound/soc/codecs/nau8325.c:389:44: note: initialize the variable 'ratio_sel' to silence this warning
> > > 389 | int i, j, mclk, mclk_max, ratio, ratio_sel, n2_max;
> > > | ^
> > > | = 0
> > > 2 errors generated.
> > > make[6]: *** [scripts/Makefile.build:287: sound/soc/codecs/nau8325.o] Error 1
> > >
> > > First seen on 6.18.2-rc1
> > > Good: 6.18.1-rc1
> > > Bad: 6.18.2-rc1
> > >
> > > And these build regressions also seen on 6.17.13-rc2.
> >
> > Thanks, I'll go queue up the fix for this.
>
> This build regression is across the 6.18.2-rc1, 6.17.13-rc2 and 6.12.63-rc1.
The fix was applied to all of these now, thanks.
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 8:27 ` Ronald Warsow
@ 2025-12-17 9:36 ` Greg Kroah-Hartman
2025-12-17 9:51 ` Ronald Warsow
2025-12-17 12:45 ` Ronald Warsow
0 siblings, 2 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-17 9:36 UTC (permalink / raw)
To: Ronald Warsow
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr
On Wed, Dec 17, 2025 at 09:27:49AM +0100, Ronald Warsow wrote:
> On 17.12.25 06:47, Greg Kroah-Hartman wrote:
> > On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
> > > Hi
> > >
> > > no regressions here on x86_64 (RKL, Intel 11th Gen. CPU), but *only* when
> > > running GPU driver i915.
> > >
> > > with GPU driver xe I get here:
> > >
> > > [ 14.391631] rfkill: input handler disabled
> > > [ 14.787149] ------------[ cut here ]------------
> > > [ 14.787153] refcount_t: underflow; use-after-free.
> > > [ 14.787167] WARNING: CPU: 10 PID: 2463 at lib/refcount.c:28
>
> ....
>
> > > ====
> > >
> > > If I did the bisect correct, bisect-log:
> > >
> > > # status: waiting for both good and bad commits
> > > # good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
> > > git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
> > > # status: waiting for bad commit, 1 good commit known
> > > # bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
> > > git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
> > > # bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL pointer
> > > dereference in crashstate_get_vm_logs()
> > > git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd
> >
> > Is this also an issue with 6.19-rc1? Are we missing something here?
> >
> 6.19-rc1 is okay here
Odd, as you aren't even running the driver that this commit points to,
right? You shouldn't be building it, so why does this show up as the
"bad" commit id?
totally confused,
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1
2025-12-16 11:09 ` [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1 Greg Kroah-Hartman
@ 2025-12-17 9:42 ` Jiri Slaby
2025-12-17 10:31 ` Greg Kroah-Hartman
0 siblings, 1 reply; 647+ messages in thread
From: Jiri Slaby @ 2025-12-17 9:42 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, Tianyou Li, Namhyung Kim, Sasha Levin
On 16. 12. 25, 12:09, Greg Kroah-Hartman wrote:
> 6.18-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Namhyung Kim <namhyung@kernel.org>
>
> [ Upstream commit 0e6c07a3c30cdc4509fc5e7dc490d4cc6e5c241a ]
>
> The recent change for perf c2c annotate broke build without slang
> support like below.
>
> builtin-annotate.c: In function 'hists__find_annotations':
> builtin-annotate.c:522:73: error: 'NO_ADDR' undeclared (first use in this function); did you mean 'NR_ADDR'?
> 522 | key = hist_entry__tui_annotate(he, evsel, NULL, NO_ADDR);
> | ^~~~~~~
> | NR_ADDR
> builtin-annotate.c:522:73: note: each undeclared identifier is reported only once for each function it appears in
>
> builtin-annotate.c:522:31: error: too many arguments to function 'hist_entry__tui_annotate'
> 522 | key = hist_entry__tui_annotate(he, evsel, NULL, NO_ADDR);
> | ^~~~~~~~~~~~~~~~~~~~~~~~
> In file included from util/sort.h:6,
> from builtin-annotate.c:28:
> util/hist.h:756:19: note: declared here
> 756 | static inline int hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
> | ^~~~~~~~~~~~~~~~~~~~~~~~
>
> And I noticed that it missed to update the other side of #ifdef
> HAVE_SLANG_SUPPORT. Let's fix it.
>
> Cc: Tianyou Li <tianyou.li@intel.com>
> Fixes: cd3466cd2639783d ("perf c2c: Add annotation support to perf c2c report")
That fixes line ^^^ appears to be wrong, as now I see:
builtin-annotate.c: In function ‘hists__find_annotations’:
builtin-annotate.c:522:10: error: too few arguments to function
‘hist_entry__tui_annotate’
key = hist_entry__tui_annotate(he, evsel, NULL);
^~~~~~~~~~~~~~~~~~~~~~~~
In file included from util/sort.h:6:0,
from builtin-annotate.c:28:
util/hist.h:757:19: note: declared here
static inline int hist_entry__tui_annotate(struct hist_entry *he
__maybe_unused,
^~~~~~~~~~~~~~~~~~~~~~~~
Because in util/hist.h, we now have:
int hist_entry__tui_annotate(struct hist_entry *he, struct evsel *evsel,
struct hist_browser_timer *hbt);
...
static inline int hist_entry__tui_annotate(struct hist_entry *he
__maybe_unused,
struct evsel *evsel
__maybe_unused,
struct hist_browser_timer
*hbt __maybe_unused,
u64 al_addr __maybe_unused)
{
return 0;
}
Was it meant to be
Fixes: ad83f3b7155d perf c2c annotate: Start from the contention line
?
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> tools/perf/util/hist.h | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
> index c64005278687c..a4f244a046866 100644
> --- a/tools/perf/util/hist.h
> +++ b/tools/perf/util/hist.h
> @@ -709,6 +709,8 @@ struct block_hist {
> struct hist_entry he;
> };
>
> +#define NO_ADDR 0
> +
> #ifdef HAVE_SLANG_SUPPORT
> #include "../ui/keysyms.h"
> void attr_to_script(char *buf, struct perf_event_attr *attr);
> @@ -746,14 +748,16 @@ int evlist__tui_browse_hists(struct evlist *evlist __maybe_unused,
> static inline int __hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
> struct map_symbol *ms __maybe_unused,
> struct evsel *evsel __maybe_unused,
> - struct hist_browser_timer *hbt __maybe_unused)
> + struct hist_browser_timer *hbt __maybe_unused,
> + u64 al_addr __maybe_unused)
> {
> return 0;
> }
>
> static inline int hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
> struct evsel *evsel __maybe_unused,
> - struct hist_browser_timer *hbt __maybe_unused)
> + struct hist_browser_timer *hbt __maybe_unused,
> + u64 al_addr __maybe_unused)
> {
> return 0;
> }
--
js
suse labs
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 9:36 ` Greg Kroah-Hartman
@ 2025-12-17 9:51 ` Ronald Warsow
2025-12-17 12:45 ` Ronald Warsow
1 sibling, 0 replies; 647+ messages in thread
From: Ronald Warsow @ 2025-12-17 9:51 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr
On 17.12.25 10:36, Greg Kroah-Hartman wrote:
> On Wed, Dec 17, 2025 at 09:27:49AM +0100, Ronald Warsow wrote:
>> On 17.12.25 06:47, Greg Kroah-Hartman wrote:
>>> On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
>>>> Hi
...
>>>> If I did the bisect correct, bisect-log:
>>>>
>>>> # status: waiting for both good and bad commits
>>>> # good: [25442251cbda7590d87d8203a8dc1ddf2c93de61] Linux 6.18.1
>>>> git bisect good 25442251cbda7590d87d8203a8dc1ddf2c93de61
>>>> # status: waiting for bad commit, 1 good commit known
>>>> # bad: [103c79e44ce7c81882928abab98b96517a8bce88] Linux 6.18.2-rc1
>>>> git bisect bad 103c79e44ce7c81882928abab98b96517a8bce88
>>>> # bad: [d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd] drm/msm: Fix NULL pointer
>>>> dereference in crashstate_get_vm_logs()
>>>> git bisect bad d32e7ccac8c6afc6a3a46fa4e7cdf0568ee919bd
>>>
>>> Is this also an issue with 6.19-rc1? Are we missing something here?
>>>
>> 6.19-rc1 is okay here
>
> Odd, as you aren't even running the driver that this commit points to,
> right? You shouldn't be building it, so why does this show up as the
> "bad" commit id?
>
maybe I did something wrong with bisect ?
- I'm no developer and not very experienced with it -
side note: tomorrow I'm in vacation
> totally confused,
>
> greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1
2025-12-17 9:42 ` Jiri Slaby
@ 2025-12-17 10:31 ` Greg Kroah-Hartman
0 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-17 10:31 UTC (permalink / raw)
To: Jiri Slaby; +Cc: stable, patches, Tianyou Li, Namhyung Kim, Sasha Levin
On Wed, Dec 17, 2025 at 10:42:54AM +0100, Jiri Slaby wrote:
> On 16. 12. 25, 12:09, Greg Kroah-Hartman wrote:
> > 6.18-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Namhyung Kim <namhyung@kernel.org>
> >
> > [ Upstream commit 0e6c07a3c30cdc4509fc5e7dc490d4cc6e5c241a ]
> >
> > The recent change for perf c2c annotate broke build without slang
> > support like below.
> >
> > builtin-annotate.c: In function 'hists__find_annotations':
> > builtin-annotate.c:522:73: error: 'NO_ADDR' undeclared (first use in this function); did you mean 'NR_ADDR'?
> > 522 | key = hist_entry__tui_annotate(he, evsel, NULL, NO_ADDR);
> > | ^~~~~~~
> > | NR_ADDR
> > builtin-annotate.c:522:73: note: each undeclared identifier is reported only once for each function it appears in
> >
> > builtin-annotate.c:522:31: error: too many arguments to function 'hist_entry__tui_annotate'
> > 522 | key = hist_entry__tui_annotate(he, evsel, NULL, NO_ADDR);
> > | ^~~~~~~~~~~~~~~~~~~~~~~~
> > In file included from util/sort.h:6,
> > from builtin-annotate.c:28:
> > util/hist.h:756:19: note: declared here
> > 756 | static inline int hist_entry__tui_annotate(struct hist_entry *he __maybe_unused,
> > | ^~~~~~~~~~~~~~~~~~~~~~~~
> >
> > And I noticed that it missed to update the other side of #ifdef
> > HAVE_SLANG_SUPPORT. Let's fix it.
> >
> > Cc: Tianyou Li <tianyou.li@intel.com>
> > Fixes: cd3466cd2639783d ("perf c2c: Add annotation support to perf c2c report")
>
> That fixes line ^^^ appears to be wrong, as now I see:
> builtin-annotate.c: In function ‘hists__find_annotations’:
> builtin-annotate.c:522:10: error: too few arguments to function
> ‘hist_entry__tui_annotate’
> key = hist_entry__tui_annotate(he, evsel, NULL);
> ^~~~~~~~~~~~~~~~~~~~~~~~
> In file included from util/sort.h:6:0,
> from builtin-annotate.c:28:
> util/hist.h:757:19: note: declared here
> static inline int hist_entry__tui_annotate(struct hist_entry *he
> __maybe_unused,
> ^~~~~~~~~~~~~~~~~~~~~~~~
>
>
>
>
> Because in util/hist.h, we now have:
> int hist_entry__tui_annotate(struct hist_entry *he, struct evsel *evsel,
> struct hist_browser_timer *hbt);
> ...
> static inline int hist_entry__tui_annotate(struct hist_entry *he
> __maybe_unused,
> struct evsel *evsel
> __maybe_unused,
> struct hist_browser_timer *hbt
> __maybe_unused,
> u64 al_addr __maybe_unused)
> {
> return 0;
> }
>
>
>
> Was it meant to be
> Fixes: ad83f3b7155d perf c2c annotate: Start from the contention line
> ?
Odd. Either way it should not have been backported to 6.18.y as neither
of those are in that release (came out in 6.19-rc1.)
I'll go drop this commit from the queues, thanks!
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message
2025-12-16 11:08 ` [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message Greg Kroah-Hartman
@ 2025-12-17 11:22 ` Barry K. Nathan
2025-12-17 15:24 ` Greg Kroah-Hartman
0 siblings, 1 reply; 647+ messages in thread
From: Barry K. Nathan @ 2025-12-17 11:22 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Jacob Keller, Jonathan Corbet, Sasha Levin
On 12/16/25 03:08, Greg Kroah-Hartman wrote:
> 6.18-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Jacob Keller <jacob.e.keller@intel.com>
>
> [ Upstream commit e5e7ca66a7fc6b8073c30a048e1157b88d427980 ]
>
> The python version of the kernel-doc parser emits some strange warnings
> with just a line number in certain cases:
>
> $ ./scripts/kernel-doc -Wall -none 'include/linux/virtio_config.h'
> Warning: 174
> Warning: 184
> Warning: 190
> Warning: include/linux/virtio_config.h:226 No description found for return value of '__virtio_test_bit'
> Warning: include/linux/virtio_config.h:259 No description found for return value of 'virtio_has_feature'
> Warning: include/linux/virtio_config.h:283 No description found for return value of 'virtio_has_dma_quirk'
> Warning: include/linux/virtio_config.h:392 No description found for return value of 'virtqueue_set_affinity'
>
> I eventually tracked this down to the lone call of emit_msg() in the
> KernelEntry class, which looks like:
>
> self.emit_msg(self.new_start_line, f"duplicate section name '{name}'\n")
>
> This looks like all the other emit_msg calls. Unfortunately, the definition
> within the KernelEntry class takes only a message parameter and not a line
> number. The intended message is passed as the warning!
>
> Pass the filename to the KernelEntry class, and use this to build the log
> message in the same way as the KernelDoc class does.
>
> To avoid future errors, mark the warning parameter for both emit_msg
> definitions as a keyword-only argument. This will prevent accidentally
> passing a string as the warning parameter in the future.
>
> Also fix the call in dump_section to avoid an unnecessary additional
> newline.
>
> Fixes: e3b42e94cf10 ("scripts/lib/kdoc/kdoc_parser.py: move kernel entry to a class")
> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
> Message-ID: <20251030-jk-fix-kernel-doc-duplicate-return-warning-v2-1-ec4b5c662881@intel.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> scripts/lib/kdoc/kdoc_parser.py | 16 ++++++++++------
> 1 file changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/scripts/lib/kdoc/kdoc_parser.py b/scripts/lib/kdoc/kdoc_parser.py
> index 2376f180b1fa9..ccbc1fe4b7ccd 100644
> --- a/scripts/lib/kdoc/kdoc_parser.py
> +++ b/scripts/lib/kdoc/kdoc_parser.py
> @@ -274,6 +274,8 @@ class KernelEntry:
>
> self.leading_space = None
>
> + self.fname = fname
> +
> # State flags
> self.brcount = 0
> self.declaration_start_line = ln + 1
> @@ -288,9 +290,11 @@ class KernelEntry:
> return '\n'.join(self._contents) + '\n'
>
> # TODO: rename to emit_message after removal of kernel-doc.pl
> - def emit_msg(self, log_msg, warning=True):
> + def emit_msg(self, ln, msg, *, warning=True):
> """Emit a message"""
>
> + log_msg = f"{self.fname}:{ln} {msg}"
> +
> if not warning:
> self.config.log.info(log_msg)
> return
> @@ -336,7 +340,7 @@ class KernelEntry:
> # Only warn on user-specified duplicate section names
> if name != SECTION_DEFAULT:
> self.emit_msg(self.new_start_line,
> - f"duplicate section name '{name}'\n")
> + f"duplicate section name '{name}'")
> # Treat as a new paragraph - add a blank line
> self.sections[name] += '\n' + contents
> else:
> @@ -387,15 +391,15 @@ class KernelDoc:
> self.emit_msg(0,
> 'Python 3.7 or later is required for correct results')
>
> - def emit_msg(self, ln, msg, warning=True):
> + def emit_msg(self, ln, msg, *, warning=True):
> """Emit a message"""
>
> - log_msg = f"{self.fname}:{ln} {msg}"
> -
> if self.entry:
> - self.entry.emit_msg(log_msg, warning)
> + self.entry.emit_msg(ln, msg, warning=warning)
> return
>
> + log_msg = f"{self.fname}:{ln} {msg}"
> +
> if warning:
> self.config.log.warning(log_msg)
> else:
On 6.18.2-rc1 and 6.17.13-rc2, this patch causes amd64 kernel builds
with my usual configs to fail with the following error:
CC drivers/gpu/drm/i915/i915_driver.o
Traceback (most recent call last):
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/./scripts/kernel-doc.py",
line 339, in <module>
main()
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/./scripts/kernel-doc.py",
line 310, in main
kfiles.parse(args.files, export_file=args.export_file)
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_files.py",
line 222, in parse
self.parse_file(fname)
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_files.py",
line 120, in parse_file
export_table, entries = doc.parse_kdoc()
^^^^^^^^^^^^^^^^
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
line 1648, in parse_kdoc
self.state_actions[self.state](self, ln, line)
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
line 1123, in process_normal
self.reset_state(ln)
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
line 447, in reset_state
self.entry = KernelEntry(self.config, ln)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File
"/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
line 277, in __init__
self.fname = fname
^^^^^
NameError: name 'fname' is not defined
make[6]: *** [scripts/Makefile.build:287:
drivers/gpu/drm/i915/i915_driver.o] Error 1
make[6]: *** Deleting file 'drivers/gpu/drm/i915/i915_driver.o'
make[5]: *** [scripts/Makefile.build:556: drivers/gpu/drm/i915] Error 2
make[4]: *** [scripts/Makefile.build:556: drivers/gpu/drm] Error 2
make[3]: *** [scripts/Makefile.build:556: drivers/gpu] Error 2
make[2]: *** [scripts/Makefile.build:556: drivers] Error 2
make[1]: ***
[/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/Makefile:2010: .]
Error 2
make: *** [Makefile:248: __sub-make] Error 2
Here is a minimal config to reproduce (make a .config with just these 6
lines, then run `make olddefconfig`):
CONFIG_64BIT=y
CONFIG_EXPERT=y
CONFIG_PCI=y
CONFIG_DRM=y
CONFIG_DRM_I915=y
CONFIG_DRM_I915_WERROR=y
This bug happens if and only if CONFIG_DRM_I915_WERROR=y. (By the way,
allyesconfig and allmodconfig set CONFIG_COMPILE_TEST=y, which disables
CONFIG_DRM_I915_DEBUG and CONFIG_DRM_I915_WERROR. So neither
allyesconfig nor allmodconfig reproduce this.)
It happens whether building for amd64 or i386 (so CONFIG_64BIT=y is not
strictly necessary). It happens on both fully updated Debian 12 Bookworm
and fully updated Debian 13 Trixie. It happens both when compiling
natively on amd64 and when cross-compiling from an arm64 system.
It happens on 6.18.2-rc1 and 6.17.13-rc2, but not on 6.19-rc1. Also, if
I revert this patch on 6.18.2-rc1 or 6.17.13-rc2, the bug no longer
reproduces.
--
-Barry K. Nathan <barryn@pobox.com>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2025-12-17 6:17 ` Jeffrin Thalakkottoor
@ 2025-12-17 11:29 ` Takeshi Ogasawara
2025-12-17 12:51 ` Justin Forbes
` (4 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Takeshi Ogasawara @ 2025-12-17 11:29 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Hi Greg
On Tue, Dec 16, 2025 at 9:53 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.18.2-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.18.2-rc1rv-g103c79e44ce7
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20251112, GNU ld (GNU
Binutils) 2.45.1) #1 SMP PREEMPT_DYNAMIC Wed Dec 17 19:51:45 JST 2025
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 9:36 ` Greg Kroah-Hartman
2025-12-17 9:51 ` Ronald Warsow
@ 2025-12-17 12:45 ` Ronald Warsow
2025-12-17 15:25 ` Greg Kroah-Hartman
1 sibling, 1 reply; 647+ messages in thread
From: Ronald Warsow @ 2025-12-17 12:45 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr
On 17.12.25 10:36, Greg Kroah-Hartman wrote:
> On Wed, Dec 17, 2025 at 09:27:49AM +0100, Ronald Warsow wrote:
>> On 17.12.25 06:47, Greg Kroah-Hartman wrote:
>>> On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
>>>> Hi
...
>
> Odd, as you aren't even running the driver that this commit points to,
> right? You shouldn't be building it, so why does this show up as the
> "bad" commit id?
>
> totally confused,
>
well I realized I left out several steps to do bisect correct.
I hope this time it's correct:
d84236562448e634208746f0e04f725a509d4648 is the first bad commit
commit d84236562448e634208746f0e04f725a509d4648
Author: Matthew Brost <matthew.brost@intel.com>
Date: Fri Oct 31 16:40:45 2025 -0700
drm/xe: Enforce correct user fence signaling order using
[ Upstream commit adda4e855ab6409a3edaa585293f1f2069ab7299 ]
Prevent application hangs caused by out-of-order fence signaling when
user fences are attached. Use drm_syncobj (via dma-fence-chain) to
guarantee that each user fence signals in order, regardless of the
signaling order of the attached fences. Ensure user fence writebacks to
user space occur in the correct sequence.
v7:
- Skip drm_syncbj create of error (CI)
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel
GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link:
https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/xe/xe_exec_queue.c | 3 +++
1 file changed, 3 insertions(+)
> greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2025-12-17 11:29 ` Takeshi Ogasawara
@ 2025-12-17 12:51 ` Justin Forbes
2025-12-17 13:41 ` Jon Hunter
` (3 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Justin Forbes @ 2025-12-17 12:51 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Tue, Dec 16, 2025 at 12:06:07PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.
Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2025-12-17 12:51 ` Justin Forbes
@ 2025-12-17 13:41 ` Jon Hunter
2025-12-18 4:27 ` Peter Schneider
` (2 subsequent siblings)
627 siblings, 0 replies; 647+ messages in thread
From: Jon Hunter @ 2025-12-17 13:41 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
linux-tegra, stable
On Tue, 16 Dec 2025 12:06:07 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.2-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v6.18:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 fail
Linux version: 6.18.2-rc1-g103c79e44ce7
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message
2025-12-17 11:22 ` Barry K. Nathan
@ 2025-12-17 15:24 ` Greg Kroah-Hartman
0 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-17 15:24 UTC (permalink / raw)
To: Barry K. Nathan
Cc: stable, patches, Jacob Keller, Jonathan Corbet, Sasha Levin
On Wed, Dec 17, 2025 at 03:22:50AM -0800, Barry K. Nathan wrote:
> On 12/16/25 03:08, Greg Kroah-Hartman wrote:
> > 6.18-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Jacob Keller <jacob.e.keller@intel.com>
> >
> > [ Upstream commit e5e7ca66a7fc6b8073c30a048e1157b88d427980 ]
> >
> > The python version of the kernel-doc parser emits some strange warnings
> > with just a line number in certain cases:
> >
> > $ ./scripts/kernel-doc -Wall -none 'include/linux/virtio_config.h'
> > Warning: 174
> > Warning: 184
> > Warning: 190
> > Warning: include/linux/virtio_config.h:226 No description found for return value of '__virtio_test_bit'
> > Warning: include/linux/virtio_config.h:259 No description found for return value of 'virtio_has_feature'
> > Warning: include/linux/virtio_config.h:283 No description found for return value of 'virtio_has_dma_quirk'
> > Warning: include/linux/virtio_config.h:392 No description found for return value of 'virtqueue_set_affinity'
> >
> > I eventually tracked this down to the lone call of emit_msg() in the
> > KernelEntry class, which looks like:
> >
> > self.emit_msg(self.new_start_line, f"duplicate section name '{name}'\n")
> >
> > This looks like all the other emit_msg calls. Unfortunately, the definition
> > within the KernelEntry class takes only a message parameter and not a line
> > number. The intended message is passed as the warning!
> >
> > Pass the filename to the KernelEntry class, and use this to build the log
> > message in the same way as the KernelDoc class does.
> >
> > To avoid future errors, mark the warning parameter for both emit_msg
> > definitions as a keyword-only argument. This will prevent accidentally
> > passing a string as the warning parameter in the future.
> >
> > Also fix the call in dump_section to avoid an unnecessary additional
> > newline.
> >
> > Fixes: e3b42e94cf10 ("scripts/lib/kdoc/kdoc_parser.py: move kernel entry to a class")
> > Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
> > Signed-off-by: Jonathan Corbet <corbet@lwn.net>
> > Message-ID: <20251030-jk-fix-kernel-doc-duplicate-return-warning-v2-1-ec4b5c662881@intel.com>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> > scripts/lib/kdoc/kdoc_parser.py | 16 ++++++++++------
> > 1 file changed, 10 insertions(+), 6 deletions(-)
> >
> > diff --git a/scripts/lib/kdoc/kdoc_parser.py b/scripts/lib/kdoc/kdoc_parser.py
> > index 2376f180b1fa9..ccbc1fe4b7ccd 100644
> > --- a/scripts/lib/kdoc/kdoc_parser.py
> > +++ b/scripts/lib/kdoc/kdoc_parser.py
> > @@ -274,6 +274,8 @@ class KernelEntry:
> > self.leading_space = None
> > + self.fname = fname
> > +
> > # State flags
> > self.brcount = 0
> > self.declaration_start_line = ln + 1
> > @@ -288,9 +290,11 @@ class KernelEntry:
> > return '\n'.join(self._contents) + '\n'
> > # TODO: rename to emit_message after removal of kernel-doc.pl
> > - def emit_msg(self, log_msg, warning=True):
> > + def emit_msg(self, ln, msg, *, warning=True):
> > """Emit a message"""
> > + log_msg = f"{self.fname}:{ln} {msg}"
> > +
> > if not warning:
> > self.config.log.info(log_msg)
> > return
> > @@ -336,7 +340,7 @@ class KernelEntry:
> > # Only warn on user-specified duplicate section names
> > if name != SECTION_DEFAULT:
> > self.emit_msg(self.new_start_line,
> > - f"duplicate section name '{name}'\n")
> > + f"duplicate section name '{name}'")
> > # Treat as a new paragraph - add a blank line
> > self.sections[name] += '\n' + contents
> > else:
> > @@ -387,15 +391,15 @@ class KernelDoc:
> > self.emit_msg(0,
> > 'Python 3.7 or later is required for correct results')
> > - def emit_msg(self, ln, msg, warning=True):
> > + def emit_msg(self, ln, msg, *, warning=True):
> > """Emit a message"""
> > - log_msg = f"{self.fname}:{ln} {msg}"
> > -
> > if self.entry:
> > - self.entry.emit_msg(log_msg, warning)
> > + self.entry.emit_msg(ln, msg, warning=warning)
> > return
> > + log_msg = f"{self.fname}:{ln} {msg}"
> > +
> > if warning:
> > self.config.log.warning(log_msg)
> > else:
>
> On 6.18.2-rc1 and 6.17.13-rc2, this patch causes amd64 kernel builds with my
> usual configs to fail with the following error:
>
> CC drivers/gpu/drm/i915/i915_driver.o
> Traceback (most recent call last):
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/./scripts/kernel-doc.py",
> line 339, in <module>
> main()
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/./scripts/kernel-doc.py",
> line 310, in main
> kfiles.parse(args.files, export_file=args.export_file)
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_files.py",
> line 222, in parse
> self.parse_file(fname)
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_files.py",
> line 120, in parse_file
> export_table, entries = doc.parse_kdoc()
> ^^^^^^^^^^^^^^^^
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
> line 1648, in parse_kdoc
> self.state_actions[self.state](self, ln, line)
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
> line 1123, in process_normal
> self.reset_state(ln)
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
> line 447, in reset_state
> self.entry = KernelEntry(self.config, ln)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> File "/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/scripts/lib/kdoc/kdoc_parser.py",
> line 277, in __init__
> self.fname = fname
> ^^^^^
> NameError: name 'fname' is not defined
> make[6]: *** [scripts/Makefile.build:287:
> drivers/gpu/drm/i915/i915_driver.o] Error 1
> make[6]: *** Deleting file 'drivers/gpu/drm/i915/i915_driver.o'
> make[5]: *** [scripts/Makefile.build:556: drivers/gpu/drm/i915] Error 2
> make[4]: *** [scripts/Makefile.build:556: drivers/gpu/drm] Error 2
> make[3]: *** [scripts/Makefile.build:556: drivers/gpu] Error 2
> make[2]: *** [scripts/Makefile.build:556: drivers] Error 2
> make[1]: ***
> [/home/barryn/src/linux/build-amd64/linux-6.18.2-rc1/Makefile:2010: .] Error
> 2
> make: *** [Makefile:248: __sub-make] Error 2
>
> Here is a minimal config to reproduce (make a .config with just these 6
> lines, then run `make olddefconfig`):
>
> CONFIG_64BIT=y
> CONFIG_EXPERT=y
> CONFIG_PCI=y
> CONFIG_DRM=y
> CONFIG_DRM_I915=y
> CONFIG_DRM_I915_WERROR=y
>
> This bug happens if and only if CONFIG_DRM_I915_WERROR=y. (By the way,
> allyesconfig and allmodconfig set CONFIG_COMPILE_TEST=y, which disables
> CONFIG_DRM_I915_DEBUG and CONFIG_DRM_I915_WERROR. So neither allyesconfig
> nor allmodconfig reproduce this.)
>
> It happens whether building for amd64 or i386 (so CONFIG_64BIT=y is not
> strictly necessary). It happens on both fully updated Debian 12 Bookworm and
> fully updated Debian 13 Trixie. It happens both when compiling natively on
> amd64 and when cross-compiling from an arm64 system.
>
> It happens on 6.18.2-rc1 and 6.17.13-rc2, but not on 6.19-rc1. Also, if I
> revert this patch on 6.18.2-rc1 or 6.17.13-rc2, the bug no longer
> reproduces.
Thanks, I'll go drop this from all queues.
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-17 12:45 ` Ronald Warsow
@ 2025-12-17 15:25 ` Greg Kroah-Hartman
0 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-17 15:25 UTC (permalink / raw)
To: Ronald Warsow
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, conor, hargar, broonie, achill, sr
On Wed, Dec 17, 2025 at 01:45:33PM +0100, Ronald Warsow wrote:
> On 17.12.25 10:36, Greg Kroah-Hartman wrote:
> > On Wed, Dec 17, 2025 at 09:27:49AM +0100, Ronald Warsow wrote:
> > > On 17.12.25 06:47, Greg Kroah-Hartman wrote:
> > > > On Tue, Dec 16, 2025 at 05:06:56PM +0100, Ronald Warsow wrote:
> > > > > Hi
> ...
> >
> > Odd, as you aren't even running the driver that this commit points to,
> > right? You shouldn't be building it, so why does this show up as the
> > "bad" commit id?
> >
> > totally confused,
> >
>
> well I realized I left out several steps to do bisect correct.
>
> I hope this time it's correct:
>
> d84236562448e634208746f0e04f725a509d4648 is the first bad commit
> commit d84236562448e634208746f0e04f725a509d4648
> Author: Matthew Brost <matthew.brost@intel.com>
> Date: Fri Oct 31 16:40:45 2025 -0700
>
> drm/xe: Enforce correct user fence signaling order using
>
> [ Upstream commit adda4e855ab6409a3edaa585293f1f2069ab7299 ]
>
> Prevent application hangs caused by out-of-order fence signaling when
> user fences are attached. Use drm_syncobj (via dma-fence-chain) to
> guarantee that each user fence signals in order, regardless of the
> signaling order of the attached fences. Ensure user fence writebacks to
> user space occur in the correct sequence.
>
> v7:
> - Skip drm_syncbj create of error (CI)
>
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel
> GPUs")
> Signed-off-by: Matthew Brost <matthew.brost@intel.com>
> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Link:
> https://patch.msgid.link/20251031234050.3043507-2-matthew.brost@intel.com
> Signed-off-by: Sasha Levin <sashal@kernel.org>
>
> drivers/gpu/drm/xe/xe_exec_queue.c | 3 +++
> 1 file changed, 3 insertions(+)
>
Thanks, will go drop this one now.
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2025-12-17 13:41 ` Jon Hunter
@ 2025-12-18 4:27 ` Peter Schneider
2025-12-18 9:35 ` Mark Brown
2025-12-19 10:24 ` Miguel Ojeda
627 siblings, 0 replies; 647+ messages in thread
From: Peter Schneider @ 2025-12-18 4:27 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 16.12.2025 um 12:06 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
2025-12-16 11:10 ` [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS) Greg Kroah-Hartman
@ 2025-12-18 6:16 ` Jiri Slaby
2025-12-18 11:25 ` Greg Kroah-Hartman
0 siblings, 1 reply; 647+ messages in thread
From: Jiri Slaby @ 2025-12-18 6:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Thomas Richter, Ian Rogers, Namhyung Kim, Sasha Levin
On 16. 12. 25, 12:10, Greg Kroah-Hartman wrote:
> 6.18-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Ian Rogers <irogers@google.com>
>
> [ Upstream commit c1932fb85af8e51ac9f6bd9947145b06c716106e ]
>
> The instructions event is now provided in json meaning the has_event
> test always succeeds. Switch to using non-legacy event names in the
> affected metrics.
>
> Reported-by: Thomas Richter <tmricht@linux.ibm.com>
> Closes: https://lore.kernel.org/linux-perf-users/3e80f453-f015-4f4f-93d3-8df6bb6b3c95@linux.ibm.com/
> Fixes: 0012e0fa221b ("perf jevents: Add legacy-hardware and legacy-cache json")
Hmm, this ^^^ is also a 19-rc1 commit, not present in .18-stable. Why
were these patches added?
> Signed-off-by: Ian Rogers <irogers@google.com>
> Reviewed-by: Thomas Richter <tmricht@linux.ibm.com>
> Tested-by: Thomas Richter <tmricht@linux.ibm.com>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
--
js
suse labs
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2025-12-18 4:27 ` Peter Schneider
@ 2025-12-18 9:35 ` Mark Brown
2025-12-19 10:24 ` Miguel Ojeda
627 siblings, 0 replies; 647+ messages in thread
From: Mark Brown @ 2025-12-18 9:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr
[-- Attachment #1: Type: text/plain, Size: 345 bytes --]
On Tue, Dec 16, 2025 at 12:06:07PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS)
2025-12-18 6:16 ` Jiri Slaby
@ 2025-12-18 11:25 ` Greg Kroah-Hartman
0 siblings, 0 replies; 647+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-18 11:25 UTC (permalink / raw)
To: Jiri Slaby
Cc: stable, patches, Thomas Richter, Ian Rogers, Namhyung Kim,
Sasha Levin
On Thu, Dec 18, 2025 at 07:16:06AM +0100, Jiri Slaby wrote:
> On 16. 12. 25, 12:10, Greg Kroah-Hartman wrote:
> > 6.18-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Ian Rogers <irogers@google.com>
> >
> > [ Upstream commit c1932fb85af8e51ac9f6bd9947145b06c716106e ]
> >
> > The instructions event is now provided in json meaning the has_event
> > test always succeeds. Switch to using non-legacy event names in the
> > affected metrics.
> >
> > Reported-by: Thomas Richter <tmricht@linux.ibm.com>
> > Closes: https://lore.kernel.org/linux-perf-users/3e80f453-f015-4f4f-93d3-8df6bb6b3c95@linux.ibm.com/
> > Fixes: 0012e0fa221b ("perf jevents: Add legacy-hardware and legacy-cache json")
>
> Hmm, this ^^^ is also a 19-rc1 commit, not present in .18-stable. Why were
> these patches added?
Ugh, let me go drop this and then verify _all_ of the commits in the
tree are actually fixing something in the right branch.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 647+ messages in thread
* Re: [PATCH 6.18 000/614] 6.18.2-rc1 review
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2025-12-18 9:35 ` Mark Brown
@ 2025-12-19 10:24 ` Miguel Ojeda
627 siblings, 0 replies; 647+ messages in thread
From: Miguel Ojeda @ 2025-12-19 10:24 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda
On Tue, 16 Dec 2025 12:06:07 +0100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.2 release.
> There are 614 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 18 Dec 2025 11:12:22 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 647+ messages in thread
* 答复: [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated
2025-12-16 11:12 ` [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated Greg Kroah-Hartman
@ 2025-12-29 7:32 ` chenridong
0 siblings, 0 replies; 647+ messages in thread
From: chenridong @ 2025-12-29 7:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable@vger.kernel.org
Cc: patches@lists.linux.dev, Waiman Long, Tejun Heo, Sasha Levin
-----邮件原件-----
发件人: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
发送时间: 2025年12月16日 19:12
收件人: stable@vger.kernel.org
抄送: Greg Kroah-Hartman <gregkh@linuxfoundation.org>; patches@lists.linux.dev; chenridong <chenridong@huawei.com>; Waiman Long <longman@redhat.com>; Tejun Heo <tj@kernel.org>; Sasha Levin <sashal@kernel.org>
主题: [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ridong <chenridong@huawei.com>
[ Upstream commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 ]
Currently, the check for whether a partition is populated does not account for tasks in the cpuset of attaching. This is a corner case that can leave a task stuck in a partition with no effective CPUs.
The race condition occurs as follows:
cpu0 cpu1
//cpuset A with cpu N
migrate task p to A
cpuset_can_attach
// with effective cpus
// check ok
// cpuset_mutex is not held // clear cpuset.cpus.exclusive
// making effective cpus empty
update_exclusive_cpumask
// tasks_nocpu_error check ok
// empty effective cpus, partition valid cpuset_attach ...
// task p stays in A, with non-effective cpus.
To fix this issue, this patch introduces cs_is_populated, which considers tasks in the attaching cpuset. This new helper is used in validate_change and partition_is_populated.
Fixes: e2d59900d936 ("cgroup/cpuset: Allow no-task partition to have empty cpuset.cpus.effective")
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/cpuset.c | 35 +++++++++++++++++++++++++++--------
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 52468d2c178a3..4dcd633fd6df5 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -352,6 +352,15 @@ static inline bool is_in_v2_mode(void)
(cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE); }
+static inline bool cpuset_is_populated(struct cpuset *cs) {
+ lockdep_assert_held(&cpuset_mutex);
+
+ /* Cpusets in the process of attaching should be considered as populated */
+ return cgroup_is_populated(cs->css.cgroup) ||
+ cs->attach_in_progress;
+}
+
/**
* partition_is_populated - check if partition has tasks
* @cs: partition root to be checked
@@ -364,21 +373,31 @@ static inline bool is_in_v2_mode(void) static inline bool partition_is_populated(struct cpuset *cs,
struct cpuset *excluded_child)
{
- struct cgroup_subsys_state *css;
- struct cpuset *child;
+ struct cpuset *cp;
+ struct cgroup_subsys_state *pos_css;
- if (cs->css.cgroup->nr_populated_csets)
+ /*
+ * We cannot call cs_is_populated(cs) directly, as
+ * nr_populated_domain_children may include populated
+ * csets from descendants that are partitions.
+ */
+ if (cs->css.cgroup->nr_populated_csets ||
+ cs->attach_in_progress)
return true;
if (!excluded_child && !cs->nr_subparts)
return cgroup_is_populated(cs->css.cgroup);
I checked this patch, And I found here should be ' cpuset_is_populated(cs)'.
rcu_read_lock();
- cpuset_for_each_child(child, css, cs) {
- if (child == excluded_child)
+ cpuset_for_each_descendant_pre(cp, pos_css, cs) {
+ if (cp == cs || cp == excluded_child)
continue;
- if (is_partition_valid(child))
+
+ if (is_partition_valid(cp)) {
+ pos_css = css_rightmost_descendant(pos_css);
continue;
- if (cgroup_is_populated(child->css.cgroup)) {
+ }
+
+ if (cpuset_is_populated(cp)) {
rcu_read_unlock();
return true;
}
@@ -663,7 +682,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
* be changed to have empty cpus_allowed or mems_allowed.
*/
ret = -ENOSPC;
- if ((cgroup_is_populated(cur->css.cgroup) || cur->attach_in_progress)) {
+ if (cpuset_is_populated(cur)) {
if (!cpumask_empty(cur->cpus_allowed) &&
cpumask_empty(trial->cpus_allowed))
goto out;
--
2.51.0
^ permalink raw reply [flat|nested] 647+ messages in thread
end of thread, other threads:[~2025-12-29 7:32 UTC | newest]
Thread overview: 647+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-16 11:06 [PATCH 6.18 000/614] 6.18.2-rc1 review Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 001/614] smack: fix bug: SMACK64TRANSMUTE set on non-directory Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 002/614] smack: deduplicate "does access rule request transmutation" Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 003/614] smack: deduplicate xattr setting in smack_inode_init_security() Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 004/614] smack: always "instantiate" inode " Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 005/614] smack: fix bug: invalid label of unix socket file Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 006/614] smack: fix bug: unprivileged task can create labels Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 007/614] smack: fix bug: setting task label silently ignores input garbage Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 008/614] gpu: host1x: Fix race in syncpt alloc/free Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 009/614] accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 010/614] accel/amdxdna: Call dma_buf_vmap_unlocked() for imported object Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 011/614] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 012/614] drm/panel: visionox-rm69299: Fix clock frequency for SHIFT6mq Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 013/614] drm/panel: visionox-rm69299: Dont clear all mode flags Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 014/614] accel/ivpu: Rework bind/unbind of imported buffers Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 015/614] accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 016/614] accel/ivpu: Fix DCT active percent format Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 017/614] drm/vgem-fence: Fix potential deadlock on release Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 018/614] bpf: Cleanup unused func args in rqspinlock implementation Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 019/614] bpf: Fix sleepable context for async callbacks Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 020/614] bpf: Fix handling maps with no BTF and non-constant offsets for the bpf_wq Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 021/614] tools/nolibc: handle NULL wstatus argument to waitpid() Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 022/614] USB: Fix descriptor count when handling invalid MBIM extended descriptor Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 023/614] perf bpf_counter: Fix opening of "any"(-1) CPU events Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 024/614] pinctrl: qcom: glymur: Drop unnecessary platform data from match table Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 025/614] pinctrl: qcom: glymur: Fix the gpio and egpio pin functions Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 026/614] ima: Attach CREDS_CHECK IMA hook to bprm_creds_from_file LSM hook Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 027/614] pinctrl: renesas: rzg2l: Fix PMC restore Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 028/614] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 029/614] clk: renesas: cpg-mssr: Read back reset registers to assure values latched Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 030/614] drm: atmel-hlcdc: fix atmel_xlcdc_plane_setup_scaler() Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 031/614] HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 032/614] remoteproc: imx_rproc: Fix runtime PM cleanup and improve remove path Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 033/614] objtool: Fix standalone --hacks=jump_label Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 034/614] objtool: Fix weak symbol detection Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 035/614] accel/ivpu: Fix race condition when mapping dmabuf Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 036/614] perf parse-events: Fix legacy cache events if event is duplicated in a PMU Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 037/614] gpu: nova-core: gsp: remove useless conversion Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 038/614] gpu: nova-core: gsp: do not unwrap() SGEntry Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 039/614] wifi: ath10k: move recovery check logic into a new work Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 040/614] wifi: ath11k: restore register window after global reset Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 041/614] wifi: ath12k: Fix MSDU buffer types handling in RX error path Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 042/614] wifi: ath12k: fix VHT MCS assignment Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 043/614] wifi: ath12k: fix TX and RX MCS rate configurations in HE mode Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 044/614] sched/fair: Forfeit vruntime on yield Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 045/614] irqchip/bcm2712-mip: Fix OF node reference imbalance Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 046/614] irqchip/bcm2712-mip: Fix section mismatch Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 047/614] irqchip/irq-bcm7038-l1: " Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 048/614] irqchip/irq-bcm7120-l2: " Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 049/614] irqchip/irq-brcmstb-l2: " Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 050/614] irqchip/imx-mu-msi: " Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 051/614] irqchip/renesas-rzg2l: " Greg Kroah-Hartman
2025-12-16 11:06 ` [PATCH 6.18 052/614] irqchip/starfive-jh8100: " Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 053/614] irqchip/qcom-irq-combiner: " Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 054/614] irqchip: Drop leftover brackets Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 055/614] irqchip: Pass platform device to platform drivers Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 056/614] crypto: authenc - Correctly pass EINPROGRESS back up to the caller Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 057/614] ntfs3: fix uninit memory after failed mi_read in mi_format_new Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 058/614] ntfs3: Fix uninit buffer allocated by __getname() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 059/614] arm64: dts: qcom: ipq5424: correct the TF-A reserved memory to 512K Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 060/614] iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 061/614] firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 062/614] perf parse-events: Make X modifier more respectful of groups Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 063/614] crypto: aead - Fix reqsize handling Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 064/614] PCI: sg2042: Fix a reference count issue in sg2042_pcie_remove() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 065/614] block/mq-deadline: Introduce dd_start_request() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 066/614] block/mq-deadline: Switch back to a single dispatch list Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 067/614] bpf: Do not let BPF test infra emit invalid GSO types to stack Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 068/614] arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 069/614] arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 070/614] arm64: dts: imx8mp-venice-gw702x: remove off-board uart Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 071/614] arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 072/614] arm64: dts: imx95-15x15-evk: add fan-supply property for pwm-fan Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 073/614] perf annotate: Check return value of evsel__get_arch() properly Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 074/614] arm64: dts: exynos: gs101: fix clock module unit reg sizes Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 075/614] arm64: dts: exynos: gs101: fix sysreg_apm reg property Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 076/614] PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 077/614] uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 078/614] tty: serial: imx: Only configure the wake register when device is set as wakeup source Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 079/614] clk: qcom: camcc-sm8550: Specify Titan GDSC power domain as a parent to other Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 080/614] clk: qcom: camcc-sm6350: " Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 081/614] clk: qcom: rpmh: Define RPMH_IPA_CLK on QCS615 Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 082/614] clk: qcom: gcc-sm8750: Add a new frequency for sdcc2 clock Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 083/614] clk: qcom: gcc-glymur: Update the halt check flags for pipe clocks Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 084/614] clk: qcom: gcc-ipq5424: Correct the icc_first_node_id Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 085/614] clk: qcom: camcc-sm6350: Fix PLL config of PLL2 Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 086/614] clk: qcom: camcc-sm7150: " Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 087/614] soc: qcom: gsbi: fix double disable caused by devm Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 088/614] crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 089/614] crypto: hisilicon/qm - restore original qos values Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 090/614] wifi: ath11k: fix VHT MCS assignment Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 091/614] wifi: ath11k: fix peer HE " Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 092/614] s390/smp: Fix fallback CPU detection Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 093/614] scsi: ufs: core: Move the ufshcd_enable_intr() declaration Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 094/614] s390/ap: Dont leak debug feature files if AP instructions are not available Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 095/614] tools/power turbostat: Regression fix Uncore MHz printed in hex Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 096/614] wifi: ath12k: restore register window after global reset Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 097/614] accel/amdxdna: Fix uninitialized return value Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 098/614] ice: move service task start out of ice_init_pf() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 099/614] ice: move ice_init_interrupt_scheme() prior ice_init_pf() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 100/614] ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 101/614] ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 102/614] ice: move ice_init_pf() out of ice_init_dev() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 103/614] ice: extract ice_init_dev() from ice_init() Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 104/614] ice: move ice_deinit_dev() to the end of deinit paths Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 105/614] ice: remove duplicate call to ice_deinit_hw() on error paths Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 106/614] leds: upboard: Fix module alias Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 107/614] PCI: endpoint: pci-epf-test: Fix sleeping function being called from atomic context Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 108/614] arm64: dts: ti: k3-am62p: Fix memory ranges for GPU Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 109/614] firmware: imx: scu-irq: fix OF node leak in Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 110/614] arm64: dts: qcom: x1e80100: Fix compile warnings for USB HS controller Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 111/614] arm64: dts: qcom: x1e80100: Add missing quirk for HS only USB controller Greg Kroah-Hartman
2025-12-16 11:07 ` [PATCH 6.18 112/614] arm64: dts: qcom: lemans: " Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 113/614] tools/nolibc: x86: fix section mismatch caused by asm "mem*" functions Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 114/614] arm64: dts: qcom: sdm845-starqltechn: remove (address|size)-cells Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 115/614] arm64: dts: qcom: sdm845-starqltechn: fix max77705 interrupts Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 116/614] arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 117/614] arm64: dts: qcom: qcm6490-fairphone-fp5: Add supplies to simple-fb node Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 118/614] arm64: dts: qcom: sm8650: set ufs as dma coherent Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 119/614] arm64: dts: qcom: sm8750-mtp: move PCIe GPIOs to pcieport0 node Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 120/614] arm64: dts: qcom: qcm6490-shift-otter: Add missing reserved-memory Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 121/614] arm64: dts: qcom: x1-dell-thena: Add missing pinctrl for eDP HPD Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 122/614] arm64: dts: qcom: x1-dell-thena: remove dp data-lanes Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 123/614] arm64: dts: qcom: sc8280xp: Fix shifted GPI DMA channels Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 124/614] arm64: dts: qcom: sdm845-starqltechn: Fix i2c-gpio node name Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 125/614] arm64: dts: qcom: sm8250-samsung-common: correct reserved pins Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 126/614] perf hwmon_pmu: Fix uninitialized variable warning Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 127/614] phy: mscc: Fix PTP for VSC8574 and VSC8572 Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 128/614] sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 129/614] arm64: dts: qcom: qcm2290: Fix camss register prop ordering Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 130/614] RDMA/rxe: Fix null deref on srq->rq.queue after resize failure Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 131/614] ARM: dts: renesas: gose: Remove superfluous port property Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 132/614] ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 133/614] drm/amdgpu: add userq object va track helpers Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 134/614] drm/amdgpu/userq: fix SDMA and compute validation Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 135/614] wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 136/614] Revert "mtd: rawnand: marvell: fix layouts" Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 137/614] mtd: nand: relax ECC parameter validation check Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 138/614] mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 139/614] bpf: Refactor stack map trace depth calculation into helper function Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 140/614] bpf: Fix stackmap overflow check in __bpf_get_stackid() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 141/614] perf/x86/intel/cstate: Remove PC3 support from LunarLake Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 142/614] task_work: Fix NMI race condition Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 143/614] drm/rcar-du: dsi: Fix missing parameter in RXSETR_...EN macros Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 144/614] x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 145/614] accel/ivpu: Remove skip of dma unmap for imported buffers Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 146/614] tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 147/614] tools/nolibc/dirent: avoid errno in readdir_r Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 148/614] clk: qcom: gcc-qcs615: Update the SDCC clock to use shared_floor_ops Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 149/614] soc: qcom: smem: fix hwspinlock resource leak in probe error paths Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 150/614] pinctrl: stm32: fix hwspinlock resource leak in probe function Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 151/614] drm: nova: select NOVA_CORE Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 152/614] accel/ivpu: Fix race condition when unbinding BOs Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 153/614] pidfs: add missing PIDFD_INFO_SIZE_VER1 Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 154/614] pidfs: add missing BUILD_BUG_ON() assert on struct pidfd_info Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 155/614] arm64: dts: ti: k3-j784s4: Fix I2C pinmux pull configuration Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 156/614] i3c: fix refcount inconsistency in i3c_master_register Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 157/614] i3c: master: svc: Prevent incomplete IBI transaction Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 158/614] random: use offstack cpumask when necessary Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 159/614] docs: kdoc: fix duplicate section warning message Greg Kroah-Hartman
2025-12-17 11:22 ` Barry K. Nathan
2025-12-17 15:24 ` Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 160/614] wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 161/614] wifi: ath12k: fix reusing m3 memory Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 162/614] wifi: ath12k: fix error handling in creating hardware group Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 163/614] wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 164/614] wifi: ath12k: unassign arvif on scan vdev create failure Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 165/614] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 166/614] arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 167/614] accel/amdxdna: Fix incorrect command state for timed out job Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 168/614] interconnect: debugfs: Fix incorrect error handling for NULL path Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 169/614] arm64: dts: renesas: sparrow-hawk: Fix full-size DP connector node name and labels Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 170/614] cgroup: add cgroup namespace to tree after owner is set Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 171/614] drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
2025-12-16 11:08 ` [PATCH 6.18 172/614] perf lock contention: Load kernel map before lookup Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 173/614] perf record: skip synthesize event when open evsel failed Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 174/614] clk: qcom: tcsrcc-glymur: Update register offsets for clock refs Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 175/614] timers/migration: Convert "while" loops to use "for" Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 176/614] timers/migration: Remove locking on group connection Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 177/614] timers/migration: Fix imbalanced NUMA trees Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 178/614] power: supply: rt5033_charger: Fix device node reference leaks Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 179/614] power: supply: cw2015: Check devm_delayed_work_autocancel() return code Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 180/614] power: supply: max17040: Check iio_read_channel_processed() " Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 181/614] power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 182/614] power: supply: rt9467: Prevent using uninitialized local variable " Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 183/614] power: supply: wm831x: Check wm831x_set_bits() return value Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 184/614] power: supply: qcom_battmgr: clamp charge control thresholds Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 185/614] power: supply: qcom_battmgr: support disabling charge control Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 186/614] power: supply: apm_power: only unset own apm_get_power_status Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 187/614] scsi: target: Do not write NUL characters into ASCII configfs output Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 188/614] scsi: target: Fix LUN/device R/W and total command stats Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 189/614] fs/9p: Dont open remote file with APPEND mode when writeback cache is used Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 190/614] drm/panthor: Handle errors returned by drm_sched_entity_init() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 191/614] drm/panthor: Fix group_free_queue() for partially initialized queues Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 192/614] drm/panthor: Fix UAF race between device unplug and FW event processing Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 193/614] drm/panthor: Fix race with suspend during unplug Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 194/614] drm/panthor: Fix UAF on kernel BO VA nodes Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 195/614] firmware: ti_sci: Set IO Isolation only if the firmware is capable Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 196/614] ns: add NS_COMMON_INIT() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 197/614] ns: initialize ns_list_node for initial namespaces Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 198/614] iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 199/614] cleanup: fix scoped_class() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 200/614] drm/xe: Enforce correct user fence signaling order using Greg Kroah-Hartman
2025-12-16 13:35 ` Thomas Hellström
2025-12-16 11:09 ` [PATCH 6.18 201/614] spi: tegra210-quad: Fix timeout handling Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 202/614] libbpf: Fix parsing of multi-split BTF Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 203/614] ARM: dts: am33xx: Add missing serial console speed Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 204/614] ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 205/614] ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 206/614] ARM: dts: omap3: n900: " Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 207/614] entry,unwind/deferred: Fix unwind_reset_info() placement Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 208/614] arm64: tegra: Add pinctrl definitions for pcie-ep nodes Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 209/614] coresight: ETR: Fix ETR buffer use-after-free issue Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 210/614] x86/boot: Fix page table access in 5-level to 4-level paging transition Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 211/614] efi/libstub: " Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 212/614] locktorture: Fix memory leak in param_set_cpumask() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 213/614] wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 214/614] wifi: rtw89: usb: fix leak in rtw89_usb_write_port() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 215/614] perf annotate: Fix build with NO_SLANG=1 Greg Kroah-Hartman
2025-12-17 9:42 ` Jiri Slaby
2025-12-17 10:31 ` Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 216/614] mfd: da9055: Fix missing regmap_del_irq_chip() in error path Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 217/614] wifi: ath12k: Fix timeout error during beacon stats retrieval Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 218/614] ext4: correct the checking of quota files before moving extents Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 219/614] accel/amdxdna: Fix dma_fence leak when job is canceled Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 220/614] hfs: fix potential use after free in hfs_correct_next_unused_CNID() Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 221/614] arm64: dts: rockchip: Fix USB Type-C host mode for Radxa ROCK 5B+/5T Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 222/614] io_uring: use WRITE_ONCE for user shared memory Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 223/614] perf/x86: Fix NULL event access and potential PEBS record loss Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 224/614] perf/x86/intel: Correct large PEBS flag check Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 225/614] regulator: core: disable supply if enabling main regulator fails Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 226/614] md: delete mddev kobj before deleting gendisk kobj Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 227/614] md: fix rcu protection in md_wakeup_thread Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 228/614] md: avoid repeated calls to del_gendisk Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 229/614] nbd: defer config put in recv_work Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 230/614] scsi: stex: Fix reboot_notifier leak in probe error path Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 231/614] scsi: smartpqi: Fix device resources accessed after device removal Greg Kroah-Hartman
2025-12-16 11:09 ` [PATCH 6.18 232/614] staging: most: remove broken i2c driver Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 233/614] iio: imu: bmi270: fix dev_err_probe error msg Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 234/614] dt-bindings: PCI: amlogic: Fix the register name of the DBI region Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 235/614] RDMA/rtrs: server: Fix error handling in get_or_create_srv Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 236/614] ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 237/614] coresight: tmc: add the handle of the event to the path Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 238/614] ntfs3: init run lock for extend inode Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 239/614] drm/panthor: Fix potential memleak of vma structure Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 240/614] scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 241/614] md: delete md_redundancy_group when array is becoming inactive Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 242/614] md: init bioset in mddev_init Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 243/614] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 244/614] powerpc/kdump: Fix size calculation for hot-removed memory ranges Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 245/614] powerpc/32: Fix unpaired stwcx. on interrupt exit Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 246/614] macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 247/614] wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 248/614] nbd: defer config unlock in nbd_genl_connect Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 249/614] net: export netdev_get_by_index_lock() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 250/614] io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 251/614] fs/ntfs3: Initialize allocated memory before use Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 252/614] coresight: Change device mode to atomic type Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 253/614] coresight: etm4x: Always set tracers device mode on target CPU Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 254/614] coresight: etm3x: " Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 255/614] coresight: etm4x: Correct polling IDLE bit Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 256/614] coresight: etm4x: Add context synchronization before enabling trace Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 257/614] coresight: etm4x: Properly control filter in CPU idle with FEAT_TRF Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 258/614] perf tools: Fix missing feature check for inherit + SAMPLE_READ Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 259/614] drm/tidss: Remove max_pclk_khz and min_pclk_khz from tidss display features Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 260/614] drm/tidss: Move OLDI mode validation to OLDI bridge mode_valid hook Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 261/614] clk: renesas: r9a09g077: Propagate rate changes to parent clocks Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 262/614] clk: renesas: r9a06g032: Fix memory leak in error path Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 263/614] lib/vsprintf: Check pointer before dereferencing in time_and_date() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 264/614] ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 265/614] ocfs2: use correct endian in ocfs2_dinode_has_extents Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 266/614] ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 267/614] scsi: qla2xxx: Clear cmds after chip reset Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 268/614] scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 269/614] leds: netxbig: Fix GPIO descriptor leak in error paths Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 270/614] arm64/mm: Allow __create_pgd_mapping() to propagate pgtable_alloc() errors Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 271/614] accel/amdxdna: Clear mailbox interrupt register during channel creation Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 272/614] accel/amdxdna: Fix deadlock between context destroy and job timeout Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 273/614] bpf: Free special fields when update [lru_,]percpu_hash maps Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 274/614] PCI: keystone: Exit ks_pcie_probe() for invalid mode Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 275/614] soc: renesas: r9a09g056-sys: Populate max_register Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 276/614] soc: renesas: rz-sysc: Populate readable_reg/writeable_reg in regmap config Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 277/614] arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 278/614] arm64: dts: rockchip: Add eeprom vcc-supply for " Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 279/614] arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 280/614] perf vendor metrics s390: Avoid has_event(INSTRUCTIONS) Greg Kroah-Hartman
2025-12-18 6:16 ` Jiri Slaby
2025-12-18 11:25 ` Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 281/614] crypto: iaa - Fix incorrect return value in save_iaa_wq() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 282/614] s390/fpu: Fix false-positive kmsan report in fpu_vstl() Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 283/614] pwm: Simplify printf to emit chip->npwm in $debugfs/pwm Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 284/614] pwm: Use %u to printf unsigned int pwm_chip::npwm and pwm_chip::id Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 285/614] arm64: dts: qcom: qrb2210-rb1: Fix UART3 wakeup IRQ storm Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 286/614] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 287/614] ps3disk: use memcpy_{from,to}_bvec index Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 288/614] soc/tegra: fuse: speedo-tegra210: Update speedo IDs Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 289/614] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 290/614] kbuild: dont enable CC_CAN_LINK if the dummy program generates warnings Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 291/614] bpf: Prevent nesting overflow in bpf_try_get_buffers Greg Kroah-Hartman
2025-12-16 11:10 ` [PATCH 6.18 292/614] bpf: Handle return value of ftrace_set_filter_ip in register_fentry Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 293/614] selftests/bpf: Fix failure paths in send_signal test Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 294/614] bpf: Check skb->transport_header is set in bpf_skb_check_mtu Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 295/614] mshv: Fix deposit memory in MSHV_ROOT_HVCALL Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 296/614] mshv: Fix create memory region overlap check Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 297/614] watchdog: wdat_wdt: Fix ACPI table leak in probe function Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 298/614] watchdog: starfive: Fix resource leak in probe error path Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 299/614] iio: core: add missing mutex_destroy in iio_dev_release() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 300/614] iio: core: Clean up device correctly on iio_device_alloc() failure Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 301/614] fuse_ctl_add_conn(): fix nlink breakage in case of early failure Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 302/614] tracefs: fix a leak in eventfs_create_events_dir() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 303/614] NFSD/blocklayout: Fix minlength check in proc_layoutget Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 304/614] arm64: dts: imx95-tqma9596sa: fix TPM5 pinctrl node name Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 305/614] arm64: dts: imx95-tqma9596sa: reduce maximum FlexSPI frequency to 66MHz Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 306/614] block/blk-throttle: Fix throttle slice time for SSDs Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 307/614] drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 308/614] drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 309/614] drm/msm/a2xx: stop over-complaining about the legacy firmware Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 310/614] PCI: stm32: Fix LTSSM EP race with start link Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 311/614] PCI: stm32: Fix EP page_size alignment Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 312/614] wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 313/614] net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 314/614] net: stmmac: dwmac-sophgo: Add phy interface filter Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 315/614] bpf: Fix invalid prog->stats access when update_effective_progs fails Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 316/614] powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 317/614] powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 318/614] net: stmmac: Fix VLAN 0 deletion in vlan_del_hw_rx_fltr() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 319/614] fs/ntfs3: out1 also needs to put mi Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 320/614] fs/ntfs3: Prevent memory leaks in add sub record Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 321/614] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 322/614] drm/msm/a6xx: Flush LRZ cache before PT switch Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 323/614] drm/msm/a6xx: Fix the gemnoc workaround Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 324/614] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 325/614] spi: sophgo: Fix incorrect use of bus width value macros Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 326/614] ipv6: clear RA flags when adding a static route Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 327/614] perf arm_spe: Fix memset subclass in operation Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 328/614] pwm: bcm2835: Make sure the channel is enabled after pwm_request() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 329/614] scsi: ufs: rockchip: Reset controller on PRE_CHANGE of hce enable notify Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 330/614] scsi: qla2xxx: Fix improper freeing of purex item Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 331/614] net: phy: realtek: create rtl8211f_config_rgmii_delay() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 332/614] iommu/vt-d: Set INTEL_IOMMU_FLOPPY_WA depend on BLK_DEV_FD Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 333/614] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 334/614] wifi: mac80211: fix CMAC functions not handling errors Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 335/614] tools/rtla: Fix unassigned nr_cpus Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 336/614] tools/rtla: Fix --on-threshold always triggering Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 337/614] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 338/614] mfd: mt6358-irq: " Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 339/614] of/fdt: Consolidate duplicate code into helper functions Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 340/614] of/fdt: Fix the len check in early_init_dt_check_for_elfcorehdr() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 341/614] of/fdt: Fix the len check in early_init_dt_check_for_usable_mem_range() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 342/614] of/fdt: Fix incorrect use of dt_root_addr_cells in early_init_dt_check_kho() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 343/614] leds: rgb: leds-qcom-lpg: Dont enable TRILED when configuring PWM Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 344/614] phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 345/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3528 Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 346/614] phy: rockchip: naneng-combphy: Fix PCIe L1ss support RK3562 Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 347/614] phy: freescale: Initialize priv->lock Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 348/614] phy: rockchip: samsung-hdptx: Fix reported clock rate in high bpc mode Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 349/614] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 350/614] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 351/614] ASoC: SDCA: Fix missing dash in HIDE DisCo property Greg Kroah-Hartman
2025-12-16 11:11 ` [PATCH 6.18 352/614] selftests/bpf: Use ASSERT_STRNEQ to factor in long slab cache names Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 353/614] net: phy: adin1100: Fix software power-down ready condition Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 354/614] cpuset: Treat cpusets in attaching as populated Greg Kroah-Hartman
2025-12-29 7:32 ` 答复: " chenridong
2025-12-16 11:12 ` [PATCH 6.18 355/614] clk: spacemit: Set clk_hw_onecell_data::num before using flex array Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 356/614] wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 357/614] RAS: Report all ARM processor CPER information to userspace Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 358/614] rtla/tests: Extend action tests to 5s Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 359/614] rtla/tests: Fix osnoise test calling timerlat Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 360/614] rtla: Fix -a overriding -t argument Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 361/614] ima: Handle error code returned by ima_filter_rule_match() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 362/614] usb: chaoskey: fix locking for O_NONBLOCK Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 363/614] usb: dwc2: fix hang during shutdown if set as peripheral Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 364/614] usb: dwc2: fix hang during suspend " Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 365/614] usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 366/614] regulator: pca9450: Fix error code in probe() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 367/614] selftests/bpf: skip test_perf_branches_hw() on unsupported platforms Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 368/614] selftests/bpf: Improve reliability of test_perf_branches_no_hw() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 369/614] selftests/bpf: Update test_tag to use sha256 Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 370/614] bpf: properly verify tail call behavior Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 371/614] crypto: starfive - Correctly handle return of sg_nents_for_len Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 372/614] crypto: ccree " Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 373/614] PM / devfreq: hisi: Fix potential UAF in OPP handling Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 374/614] RISC-V: KVM: Fix guest page fault within HLV* instructions Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 375/614] erofs: correct FSDAX detection Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 376/614] erofs: limit the level of fs stacking for file-backed mounts Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 377/614] RDMA/bnxt_re: Fix the inline size for GenP7 devices Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 378/614] RDMA/bnxt_re: Pass correct flag for dma mr creation Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 379/614] crypto: ahash - Fix crypto_ahash_import with partial block data Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 380/614] crypto: ahash - Zero positive err value in ahash_update_finish Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 381/614] ASoC: tas2781: Correct the wrong chip ID for reset variable check Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 382/614] ASoC: tas2781: correct the wrong period Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 383/614] wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 384/614] wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 385/614] wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 386/614] wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 387/614] Revert "wifi: mt76: mt792x: improve monitor interface handling" Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 388/614] wifi: mt76: mt7996: fix max nss value when getting rx chainmask Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 389/614] wifi: mt76: mt7996: fix implicit beamforming support for mt7992 Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 390/614] wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 391/614] wifi: mt76: mt7996: fix teardown command for an MLD peer Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 392/614] wifi: mt76: mt7996: set link_valid field when initializing wcid Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 393/614] wifi: mt76: mt7996: fix MLD group index assignment Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 394/614] wifi: mt76: mt7996: fix MLO set key and group key issues Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 395/614] wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 396/614] wifi: mt76: mt7996: fix EMI rings for RRO Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 397/614] wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 398/614] wifi: mt76: Move mt76_abort_scan out of mt76_reset_device() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 399/614] wifi: mt76: mt7996: skip deflink accounting for offchannel links Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 400/614] wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 401/614] wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 402/614] mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 403/614] firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 404/614] staging: fbtft: core: fix potential memory leak in fbtft_probe_common() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 405/614] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 406/614] bpftool: Allow bpftool to build with openssl < 3 Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 407/614] selftests/bpf: Allow selftests to build with older xxd Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 408/614] btrfs: fix double free of qgroup record after failure to add delayed ref head Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 409/614] btrfs: fix racy bitfield write in btrfs_clear_space_info_full() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 410/614] btrfs: make sure extent and csum paths are always released in scrub_raid56_parity_stripe() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 411/614] btrfs: fix leaf leak in an error path in btrfs_del_items() Greg Kroah-Hartman
2025-12-16 11:12 ` [PATCH 6.18 412/614] PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 413/614] drm/nouveau: restrict the flush page to a 32-bit address Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 414/614] um: Dont rename vmap to kernel_vmap Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 415/614] iomap: always run error completions in user context Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 416/614] iomap: allocate s_dio_done_wq for async reads as well Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 417/614] wifi: ieee80211: correct FILS status codes Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 418/614] backlight: led-bl: Add devlink to supplier LEDs Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 419/614] backlight: lp855x: Fix lp855x.h kernel-doc warnings Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 420/614] iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 421/614] RDMA/irdma: Fix data race in irdma_sc_ccq_arm Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 422/614] RDMA/irdma: Fix data race in irdma_free_pble Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 423/614] RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 424/614] RDMA/irdma: Fix SIGBUS in AEQ destroy Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 425/614] RDMA/irdma: Add missing mutex destroy Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 426/614] RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 427/614] RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 428/614] RDMA/irdma: Remove doorbell elision logic Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 429/614] RDMA/irdma: Fix SRQ shadow area address initialization Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 430/614] arm64: dts: amlogic: meson-g12b: Fix L2 cache reference for S922X CPUs Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 431/614] drm/panthor: Avoid adding of kernel BOs to extobj list Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 432/614] clocksource/drivers/ralink: Fix resource leaks in init error path Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 433/614] clocksource/drivers/stm: Fix double deregistration on probe failure Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 434/614] clocksource/drivers/arm_arch_timer_mmio: Prevent driver unbind Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 435/614] clocksource/drivers/nxp-pit: " Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 436/614] clocksource/drivers/nxp-stm: Fix section mismatches Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 437/614] clocksource/drivers/nxp-stm: Prevent driver unbind Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 438/614] ASoC: nau8325: use simple i2c probe function Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 439/614] ASoC: nau8325: add missing build config Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 440/614] gfs2: Prevent recursive memory reclaim Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 441/614] ASoC: fsl_xcvr: clear the channel status control memory Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 442/614] firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 443/614] greybus: gb-beagleplay: Fix timeout handling in bootloader functions Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 444/614] fs: refactor file timestamp update logic Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 445/614] fs: lift the FMODE_NOCMTIME check into file_update_time_flags Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 446/614] misc: rp1: Fix an error handling path in rp1_probe() Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 447/614] kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node Greg Kroah-Hartman
2025-12-16 16:52 ` Will Rosenberg
2025-12-16 11:13 ` [PATCH 6.18 448/614] drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 449/614] drm/amdkfd: assign AID to uuid in topology for SPX mode Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 450/614] hwmon: sy7636a: Fix regulator_enable resource leak on error path Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 451/614] ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 452/614] ublk: prevent invalid access with DEBUG Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 453/614] selftests/landlock: Fix makefile header list Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 454/614] bpf: Fix exclusive map memory leak Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 455/614] ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 456/614] selftests/net: packetdrill: pass send_omit_free to MSG_ZEROCOPY tests Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 457/614] of: Skip devicetree kunit tests when RISCV+ACPI doesnt populate root node Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 458/614] virtio_vdpa: fix misleading return in void function Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 459/614] virtio: fix kernel-doc for mapping/free_coherent functions Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 460/614] virtio: fix typo in virtio_device_ready() comment Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 461/614] virtio: fix whitespace in virtio_config_ops Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 462/614] virtio: fix grammar in virtio_queue_info docs Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 463/614] virtio: fix grammar in virtio_map_ops docs Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 464/614] virtio: standardize Returns documentation style Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 465/614] virtio: fix virtqueue_set_affinity() docs Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 466/614] virtio: fix map ops comment Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 467/614] vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 468/614] vhost: Fix kthread worker cgroup failure handling Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 469/614] vdpa/pds: use %pe for ERR_PTR() in event handler registration Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 470/614] virtio: clean up features qword/dword terms Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 471/614] ASoC: Intel: catpt: Fix error path in hw_params() Greg Kroah-Hartman
2025-12-16 11:13 ` [PATCH 6.18 472/614] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 473/614] soc: samsung: exynos-pmu: Fix structure initialization Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 474/614] ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 475/614] ARM: dts: samsung: exynos4210-i9100: " Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 476/614] ARM: dts: samsung: exynos4210-trats: " Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 477/614] ARM: dts: samsung: exynos4412-midas: " Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 478/614] regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 479/614] arm64: dts: mediatek: mt8195: Fix address range for JPEG decoder core 1 Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 480/614] Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 481/614] netfilter: flowtable: check for maximum number of encapsulations in bridge vlan Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 482/614] netfilter: nf_conncount: rework API to use sk_buff directly Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 483/614] netfilter: nft_connlimit: update the count if add was skipped Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 484/614] iavf: Implement settime64 with -EOPNOTSUPP Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 485/614] net: vxlan: prevent NULL deref in vxlan_xmit_one Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 486/614] net: stmmac: fix rx limit check in stmmac_rx_zc() Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 487/614] mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 488/614] spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 489/614] arm64/pageattr: Propagate return value from __change_memory_common Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 490/614] vfio/pci: Use RCU for error/request triggers to avoid circular locking Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 491/614] landlock: Fix handling of disconnected directories Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 492/614] net: phy: aquantia: check for NVMEM deferral Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 493/614] selftests: bonding: add delay before each xvlan_over_bond connectivity check Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 494/614] net: netpoll: initialize work queue before error checks Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 495/614] mtd: lpddr_cmds: fix signed shifts in lpddr_cmds Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 496/614] rqspinlock: Enclose lock/unlock within lock entry acquisitions Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 497/614] rqspinlock: Use trylock fallback when per-CPU rqnode is busy Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 498/614] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 499/614] md/raid5: fix IO hang when array is broken with IO inflight Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 500/614] clk: keystone: fix compile testing Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 501/614] smb: smbdirect: introduce SMBDIRECT_DEBUG_ERR_PTR() helper Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 502/614] smb: smbdirect: introduce SMBDIRECT_CHECK_STATUS_{WARN,DISCONNECT}() Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 503/614] smb: server: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smb_direct_cm_handler() Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 504/614] smb: client: relax WARN_ON_ONCE(SMBDIRECT_SOCKET_*) checks in recv_done() and smbd_conn_upcall() Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 505/614] um: Disable KASAN_INLINE when STATIC_LINK is selected Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 506/614] net: dsa: b53: fix VLAN_ID_IDX write size for BCM5325/65 Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 507/614] net: dsa: b53: fix extracting VID from entry " Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 508/614] net: dsa: b53: b53_arl_read{,25}(): use the entry for comparision Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 509/614] net: dsa: b53: move reading ARL entries into their own function Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 510/614] net: dsa: b53: move writing ARL entries into their own functions Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 511/614] net: dsa: b53: provide accessors for accessing ARL_SRCH_CTL Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 512/614] net: dsa: b53: split reading search entry into their own functions Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 513/614] net: dsa: b53: move ARL entry functions into ops struct Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 514/614] net: dsa: b53: add support for 5389/5397/5398 ARL entry format Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 515/614] net: dsa: b53: use same ARL search result offset for BCM5325/65 Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 516/614] net: dsa: b53: fix CPU port unicast ARL entries " Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 517/614] net: dsa: b53: add support for bcm63xx ARL entry format Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 518/614] net: dsa: b53: fix BCM5325/65 ARL entry multicast port masks Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 519/614] net: dsa: b53: fix BCM5325/65 ARL entry VIDs Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 520/614] net: hsr: create an API to get hsr port type Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 521/614] net: dsa: xrs700x: reject unsupported HSR configurations Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 522/614] net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 523/614] perf jitdump: Add sym/str-tables to build-ID generation Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 524/614] exfat: fix refcount leak in exfat_find Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 525/614] exfat: fix divide-by-zero in exfat_allocate_bitmap Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 526/614] perf tools: Mark split kallsyms DSOs as loaded Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 527/614] perf tools: Fix split kallsyms DSO counting Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 528/614] perf kvm: Fix debug assertion Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 529/614] perf hist: In init, ensure mem_info is put on error paths Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 530/614] pinctrl: single: Fix incorrect type for error return variable Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 531/614] perf stat: Allow no events to open if this is a "--null" run Greg Kroah-Hartman
2025-12-16 11:14 ` [PATCH 6.18 532/614] fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 533/614] 9p: fix cache/debug options printing in v9fs_show_options Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 534/614] sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 535/614] sched/core: Fix psi_dequeue() for Proxy Execution Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 536/614] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 537/614] f2fs: maintain one time GC mode is enabled during whole zoned GC cycle Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 538/614] rtc: amlogic-a4: fix double free caused by devm Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 539/614] kbuild: install-extmod-build: Properly fix CC expansion when ccache is used Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 540/614] NFS: Avoid changing nlink when file removes and attribute updates race Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 541/614] fs/nls: Fix utf16 to utf8 conversion Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 542/614] NFS: Initialise verifiers for visible dentries in readdir and lookup Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 543/614] NFS: Initialise verifiers for visible dentries in nfs_atomic_open() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 544/614] NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 545/614] NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 546/614] drm/panthor: Prevent potential UAF in group creation Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 547/614] Revert "nfs: ignore SB_RDONLY when remounting nfs" Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 548/614] Revert "nfs: clear SB_RDONLY before getting superblock" Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 549/614] Revert "nfs: ignore SB_RDONLY when mounting nfs" Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 550/614] NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 551/614] NFS: Fix inheritance of the block sizes when automounting Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 552/614] fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 553/614] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 554/614] ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 555/614] ASoC: amd: acp: Audio is not resuming after s0ix Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 556/614] ASoC: ak4458: Disable regulator when error happens Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 557/614] ASoC: ak5558: " Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 558/614] f2fs: revert summary entry count from 2048 to 512 in 16kb block support Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 559/614] blk-mq: Abort suspend when wakeup events are pending Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 560/614] drm/panel: novatek-nt35560: avoid on-stack device structure Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 561/614] block: fix comment for op_is_zone_mgmt() to include RESET_ALL Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 562/614] block: fix memory leak in __blkdev_issue_zero_pages Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 563/614] nvme-auth: use kvfree() for memory allocated with kvcalloc() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 564/614] io_uring/kbuf: use READ_ONCE() for userspace-mapped memory Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 565/614] drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 566/614] regulator: fixed: Rely on the core freeing the enable GPIO Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 567/614] ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 568/614] drm/nouveau: refactor deprecated strcpy Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 569/614] drm/nouveau: fix circular dep oops from vendored i2c encoder Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 570/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 571/614] cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 572/614] nfs/localio: remove alignment size checking in nfs_is_local_dio_possible Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 573/614] nfs/localio: remove 61 byte hole from needless ____cacheline_aligned Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 574/614] gpio: tb10x: fix OF_GPIO dependency Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 575/614] docs: hwmon: fix link to g762 devicetree binding Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 576/614] i2c: spacemit: fix detect issue Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 577/614] dma/pool: eliminate alloc_pages warning in atomic_pool_expand Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 578/614] ALSA: uapi: Fix typo in asound.h comment Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 579/614] drm/amdkfd: Use huge page size to check split svm range alignment Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 580/614] rtc: gamecube: Check the return value of ioremap() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 581/614] rtc: max31335: Fix ignored return value in set_alarm Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 582/614] regulator: spacemit: Align input supply name with the DT binding Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 583/614] ALSA: firewire-motu: add bounds check in put_user loop for DSP events Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 584/614] ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 585/614] drm/xe/fbdev: use the same 64-byte stride alignment as i915 Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 586/614] drm/i915/fbdev: make intel_framebuffer_create() error return handling explicit Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 587/614] drm/{i915, xe}/fbdev: pass struct drm_device to intel_fbdev_fb_alloc() Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 588/614] drm/{i915, xe}/fbdev: deduplicate struct drm_mode_fb_cmd2 init Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 589/614] drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 590/614] block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 591/614] ASoC: amd: acp: update tdm channels for specific DAI Greg Kroah-Hartman
2025-12-16 11:15 ` [PATCH 6.18 592/614] dm-raid: fix possible NULL dereference with undefined raid type Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 593/614] dm log-writes: Add missing set_freezable() for freezable kthread Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 594/614] scsi: imm: Fix use-after-free bug caused by unfinished delayed work Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 595/614] scsi: ufs: core: Fix an error handler crash Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 596/614] perf/core: Fix missing read event generation on task exit Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 597/614] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 598/614] cpu: Make atomic hotplug callbacks run with interrupts disabled on UP Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 599/614] ocfs2: fix memory leak in ocfs2_merge_rec_left() Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 600/614] perf/x86/intel: Fix NULL event dereference crash in handle_pmi_common() Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 601/614] efi/cper: Add a new helper function to print bitmasks Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 602/614] efi/cper: Adjust infopfx size to accept an extra space Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 603/614] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 604/614] usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 605/614] usb: typec: ucsi: fix probe failure in gaokun_ucsi_probe() Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 606/614] usb: phy: Initialize struct usb_phy list_head Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 607/614] usb: typec: ucsi: fix use-after-free caused by uec->work Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 608/614] usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 609/614] ALSA: dice: fix buffer overflow in detect_stream_formats() Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 610/614] ALSA: hda/realtek: Add match for ASUS Xbox Ally projects Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 611/614] ALSA: hda/tas2781: fix speaker id retrieval for multiple probes Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 612/614] ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 613/614] ALSA: wavefront: Clear substream pointers on close Greg Kroah-Hartman
2025-12-16 11:16 ` [PATCH 6.18 614/614] ALSA: wavefront: Fix integer overflow in sample size validation Greg Kroah-Hartman
2025-12-16 16:06 ` [PATCH 6.18 000/614] 6.18.2-rc1 review Ronald Warsow
2025-12-17 5:47 ` Greg Kroah-Hartman
2025-12-17 8:27 ` Ronald Warsow
2025-12-17 9:36 ` Greg Kroah-Hartman
2025-12-17 9:51 ` Ronald Warsow
2025-12-17 12:45 ` Ronald Warsow
2025-12-17 15:25 ` Greg Kroah-Hartman
2025-12-16 17:29 ` Brett A C Sheffield
2025-12-16 19:17 ` Achill Gilgenast
2025-12-16 19:35 ` Dileep malepu
2025-12-16 19:52 ` Naresh Kamboju
2025-12-17 6:30 ` Greg KH
2025-12-17 8:06 ` Naresh Kamboju
2025-12-17 9:25 ` Greg KH
2025-12-16 21:48 ` Florian Fainelli
2025-12-17 5:04 ` Ron Economos
2025-12-17 6:17 ` Jeffrin Thalakkottoor
2025-12-17 11:29 ` Takeshi Ogasawara
2025-12-17 12:51 ` Justin Forbes
2025-12-17 13:41 ` Jon Hunter
2025-12-18 4:27 ` Peter Schneider
2025-12-18 9:35 ` Mark Brown
2025-12-19 10:24 ` Miguel Ojeda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).