* [PATCH 6.1 000/280] 6.1.162-rc1 review
@ 2026-02-04 14:36 Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 001/280] firmware: imx: scu-irq: Set mu_resource_id before get handle Greg Kroah-Hartman
` (284 more replies)
0 siblings, 285 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.1.162 release.
There are 280 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.162-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.1.162-rc1
Marios Makassikis <mmakassikis@freebox.fr>
ksmbd: fix recursive locking in RPC handle list access
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
Johan Hovold <johan@kernel.org>
drm/imx/tve: fix probe device leak
Laveesh Bansal <laveeshb@laveeshbansal.com>
writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
Pimyn Girgis <pimyn@google.com>
mm/kfence: randomize the freelist on initialization
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: avoid dup SUB_CLOSED events after disconnect
Chen Ni <nichen@iscas.ac.cn>
net/sched: act_ife: convert comma to semicolon
JP Kobryn <inwardvessel@gmail.com>
btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate()
Robert McClinton <rbmccav@gmail.com>
drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
Mike Christie <michael.christie@oracle.com>
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
Yunseong Kim <ysk@kzalloc.com>
ksmbd: Fix race condition in RPC handle list access
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix use-after-free in ksmbd_session_rpc_open
Xin Long <lucien.xin@gmail.com>
sctp: linearize cloned gso packets in sctp_rcv
Alexis Lothoré <alexis.lothore@bootlin.com>
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV
Zqiang <qiang.zhang@linux.dev>
usbnet: Fix using smp_processor_id() in preemptible code warnings
Maninder Singh <maninder1.s@samsung.com>
NFSD: fix race between nfsd registration and exports_proc
Andreas Gruenbacher <agruenba@redhat.com>
gfs2: Fix NULL pointer dereference in gfs2_log_flush
Gavin Li <gavinl@nvidia.com>
Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"
Waiman Long <longman@redhat.com>
blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
fs/ntfs3: Initialize allocated memory before use
Ritesh Harjani (IBM) <ritesh.list@gmail.com>
iomap: Fix possible overflow condition in iomap_write_delalloc_scan
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - flush misc workqueue during device shutdown
Alex Hung <alex.hung@amd.com>
drm/amd/display: Check dce_hwseq before dereferencing it
Harry Yoo <harry.yoo@oracle.com>
Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()"
Marc Kleine-Budde <mkl@pengutronix.de>
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
drm/amdkfd: fix a memory leak in device_queue_manager_init()
Gyeyoung Baek <gye976@gmail.com>
genirq/irq_sim: Initialize work context pointers properly
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: move TDLS work to wiphy work
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: use wiphy work for sdata->work
Nikola Z. Ivanov <zlatistiv@gmail.com>
team: Move team device type change at the end of team_port_add
Sean Christopherson <seanjc@google.com>
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
Johan Hovold <johan@kernel.org>
ASoC: codecs: wsa883x: fix unnecessary initialisation
Johan Hovold <johan@kernel.org>
ASoC: codecs: wsa881x: fix unnecessary initialisation
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ASoC: codecs: wsa881x: Drop unused version readout
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ASoC: codecs: wsa881x: Use proper shutdown GPIO polarity
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ASoC: codecs: wsa881x: Simplify &pdev->dev in probe
Wentao Liang <vulab@iscas.ac.cn>
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
Dragan Simic <dsimic@manjaro.org>
phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
Sebastian Reichel <sebastian.reichel@collabora.com>
phy: phy-rockchip-inno-usb2: simplify phy clock handling
Nilay Shroff <nilay@linux.ibm.com>
nvme: fix PCIe subsystem reset controller state transition
Keith Busch <kbusch@kernel.org>
nvme-pci: do not directly handle subsys reset fallout
Daniel Wagner <dwagner@suse.de>
nvme-fc: rename free_ctrl callback to match name pattern
Fiona Klute <fiona.klute@gmx.de>
iio: chemical: scd4x: fix reported channel endianness
Johan Hovold <johan@kernel.org>
iio: adc: exynos_adc: fix OF populate on driver rebind
Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
ALSA: scarlett2: Fix buffer overflow in config retrieval
Shawn Lin <shawn.lin@rock-chips.com>
mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
Shawn Lin <shawn.lin@rock-chips.com>
mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform
Mark Rutland <mark.rutland@arm.com>
arm64/fpsimd: signal: Fix restoration of SVE context
Alexander Usyskin <alexander.usyskin@intel.com>
mei: trace: treat reg parameter as string
Thomas Fourier <fourier.thomas@gmail.com>
ksmbd: smbd: fix dma_unmap_sg() nents
Ming Qian <ming.qian@oss.nxp.com>
pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
Brian Foster <bfoster@redhat.com>
xfs: set max_agbno to allow sparse alloc of last full inode chunk
Ryan Roberts <ryan.roberts@arm.com>
mm: kmsan: fix poisoning of high-order non-compound pages
Johan Hovold <johan@kernel.org>
dmaengine: stm32: dmamux: fix device leak on route allocation
Vlastimil Babka <vbabka@suse.cz>
mm/page_alloc: prevent pcp corruption with SMP=n
Johan Hovold <johan@kernel.org>
dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
Abdun Nihaal <nihaal@cse.iitm.ac.in>
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
Dawei Li <set_pte_at@outlook.com>
xen: make remove callback of xen driver void returned
Geraldo Nascimento <geraldogabriel@gmail.com>
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
David Hildenbrand (Red Hat) <david@kernel.org>
mm/rmap: fix two comments related to huge_pmd_unshare()
Robin Murphy <robin.murphy@arm.com>
gpio: rockchip: Stop calling pinctrl for set_direction
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx11: fix wptr reset in KGQ init
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/gfx10: fix wptr reset in KGQ init
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/soc21: fix xclk for APUs
Tamir Duberstein <tamird@kernel.org>
scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
Jan Kara <jack@suse.cz>
flex_proportions: make fprop_new_period() hardirq safe
Matthieu Baerts (NGI0) <matttbe@kernel.org>
mptcp: only reset subflow errors when propagated
Kohei Enju <kohei@enjuk.jp>
efivarfs: fix error propagation in efivar_entry_get()
Thomas Fourier <fourier.thomas@gmail.com>
scsi: qla2xxx: edif: Fix dma_free_coherent() size
Zhang Heng <zhangheng@kylinos.cn>
ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
Fabio Estevam <festevam@gmail.com>
ASoC: fsl: imx-card: Do not force slot width to sample width
Han Gao <gaohan@iscas.ac.cn>
riscv: compat: fix COMPAT_UTS_MACHINE definition
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
pinctrl: meson: mark the GPIO controller as sleeping
Sai Sree Kartheek Adivi <s-adivi@ti.com>
dma/pool: distinguish between missing and exhausted atomic pools
Denis Sergeev <denserg.edu@gmail.com>
gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
Tagir Garaev <tgaraev653@gmail.com>
ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
Kery Qi <qikeyu2017@gmail.com>
scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
Martin Kaiser <martin@kaiser.cx>
net: bridge: fix static key check
Kuniyuki Iwashima <kuniyu@google.com>
nfc: nci: Fix race between rfkill and nci_unregister_device().
Gal Pressman <gal@nvidia.com>
net/mlx5e: Account for netdev stats in ndo_get_stats64
Yafang Shao <laoar.shao@gmail.com>
net/mlx5e: Report rx_discards_phy via rx_dropped
Jesse Brandeburg <jbrandeburg@cloudflare.com>
ice: stop counting UDP csum mismatch as rx_errors
Kuniyuki Iwashima <kuniyu@google.com>
nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
Kery Qi <qikeyu2017@gmail.com>
rocker: fix memory leak in rocker_world_port_post_fini()
Kery Qi <qikeyu2017@gmail.com>
net: wwan: t7xx: fix potential skb->frags overflow in RX path
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: use the right ifindex when replying to icmpv6 from localhost
Zilin Guan <zilin@seu.edu.cn>
net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
Eric Dumazet <edumazet@google.com>
bonding: annotate data-races around slave->last_rx
Marc Kleine-Budde <mkl@pengutronix.de>
can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
Zilin Guan <zilin@seu.edu.cn>
net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
Jia-Hong Su <s11242586@gmail.com>
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
SeongJae Park <sj@kernel.org>
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
SeongJae Park <sj@kernel.org>
mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
Paul Chaignon <paul.chaignon@gmail.com>
bpf: Reject narrower access to pointer ctx fields
Daniel Borkmann <daniel@iogearbox.net>
bpf: Do not let BPF test infra emit invalid GSO types to stack
Matthew Wilcox (Oracle) <willy@infradead.org>
migrate: correct lock ordering for hugetlb file folios
Marc Kleine-Budde <mkl@pengutronix.de>
can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <mkl@pengutronix.de>
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <mkl@pengutronix.de>
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
Marc Kleine-Budde <mkl@pengutronix.de>
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
Arnd Bergmann <arnd@arndb.de>
irqchip/gic-v3-its: Avoid truncating memory addresses
Fernand Sieber <sieberf@amazon.com>
perf/x86/intel: Do not enable BTS for guests
Jeongjun Park <aha310510@gmail.com>
netrom: fix double-free in nr_route_frame()
Chenghai Huang <huangchenghai2@huawei.com>
uacce: ensure safe queue release with state management
Yang Shen <shenyang39@huawei.com>
uacce: implement mremap in uacce_vm_ops to return -EPERM
Wenkai Lin <linwenkai6@hisilicon.com>
uacce: fix cdev handling in the cleanup path
Johan Hovold <johan@kernel.org>
intel_th: fix device leak on output open()
Johan Hovold <johan@kernel.org>
slimbus: core: fix device reference leak on report present
Johan Hovold <johan@kernel.org>
slimbus: core: fix runtime PM imbalance on report present
Thomas Fourier <fourier.thomas@gmail.com>
octeontx2: Fix otx2_dma_map_page() error return code
Zhaoyang Huang <zhaoyang.huang@unisoc.com>
arm64: Set __nocfi on swsusp_arch_resume()
Mark Rutland <mark.rutland@arm.com>
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
Marek Vasut <marex@nabladev.com>
wifi: rsi: Fix memory corruption due to not set vif driver data size
Dan Carpenter <dan.carpenter@linaro.org>
wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
Thomas Fourier <fourier.thomas@gmail.com>
wifi: ath10k: fix dma_free_coherent() pointer
Matthew Schwartz <matthew.schwartz@linux.dev>
mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
Berk Cem Goksel <berkcgoksel@gmail.com>
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
Takashi Iwai <tiwai@suse.de>
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
Kübrich, Andreas <andreas.kuebrich@spektra-dresden.de>
iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
Pei Xiao <xiaopei01@kylinos.cn>
iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
Tomas Melin <tomas.melin@vaisala.com>
iio: adc: ad9467: fix ad9434 vref mask
Rob Herring (Arm) <robh@kernel.org>
of: platform: Use default match table for /firmware
Weigang He <geoffreyhe2@gmail.com>
of: fix reference count leak in of_alias_scan()
Hans de Goede <johannes.goede@oss.qualcomm.com>
leds: led-class: Only Add LED to leds_list when it is fully ready
Cedric Xing <cedric.xing@intel.com>
x86: make page fault handling disable interrupts properly
Eric Dumazet <edumazet@google.com>
net/sched: act_ife: avoid possible NULL deref
Melbin K Mathew <mlbnkm1@gmail.com>
vsock/virtio: cap TX credit to local buffer size
Melbin K Mathew <mlbnkm1@gmail.com>
vsock/virtio: fix potential underflow in virtio_transport_get_credit()
Ratheesh Kannoth <rkannoth@marvell.com>
octeontx2-af: Fix error handling
Eric Dumazet <edumazet@google.com>
bonding: provide a net pointer to __skb_flow_dissect()
Taehee Yoo <ap420073@gmail.com>
selftests: net: amt: wait longer for connection before sending packets
Andrey Vatoropin <a.vatoropin@crpt.ru>
be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
Timur Kristóf <timur.kristof@gmail.com>
drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
Timur Kristóf <timur.kristof@gmail.com>
drm/amd/pm: Don't clear SI SMC table when setting power limit
Laurent Vivier <lvivier@redhat.com>
usbnet: limit max_mtu based on device's hard_mtu
Eric Dumazet <edumazet@google.com>
ipv6: annotate data-race in ndisc_router_discovery()
Eric Dumazet <edumazet@google.com>
mISDN: annotate data-race around dev->work
Jijie Shao <shaojijie@huawei.com>
net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
Jijie Shao <shaojijie@huawei.com>
net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
Yun Lu <luyun@kylinos.cn>
netdevsim: fix a race issue related to the operation on bpf_bound_progs list
Arun Raghavan <arunr@valvesoftware.com>
ALSA: usb: Increase volume range that triggers a warning
David Jeffery <djeffery@redhat.com>
scsi: core: Wake up the error handler when final completions race against each other
Naohiko Shimizu <naohiko.shimizu@gmail.com>
riscv: clocksource: Fix stimecmp update hazard on RV32
Arkadiusz Kozdra <floss@arusekk.pl>
kconfig: fix static linking of nconf
Masahiro Yamada <masahiroy@kernel.org>
kconfig: refactor Makefile to reduce process forks
Cheng-Yu Lee <cylee12@realtek.com>
regmap: Fix race condition in hwspinlock irqsave routine
Felix Gu <gu_0233@qq.com>
spi: spi-sprd-adi: Fix double free in probe error path
Yang Yingliang <yangyingliang@huawei.com>
spi: sprd-adi: switch to use spi_alloc_host()
Andrew Davis <afd@ti.com>
spi: sprd: adi: Use devm_register_restart_handler()
Yang Li <yang.lee@linux.alibaba.com>
spi: sprd-adi: Use devm_platform_get_and_ioremap_resource()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
spi: sprd-adi: Convert to platform remove callback returning void
Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
iio: adc: ad7280a: handle spi_setup() errors in probe()
Francesco Lavra <flavra@baylibre.com>
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
Ian Abbott <abbotti@mev.co.uk>
comedi: Fix getting range information for subdevices 16 to 255
Andrew Cooper <andrew.cooper3@citrix.com>
x86/kfence: avoid writing L1TF-vulnerable PTEs
Geraldo Nascimento <geraldogabriel@gmail.com>
arm64: dts: rockchip: remove dangerous max-link-speed from helios64
Long Li <longli@microsoft.com>
scsi: storvsc: Process unsupported MODE_SENSE_10
feng <alec.jiang@gmail.com>
Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
gongqi <550230171hxy@gmail.com>
Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Revert "nfc/nci: Add the inconsistency check between the input data length and count"
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
w1: fix redundant counter decrement in w1_attach_slave_device()
Thorsten Blum <thorsten.blum@linux.dev>
w1: therm: Fix off-by-one buffer overflow in alarms_store
Ian Abbott <abbotti@mev.co.uk>
comedi: dmm32at: serialize use of paged registers
Marnix Rijnart <marnix.rijnart@iwell.eu>
serial: 8250_pci: Fix broken RS485 for F81504/508/512
Taeyang Lee <0wn@theori.io>
crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: Enforce that teql can only be used as root qdisc
Alok Tiwari <alok.a.tiwari@oracle.com>
octeontx2: cn10k: fix RX flowid TCAM mask handling
Dmitry Skorodumov <dskr99@gmail.com>
ipvlan: Make the addrs_lock be per port
Eric Dumazet <edumazet@google.com>
l2tp: avoid one data-race in l2tp_tunnel_del_work()
Kuniyuki Iwashima <kuniyu@google.com>
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
Jakub Kicinski <kuba@kernel.org>
net: fou: use policy and operation tables generated from the spec
Jakub Kicinski <kuba@kernel.org>
net: fou: rename the source for linking
Jakub Kicinski <kuba@kernel.org>
netlink: add a proto specification for FOU
Kuniyuki Iwashima <kuniyu@google.com>
gue: Fix skb memleak with inner IP protocol 0.
Raju Rangoju <Raju.Rangoju@amd.com>
amd-xgbe: avoid misleading per-packet error log
Xin Long <lucien.xin@gmail.com>
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
Marc Kleine-Budde <mkl@pengutronix.de>
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
Ricardo B. Marlière <rbm@suse.com>
selftests: net: fib-onlink-tests: Convert to use namespaces by default
Hangbin Liu <liuhangbin@gmail.com>
selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
Eric Dumazet <edumazet@google.com>
bonding: limit BOND_MODE_8023AD to Ethernet devices
Ethan Nelson-Moore <enelsonmoore@gmail.com>
net: usb: dm9601: remove broken SR9700 support
Niklas Cassel <cassel@kernel.org>
ata: libata: Print features also for ATAPI devices
Niklas Cassel <cassel@kernel.org>
ata: libata: Call ata_dev_config_lpm() for ATAPI devices
Damien Le Moal <dlemoal@kernel.org>
ata: libata-core: Introduce ata_dev_config_lpm()
Damien Le Moal <damien.lemoal@opensource.wdc.com>
ata: libata: cleanup fua support detection
Damien Le Moal <damien.lemoal@opensource.wdc.com>
ata: libata: Introduce ata_ncq_supported()
Niklas Cassel <cassel@kernel.org>
ata: libata: Add cpr_log to ata_dev_print_features() early return
Mark Harmstone <mark@harmstone.com>
btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
Wojtek Wasko <wwasko@nvidia.com>
testptp: Add option to open PHC in readonly mode
Mahesh Bandewar <maheshb@google.com>
selftest/ptp: update ptp selftest to exercise the gettimex options
Xabier Marquiegui <reibax@gmail.com>
ptp: add testptp mask test
Alex Maftei <alex.maftei@amd.com>
selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
Alex Maftei <alex.maftei@amd.com>
selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
Rahul Rameshbabu <rrameshbabu@nvidia.com>
testptp: Add support for testing ptp_clock_info .adjphase callback
Wojtek Wasko <wwasko@nvidia.com>
ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
Wojtek Wasko <wwasko@nvidia.com>
posix-clock: Store file pointer in struct posix_clock_context
Linus Torvalds <torvalds@linux-foundation.org>
Fix memory leak in posix_clock_open()
Xabier Marquiegui <reibax@gmail.com>
posix-clock: introduce posix_clock_context concept
Ming Lei <ming.lei@redhat.com>
io_uring: move local task_work in exit cancel loop
Robbie Ko <robbieko@synology.com>
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
Johan Hovold <johan@kernel.org>
dmaengine: ti: k3-udma: fix device leak on udma lookup
Johan Hovold <johan@kernel.org>
dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
Johan Hovold <johan@kernel.org>
dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
Biju Das <biju.das.jz@bp.renesas.com>
dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
Miaoqian Lin <linmq006@gmail.com>
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
Johan Hovold <johan@kernel.org>
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
Johan Hovold <johan@kernel.org>
dmaengine: idxd: fix device leaks on compat bind and unbind
Johan Hovold <johan@kernel.org>
dmaengine: dw: dmamux: fix OF node leak on route allocation failure
Johan Hovold <johan@kernel.org>
dmaengine: bcm-sba-raid: fix device leak on probe
Johan Hovold <johan@kernel.org>
dmaengine: at_hdmac: fix device leak on of_dma_xlate()
Janne Grunau <j@jannau.net>
dmaengine: apple-admac: Add "apple,t8103-admac" compatible
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
Marek Vasut <marex@nabladev.com>
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
Lyude Paul <lyude@redhat.com>
drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
Mario Limonciello (AMD) <superm1@kernel.org>
drm/amd: Clean up kfd node on surprise disconnect
Lisa Robinson <lisa@bytefly.space>
LoongArch: Fix PMU counter allocation for mixed-type event groups
SeongJae Park <sj@kernel.org>
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
Aboorva Devarajan <aboorvad@linux.ibm.com>
mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
Xiaochen Shen <shenxiaochen@open-hieco.net>
x86/resctrl: Fix memory bandwidth counter width for Hygon
Xiaochen Shen <shenxiaochen@open-hieco.net>
x86/resctrl: Add missing resctrl initialization for Hygon
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
EDAC/i3200: Fix a resource leak in i3200_probe1()
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
EDAC/x38: Fix a resource leak in x38_probe1()
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
hrtimer: Fix softirq base check in update_needs_ipi()
Yang Erkun <yangerkun@huawei.com>
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
Ilikara Zheng <ilikara@aosc.io>
nvme-pci: disable secondary temp for Wodposit WPBSNM8
Ethan Nelson-Moore <enelsonmoore@gmail.com>
USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
Ulrich Mohr <u.mohr@semex-engcon.com>
USB: serial: option: add Telit LE910 MBIM composition
Huacai Chen <chenhuacai@kernel.org>
USB: OHCI/UHCI: Add soft dependencies on ehci_platform
Johannes Brüderl <johannes.bruederl@gmail.com>
usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: dwc3: Check for USB4 IP_NAME
Wayne Chang <waynec@nvidia.com>
phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
Louis Chauvet <louis.chauvet@bootlin.com>
phy: rockchip: inno-usb2: fix disconnection in gadget mode
Rafael Beims <rafael.beims@toradex.com>
phy: freescale: imx8m-pcie: assert phy reset during power on
Luca Ceresoli <luca.ceresoli@bootlin.com>
phy: rockchip: inno-usb2: fix communication disruption in gadget mode
Dan Williams <dan.j.williams@intel.com>
x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
Ondrej Ille <ondrej.ille@gmail.com>
can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
Marc Kleine-Budde <mkl@pengutronix.de>
can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
Jaroslav Kysela <perex@perex.cz>
ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
Brian Kao <powenkao@google.com>
scsi: core: Fix error handler encryption support
Benjamin Tissoires <bentiss@kernel.org>
HID: usbhid: paper over wrong bNumDescriptor field
Haotian Zhang <vulab@iscas.ac.cn>
dmaengine: omap-dma: fix dma_pool resource leak in error paths
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
Dan Carpenter <dan.carpenter@linaro.org>
phy: stm32-usphyc: Fix off by one in probe()
Suraj Gupta <suraj.gupta2@amd.com>
dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
Sheetal <sheetal@nvidia.com>
dmaengine: tegra-adma: Fix use-after-free
Bagas Sanjaya <bagasdotme@gmail.com>
mm, kfence: describe @slab parameter in __kfence_obj_info()
Bagas Sanjaya <bagasdotme@gmail.com>
textsearch: describe @list member in ts_ops search
Emil Svendsen <emas@bang-olufsen.dk>
ASoC: tlv320adcx140: fix word length
Emil Svendsen <emas@bang-olufsen.dk>
ASoC: tlv320adcx140: fix null pointer
Eric Dumazet <edumazet@google.com>
net/sched: sch_qfq: do not free existing class in qfq_change_class()
Gal Pressman <gal@nvidia.com>
selftests: drv-net: fix RPS mask handling for high CPU numbers
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: Fix use-after-free in inet6_addr_del().
Aditya Garg <gargaditya@linux.microsoft.com>
net: hv_netvsc: reject RSS hash key programming without RX indirection table
Shradha Gupta <shradhagupta@linux.microsoft.com>
hv_netvsc: Allocate rx indirection table size dynamically
Jiasheng Jiang <jiashengjiangcool@gmail.com>
btrfs: fix memory leaks in create_space_info() error paths
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: introduce btrfs_space_info sub-group
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
Naohiro Aota <naohiro.aota@wdc.com>
btrfs: factor out init_space_info() from create_space_info()
Boris Burkov <boris@bur.io>
btrfs: store fs_info in space_info
Josef Bacik <josef@toxicpanda.com>
btrfs: move flush related definitions to space-info.h
Saeed Mahameed <saeedm@nvidia.com>
net/mlx5e: Restore destroying state bit after profile cleanup
Stefano Garzarella <sgarzare@redhat.com>
vsock/test: add a final full barrier after run all tests
Eric Dumazet <edumazet@google.com>
ipv4: ip_gre: make ipgre_header() robust
Eric Dumazet <edumazet@google.com>
macvlan: fix possible UAF in macvlan_forward_source()
Eric Dumazet <edumazet@google.com>
net: update netdev_lock_{type,name}
Eric Dumazet <edumazet@google.com>
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
Qu Wenruo <wqu@suse.com>
btrfs: send: check for inline extents in range_is_hole_in_parent()
Shivam Kumar <kumar.shivam43666@gmail.com>
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Maurizio Lombardi <mlombard@redhat.com>
nvmet-tcp: remove boilerplate code
Szymon Wilczek <swilczek.lx@gmail.com>
can: etas_es58x: allow partial RX URB allocation to succeed
Zilin Guan <zilin@seu.edu.cn>
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
Jianbo Liu <jianbol@nvidia.com>
xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
Andreas Gruenbacher <agruenba@redhat.com>
Revert "gfs2: Fix use of bio_chain"
Morduan Zang <zhangdandan@uniontech.com>
efi/cper: Fix cper_bits_to_str buffer handling and return value
Peng Fan <peng.fan@nxp.com>
firmware: imx: scu-irq: Set mu_resource_id before get handle
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 3 +
Documentation/netlink/specs/fou.yaml | 130 ++++++++++++++
Makefile | 4 +-
arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 16 +-
.../boot/dts/rockchip/rk3399-kobol-helios64.dts | 1 -
arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 1 -
arch/arm64/kernel/hibernate.c | 2 +-
arch/arm64/kernel/signal.c | 26 ++-
arch/loongarch/kernel/perf_event.c | 21 ++-
arch/riscv/include/asm/compat.h | 2 +-
arch/x86/events/perf_event.h | 13 +-
arch/x86/include/asm/kfence.h | 29 ++-
arch/x86/kernel/cpu/resctrl/core.c | 21 ++-
arch/x86/kernel/cpu/resctrl/internal.h | 3 +
arch/x86/kernel/fpu/core.c | 32 +++-
arch/x86/kvm/x86.c | 9 +
arch/x86/mm/fault.c | 15 +-
arch/x86/mm/kaslr.c | 10 +-
block/blk-cgroup.c | 4 +
crypto/authencesn.c | 6 +
drivers/ata/libata-core.c | 62 ++++++-
drivers/ata/libata-scsi.c | 30 +---
drivers/base/regmap/regmap.c | 4 +-
drivers/block/xen-blkback/xenbus.c | 4 +-
drivers/block/xen-blkfront.c | 3 +-
drivers/bluetooth/hci_ldisc.c | 4 +-
drivers/char/tpm/xen-tpmfront.c | 3 +-
drivers/clocksource/timer-riscv.c | 3 +-
drivers/comedi/comedi_fops.c | 2 +-
drivers/comedi/drivers/dmm32at.c | 32 +++-
drivers/comedi/range.c | 2 +-
drivers/crypto/qat/qat_common/adf_common_drv.h | 1 +
drivers/crypto/qat/qat_common/adf_init.c | 1 +
drivers/crypto/qat/qat_common/adf_isr.c | 5 +
drivers/dma/apple-admac.c | 1 +
drivers/dma/at_hdmac.c | 9 +-
drivers/dma/bcm-sba-raid.c | 6 +-
drivers/dma/dw/rzn1-dmamux.c | 4 +-
drivers/dma/idxd/compat.c | 23 ++-
drivers/dma/lpc18xx-dmamux.c | 19 +-
drivers/dma/qcom/gpi.c | 6 +-
drivers/dma/sh/rz-dmac.c | 5 +
drivers/dma/stm32-dmamux.c | 22 ++-
drivers/dma/tegra210-adma.c | 10 +-
drivers/dma/ti/dma-crossbar.c | 18 +-
drivers/dma/ti/k3-udma-private.c | 2 +-
drivers/dma/ti/omap-dma.c | 4 +
drivers/dma/xilinx/xilinx_dma.c | 7 +-
drivers/edac/i3200_edac.c | 11 +-
drivers/edac/x38_edac.c | 9 +-
drivers/firmware/efi/cper.c | 2 +-
drivers/firmware/imx/imx-scu-irq.c | 24 +--
drivers/gpio/gpio-rockchip.c | 8 -
drivers/gpio/gpiolib-acpi.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 10 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 5 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 +-
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 18 +-
.../amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +-
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 23 +--
drivers/gpu/drm/imx/imx-tve.c | 13 ++
drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 +
drivers/gpu/drm/panel/panel-simple.c | 1 +
drivers/gpu/drm/radeon/radeon_fence.c | 8 -
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +-
drivers/gpu/drm/xen/xen_drm_front.c | 3 +-
drivers/hid/usbhid/hid-core.c | 17 +-
drivers/hwtracing/intel_th/core.c | 19 +-
drivers/iio/adc/ad7280a.c | 4 +-
drivers/iio/adc/ad9467.c | 2 +-
drivers/iio/adc/at91-sama5d2_adc.c | 1 +
drivers/iio/adc/exynos_adc.c | 13 +-
drivers/iio/chemical/scd4x.c | 6 +-
drivers/iio/dac/ad5686.c | 6 +
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +-
drivers/input/misc/xen-kbdfront.c | 5 +-
drivers/input/serio/i8042-acpipnpio.h | 18 ++
drivers/irqchip/irq-gic-v3-its.c | 8 +-
drivers/isdn/mISDN/timerdev.c | 13 +-
drivers/leds/led-class.c | 10 +-
drivers/misc/mei/mei-trace.h | 18 +-
drivers/misc/uacce/uacce.c | 42 ++++-
drivers/mmc/host/rtsx_pci_sdmmc.c | 41 +++++
drivers/mmc/host/sdhci-of-dwcmshc.c | 20 ++-
drivers/net/bonding/bond_main.c | 29 +--
drivers/net/bonding/bond_options.c | 8 +-
drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +-
drivers/net/can/usb/ems_usb.c | 8 +-
drivers/net/can/usb/esd_usb.c | 9 +-
drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +-
drivers/net/can/usb/gs_usb.c | 11 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 +-
drivers/net/can/usb/mcba_usb.c | 8 +-
drivers/net/can/usb/usb_8dev.c | 8 +-
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +-
drivers/net/ethernet/emulex/benet/be_cmds.c | 3 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +-
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
drivers/net/ethernet/intel/ice/ice_main.c | 1 -
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +-
drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 86 ++++++---
.../ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 2 +-
.../ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 22 ++-
.../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +-
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 19 --
drivers/net/ethernet/rocker/rocker_main.c | 5 +-
drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 5 +
.../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 5 +
drivers/net/hyperv/hyperv_net.h | 5 +-
drivers/net/hyperv/netvsc_drv.c | 13 +-
drivers/net/hyperv/rndis_filter.c | 29 ++-
drivers/net/ipvlan/ipvlan.h | 2 +-
drivers/net/ipvlan/ipvlan_core.c | 16 +-
drivers/net/ipvlan/ipvlan_main.c | 49 +++---
drivers/net/macvlan.c | 20 ++-
drivers/net/netdevsim/bpf.c | 6 +
drivers/net/netdevsim/dev.c | 2 +
drivers/net/netdevsim/netdevsim.h | 1 +
drivers/net/team/team.c | 23 ++-
drivers/net/usb/dm9601.c | 4 -
drivers/net/usb/usbnet.c | 11 +-
drivers/net/wireless/ath/ath10k/ce.c | 16 +-
.../net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +-
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +-
drivers/net/xen-netback/xenbus.c | 3 +-
drivers/net/xen-netfront.c | 4 +-
drivers/nfc/virtual_ncidev.c | 4 -
drivers/nvme/host/fabrics.c | 15 ++
drivers/nvme/host/fabrics.h | 1 +
drivers/nvme/host/fc.c | 5 +-
drivers/nvme/host/nvme.h | 14 +-
drivers/nvme/host/pci.c | 41 +++++
drivers/nvme/host/rdma.c | 1 +
drivers/nvme/host/tcp.c | 1 +
drivers/nvme/target/tcp.c | 28 ++-
drivers/of/base.c | 8 +-
drivers/of/platform.c | 2 +-
drivers/pci/Kconfig | 6 -
drivers/pci/xen-pcifront.c | 4 +-
drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +-
drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 +-
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 56 +++---
drivers/phy/st/phy-stm32-usbphyc.c | 2 +-
drivers/phy/tegra/xusb-tegra186.c | 3 +
drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
drivers/pinctrl/pinctrl-rockchip.c | 9 +-
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 ++
drivers/ptp/ptp_chardev.c | 37 +++-
drivers/ptp/ptp_private.h | 16 +-
drivers/scsi/be2iscsi/be_mgmt.c | 1 +
drivers/scsi/qla2xxx/qla_os.c | 2 +-
drivers/scsi/scsi_error.c | 35 +++-
drivers/scsi/scsi_lib.c | 8 +
drivers/scsi/storvsc_drv.c | 3 +-
drivers/scsi/xen-scsifront.c | 4 +-
drivers/slimbus/core.c | 19 +-
drivers/soc/imx/imx8m-blk-ctrl.c | 11 +-
drivers/spi/spi-sprd-adi.c | 67 ++-----
drivers/target/sbp/sbp_target.c | 4 +-
drivers/tty/hvc/hvc_xen.c | 4 +-
drivers/tty/serial/8250/8250_pci.c | 2 +-
drivers/usb/core/config.c | 5 +
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc3/core.c | 2 +
drivers/usb/dwc3/core.h | 1 +
drivers/usb/host/ohci-platform.c | 1 +
drivers/usb/host/uhci-platform.c | 1 +
drivers/usb/host/xen-hcd.c | 4 +-
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 2 +
drivers/usb/serial/option.c | 1 +
drivers/vhost/scsi.c | 24 +--
drivers/video/fbdev/xen-fbfront.c | 6 +-
drivers/w1/slaves/w1_therm.c | 60 ++-----
drivers/w1/w1.c | 2 -
drivers/xen/pvcalls-back.c | 3 +-
drivers/xen/pvcalls-front.c | 3 +-
drivers/xen/xen-pciback/xenbus.c | 4 +-
drivers/xen/xen-scsiback.c | 5 +-
fs/btrfs/block-group.c | 60 ++++---
fs/btrfs/ctree.h | 59 -------
fs/btrfs/delayed-inode.c | 1 +
fs/btrfs/disk-io.c | 2 +-
fs/btrfs/inode-item.c | 1 +
fs/btrfs/props.c | 1 +
fs/btrfs/relocation.c | 14 ++
fs/btrfs/send.c | 2 +
fs/btrfs/space-info.c | 76 ++++++--
fs/btrfs/space-info.h | 69 ++++++++
fs/btrfs/sysfs.c | 18 +-
fs/btrfs/transaction.c | 11 +-
fs/efivarfs/vars.c | 2 +-
fs/ext4/xattr.c | 1 +
fs/fs-writeback.c | 14 +-
fs/gfs2/log.c | 3 +-
fs/gfs2/lops.c | 2 +-
fs/gfs2/super.c | 4 +
fs/iomap/buffered-io.c | 2 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +-
fs/nfsd/nfsctl.c | 17 +-
fs/ntfs3/inode.c | 7 +-
fs/smb/server/mgmt/user_session.c | 35 ++--
fs/smb/server/mgmt/user_session.h | 1 +
fs/smb/server/smb2pdu.c | 9 +-
fs/smb/server/transport_ipc.c | 12 ++
fs/smb/server/transport_rdma.c | 15 +-
fs/xfs/libxfs/xfs_ialloc.c | 11 +-
include/linux/kfence.h | 1 +
include/linux/libata.h | 36 ++--
include/linux/nvme.h | 3 +
include/linux/posix-clock.h | 39 ++++-
include/linux/textsearch.h | 1 +
include/linux/usb/quirks.h | 3 +
include/net/bonding.h | 13 +-
include/net/nfc/nfc.h | 2 +
include/scsi/scsi_eh.h | 6 +
include/sound/pcm.h | 2 +-
include/uapi/linux/comedi.h | 2 +-
include/xen/xenbus.h | 2 +-
io_uring/io_uring.c | 8 +-
kernel/bpf/cgroup.c | 8 +-
kernel/dma/pool.c | 7 +-
kernel/irq/irq_sim.c | 2 +-
kernel/time/hrtimer.c | 2 +-
kernel/time/posix-clock.c | 53 ++++--
lib/flex_proportions.c | 5 +-
mm/Kconfig | 10 +-
mm/damon/sysfs.c | 15 +-
mm/kfence/core.c | 23 ++-
mm/kmsan/shadow.c | 3 +-
mm/migrate.c | 12 +-
mm/mprotect.c | 101 ++++++-----
mm/page_alloc.c | 47 ++++-
mm/rmap.c | 20 +--
net/9p/trans_xen.c | 3 +-
net/bpf/test_run.c | 5 +
net/bridge/br_input.c | 2 +-
net/can/j1939/transport.c | 10 +-
net/core/dev.c | 25 ++-
net/core/filter.c | 25 ++-
net/ipv4/Makefile | 1 +
net/ipv4/esp4_offload.c | 4 +-
net/ipv4/{fou.c => fou_core.c} | 50 ++----
net/ipv4/fou_nl.c | 48 +++++
net/ipv4/fou_nl.h | 25 +++
net/ipv4/ip_gre.c | 11 +-
net/ipv6/addrconf.c | 4 +-
net/ipv6/esp6_offload.c | 4 +-
net/ipv6/icmp.c | 4 +-
net/ipv6/ip6_tunnel.c | 2 +-
net/ipv6/ndisc.c | 4 +-
net/l2tp/l2tp_core.c | 4 +-
net/mac80211/ibss.c | 8 +-
net/mac80211/ieee80211_i.h | 6 +-
net/mac80211/iface.c | 10 +-
net/mac80211/mesh.c | 10 +-
net/mac80211/mesh_hwmp.c | 6 +-
net/mac80211/mlme.c | 13 +-
net/mac80211/ocb.c | 6 +-
net/mac80211/rx.c | 2 +-
net/mac80211/scan.c | 2 +-
net/mac80211/status.c | 6 +-
net/mac80211/tdls.c | 11 +-
net/mac80211/util.c | 2 +-
net/mptcp/protocol.c | 13 +-
net/netrom/nr_route.c | 13 +-
net/nfc/core.c | 27 ++-
net/nfc/llcp_commands.c | 17 +-
net/nfc/llcp_core.c | 4 +-
net/nfc/nci/core.c | 4 +-
net/sched/act_ife.c | 12 +-
net/sched/sch_qfq.c | 8 +-
net/sched/sch_teql.c | 5 +
net/sctp/input.c | 2 +-
net/sctp/sm_statefuns.c | 10 +-
net/vmw_vsock/virtio_transport_common.c | 30 +++-
scripts/generate_rust_analyzer.py | 2 +-
scripts/kconfig/.gitignore | 4 +-
scripts/kconfig/Makefile | 45 ++---
scripts/kconfig/gconf-cfg.sh | 7 +-
scripts/kconfig/mconf-cfg.sh | 25 +--
scripts/kconfig/nconf-cfg.sh | 28 +--
scripts/kconfig/qconf-cfg.sh | 10 +-
scripts/remove-stale-files | 2 +
sound/core/oss/pcm_oss.c | 4 +-
sound/core/pcm_native.c | 9 +-
sound/pci/ctxfi/ctamixer.c | 2 +
sound/soc/amd/yc/acp6x-mach.c | 8 +
sound/soc/codecs/tlv320adcx140.c | 8 +-
sound/soc/codecs/wsa881x.c | 54 ++++--
sound/soc/codecs/wsa883x.c | 9 +
sound/soc/fsl/imx-card.c | 1 -
sound/soc/intel/boards/sof_es8336.c | 2 +-
sound/usb/mixer.c | 22 ++-
sound/usb/mixer_scarlett2.c | 7 +-
sound/xen/xen_snd_front.c | 3 +-
tools/testing/selftests/net/amt.sh | 7 +-
tools/testing/selftests/net/fib-onlink-tests.sh | 76 ++++----
tools/testing/selftests/net/toeplitz.c | 4 +-
tools/testing/selftests/ptp/testptp.c | 194 +++++++++++++++++++--
tools/testing/vsock/util.c | 12 ++
306 files changed, 2737 insertions(+), 1248 deletions(-)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 001/280] firmware: imx: scu-irq: Set mu_resource_id before get handle
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 002/280] efi/cper: Fix cper_bits_to_str buffer handling and return value Greg Kroah-Hartman
` (283 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Peng Fan, Shawn Guo,
Ben Hutchings
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
commit ff3f9913bc0749364fbfd86ea62ba2d31c6136c8 upstream.
mu_resource_id is referenced in imx_scu_irq_get_status() and
imx_scu_irq_group_enable() which could be used by other modules, so
need to set correct value before using imx_sc_irq_ipc_handle in
SCU API call.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Fixes: 81fb53feb66a ("firmware: imx: scu-irq: Init workqueue before request mbox channel")
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/imx/imx-scu-irq.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/firmware/imx/imx-scu-irq.c
+++ b/drivers/firmware/imx/imx-scu-irq.c
@@ -137,6 +137,18 @@ int imx_scu_enable_general_irq_channel(s
struct mbox_chan *ch;
int ret = 0, i = 0;
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+ of_node_put(spec.np);
+ }
+
+ /* use mu1 as general mu irq channel if failed */
+ if (i < 0)
+ i = 1;
+
+ mu_resource_id = IMX_SC_R_MU_0A + i;
+
ret = imx_scu_get_handle(&imx_sc_irq_ipc_handle);
if (ret)
return ret;
@@ -159,18 +171,6 @@ int imx_scu_enable_general_irq_channel(s
return ret;
}
- if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
- "#mbox-cells", 0, &spec)) {
- i = of_alias_get_id(spec.np, "mu");
- of_node_put(spec.np);
- }
-
- /* use mu1 as general mu irq channel if failed */
- if (i < 0)
- i = 1;
-
- mu_resource_id = IMX_SC_R_MU_0A + i;
-
return ret;
}
EXPORT_SYMBOL(imx_scu_enable_general_irq_channel);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 002/280] efi/cper: Fix cper_bits_to_str buffer handling and return value
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 001/280] firmware: imx: scu-irq: Set mu_resource_id before get handle Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 003/280] Revert "gfs2: Fix use of bio_chain" Greg Kroah-Hartman
` (282 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Morduan Zang, Ard Biesheuvel
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Morduan Zang <zhangdandan@uniontech.com>
commit d7f1b4bdc7108be1b178e1617b5f45c8918e88d7 upstream.
The return value calculation was incorrect: `return len - buf_size;`
Initially `len = buf_size`, then `len` decreases with each operation.
This results in a negative return value on success.
Fix by returning `buf_size - len` which correctly calculates the actual
number of bytes written.
Fixes: a976d790f494 ("efi/cper: Add a new helper function to print bitmasks")
Signed-off-by: Morduan Zang <zhangdandan@uniontech.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efi/cper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -161,7 +161,7 @@ int cper_bits_to_str(char *buf, int buf_
len -= size;
str += size;
}
- return len - buf_size;
+ return buf_size - len;
}
EXPORT_SYMBOL_GPL(cper_bits_to_str);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 003/280] Revert "gfs2: Fix use of bio_chain"
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 001/280] firmware: imx: scu-irq: Set mu_resource_id before get handle Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 002/280] efi/cper: Fix cper_bits_to_str buffer handling and return value Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 004/280] xfrm: Fix inner mode lookup in tunnel mode GSO segmentation Greg Kroah-Hartman
` (281 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
commit 469d71512d135907bf5ea0972dfab8c420f57848 upstream.
This reverts commit 8a157e0a0aa5143b5d94201508c0ca1bb8cfb941.
That commit incorrectly assumed that the bio_chain() arguments were
swapped in gfs2. However, gfs2 intentionally constructs bio chains so
that the first bio's bi_end_io callback is invoked when all bios in the
chain have completed, unlike bio chains where the last bio's callback is
invoked.
Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/gfs2/lops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -491,7 +491,7 @@ static struct bio *gfs2_chain_bio(struct
new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
bio_clone_blkg_association(new, prev);
new->bi_iter.bi_sector = bio_end_sector(prev);
- bio_chain(prev, new);
+ bio_chain(new, prev);
submit_bio(prev);
return new;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 004/280] xfrm: Fix inner mode lookup in tunnel mode GSO segmentation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 003/280] Revert "gfs2: Fix use of bio_chain" Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 005/280] pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() Greg Kroah-Hartman
` (280 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianbo Liu, Sabrina Dubroca,
Steffen Klassert, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <jianbol@nvidia.com>
[ Upstream commit 3d5221af9c7711b7aec8da1298c8fc393ef6183d ]
Commit 61fafbee6cfe ("xfrm: Determine inner GSO type from packet inner
protocol") attempted to fix GSO segmentation by reading the inner
protocol from XFRM_MODE_SKB_CB(skb)->protocol. This was incorrect
because the field holds the inner L4 protocol (TCP/UDP) instead of the
required tunnel protocol. Also, the memory location (shared by
XFRM_SKB_CB(skb) which could be overwritten by xfrm_replay_overflow())
is prone to corruption. This combination caused the kernel to select
the wrong inner mode and get the wrong address family.
The correct value is in xfrm_offload(skb)->proto, which is set from
the outer tunnel header's protocol field by esp[4|6]_gso_encap(). It
is initialized by xfrm[4|6]_tunnel_encap_add() to either IPPROTO_IPIP
or IPPROTO_IPV6, using xfrm_af2proto() and correctly reflects the
inner packet's address family.
Fixes: 61fafbee6cfe ("xfrm: Determine inner GSO type from packet inner protocol")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/esp4_offload.c | 4 ++--
net/ipv6/esp6_offload.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index cbfc8b5b15bd2..8d6a40054eaab 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -110,8 +110,8 @@ static struct sk_buff *xfrm4_tunnel_gso_segment(struct xfrm_state *x,
struct sk_buff *skb,
netdev_features_t features)
{
- const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x,
- XFRM_MODE_SKB_CB(skb)->protocol);
+ struct xfrm_offload *xo = xfrm_offload(skb);
+ const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x, xo->proto);
__be16 type = inner_mode->family == AF_INET6 ? htons(ETH_P_IPV6)
: htons(ETH_P_IP);
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 65d628e500059..460cf1dab9da2 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -145,8 +145,8 @@ static struct sk_buff *xfrm6_tunnel_gso_segment(struct xfrm_state *x,
struct sk_buff *skb,
netdev_features_t features)
{
- const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x,
- XFRM_MODE_SKB_CB(skb)->protocol);
+ struct xfrm_offload *xo = xfrm_offload(skb);
+ const struct xfrm_mode *inner_mode = xfrm_ip2inner_mode(x, xo->proto);
__be16 type = inner_mode->family == AF_INET ? htons(ETH_P_IP)
: htons(ETH_P_IPV6);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 005/280] pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 004/280] xfrm: Fix inner mode lookup in tunnel mode GSO segmentation Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 006/280] can: etas_es58x: allow partial RX URB allocation to succeed Greg Kroah-Hartman
` (279 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Trond Myklebust,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 0c728083654f0066f5e10a1d2b0bd0907af19a58 ]
In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,
the function jumps to the out_scratch label without freeing the already
allocated dsaddrs list, leading to a memory leak.
Fix this by jumping to the out_err_drain_dsaddrs label, which properly
frees the dsaddrs list before cleaning up other resources.
Fixes: d67ae825a59d6 ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 95d5dca671456..ed18e9e87c25f 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -103,7 +103,7 @@ nfs4_ff_alloc_deviceid_node(struct nfs_server *server, struct pnfs_device *pdev,
sizeof(struct nfs4_ff_ds_version),
gfp_flags);
if (!ds_versions)
- goto out_scratch;
+ goto out_err_drain_dsaddrs;
for (i = 0; i < version_count; i++) {
/* 20 = version(4) + minor_version(4) + rsize(4) + wsize(4) +
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 006/280] can: etas_es58x: allow partial RX URB allocation to succeed
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 005/280] pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 007/280] nvmet-tcp: remove boilerplate code Greg Kroah-Hartman
` (278 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e8cb6691a7cf68256cb8,
Szymon Wilczek, Vincent Mailhol, Marc Kleine-Budde, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szymon Wilczek <swilczek.lx@gmail.com>
[ Upstream commit b1979778e98569c1e78c2c7f16bb24d76541ab00 ]
When es58x_alloc_rx_urbs() fails to allocate the requested number of
URBs but succeeds in allocating some, it returns an error code.
This causes es58x_open() to return early, skipping the cleanup label
'free_urbs', which leads to the anchored URBs being leaked.
As pointed out by maintainer Vincent Mailhol, the driver is designed
to handle partial URB allocation gracefully. Therefore, partial
allocation should not be treated as a fatal error.
Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been
allocated, restoring the intended behavior and preventing the leak
in es58x_open().
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e8cb6691a7cf68256cb8
Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20251223011732.39361-1-swilczek.lx@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index 41bea531234db..6995fbce829ad 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -1735,7 +1735,7 @@ static int es58x_alloc_rx_urbs(struct es58x_device *es58x_dev)
dev_dbg(dev, "%s: Allocated %d rx URBs each of size %u\n",
__func__, i, rx_buf_len);
- return ret;
+ return 0;
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 007/280] nvmet-tcp: remove boilerplate code
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 006/280] can: etas_es58x: allow partial RX URB allocation to succeed Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 008/280] nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Greg Kroah-Hartman
` (277 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Sagi Grimberg,
Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit 75011bd0f9c55db523242f9f9a0b0b826165f14b ]
Simplify the nvmet_tcp_handle_h2c_data_pdu() function by removing
boilerplate code.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 32b63acd78f5 ("nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index eee052dbf80c1..8fc626ddc1275 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -930,8 +930,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
if (unlikely(data->ttag >= queue->nr_cmds)) {
pr_err("queue %d: received out of bound ttag %u, nr_cmds %u\n",
queue->idx, data->ttag, queue->nr_cmds);
- nvmet_tcp_fatal_error(queue);
- return -EPROTO;
+ goto err_proto;
}
cmd = &queue->cmds[data->ttag];
} else {
@@ -942,9 +941,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
pr_err("ttag %u unexpected data offset %u (expected %u)\n",
data->ttag, le32_to_cpu(data->data_offset),
cmd->rbytes_done);
- /* FIXME: use path and transport errors */
- nvmet_tcp_fatal_error(queue);
- return -EPROTO;
+ goto err_proto;
}
exp_data_len = le32_to_cpu(data->hdr.plen) -
@@ -957,9 +954,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
cmd->pdu_len == 0 ||
cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) {
pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);
- /* FIXME: use proper transport errors */
- nvmet_tcp_fatal_error(queue);
- return -EPROTO;
+ goto err_proto;
}
cmd->pdu_recv = 0;
nvmet_tcp_build_pdu_iovec(cmd);
@@ -967,6 +962,11 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
queue->rcv_state = NVMET_TCP_RECV_DATA;
return 0;
+
+err_proto:
+ /* FIXME: use proper transport errors */
+ nvmet_tcp_fatal_error(queue);
+ return -EPROTO;
}
static int nvmet_tcp_done_recv_pdu(struct nvmet_tcp_queue *queue)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 008/280] nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 007/280] nvmet-tcp: remove boilerplate code Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 009/280] btrfs: send: check for inline extents in range_is_hole_in_parent() Greg Kroah-Hartman
` (276 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Shivam Kumar,
Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <kumar.shivam43666@gmail.com>
[ Upstream commit 32b63acd78f577b332d976aa06b56e70d054cbba ]
Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length")
added ttag bounds checking and data_offset
validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate
whether the command's data structures (cmd->req.sg and cmd->iov) have
been properly initialized before processing H2C_DATA PDUs.
The nvmet_tcp_build_pdu_iovec() function dereferences these pointers
without NULL checks. This can be triggered by sending H2C_DATA PDU
immediately after the ICREQ/ICRESP handshake, before
sending a CONNECT command or NVMe write command.
Attack vectors that trigger NULL pointer dereferences:
1. H2C_DATA PDU sent before CONNECT → both pointers NULL
2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL
3. H2C_DATA PDU for uninitialized command slot → both pointers NULL
The fix validates both cmd->req.sg and cmd->iov before calling
nvmet_tcp_build_pdu_iovec(). Both checks are required because:
- Uninitialized commands: both NULL
- READ commands: cmd->req.sg allocated, cmd->iov NULL
- WRITE commands: both allocated
Fixes: efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length")
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 8fc626ddc1275..7fae0103a515b 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -956,6 +956,18 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);
goto err_proto;
}
+ /*
+ * Ensure command data structures are initialized. We must check both
+ * cmd->req.sg and cmd->iov because they can have different NULL states:
+ * - Uninitialized commands: both NULL
+ * - READ commands: cmd->req.sg allocated, cmd->iov NULL
+ * - WRITE commands: both allocated
+ */
+ if (unlikely(!cmd->req.sg || !cmd->iov)) {
+ pr_err("queue %d: H2CData PDU received for invalid command state (ttag %u)\n",
+ queue->idx, data->ttag);
+ goto err_proto;
+ }
cmd->pdu_recv = 0;
nvmet_tcp_build_pdu_iovec(cmd);
queue->cmd = cmd;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 009/280] btrfs: send: check for inline extents in range_is_hole_in_parent()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 008/280] nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 010/280] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Greg Kroah-Hartman
` (275 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Qu Wenruo,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 08b096c1372cd69627f4f559fb47c9fb67a52b39 ]
Before accessing the disk_bytenr field of a file extent item we need
to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of
the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less
than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf
or access metadata from other items.
Fixes: 82bfb2e7b645 ("Btrfs: incremental send, fix unnecessary hole writes for sparse files")
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/send.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index f5a9f6689c460..486d4fcc597b2 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -6289,6 +6289,8 @@ static int range_is_hole_in_parent(struct send_ctx *sctx,
extent_end = btrfs_file_extent_end(path);
if (extent_end <= start)
goto next;
+ if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE)
+ return 0;
if (btrfs_file_extent_disk_bytenr(leaf, fi) == 0) {
search_start = extent_end;
goto next;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 010/280] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 009/280] btrfs: send: check for inline extents in range_is_hole_in_parent() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 011/280] net: update netdev_lock_{type,name} Greg Kroah-Hartman
` (274 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d4dda070f833dc5dc89a,
Eric Dumazet, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 81c734dae203757fb3c9eee6f9896386940776bd ]
Blamed commit did not take care of VLAN encapsulations
as spotted by syzbot [1].
Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().
[1]
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321
__INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321
ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729
__ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860
ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903
gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1
ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438
ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489
NF_HOOK include/linux/netfilter.h:318 [inline]
ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500
ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590
dst_input include/net/dst.h:474 [inline]
ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79
NF_HOOK include/linux/netfilter.h:318 [inline]
ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core net/core/dev.c:6139 [inline]
__netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252
netif_receive_skb_internal net/core/dev.c:6338 [inline]
netif_receive_skb+0x57/0x630 net/core/dev.c:6397
tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485
tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953
tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0xbe2/0x15d0 fs/read_write.c:686
ksys_write fs/read_write.c:738 [inline]
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4960 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315
kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586
__alloc_skb+0x805/0x1040 net/core/skbuff.c:690
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712
sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995
tun_alloc_skb drivers/net/tun.c:1461 [inline]
tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794
tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0xbe2/0x15d0 fs/read_write.c:686
ksys_write fs/read_write.c:738 [inline]
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Fixes: 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()")
Reported-by: syzbot+d4dda070f833dc5dc89a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/695e88b2.050a0220.1c677c.036d.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260107163109.4188620-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_tunnel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index dfca22c6d345d..8ce36fcc3dd5b 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -844,7 +844,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
skb_reset_network_header(skb);
- if (!pskb_inet_may_pull(skb)) {
+ if (skb_vlan_inet_prepare(skb, true)) {
DEV_STATS_INC(tunnel->dev, rx_length_errors);
DEV_STATS_INC(tunnel->dev, rx_errors);
goto drop;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 011/280] net: update netdev_lock_{type,name}
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 010/280] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 012/280] macvlan: fix possible UAF in macvlan_forward_source() Greg Kroah-Hartman
` (273 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit eb74c19fe10872ee1f29a8f90ca5ce943921afe9 ]
Add missing entries in netdev_lock_type[] and netdev_lock_name[] :
CAN, MCTP, RAWIP, CAIF, IP6GRE, 6LOWPAN, NETLINK, VSOCKMON,
IEEE802154_MONITOR.
Also add a WARN_ONCE() in netdev_lock_pos() to help future bug hunting
next time a protocol is added without updating these arrays.
Fixes: 1a33e10e4a95 ("net: partially revert dynamic lockdep key changes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260108093244.830280-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/dev.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 114fc8bc37f8b..69bb7ac73d047 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -449,15 +449,21 @@ static const unsigned short netdev_lock_type[] = {
ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP,
ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD,
ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
+ ARPHRD_CAN, ARPHRD_MCTP,
ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
- ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
+ ARPHRD_RAWHDLC, ARPHRD_RAWIP,
+ ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
ARPHRD_FCFABRIC, ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM,
- ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
- ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE};
+ ARPHRD_IEEE80211_RADIOTAP,
+ ARPHRD_IEEE802154, ARPHRD_IEEE802154_MONITOR,
+ ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
+ ARPHRD_CAIF, ARPHRD_IP6GRE, ARPHRD_NETLINK, ARPHRD_6LOWPAN,
+ ARPHRD_VSOCKMON,
+ ARPHRD_VOID, ARPHRD_NONE};
static const char *const netdev_lock_name[] = {
"_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
@@ -466,15 +472,21 @@ static const char *const netdev_lock_name[] = {
"_xmit_IEEE1394", "_xmit_EUI64", "_xmit_INFINIBAND", "_xmit_SLIP",
"_xmit_CSLIP", "_xmit_SLIP6", "_xmit_CSLIP6", "_xmit_RSRVD",
"_xmit_ADAPT", "_xmit_ROSE", "_xmit_X25", "_xmit_HWX25",
+ "_xmit_CAN", "_xmit_MCTP",
"_xmit_PPP", "_xmit_CISCO", "_xmit_LAPB", "_xmit_DDCMP",
- "_xmit_RAWHDLC", "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
+ "_xmit_RAWHDLC", "_xmit_RAWIP",
+ "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
"_xmit_SKIP", "_xmit_LOOPBACK", "_xmit_LOCALTLK", "_xmit_FDDI",
"_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
"_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
"_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
"_xmit_FCFABRIC", "_xmit_IEEE80211", "_xmit_IEEE80211_PRISM",
- "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET", "_xmit_PHONET_PIPE",
- "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"};
+ "_xmit_IEEE80211_RADIOTAP",
+ "_xmit_IEEE802154", "_xmit_IEEE802154_MONITOR",
+ "_xmit_PHONET", "_xmit_PHONET_PIPE",
+ "_xmit_CAIF", "_xmit_IP6GRE", "_xmit_NETLINK", "_xmit_6LOWPAN",
+ "_xmit_VSOCKMON",
+ "_xmit_VOID", "_xmit_NONE"};
static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE(netdev_lock_type)];
@@ -487,6 +499,7 @@ static inline unsigned short netdev_lock_pos(unsigned short dev_type)
if (netdev_lock_type[i] == dev_type)
return i;
/* the last key is used by default */
+ WARN_ONCE(1, "netdev_lock_pos() could not find dev_type=%u\n", dev_type);
return ARRAY_SIZE(netdev_lock_type) - 1;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 012/280] macvlan: fix possible UAF in macvlan_forward_source()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 011/280] net: update netdev_lock_{type,name} Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 013/280] ipv4: ip_gre: make ipgre_header() robust Greg Kroah-Hartman
` (272 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7182fbe91e58602ec1fe,
Eric Dumazet, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e ]
Add RCU protection on (struct macvlan_source_entry)->vlan.
Whenever macvlan_hash_del_source() is called, we must clear
entry->vlan pointer before RCU grace period starts.
This allows macvlan_forward_source() to skip over
entries queued for freeing.
Note that macvlan_dev are already RCU protected, as they
are embedded in a standard netdev (netdev_priv(ndev)).
Fixes: 79cf79abce71 ("macvlan: add source mode")
Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com
https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/macvlan.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 012830d12fde6..428b139822cf6 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -56,7 +56,7 @@ struct macvlan_port {
struct macvlan_source_entry {
struct hlist_node hlist;
- struct macvlan_dev *vlan;
+ struct macvlan_dev __rcu *vlan;
unsigned char addr[6+2] __aligned(sizeof(u16));
struct rcu_head rcu;
};
@@ -143,7 +143,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source(
hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) {
if (ether_addr_equal_64bits(entry->addr, addr) &&
- entry->vlan == vlan)
+ rcu_access_pointer(entry->vlan) == vlan)
return entry;
}
return NULL;
@@ -165,7 +165,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan,
return -ENOMEM;
ether_addr_copy(entry->addr, addr);
- entry->vlan = vlan;
+ RCU_INIT_POINTER(entry->vlan, vlan);
h = &port->vlan_source_hash[macvlan_eth_hash(addr)];
hlist_add_head_rcu(&entry->hlist, h);
vlan->macaddr_count++;
@@ -184,6 +184,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan)
static void macvlan_hash_del_source(struct macvlan_source_entry *entry)
{
+ RCU_INIT_POINTER(entry->vlan, NULL);
hlist_del_rcu(&entry->hlist);
kfree_rcu(entry, rcu);
}
@@ -382,7 +383,7 @@ static void macvlan_flush_sources(struct macvlan_port *port,
int i;
hash_for_each_safe(port->vlan_source_hash, i, next, entry, hlist)
- if (entry->vlan == vlan)
+ if (rcu_access_pointer(entry->vlan) == vlan)
macvlan_hash_del_source(entry);
vlan->macaddr_count = 0;
@@ -425,9 +426,14 @@ static bool macvlan_forward_source(struct sk_buff *skb,
hlist_for_each_entry_rcu(entry, h, hlist) {
if (ether_addr_equal_64bits(entry->addr, addr)) {
- if (entry->vlan->flags & MACVLAN_FLAG_NODST)
+ struct macvlan_dev *vlan = rcu_dereference(entry->vlan);
+
+ if (!vlan)
+ continue;
+
+ if (vlan->flags & MACVLAN_FLAG_NODST)
consume = true;
- macvlan_forward_source_one(skb, entry->vlan);
+ macvlan_forward_source_one(skb, vlan);
}
}
@@ -1648,7 +1654,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb,
struct macvlan_source_entry *entry;
hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) {
- if (entry->vlan != vlan)
+ if (rcu_access_pointer(entry->vlan) != vlan)
continue;
if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr))
return 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 013/280] ipv4: ip_gre: make ipgre_header() robust
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 012/280] macvlan: fix possible UAF in macvlan_forward_source() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 014/280] vsock/test: add a final full barrier after run all tests Greg Kroah-Hartman
` (271 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7c134e1c3aa3283790b9,
Eric Dumazet, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e67c577d89894811ce4dcd1a9ed29d8b63476667 ]
Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
Over the years, syzbot found many ways to crash the kernel
in ipgre_header() [1].
This involves team or bonding drivers ability to dynamically
change their dev->needed_headroom and/or dev->hard_header_len
In this particular crash mld_newpack() allocated an skb
with a too small reserve/headroom, and by the time mld_sendpack()
was called, syzbot managed to attach an ipgre device.
[1]
skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0
kernel BUG at net/core/skbuff.c:213 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: mld mld_ifc_work
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213
Call Trace:
<TASK>
skb_under_panic net/core/skbuff.c:223 [inline]
skb_push+0xc3/0xe0 net/core/skbuff.c:2641
ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897
dev_hard_header include/linux/netdevice.h:3436 [inline]
neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318
mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
Reported-by: syzbot+7c134e1c3aa3283790b9@syzkaller.appspotmail.com
Closes: https://www.spinics.net/lists/netdev/msg1147302.html
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260108190214.1667040-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/ip_gre.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 2c311ed84a3b3..b90241aff93c3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -854,10 +854,17 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
const void *daddr, const void *saddr, unsigned int len)
{
struct ip_tunnel *t = netdev_priv(dev);
- struct iphdr *iph;
struct gre_base_hdr *greh;
+ struct iphdr *iph;
+ int needed;
+
+ needed = t->hlen + sizeof(*iph);
+ if (skb_headroom(skb) < needed &&
+ pskb_expand_head(skb, HH_DATA_ALIGN(needed - skb_headroom(skb)),
+ 0, GFP_ATOMIC))
+ return -needed;
- iph = skb_push(skb, t->hlen + sizeof(*iph));
+ iph = skb_push(skb, needed);
greh = (struct gre_base_hdr *)(iph+1);
greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags);
greh->protocol = htons(type);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 014/280] vsock/test: add a final full barrier after run all tests
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 013/280] ipv4: ip_gre: make ipgre_header() robust Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 015/280] net/mlx5e: Restore destroying state bit after profile cleanup Greg Kroah-Hartman
` (270 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luigi Leonardi, Stefano Garzarella,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <sgarzare@redhat.com>
[ Upstream commit c39a6a277e0e67ffff6a8efcbbf7e7e23ce9e38c ]
If the last test fails, the other side still completes correctly,
which could lead to false positives.
Let's add a final barrier that ensures that the last test has finished
correctly on both sides, but also that the two sides agree on the
number of tests to be performed.
Fixes: 2f65b44e199c ("VSOCK: add full barrier between test cases")
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20260108114419.52747-1-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/vsock/util.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/tools/testing/vsock/util.c b/tools/testing/vsock/util.c
index 2acbb7703c6a0..259d33ae6293b 100644
--- a/tools/testing/vsock/util.c
+++ b/tools/testing/vsock/util.c
@@ -360,6 +360,18 @@ void run_tests(const struct test_case *test_cases,
printf("ok\n");
}
+
+ printf("All tests have been executed. Waiting other peer...");
+ fflush(stdout);
+
+ /*
+ * Final full barrier, to ensure that all tests have been run and
+ * that even the last one has been successful on both sides.
+ */
+ control_writeln("COMPLETED");
+ control_expectln("COMPLETED");
+
+ printf("ok\n");
}
void list_tests(const struct test_case *test_cases)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 015/280] net/mlx5e: Restore destroying state bit after profile cleanup
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 014/280] vsock/test: add a final full barrier after run all tests Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 016/280] btrfs: move flush related definitions to space-info.h Greg Kroah-Hartman
` (269 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saeed Mahameed, Tariq Toukan,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <saeedm@nvidia.com>
[ Upstream commit 5629f8859dca7ef74d7314b60de6a957f23166c0 ]
Profile rollback can fail in mlx5e_netdev_change_profile() and we will
end up with invalid mlx5e_priv memset to 0, we must maintain the
'destroying' bit in order to gracefully shutdown even if the
profile/priv are not valid.
This patch maintains the previous state of the 'destroying' state of
mlx5e_priv after priv cleanup, to allow the remove flow to cleanup
common resources from mlx5_core to avoid FW fatal errors as seen below:
$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev
Error: mlx5_core: Failed setting eswitch to offloads.
dmesg: mlx5_core 0000:00:03.0 enp0s3np0: failed to rollback to orig profile, ...
$ devlink dev reload pci/0000:00:03.0
mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)
mlx5_core 0000:00:03.0: poll_health:803:(pid 519): Fatal error 3 detected
mlx5_core 0000:00:03.0: firmware version: 28.41.1000
mlx5_core 0000:00:03.0: 0.000 Gb/s available PCIe bandwidth (Unknown x255 link)
mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failed
mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failed
mlx5_core 0000:00:03.0: mlx5_health_try_recover:340:(pid 141): handling bad device here
mlx5_core 0000:00:03.0: mlx5_handle_bad_state:285:(pid 141): Expected to see disabled NIC but it is full driver
mlx5_core 0000:00:03.0: mlx5_error_sw_reset:236:(pid 141): start
mlx5_core 0000:00:03.0: NIC IFC still 0 after 4000ms.
Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method")
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260108212657.25090-5-saeed@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 0c1f89196f6c1..73011870e5ff6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -5566,6 +5566,7 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,
void mlx5e_priv_cleanup(struct mlx5e_priv *priv)
{
+ bool destroying = test_bit(MLX5E_STATE_DESTROYING, &priv->state);
int i;
/* bail if change profile failed and also rollback failed */
@@ -5591,6 +5592,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv)
}
memset(priv, 0, sizeof(*priv));
+ if (destroying) /* restore destroying bit, to allow unload */
+ set_bit(MLX5E_STATE_DESTROYING, &priv->state);
}
static unsigned int mlx5e_get_max_num_txqs(struct mlx5_core_dev *mdev,
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 016/280] btrfs: move flush related definitions to space-info.h
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 015/280] net/mlx5e: Restore destroying state bit after profile cleanup Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 017/280] btrfs: store fs_info in space_info Greg Kroah-Hartman
` (268 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Johannes Thumshirn,
Josef Bacik, David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit f1e5c6185ca166cde0c7c2eeeab5d233ef315140 ]
This code is used in space-info.c, move the definitions to space-info.h.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ctree.h | 59 ----------------------------------------
fs/btrfs/delayed-inode.c | 1 +
fs/btrfs/inode-item.c | 1 +
fs/btrfs/props.c | 1 +
fs/btrfs/relocation.c | 1 +
fs/btrfs/space-info.h | 59 ++++++++++++++++++++++++++++++++++++++++
6 files changed, 63 insertions(+), 59 deletions(-)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index da8986e0c4222..bd84a8b774a68 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2925,65 +2925,6 @@ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
void btrfs_clear_space_info_full(struct btrfs_fs_info *info);
-/*
- * Different levels for to flush space when doing space reservations.
- *
- * The higher the level, the more methods we try to reclaim space.
- */
-enum btrfs_reserve_flush_enum {
- /* If we are in the transaction, we can't flush anything.*/
- BTRFS_RESERVE_NO_FLUSH,
-
- /*
- * Flush space by:
- * - Running delayed inode items
- * - Allocating a new chunk
- */
- BTRFS_RESERVE_FLUSH_LIMIT,
-
- /*
- * Flush space by:
- * - Running delayed inode items
- * - Running delayed refs
- * - Running delalloc and waiting for ordered extents
- * - Allocating a new chunk
- */
- BTRFS_RESERVE_FLUSH_EVICT,
-
- /*
- * Flush space by above mentioned methods and by:
- * - Running delayed iputs
- * - Committing transaction
- *
- * Can be interrupted by a fatal signal.
- */
- BTRFS_RESERVE_FLUSH_DATA,
- BTRFS_RESERVE_FLUSH_FREE_SPACE_INODE,
- BTRFS_RESERVE_FLUSH_ALL,
-
- /*
- * Pretty much the same as FLUSH_ALL, but can also steal space from
- * global rsv.
- *
- * Can be interrupted by a fatal signal.
- */
- BTRFS_RESERVE_FLUSH_ALL_STEAL,
-};
-
-enum btrfs_flush_state {
- FLUSH_DELAYED_ITEMS_NR = 1,
- FLUSH_DELAYED_ITEMS = 2,
- FLUSH_DELAYED_REFS_NR = 3,
- FLUSH_DELAYED_REFS = 4,
- FLUSH_DELALLOC = 5,
- FLUSH_DELALLOC_WAIT = 6,
- FLUSH_DELALLOC_FULL = 7,
- ALLOC_CHUNK = 8,
- ALLOC_CHUNK_FORCE = 9,
- RUN_DELAYED_IPUTS = 10,
- COMMIT_TRANS = 11,
-};
-
int btrfs_subvolume_reserve_metadata(struct btrfs_root *root,
struct btrfs_block_rsv *rsv,
int nitems, bool use_global_rsv);
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 052112d0daa74..214168868ac08 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -14,6 +14,7 @@
#include "qgroup.h"
#include "locking.h"
#include "inode-item.h"
+#include "space-info.h"
#define BTRFS_DELAYED_WRITEBACK 512
#define BTRFS_DELAYED_BACKGROUND 128
diff --git a/fs/btrfs/inode-item.c b/fs/btrfs/inode-item.c
index 5add022d3534f..ce5c51ffdc0d0 100644
--- a/fs/btrfs/inode-item.c
+++ b/fs/btrfs/inode-item.c
@@ -8,6 +8,7 @@
#include "disk-io.h"
#include "transaction.h"
#include "print-tree.h"
+#include "space-info.h"
struct btrfs_inode_ref *btrfs_find_name_in_backref(struct extent_buffer *leaf,
int slot,
diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
index 055a631276ce1..07f62e3ba6a51 100644
--- a/fs/btrfs/props.c
+++ b/fs/btrfs/props.c
@@ -10,6 +10,7 @@
#include "ctree.h"
#include "xattr.h"
#include "compression.h"
+#include "space-info.h"
#define BTRFS_PROP_HANDLERS_HT_BITS 8
static DEFINE_HASHTABLE(prop_handlers_ht, BTRFS_PROP_HANDLERS_HT_BITS);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 3fdf5519336f9..795df859cdbfc 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -27,6 +27,7 @@
#include "subpage.h"
#include "zoned.h"
#include "inode-item.h"
+#include "space-info.h"
/*
* Relocation overview
diff --git a/fs/btrfs/space-info.h b/fs/btrfs/space-info.h
index 99ce3225dd59d..fea2f93674e7c 100644
--- a/fs/btrfs/space-info.h
+++ b/fs/btrfs/space-info.h
@@ -5,6 +5,65 @@
#include "volumes.h"
+/*
+ * Different levels for to flush space when doing space reservations.
+ *
+ * The higher the level, the more methods we try to reclaim space.
+ */
+enum btrfs_reserve_flush_enum {
+ /* If we are in the transaction, we can't flush anything.*/
+ BTRFS_RESERVE_NO_FLUSH,
+
+ /*
+ * Flush space by:
+ * - Running delayed inode items
+ * - Allocating a new chunk
+ */
+ BTRFS_RESERVE_FLUSH_LIMIT,
+
+ /*
+ * Flush space by:
+ * - Running delayed inode items
+ * - Running delayed refs
+ * - Running delalloc and waiting for ordered extents
+ * - Allocating a new chunk
+ */
+ BTRFS_RESERVE_FLUSH_EVICT,
+
+ /*
+ * Flush space by above mentioned methods and by:
+ * - Running delayed iputs
+ * - Committing transaction
+ *
+ * Can be interrupted by a fatal signal.
+ */
+ BTRFS_RESERVE_FLUSH_DATA,
+ BTRFS_RESERVE_FLUSH_FREE_SPACE_INODE,
+ BTRFS_RESERVE_FLUSH_ALL,
+
+ /*
+ * Pretty much the same as FLUSH_ALL, but can also steal space from
+ * global rsv.
+ *
+ * Can be interrupted by a fatal signal.
+ */
+ BTRFS_RESERVE_FLUSH_ALL_STEAL,
+};
+
+enum btrfs_flush_state {
+ FLUSH_DELAYED_ITEMS_NR = 1,
+ FLUSH_DELAYED_ITEMS = 2,
+ FLUSH_DELAYED_REFS_NR = 3,
+ FLUSH_DELAYED_REFS = 4,
+ FLUSH_DELALLOC = 5,
+ FLUSH_DELALLOC_WAIT = 6,
+ FLUSH_DELALLOC_FULL = 7,
+ ALLOC_CHUNK = 8,
+ ALLOC_CHUNK_FORCE = 9,
+ RUN_DELAYED_IPUTS = 10,
+ COMMIT_TRANS = 11,
+};
+
struct btrfs_space_info {
spinlock_t lock;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 017/280] btrfs: store fs_info in space_info
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 016/280] btrfs: move flush related definitions to space-info.h Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 018/280] btrfs: factor out init_space_info() from create_space_info() Greg Kroah-Hartman
` (267 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Johannes Thumshirn,
Boris Burkov, David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <boris@bur.io>
[ Upstream commit 42f620aec182f62ee72e3fce41cb3353951b3508 ]
This is handy when computing space_info dynamic reclaim thresholds where
we do not have access to a block group. We could add it to the various
functions as a parameter, but it seems reasonable for space_info to have
an fs_info pointer.
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Boris Burkov <boris@bur.io>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/space-info.c | 1 +
fs/btrfs/space-info.h | 1 +
2 files changed, 2 insertions(+)
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index bede72f3dffc3..069df2ebd1ca5 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -230,6 +230,7 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)
if (!space_info)
return -ENOMEM;
+ space_info->fs_info = info;
for (i = 0; i < BTRFS_NR_RAID_TYPES; i++)
INIT_LIST_HEAD(&space_info->block_groups[i]);
init_rwsem(&space_info->groups_sem);
diff --git a/fs/btrfs/space-info.h b/fs/btrfs/space-info.h
index fea2f93674e7c..d6b34f2738b53 100644
--- a/fs/btrfs/space-info.h
+++ b/fs/btrfs/space-info.h
@@ -65,6 +65,7 @@ enum btrfs_flush_state {
};
struct btrfs_space_info {
+ struct btrfs_fs_info *fs_info;
spinlock_t lock;
u64 total_bytes; /* total bytes in the space,
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 018/280] btrfs: factor out init_space_info() from create_space_info()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 017/280] btrfs: store fs_info in space_info Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 019/280] btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() Greg Kroah-Hartman
` (266 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Naohiro Aota,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit ac5578fef380e68e539a2238ba63dd978a450ef2 ]
Factor out initialization of the space_info struct, which is used in a
later patch. There is no functional change.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/space-info.c | 27 ++++++++++++++++-----------
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 069df2ebd1ca5..88cd37a13c0ee 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -219,19 +219,11 @@ void btrfs_update_space_info_chunk_size(struct btrfs_space_info *space_info,
WRITE_ONCE(space_info->chunk_size, chunk_size);
}
-static int create_space_info(struct btrfs_fs_info *info, u64 flags)
+static void init_space_info(struct btrfs_fs_info *info,
+ struct btrfs_space_info *space_info, u64 flags)
{
-
- struct btrfs_space_info *space_info;
- int i;
- int ret;
-
- space_info = kzalloc(sizeof(*space_info), GFP_NOFS);
- if (!space_info)
- return -ENOMEM;
-
space_info->fs_info = info;
- for (i = 0; i < BTRFS_NR_RAID_TYPES; i++)
+ for (int i = 0; i < BTRFS_NR_RAID_TYPES; i++)
INIT_LIST_HEAD(&space_info->block_groups[i]);
init_rwsem(&space_info->groups_sem);
spin_lock_init(&space_info->lock);
@@ -245,6 +237,19 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)
if (btrfs_is_zoned(info))
space_info->bg_reclaim_threshold = BTRFS_DEFAULT_ZONED_RECLAIM_THRESH;
+}
+
+static int create_space_info(struct btrfs_fs_info *info, u64 flags)
+{
+
+ struct btrfs_space_info *space_info;
+ int ret;
+
+ space_info = kzalloc(sizeof(*space_info), GFP_NOFS);
+ if (!space_info)
+ return -ENOMEM;
+
+ init_space_info(info, space_info, flags);
ret = btrfs_sysfs_add_space_info_type(info, space_info);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 019/280] btrfs: factor out check_removing_space_info() from btrfs_free_block_groups()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 018/280] btrfs: factor out init_space_info() from create_space_info() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 020/280] btrfs: introduce btrfs_space_info sub-group Greg Kroah-Hartman
` (265 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Naohiro Aota,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit 1cfdbe0d53b27b4b4a4f4cf2a4e430bc65ba2ba5 ]
Factor out check_removing_space_info() from btrfs_free_block_groups(). It
sanity checks a to-be-removed space_info. There is no functional change.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 49 +++++++++++++++++++++++-------------------
1 file changed, 27 insertions(+), 22 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index 3295fb978a35b..797df5ddbcd12 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -4145,6 +4145,32 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
}
}
+static void check_removing_space_info(struct btrfs_space_info *space_info)
+{
+ struct btrfs_fs_info *info = space_info->fs_info;
+
+ /*
+ * Do not hide this behind enospc_debug, this is actually important and
+ * indicates a real bug if this happens.
+ */
+ if (WARN_ON(space_info->bytes_pinned > 0 || space_info->bytes_may_use > 0))
+ btrfs_dump_space_info(info, space_info, 0, 0);
+
+ /*
+ * If there was a failure to cleanup a log tree, very likely due to an
+ * IO failure on a writeback attempt of one or more of its extent
+ * buffers, we could not do proper (and cheap) unaccounting of their
+ * reserved space, so don't warn on bytes_reserved > 0 in that case.
+ */
+ if (!(space_info->flags & BTRFS_BLOCK_GROUP_METADATA) ||
+ !BTRFS_FS_LOG_CLEANUP_ERROR(info)) {
+ if (WARN_ON(space_info->bytes_reserved > 0))
+ btrfs_dump_space_info(info, space_info, 0, 0);
+ }
+
+ WARN_ON(space_info->reclaim_size > 0);
+}
+
/*
* Must be called only after stopping all workers, since we could have block
* group caching kthreads running, and therefore they could race with us if we
@@ -4235,28 +4261,7 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
struct btrfs_space_info,
list);
- /*
- * Do not hide this behind enospc_debug, this is actually
- * important and indicates a real bug if this happens.
- */
- if (WARN_ON(space_info->bytes_pinned > 0 ||
- space_info->bytes_may_use > 0))
- btrfs_dump_space_info(info, space_info, 0, 0);
-
- /*
- * If there was a failure to cleanup a log tree, very likely due
- * to an IO failure on a writeback attempt of one or more of its
- * extent buffers, we could not do proper (and cheap) unaccounting
- * of their reserved space, so don't warn on bytes_reserved > 0 in
- * that case.
- */
- if (!(space_info->flags & BTRFS_BLOCK_GROUP_METADATA) ||
- !BTRFS_FS_LOG_CLEANUP_ERROR(info)) {
- if (WARN_ON(space_info->bytes_reserved > 0))
- btrfs_dump_space_info(info, space_info, 0, 0);
- }
-
- WARN_ON(space_info->reclaim_size > 0);
+ check_removing_space_info(space_info);
list_del(&space_info->list);
btrfs_sysfs_remove_space_info(space_info);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 020/280] btrfs: introduce btrfs_space_info sub-group
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 019/280] btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 021/280] btrfs: fix memory leaks in create_space_info() error paths Greg Kroah-Hartman
` (264 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Naohiro Aota,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiro Aota <naohiro.aota@wdc.com>
[ Upstream commit f92ee31e031c7819126d2febdda0c3e91f5d2eb9 ]
Current code assumes we have only one space_info for each block group type
(DATA, METADATA, and SYSTEM). We sometime need multiple space infos to
manage special block groups.
One example is handling the data relocation block group for the zoned mode.
That block group is dedicated for writing relocated data and we cannot
allocate any regular extent from that block group, which is implemented in
the zoned extent allocator. This block group still belongs to the normal
data space_info. So, when all the normal data block groups are full and
there is some free space in the dedicated block group, the space_info
looks to have some free space, while it cannot allocate normal extent
anymore. That results in a strange ENOSPC error. We need to have a
space_info for the relocation data block group to represent the situation
properly.
Adds a basic infrastructure for having a "sub-group" of a space_info:
creation and removing. A sub-group space_info belongs to one of the
primary space_infos and has the same flags as its parent.
This commit first introduces the relocation data sub-space_info, and the
next commit will introduce tree-log sub-space_info. In the future, it could
be useful to implement tiered storage for btrfs e.g. by implementing a
sub-group space_info for block groups resides on a fast storage.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: a11224a016d6 ("btrfs: fix memory leaks in create_space_info() error paths")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/block-group.c | 11 +++++++++++
fs/btrfs/space-info.c | 44 +++++++++++++++++++++++++++++++++++++++---
fs/btrfs/space-info.h | 9 +++++++++
fs/btrfs/sysfs.c | 18 ++++++++++++++---
4 files changed, 76 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
index 797df5ddbcd12..2338d42b8f4e6 100644
--- a/fs/btrfs/block-group.c
+++ b/fs/btrfs/block-group.c
@@ -4149,6 +4149,17 @@ static void check_removing_space_info(struct btrfs_space_info *space_info)
{
struct btrfs_fs_info *info = space_info->fs_info;
+ if (space_info->subgroup_id == BTRFS_SUB_GROUP_PRIMARY) {
+ /* This is a top space_info, proceed with its children first. */
+ for (int i = 0; i < BTRFS_SPACE_INFO_SUB_GROUP_MAX; i++) {
+ if (space_info->sub_group[i]) {
+ check_removing_space_info(space_info->sub_group[i]);
+ kfree(space_info->sub_group[i]);
+ space_info->sub_group[i] = NULL;
+ }
+ }
+ }
+
/*
* Do not hide this behind enospc_debug, this is actually important and
* indicates a real bug if this happens.
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 88cd37a13c0ee..15c578f49caab 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -234,16 +234,44 @@ static void init_space_info(struct btrfs_fs_info *info,
INIT_LIST_HEAD(&space_info->priority_tickets);
space_info->clamp = 1;
btrfs_update_space_info_chunk_size(space_info, calc_chunk_size(info, flags));
+ space_info->subgroup_id = BTRFS_SUB_GROUP_PRIMARY;
if (btrfs_is_zoned(info))
space_info->bg_reclaim_threshold = BTRFS_DEFAULT_ZONED_RECLAIM_THRESH;
}
+static int create_space_info_sub_group(struct btrfs_space_info *parent, u64 flags,
+ enum btrfs_space_info_sub_group id, int index)
+{
+ struct btrfs_fs_info *fs_info = parent->fs_info;
+ struct btrfs_space_info *sub_group;
+ int ret;
+
+ ASSERT(parent->subgroup_id == BTRFS_SUB_GROUP_PRIMARY);
+ ASSERT(id != BTRFS_SUB_GROUP_PRIMARY);
+
+ sub_group = kzalloc(sizeof(*sub_group), GFP_NOFS);
+ if (!sub_group)
+ return -ENOMEM;
+
+ init_space_info(fs_info, sub_group, flags);
+ parent->sub_group[index] = sub_group;
+ sub_group->parent = parent;
+ sub_group->subgroup_id = id;
+
+ ret = btrfs_sysfs_add_space_info_type(fs_info, sub_group);
+ if (ret) {
+ kfree(sub_group);
+ parent->sub_group[index] = NULL;
+ }
+ return ret;
+}
+
static int create_space_info(struct btrfs_fs_info *info, u64 flags)
{
struct btrfs_space_info *space_info;
- int ret;
+ int ret = 0;
space_info = kzalloc(sizeof(*space_info), GFP_NOFS);
if (!space_info)
@@ -251,6 +279,15 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)
init_space_info(info, space_info, flags);
+ if (btrfs_is_zoned(info)) {
+ if (flags & BTRFS_BLOCK_GROUP_DATA)
+ ret = create_space_info_sub_group(space_info, flags,
+ BTRFS_SUB_GROUP_DATA_RELOC,
+ 0);
+ if (ret)
+ return ret;
+ }
+
ret = btrfs_sysfs_add_space_info_type(info, space_info);
if (ret)
return ret;
@@ -511,8 +548,9 @@ static void __btrfs_dump_space_info(struct btrfs_fs_info *fs_info,
lockdep_assert_held(&info->lock);
/* The free space could be negative in case of overcommit */
- btrfs_info(fs_info, "space_info %s has %lld free, is %sfull",
- flag_str,
+ btrfs_info(fs_info,
+ "space_info %s (sub-group id %d) has %lld free, is %sfull",
+ flag_str, info->subgroup_id,
(s64)(info->total_bytes - btrfs_space_info_used(info, true)),
info->full ? "" : "not ");
btrfs_info(fs_info,
diff --git a/fs/btrfs/space-info.h b/fs/btrfs/space-info.h
index d6b34f2738b53..dc69138f3de17 100644
--- a/fs/btrfs/space-info.h
+++ b/fs/btrfs/space-info.h
@@ -64,8 +64,17 @@ enum btrfs_flush_state {
COMMIT_TRANS = 11,
};
+enum btrfs_space_info_sub_group {
+ BTRFS_SUB_GROUP_PRIMARY,
+ BTRFS_SUB_GROUP_DATA_RELOC,
+};
+
+#define BTRFS_SPACE_INFO_SUB_GROUP_MAX 1
struct btrfs_space_info {
struct btrfs_fs_info *fs_info;
+ struct btrfs_space_info *parent;
+ struct btrfs_space_info *sub_group[BTRFS_SPACE_INFO_SUB_GROUP_MAX];
+ int subgroup_id;
spinlock_t lock;
u64 total_bytes; /* total bytes in the space,
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index 44a94ac21e2fa..693ae78705684 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -1585,16 +1585,28 @@ void btrfs_sysfs_remove_space_info(struct btrfs_space_info *space_info)
kobject_put(&space_info->kobj);
}
-static const char *alloc_name(u64 flags)
+static const char *alloc_name(struct btrfs_space_info *space_info)
{
+ u64 flags = space_info->flags;
+
switch (flags) {
case BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA:
return "mixed";
case BTRFS_BLOCK_GROUP_METADATA:
+ ASSERT(space_info->subgroup_id == BTRFS_SUB_GROUP_PRIMARY);
return "metadata";
case BTRFS_BLOCK_GROUP_DATA:
- return "data";
+ switch (space_info->subgroup_id) {
+ case BTRFS_SUB_GROUP_PRIMARY:
+ return "data";
+ case BTRFS_SUB_GROUP_DATA_RELOC:
+ return "data-reloc";
+ default:
+ WARN_ON_ONCE(1);
+ return "data (unknown sub-group)";
+ }
case BTRFS_BLOCK_GROUP_SYSTEM:
+ ASSERT(space_info->subgroup_id == BTRFS_SUB_GROUP_PRIMARY);
return "system";
default:
WARN_ON(1);
@@ -1613,7 +1625,7 @@ int btrfs_sysfs_add_space_info_type(struct btrfs_fs_info *fs_info,
ret = kobject_init_and_add(&space_info->kobj, &space_info_ktype,
fs_info->space_info_kobj, "%s",
- alloc_name(space_info->flags));
+ alloc_name(space_info));
if (ret) {
kobject_put(&space_info->kobj);
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 021/280] btrfs: fix memory leaks in create_space_info() error paths
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 020/280] btrfs: introduce btrfs_space_info sub-group Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 022/280] hv_netvsc: Allocate rx indirection table size dynamically Greg Kroah-Hartman
` (263 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Jiasheng Jiang,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
[ Upstream commit a11224a016d6d1d46a4d9b6573244448a80d4d7f ]
In create_space_info(), the 'space_info' object is allocated at the
beginning of the function. However, there are two error paths where the
function returns an error code without freeing the allocated memory:
1. When create_space_info_sub_group() fails in zoned mode.
2. When btrfs_sysfs_add_space_info_type() fails.
In both cases, 'space_info' has not yet been added to the
fs_info->space_info list, resulting in a memory leak. Fix this by
adding an error handling label to kfree(space_info) before returning.
Fixes: 2be12ef79fe9 ("btrfs: Separate space_info create/update")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/space-info.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index 15c578f49caab..230e086ddee8e 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -285,18 +285,22 @@ static int create_space_info(struct btrfs_fs_info *info, u64 flags)
BTRFS_SUB_GROUP_DATA_RELOC,
0);
if (ret)
- return ret;
+ goto out_free;
}
ret = btrfs_sysfs_add_space_info_type(info, space_info);
if (ret)
- return ret;
+ goto out_free;
list_add(&space_info->list, &info->space_info);
if (flags & BTRFS_BLOCK_GROUP_DATA)
info->data_sinfo = space_info;
return ret;
+
+out_free:
+ kfree(space_info);
+ return ret;
}
int btrfs_init_space_info(struct btrfs_fs_info *fs_info)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 022/280] hv_netvsc: Allocate rx indirection table size dynamically
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 021/280] btrfs: fix memory leaks in create_space_info() error paths Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 023/280] net: hv_netvsc: reject RSS hash key programming without RX indirection table Greg Kroah-Hartman
` (262 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shradha Gupta, Haiyang Zhang,
Simon Horman, David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shradha Gupta <shradhagupta@linux.microsoft.com>
[ Upstream commit 4cab498f33f7adaa01ad15909c0f34a81e5a0b0a ]
Allocate the size of rx indirection table dynamically in netvsc
from the value of size provided by OID_GEN_RECEIVE_SCALE_CAPABILITIES
query instead of using a constant value of ITAB_NUM.
Signed-off-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Tested-on: Ubuntu22 (azure VM, SKU size: Standard_F72s_v2)
Testcases:
1. ethtool -x eth0 output
2. LISA testcase:PERF-NETWORK-TCP-THROUGHPUT-MULTICONNECTION-NTTTCP-Synthetic
3. LISA testcase:PERF-NETWORK-TCP-THROUGHPUT-MULTICONNECTION-NTTTCP-SRIOV
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: d23564955811 ("net: hv_netvsc: reject RSS hash key programming without RX indirection table")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/hyperv/hyperv_net.h | 5 ++++-
drivers/net/hyperv/netvsc_drv.c | 10 ++++++----
drivers/net/hyperv/rndis_filter.c | 29 +++++++++++++++++++++++++----
3 files changed, 35 insertions(+), 9 deletions(-)
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index ea9cb1ac4bbe1..97952229a7b77 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -74,6 +74,7 @@ struct ndis_recv_scale_cap { /* NDIS_RECEIVE_SCALE_CAPABILITIES */
#define NDIS_RSS_HASH_SECRET_KEY_MAX_SIZE_REVISION_2 40
#define ITAB_NUM 128
+#define ITAB_NUM_MAX 256
struct ndis_recv_scale_param { /* NDIS_RECEIVE_SCALE_PARAMETERS */
struct ndis_obj_header hdr;
@@ -1045,7 +1046,9 @@ struct net_device_context {
u32 tx_table[VRSS_SEND_TAB_SIZE];
- u16 rx_table[ITAB_NUM];
+ u16 *rx_table;
+
+ u32 rx_table_sz;
/* Ethtool settings */
u8 duplex;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7433fe7699432..68dfe77a6bbfe 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1717,7 +1717,9 @@ static u32 netvsc_get_rxfh_key_size(struct net_device *dev)
static u32 netvsc_rss_indir_size(struct net_device *dev)
{
- return ITAB_NUM;
+ struct net_device_context *ndc = netdev_priv(dev);
+
+ return ndc->rx_table_sz;
}
static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key,
@@ -1736,7 +1738,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key,
rndis_dev = ndev->extension;
if (indir) {
- for (i = 0; i < ITAB_NUM; i++)
+ for (i = 0; i < ndc->rx_table_sz; i++)
indir[i] = ndc->rx_table[i];
}
@@ -1762,11 +1764,11 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,
rndis_dev = ndev->extension;
if (indir) {
- for (i = 0; i < ITAB_NUM; i++)
+ for (i = 0; i < ndc->rx_table_sz; i++)
if (indir[i] >= ndev->num_chn)
return -EINVAL;
- for (i = 0; i < ITAB_NUM; i++)
+ for (i = 0; i < ndc->rx_table_sz; i++)
ndc->rx_table[i] = indir[i];
}
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index bb656ea097731..09144f0ec2aa4 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -21,6 +21,7 @@
#include <linux/rtnetlink.h>
#include <linux/ucs2_string.h>
#include <linux/string.h>
+#include <linux/slab.h>
#include "hyperv_net.h"
#include "netvsc_trace.h"
@@ -913,7 +914,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
struct rndis_set_request *set;
struct rndis_set_complete *set_complete;
u32 extlen = sizeof(struct ndis_recv_scale_param) +
- 4 * ITAB_NUM + NETVSC_HASH_KEYLEN;
+ 4 * ndc->rx_table_sz + NETVSC_HASH_KEYLEN;
struct ndis_recv_scale_param *rssp;
u32 *itab;
u8 *keyp;
@@ -939,7 +940,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
NDIS_HASH_TCP_IPV6;
- rssp->indirect_tabsize = 4*ITAB_NUM;
+ rssp->indirect_tabsize = 4 * ndc->rx_table_sz;
rssp->indirect_taboffset = sizeof(struct ndis_recv_scale_param);
rssp->hashkey_size = NETVSC_HASH_KEYLEN;
rssp->hashkey_offset = rssp->indirect_taboffset +
@@ -947,7 +948,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
/* Set indirection table entries */
itab = (u32 *)(rssp + 1);
- for (i = 0; i < ITAB_NUM; i++)
+ for (i = 0; i < ndc->rx_table_sz; i++)
itab[i] = ndc->rx_table[i];
/* Set hask key values */
@@ -1534,6 +1535,18 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
if (ret || rsscap.num_recv_que < 2)
goto out;
+ if (rsscap.num_indirect_tabent &&
+ rsscap.num_indirect_tabent <= ITAB_NUM_MAX)
+ ndc->rx_table_sz = rsscap.num_indirect_tabent;
+ else
+ ndc->rx_table_sz = ITAB_NUM;
+
+ ndc->rx_table = kcalloc(ndc->rx_table_sz, sizeof(u16), GFP_KERNEL);
+ if (!ndc->rx_table) {
+ ret = -ENOMEM;
+ goto err_dev_remv;
+ }
+
/* This guarantees that num_possible_rss_qs <= num_online_cpus */
num_possible_rss_qs = min_t(u32, num_online_cpus(),
rsscap.num_recv_que);
@@ -1544,7 +1557,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
net_device->num_chn = min(net_device->max_chn, device_info->num_chn);
if (!netif_is_rxfh_configured(net)) {
- for (i = 0; i < ITAB_NUM; i++)
+ for (i = 0; i < ndc->rx_table_sz; i++)
ndc->rx_table[i] = ethtool_rxfh_indir_default(
i, net_device->num_chn);
}
@@ -1582,11 +1595,19 @@ void rndis_filter_device_remove(struct hv_device *dev,
struct netvsc_device *net_dev)
{
struct rndis_device *rndis_dev = net_dev->extension;
+ struct net_device *net = hv_get_drvdata(dev);
+ struct net_device_context *ndc;
+
+ ndc = netdev_priv(net);
/* Halt and release the rndis device */
rndis_filter_halt_device(net_dev, rndis_dev);
netvsc_device_remove(dev);
+
+ ndc->rx_table_sz = 0;
+ kfree(ndc->rx_table);
+ ndc->rx_table = NULL;
}
int rndis_filter_open(struct netvsc_device *nvdev)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 023/280] net: hv_netvsc: reject RSS hash key programming without RX indirection table
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 022/280] hv_netvsc: Allocate rx indirection table size dynamically Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 024/280] ipv6: Fix use-after-free in inet6_addr_del() Greg Kroah-Hartman
` (261 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Garg, Dipayaan Roy,
Haiyang Zhang, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Garg <gargaditya@linux.microsoft.com>
[ Upstream commit d23564955811da493f34412d7de60fa268c8cb50 ]
RSS configuration requires a valid RX indirection table. When the device
reports a single receive queue, rndis_filter_device_add() does not
allocate an indirection table, accepting RSS hash key updates in this
state leads to a hang.
Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return
-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device
capabilities and prevents incorrect behavior.
Fixes: 962f3fee83a4 ("netvsc: add ethtool ops to get/set RSS key")
Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com>
Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Link: https://patch.msgid.link/1768212093-1594-1-git-send-email-gargaditya@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/hyperv/netvsc_drv.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 68dfe77a6bbfe..20c584f46ec01 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1762,6 +1762,9 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,
if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
return -EOPNOTSUPP;
+ if (!ndc->rx_table_sz)
+ return -EOPNOTSUPP;
+
rndis_dev = ndev->extension;
if (indir) {
for (i = 0; i < ndc->rx_table_sz; i++)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 024/280] ipv6: Fix use-after-free in inet6_addr_del().
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 023/280] net: hv_netvsc: reject RSS hash key programming without RX indirection table Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 025/280] selftests: drv-net: fix RPS mask handling for high CPU numbers Greg Kroah-Hartman
` (260 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+72e610f4f1a930ca9d8a,
Kuniyuki Iwashima, Hangbin Liu, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit ddf96c393a33aef4887e2e406c76c2f8cda1419c ]
syzbot reported use-after-free of inet6_ifaddr in
inet6_addr_del(). [0]
The cited commit accidentally moved ipv6_del_addr() for
mngtmpaddr before reading its ifp->flags for temporary
addresses in inet6_addr_del().
Let's move ipv6_del_addr() down to fix the UAF.
[0]:
BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117
Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593
CPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117
addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181
inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f164cf8f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749
RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003
RBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288
</TASK>
Allocated by task 9593:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120
inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050
addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160
inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6099:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free_freelist_hook mm/slub.c:2569 [inline]
slab_free_bulk mm/slub.c:6696 [inline]
kmem_cache_free_bulk mm/slub.c:7383 [inline]
kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362
kfree_bulk include/linux/slab.h:830 [inline]
kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523
kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline]
kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801
process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Fixes: 00b5b7aab9e42 ("net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged")
Reported-by: syzbot+72e610f4f1a930ca9d8a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/696598e9.050a0220.3be5c5.0009.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260113010538.2019411-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 03961f8080757..d6a33452dd369 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3068,12 +3068,12 @@ static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
in6_ifa_hold(ifp);
read_unlock_bh(&idev->lock);
- ipv6_del_addr(ifp);
-
if (!(ifp->flags & IFA_F_TEMPORARY) &&
(ifp->flags & IFA_F_MANAGETEMPADDR))
delete_tempaddrs(idev, ifp);
+ ipv6_del_addr(ifp);
+
addrconf_verify_rtnl(net);
if (ipv6_addr_is_multicast(pfx)) {
ipv6_mc_config(net->ipv6.mc_autojoin_sk,
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 025/280] selftests: drv-net: fix RPS mask handling for high CPU numbers
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 024/280] ipv6: Fix use-after-free in inet6_addr_del() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 026/280] net/sched: sch_qfq: do not free existing class in qfq_change_class() Greg Kroah-Hartman
` (259 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nimrod Oren, Gal Pressman,
Willem de Bruijn, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit cf055f8c000445aa688c53a706ef4f580818eedb ]
The RPS bitmask bounds check uses ~(RPS_MAX_CPUS - 1) which equals ~15 =
0xfff0, only allowing CPUs 0-3.
Change the mask to ~((1UL << RPS_MAX_CPUS) - 1) = ~0xffff to allow CPUs
0-15.
Fixes: 5ebfb4cc3048 ("selftests/net: toeplitz test")
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260112173715.384843-3-gal@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/toeplitz.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/toeplitz.c b/tools/testing/selftests/net/toeplitz.c
index 9ba03164d73a6..5099157f01b9a 100644
--- a/tools/testing/selftests/net/toeplitz.c
+++ b/tools/testing/selftests/net/toeplitz.c
@@ -473,8 +473,8 @@ static void parse_rps_bitmap(const char *arg)
bitmap = strtoul(arg, NULL, 0);
- if (bitmap & ~(RPS_MAX_CPUS - 1))
- error(1, 0, "rps bitmap 0x%lx out of bounds 0..%lu",
+ if (bitmap & ~((1UL << RPS_MAX_CPUS) - 1))
+ error(1, 0, "rps bitmap 0x%lx out of bounds, max cpu %lu",
bitmap, RPS_MAX_CPUS - 1);
for (i = 0; i < RPS_MAX_CPUS; i++)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 026/280] net/sched: sch_qfq: do not free existing class in qfq_change_class()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 025/280] selftests: drv-net: fix RPS mask handling for high CPU numbers Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 027/280] ASoC: tlv320adcx140: fix null pointer Greg Kroah-Hartman
` (258 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+07f3f38f723c335f106d,
Eric Dumazet, Jamal Hadi Salim, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 ]
Fixes qfq_change_class() error case.
cl->qdisc and cl should only be freed if a new class and qdisc
were allocated, or we risk various UAF.
Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: syzbot+07f3f38f723c335f106d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260112175656.17605-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_qfq.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 80a7173843b90..0047f35504348 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -533,8 +533,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
return 0;
destroy_class:
- qdisc_put(cl->qdisc);
- kfree(cl);
+ if (!existing) {
+ qdisc_put(cl->qdisc);
+ kfree(cl);
+ }
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 027/280] ASoC: tlv320adcx140: fix null pointer
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 026/280] net/sched: sch_qfq: do not free existing class in qfq_change_class() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 028/280] ASoC: tlv320adcx140: fix word length Greg Kroah-Hartman
` (257 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emil Svendsen, Sascha Hauer,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <emas@bang-olufsen.dk>
[ Upstream commit be7664c81d3129fc313ef62ff275fd3d33cfecd4 ]
The "snd_soc_component" in "adcx140_priv" was only used once but never
set. It was only used for reaching "dev" which is already present in
"adcx140_priv".
Fixes: 4e82971f7b55 ("ASoC: tlv320adcx140: Add a new kcontrol")
Signed-off-by: Emil Svendsen <emas@bang-olufsen.dk>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-2-8f7ecec525c8@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tlv320adcx140.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c
index 530f321d08e9c..4405934120e51 100644
--- a/sound/soc/codecs/tlv320adcx140.c
+++ b/sound/soc/codecs/tlv320adcx140.c
@@ -24,7 +24,6 @@
#include "tlv320adcx140.h"
struct adcx140_priv {
- struct snd_soc_component *component;
struct regulator *supply_areg;
struct gpio_desc *gpio_reset;
struct regmap *regmap;
@@ -702,7 +701,6 @@ static void adcx140_pwr_ctrl(struct adcx140_priv *adcx140, bool power_state)
{
int pwr_ctrl = 0;
int ret = 0;
- struct snd_soc_component *component = adcx140->component;
if (power_state)
pwr_ctrl = ADCX140_PWR_CFG_ADC_PDZ | ADCX140_PWR_CFG_PLL_PDZ;
@@ -714,7 +712,7 @@ static void adcx140_pwr_ctrl(struct adcx140_priv *adcx140, bool power_state)
ret = regmap_write(adcx140->regmap, ADCX140_PHASE_CALIB,
adcx140->phase_calib_on ? 0x00 : 0x40);
if (ret)
- dev_err(component->dev, "%s: register write error %d\n",
+ dev_err(adcx140->dev, "%s: register write error %d\n",
__func__, ret);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 028/280] ASoC: tlv320adcx140: fix word length
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 027/280] ASoC: tlv320adcx140: fix null pointer Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 029/280] textsearch: describe @list member in ts_ops search Greg Kroah-Hartman
` (256 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emil Svendsen, Sascha Hauer,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emil Svendsen <emas@bang-olufsen.dk>
[ Upstream commit 46378ab9fcb796dca46b51e10646f636e2c661f9 ]
The word length is the physical width of the channel slots. So the
hw_params would misconfigure when format width and physical width
doesn't match. Like S24_LE which has data width of 24 bits but physical
width of 32 bits. So if using asymmetric formats you will get a lot of
noise.
Fixes: 689c7655b50c5 ("ASoC: tlv320adcx140: Add the tlv320adcx140 codec driver family")
Signed-off-by: Emil Svendsen <emas@bang-olufsen.dk>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Link: https://patch.msgid.link/20260113-sound-soc-codecs-tvl320adcx140-v4-4-8f7ecec525c8@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/tlv320adcx140.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c
index 4405934120e51..67eef894d0c2d 100644
--- a/sound/soc/codecs/tlv320adcx140.c
+++ b/sound/soc/codecs/tlv320adcx140.c
@@ -728,7 +728,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,
struct adcx140_priv *adcx140 = snd_soc_component_get_drvdata(component);
u8 data = 0;
- switch (params_width(params)) {
+ switch (params_physical_width(params)) {
case 16:
data = ADCX140_16_BIT_WORD;
break;
@@ -743,7 +743,7 @@ static int adcx140_hw_params(struct snd_pcm_substream *substream,
break;
default:
dev_err(component->dev, "%s: Unsupported width %d\n",
- __func__, params_width(params));
+ __func__, params_physical_width(params));
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 029/280] textsearch: describe @list member in ts_ops search
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 028/280] ASoC: tlv320adcx140: fix word length Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 030/280] mm, kfence: describe @slab parameter in __kfence_obj_info() Greg Kroah-Hartman
` (255 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bagas Sanjaya, Thomas Graf,
David S. Miller, Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <bagasdotme@gmail.com>
[ Upstream commit f26528478bb102c28e7ac0cbfc8ec8185afdafc7 ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/textsearch.h:49 struct member 'list' not described in 'ts_ops'
Describe @list member to fix it.
Link: https://lkml.kernel.org/r/20251219014006.16328-4-bagasdotme@gmail.com
Fixes: 2de4ff7bd658 ("[LIB]: Textsearch infrastructure.")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Cc: Thomas Graf <tgraf@suug.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/textsearch.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/textsearch.h b/include/linux/textsearch.h
index 6673e4d4ac2e1..4933777404d61 100644
--- a/include/linux/textsearch.h
+++ b/include/linux/textsearch.h
@@ -35,6 +35,7 @@ struct ts_state
* @get_pattern: return head of pattern
* @get_pattern_len: return length of pattern
* @owner: module reference to algorithm
+ * @list: list to search
*/
struct ts_ops
{
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 030/280] mm, kfence: describe @slab parameter in __kfence_obj_info()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 029/280] textsearch: describe @list member in ts_ops search Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 031/280] dmaengine: tegra-adma: Fix use-after-free Greg Kroah-Hartman
` (254 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bagas Sanjaya, Marco Elver,
David Hildenbrand (Red Hat), Harry Yoo, Andrew Morton,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <bagasdotme@gmail.com>
[ Upstream commit 6cfab50e1440fde19af7c614aacd85e11aa4dcea ]
Sphinx reports kernel-doc warning:
WARNING: ./include/linux/kfence.h:220 function parameter 'slab' not described in '__kfence_obj_info'
Fix it by describing @slab parameter.
Link: https://lkml.kernel.org/r/20251219014006.16328-6-bagasdotme@gmail.com
Fixes: 2dfe63e61cc3 ("mm, kfence: support kmem_dump_obj() for KFENCE objects")
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: Marco Elver <elver@google.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Acked-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/kfence.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/kfence.h b/include/linux/kfence.h
index 726857a4b6805..d5258c63ffd7c 100644
--- a/include/linux/kfence.h
+++ b/include/linux/kfence.h
@@ -210,6 +210,7 @@ struct kmem_obj_info;
* __kfence_obj_info() - fill kmem_obj_info struct
* @kpp: kmem_obj_info to be filled
* @object: the object
+ * @slab: the slab
*
* Return:
* * false - not a KFENCE object
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 031/280] dmaengine: tegra-adma: Fix use-after-free
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 030/280] mm, kfence: describe @slab parameter in __kfence_obj_info() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 032/280] dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing Greg Kroah-Hartman
` (253 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sheetal, Thierry Reding, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sheetal <sheetal@nvidia.com>
[ Upstream commit 2efd07a7c36949e6fa36a69183df24d368bf9e96 ]
A use-after-free bug exists in the Tegra ADMA driver when audio streams
are terminated, particularly during XRUN conditions. The issue occurs
when the DMA buffer is freed by tegra_adma_terminate_all() before the
vchan completion tasklet finishes accessing it.
The race condition follows this sequence:
1. DMA transfer completes, triggering an interrupt that schedules the
completion tasklet (tasklet has not executed yet)
2. Audio playback stops, calling tegra_adma_terminate_all() which
frees the DMA buffer memory via kfree()
3. The scheduled tasklet finally executes, calling vchan_complete()
which attempts to access the already-freed memory
Since tasklets can execute at any time after being scheduled, there is
no guarantee that the buffer will remain valid when vchan_complete()
runs.
Fix this by properly synchronizing the virtual channel completion:
- Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the
descriptors as terminated instead of freeing the descriptor.
- Add the callback tegra_adma_synchronize() that calls
vchan_synchronize() which kills any pending tasklets and frees any
terminated descriptors.
Crash logs:
[ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0
[ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0
[ 337.427562] Call trace:
[ 337.427564] dump_backtrace+0x0/0x320
[ 337.427571] show_stack+0x20/0x30
[ 337.427575] dump_stack_lvl+0x68/0x84
[ 337.427584] print_address_description.constprop.0+0x74/0x2b8
[ 337.427590] kasan_report+0x1f4/0x210
[ 337.427598] __asan_load8+0xa0/0xd0
[ 337.427603] vchan_complete+0x124/0x3b0
[ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0
[ 337.427617] tasklet_action+0x30/0x40
[ 337.427623] __do_softirq+0x1a0/0x5c4
[ 337.427628] irq_exit+0x110/0x140
[ 337.427633] handle_domain_irq+0xa4/0xe0
[ 337.427640] gic_handle_irq+0x64/0x160
[ 337.427644] call_on_irq_stack+0x20/0x4c
[ 337.427649] do_interrupt_handler+0x7c/0x90
[ 337.427654] el1_interrupt+0x30/0x80
[ 337.427659] el1h_64_irq_handler+0x18/0x30
[ 337.427663] el1h_64_irq+0x7c/0x80
[ 337.427667] cpuidle_enter_state+0xe4/0x540
[ 337.427674] cpuidle_enter+0x54/0x80
[ 337.427679] do_idle+0x2e0/0x380
[ 337.427685] cpu_startup_entry+0x2c/0x70
[ 337.427690] rest_init+0x114/0x130
[ 337.427695] arch_call_rest_init+0x18/0x24
[ 337.427702] start_kernel+0x380/0x3b4
[ 337.427706] __primary_switched+0xc0/0xc8
Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
Signed-off-by: Sheetal <sheetal@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251110142445.3842036-1-sheetal@nvidia.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/tegra210-adma.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index 79da93cc77b64..db79e92f5e611 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -341,10 +341,17 @@ static void tegra_adma_stop(struct tegra_adma_chan *tdc)
return;
}
- kfree(tdc->desc);
+ vchan_terminate_vdesc(&tdc->desc->vd);
tdc->desc = NULL;
}
+static void tegra_adma_synchronize(struct dma_chan *dc)
+{
+ struct tegra_adma_chan *tdc = to_tegra_adma_chan(dc);
+
+ vchan_synchronize(&tdc->vc);
+}
+
static void tegra_adma_start(struct tegra_adma_chan *tdc)
{
struct virt_dma_desc *vd = vchan_next_desc(&tdc->vc);
@@ -910,6 +917,7 @@ static int tegra_adma_probe(struct platform_device *pdev)
tdma->dma_dev.device_config = tegra_adma_slave_config;
tdma->dma_dev.device_tx_status = tegra_adma_tx_status;
tdma->dma_dev.device_terminate_all = tegra_adma_terminate_all;
+ tdma->dma_dev.device_synchronize = tegra_adma_synchronize;
tdma->dma_dev.src_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
tdma->dma_dev.dst_addr_widths = BIT(DMA_SLAVE_BUSWIDTH_4_BYTES);
tdma->dma_dev.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 032/280] dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 031/280] dmaengine: tegra-adma: Fix use-after-free Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 033/280] phy: stm32-usphyc: Fix off by one in probe() Greg Kroah-Hartman
` (252 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suraj Gupta, Radhey Shyam Pandey,
Folker Schwesinger, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Gupta <suraj.gupta2@amd.com>
[ Upstream commit c0732fe78728718c853ef8e7af5bbb05262acbd1 ]
When device tree lacks optional "xlnx,addrwidth" property, the addr_width
variable remained uninitialized with garbage values, causing incorrect
DMA mask configuration and subsequent probe failure. The fix ensures a
fallback to the default 32-bit address width when this property is missing.
Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com>
Fixes: b72db4005fe4 ("dmaengine: vdma: Add 64 bit addressing support to the driver")
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Reviewed-by: Folker Schwesinger <dev@folker-schwesinger.de>
Link: https://patch.msgid.link/20251021183006.3434495-1-suraj.gupta2@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/xilinx/xilinx_dma.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index e2175651f9795..8402dc3d3a352 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -128,6 +128,7 @@
#define XILINX_MCDMA_MAX_CHANS_PER_DEVICE 0x20
#define XILINX_DMA_MAX_CHANS_PER_DEVICE 0x2
#define XILINX_CDMA_MAX_CHANS_PER_DEVICE 0x1
+#define XILINX_DMA_DFAULT_ADDRWIDTH 0x20
#define XILINX_DMA_DMAXR_ALL_IRQ_MASK \
(XILINX_DMA_DMASR_FRM_CNT_IRQ | \
@@ -3016,7 +3017,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
struct device_node *node = pdev->dev.of_node;
struct xilinx_dma_device *xdev;
struct device_node *child, *np = pdev->dev.of_node;
- u32 num_frames, addr_width, len_width;
+ u32 num_frames, addr_width = XILINX_DMA_DFAULT_ADDRWIDTH, len_width;
int i, err;
/* Allocate and initialize the DMA engine structure */
@@ -3085,7 +3086,9 @@ static int xilinx_dma_probe(struct platform_device *pdev)
err = of_property_read_u32(node, "xlnx,addrwidth", &addr_width);
if (err < 0)
- dev_warn(xdev->dev, "missing xlnx,addrwidth property\n");
+ dev_warn(xdev->dev,
+ "missing xlnx,addrwidth property, using default value %d\n",
+ XILINX_DMA_DFAULT_ADDRWIDTH);
if (addr_width > 32)
xdev->ext_addr = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 033/280] phy: stm32-usphyc: Fix off by one in probe()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 032/280] dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 034/280] phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) Greg Kroah-Hartman
` (251 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Amelie Delaunay,
Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit cabd25b57216ddc132efbcc31f972baa03aad15a ]
The "index" variable is used as an index into the usbphyc->phys[] array
which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys
then it is one element out of bounds. The "index" comes from the
device tree so it's data that we trust and it's unlikely to be wrong,
however it's obviously still worth fixing the bug. Change the > to >=.
Fixes: 94c358da3a05 ("phy: stm32: add support for STM32 USB PHY Controller (USBPHYC)")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://patch.msgid.link/aTfHcMJK1wFVnvEe@stanley.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/st/phy-stm32-usbphyc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/phy/st/phy-stm32-usbphyc.c b/drivers/phy/st/phy-stm32-usbphyc.c
index 5bb9647b078f1..c2947159e8b41 100644
--- a/drivers/phy/st/phy-stm32-usbphyc.c
+++ b/drivers/phy/st/phy-stm32-usbphyc.c
@@ -708,7 +708,7 @@ static int stm32_usbphyc_probe(struct platform_device *pdev)
}
ret = of_property_read_u32(child, "reg", &index);
- if (ret || index > usbphyc->nphys) {
+ if (ret || index >= usbphyc->nphys) {
dev_err(&phy->dev, "invalid reg property: %d\n", ret);
if (!ret)
ret = -EINVAL;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 034/280] phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 033/280] phy: stm32-usphyc: Fix off by one in probe() Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 035/280] dmaengine: omap-dma: fix dma_pool resource leak in error paths Greg Kroah-Hartman
` (250 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
[ Upstream commit fb21116099bbea1fc59efa9207e63c4be390ab72 ]
"family" is an enum, thus cast of pointer on 64-bit compile test with
clang W=1 causes:
phy-bcm-ns-usb3.c:206:17: error: cast to smaller integer type 'enum bcm_ns_family' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
This was already fixed in commit bd6e74a2f0a0 ("phy: broadcom: ns-usb3:
fix Wvoid-pointer-to-enum-cast warning") but then got bad in commit
21bf6fc47a1e ("phy: Use device_get_match_data()").
Note that after various discussions the preferred cast is via "unsigned
long", not "uintptr_t".
Fixes: 21bf6fc47a1e ("phy: Use device_get_match_data()")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20251224115533.154162-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/broadcom/phy-bcm-ns-usb3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/phy/broadcom/phy-bcm-ns-usb3.c b/drivers/phy/broadcom/phy-bcm-ns-usb3.c
index 2c8b1b7dda5bd..5c2710597df2c 100644
--- a/drivers/phy/broadcom/phy-bcm-ns-usb3.c
+++ b/drivers/phy/broadcom/phy-bcm-ns-usb3.c
@@ -203,7 +203,7 @@ static int bcm_ns_usb3_mdio_probe(struct mdio_device *mdiodev)
usb3->dev = dev;
usb3->mdiodev = mdiodev;
- usb3->family = (enum bcm_ns_family)device_get_match_data(dev);
+ usb3->family = (unsigned long)device_get_match_data(dev);
syscon_np = of_parse_phandle(dev->of_node, "usb3-dmp-syscon", 0);
err = of_address_to_resource(syscon_np, 0, &res);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 035/280] dmaengine: omap-dma: fix dma_pool resource leak in error paths
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 034/280] phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 036/280] HID: usbhid: paper over wrong bNumDescriptor field Greg Kroah-Hartman
` (249 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 2e1136acf8a8887c29f52e35a77b537309af321f ]
The dma_pool created by dma_pool_create() is not destroyed when
dma_async_device_register() or of_dma_controller_register() fails,
causing a resource leak in the probe error paths.
Add dma_pool_destroy() in both error paths to properly release the
allocated dma_pool resource.
Fixes: 7bedaa553760 ("dmaengine: add OMAP DMA engine driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251103073018.643-1-vulab@iscas.ac.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/ti/omap-dma.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index 27f5019bdc1ed..7755a79b429f4 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -1811,6 +1811,8 @@ static int omap_dma_probe(struct platform_device *pdev)
if (rc) {
pr_warn("OMAP-DMA: failed to register slave DMA engine device: %d\n",
rc);
+ if (od->ll123_supported)
+ dma_pool_destroy(od->desc_pool);
omap_dma_free(od);
return rc;
}
@@ -1826,6 +1828,8 @@ static int omap_dma_probe(struct platform_device *pdev)
if (rc) {
pr_warn("OMAP-DMA: failed to register DMA controller\n");
dma_async_device_unregister(&od->ddev);
+ if (od->ll123_supported)
+ dma_pool_destroy(od->desc_pool);
omap_dma_free(od);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 036/280] HID: usbhid: paper over wrong bNumDescriptor field
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 035/280] dmaengine: omap-dma: fix dma_pool resource leak in error paths Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 037/280] scsi: core: Fix error handler encryption support Greg Kroah-Hartman
` (248 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires,
Salvatore Bonaccorso
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
commit f28beb69c51517aec7067dfb2074e7c751542384 upstream.
Some faulty devices (ZWO EFWmini) have a wrong optional HID class
descriptor count compared to the provided length.
Given that we plainly ignore those optional descriptor, we can attempt
to fix the provided number so we do not lock out those devices.
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Cc: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hid-core.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -983,6 +983,7 @@ static int usbhid_parse(struct hid_devic
struct usb_device *dev = interface_to_usbdev (intf);
struct hid_descriptor *hdesc;
struct hid_class_descriptor *hcdesc;
+ __u8 fixed_opt_descriptors_size;
u32 quirks = 0;
unsigned int rsize = 0;
char *rdesc;
@@ -1013,7 +1014,21 @@ static int usbhid_parse(struct hid_devic
(hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) {
dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n",
hdesc->bLength, hdesc->bNumDescriptors);
- return -EINVAL;
+
+ /*
+ * Some devices may expose a wrong number of descriptors compared
+ * to the provided length.
+ * However, we ignore the optional hid class descriptors entirely
+ * so we can safely recompute the proper field.
+ */
+ if (hdesc->bLength >= sizeof(*hdesc)) {
+ fixed_opt_descriptors_size = hdesc->bLength - sizeof(*hdesc);
+
+ hid_warn(intf, "fixing wrong optional hid class descriptors count\n");
+ hdesc->bNumDescriptors = fixed_opt_descriptors_size / sizeof(*hcdesc) + 1;
+ } else {
+ return -EINVAL;
+ }
}
hid->version = le16_to_cpu(hdesc->bcdHID);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 037/280] scsi: core: Fix error handler encryption support
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 036/280] HID: usbhid: paper over wrong bNumDescriptor field Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 038/280] ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer Greg Kroah-Hartman
` (247 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Kao, Bart Van Assche,
Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Kao <powenkao@google.com>
commit 9a49157deeb23581fc5c8189b486340d7343264a upstream.
Some low-level drivers (LLD) access block layer crypto fields, such as
rq->crypt_keyslot and rq->crypt_ctx within `struct request`, to
configure hardware for inline encryption. However, SCSI Error Handling
(EH) commands (e.g., TEST UNIT READY, START STOP UNIT) should not
involve any encryption setup.
To prevent drivers from erroneously applying crypto settings during EH,
this patch saves the original values of rq->crypt_keyslot and
rq->crypt_ctx before an EH command is prepared via scsi_eh_prep_cmnd().
These fields in the 'struct request' are then set to NULL. The original
values are restored in scsi_eh_restore_cmnd() after the EH command
completes.
This ensures that the block layer crypto context does not leak into EH
command execution.
Signed-off-by: Brian Kao <powenkao@google.com>
Link: https://patch.msgid.link/20251218031726.2642834-1-powenkao@google.com
Cc: stable@vger.kernel.org
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_error.c | 24 ++++++++++++++++++++++++
include/scsi/scsi_eh.h | 6 ++++++
2 files changed, 30 insertions(+)
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -995,6 +995,9 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd
unsigned char *cmnd, int cmnd_size, unsigned sense_bytes)
{
struct scsi_device *sdev = scmd->device;
+#ifdef CONFIG_BLK_INLINE_ENCRYPTION
+ struct request *rq = scsi_cmd_to_rq(scmd);
+#endif
/*
* We need saved copies of a number of fields - this is because
@@ -1047,6 +1050,18 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd
(sdev->lun << 5 & 0xe0);
/*
+ * Encryption must be disabled for the commands submitted by the error handler.
+ * Hence, clear the encryption context information.
+ */
+#ifdef CONFIG_BLK_INLINE_ENCRYPTION
+ ses->rq_crypt_keyslot = rq->crypt_keyslot;
+ ses->rq_crypt_ctx = rq->crypt_ctx;
+
+ rq->crypt_keyslot = NULL;
+ rq->crypt_ctx = NULL;
+#endif
+
+ /*
* Zero the sense buffer. The scsi spec mandates that any
* untransferred sense data should be interpreted as being zero.
*/
@@ -1063,6 +1078,10 @@ EXPORT_SYMBOL(scsi_eh_prep_cmnd);
*/
void scsi_eh_restore_cmnd(struct scsi_cmnd* scmd, struct scsi_eh_save *ses)
{
+#ifdef CONFIG_BLK_INLINE_ENCRYPTION
+ struct request *rq = scsi_cmd_to_rq(scmd);
+#endif
+
/*
* Restore original data
*/
@@ -1075,6 +1094,11 @@ void scsi_eh_restore_cmnd(struct scsi_cm
scmd->underflow = ses->underflow;
scmd->prot_op = ses->prot_op;
scmd->eh_eflags = ses->eh_eflags;
+
+#ifdef CONFIG_BLK_INLINE_ENCRYPTION
+ rq->crypt_keyslot = ses->rq_crypt_keyslot;
+ rq->crypt_ctx = ses->rq_crypt_ctx;
+#endif
}
EXPORT_SYMBOL(scsi_eh_restore_cmnd);
--- a/include/scsi/scsi_eh.h
+++ b/include/scsi/scsi_eh.h
@@ -41,6 +41,12 @@ struct scsi_eh_save {
unsigned char cmnd[32];
struct scsi_data_buffer sdb;
struct scatterlist sense_sgl;
+
+ /* struct request fields */
+#ifdef CONFIG_BLK_INLINE_ENCRYPTION
+ struct bio_crypt_ctx *rq_crypt_ctx;
+ struct blk_crypto_keyslot *rq_crypt_keyslot;
+#endif
};
extern void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 038/280] ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 037/280] scsi: core: Fix error handler encryption support Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 039/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
` (246 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jaroslav Kysela, Takashi Iwai
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <perex@perex.cz>
commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream.
Handle the error code from snd_pcm_buffer_access_lock() in
snd_pcm_runtime_buffer_set_silence() function.
Found by Alexandros Panagiotou <apanagio@redhat.com>
Fixes: 93a81ca06577 ("ALSA: pcm: Fix race of buffer access at PCM OSS layer")
Cc: stable@vger.kernel.org # 6.15
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://patch.msgid.link/20260107213642.332954-1-perex@perex.cz
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/pcm.h | 2 +-
sound/core/oss/pcm_oss.c | 4 +++-
sound/core/pcm_native.c | 9 +++++++--
3 files changed, 11 insertions(+), 4 deletions(-)
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -1429,7 +1429,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
#define snd_pcm_lib_mmap_iomem NULL
#endif
-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
+int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
/**
* snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1085,7 +1085,9 @@ static int snd_pcm_oss_change_params_loc
runtime->oss.params = 0;
runtime->oss.prepare = 1;
runtime->oss.buffer_used = 0;
- snd_pcm_runtime_buffer_set_silence(runtime);
+ err = snd_pcm_runtime_buffer_set_silence(runtime);
+ if (err < 0)
+ goto failure;
runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size);
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -705,13 +705,18 @@ static void snd_pcm_buffer_access_unlock
}
/* fill the PCM buffer with the current silence format; called from pcm_oss.c */
-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
+int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
{
- snd_pcm_buffer_access_lock(runtime);
+ int err;
+
+ err = snd_pcm_buffer_access_lock(runtime);
+ if (err < 0)
+ return err;
if (runtime->dma_area)
snd_pcm_format_set_silence(runtime->format, runtime->dma_area,
bytes_to_samples(runtime, runtime->dma_bytes));
snd_pcm_buffer_access_unlock(runtime);
+ return 0;
}
EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 039/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 038/280] ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 040/280] can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit Greg Kroah-Hartman
` (245 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 7352e1d5932a0e777e39fa4b619801191f57e603 upstream.
In gs_can_open(), the URBs for USB-in transfers are allocated, added to the
parent->rx_submitted anchor and submitted. In the complete callback
gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In
gs_can_close() the URBs are freed by calling
usb_kill_anchored_urbs(parent->rx_submitted).
However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in gs_can_close().
Fix the memory leak by anchoring the URB in the
gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/gs_usb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -657,6 +657,8 @@ resubmit_urb:
hf, parent->hf_size_rx,
gs_usb_receive_bulk_callback, parent);
+ usb_anchor_urb(urb, &parent->rx_submitted);
+
rc = usb_submit_urb(urb, GFP_ATOMIC);
/* USB failure take down all interfaces */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 040/280] can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 039/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 041/280] net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Greg Kroah-Hartman
` (244 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ondrej Ille, Pavel Pisa,
Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Ille <ondrej.ille@gmail.com>
commit e707c591a139d1bfa4ddc83036fc820ca006a140 upstream.
The Secondary Sample Point Source field has been
set to an incorrect value by some mistake in the
past
0b01 - SSP_SRC_NO_SSP - SSP is not used.
for data bitrates above 1 MBit/s. The correct/default
value already used for lower bitrates is
0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY
(Measured Transmitter delay) + SSP_OFFSET.
The related configuration register structure is described
in section 3.1.46 SSP_CFG of the CTU CAN FD
IP CORE Datasheet.
The analysis leading to the proper configuration
is described in section 2.8.3 Secondary sampling point
of the datasheet.
The change has been tested on AMD/Xilinx Zynq
with the next CTU CN FD IP core versions:
- 2.6 aka master in the "integration with Zynq-7000 system" test
6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git
driver (change already included in the driver repo)
- older 2.5 snapshot with mainline kernels with this patch
applied locally in the multiple CAN latency tester nightly runs
6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT
6.19.0-rc3-dut
The logs, the datasheet and sources are available at
https://canbus.pages.fel.cvut.cz/
Signed-off-by: Ondrej Ille <ondrej.ille@gmail.com>
Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz>
Link: https://patch.msgid.link/20260105111620.16580-1-pisa@fel.cvut.cz
Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.")
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/can/ctucanfd/ctucanfd_base.c
+++ b/drivers/net/can/ctucanfd/ctucanfd_base.c
@@ -310,7 +310,7 @@ static int ctucan_set_secondary_sample_p
}
ssp_cfg = FIELD_PREP(REG_TRV_DELAY_SSP_OFFSET, ssp_offset);
- ssp_cfg |= FIELD_PREP(REG_TRV_DELAY_SSP_SRC, 0x1);
+ ssp_cfg |= FIELD_PREP(REG_TRV_DELAY_SSP_SRC, 0x0);
}
ctucan_write32(priv, CTUCANFD_TRV_DELAY, ssp_cfg);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 041/280] net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 040/280] can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 042/280] x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers Greg Kroah-Hartman
` (243 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Tetsuo Handa, Oleksij Rempel,
Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit 1809c82aa073a11b7d335ae932d81ce51a588a4a upstream.
Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is
called only when the timer is enabled, we need to call
j1939_session_deactivate_activate_next() if we cancelled the timer.
Otherwise, refcount for j1939_session leaks, which will later appear as
| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.
problem.
Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://patch.msgid.link/b1212653-8fa1-44e1-be9d-12f950fb3a07@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/j1939/transport.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1699,8 +1699,16 @@ static int j1939_xtp_rx_rts_session_acti
j1939_session_timers_cancel(session);
j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
- if (session->transmission)
+ if (session->transmission) {
j1939_session_deactivate_activate_next(session);
+ } else if (session->state == J1939_SESSION_WAITING_ABORT) {
+ /* Force deactivation for the receiver.
+ * If we rely on the timer starting in j1939_session_cancel,
+ * a second RTS call here will cancel that timer and fail
+ * to restart it because the state is already WAITING_ABORT.
+ */
+ j1939_session_deactivate_activate_next(session);
+ }
return -EBUSY;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 042/280] x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 041/280] net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 043/280] phy: rockchip: inno-usb2: fix communication disruption in gadget mode Greg Kroah-Hartman
` (242 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ingo Molnar, Kees Cook,
Bjorn Helgaas, Peter Zijlstra, Andy Lutomirski, Logan Gunthorpe,
Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Dan Williams, Balbir Singh,
Yasunori Goto, Dave Hansen, Dave Jiang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 upstream.
Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
is too narrow. The effect being mitigated in that commit is caused by
ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general,
lets any physical address be added to the direct-map. I.e. not only ACPI
hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but
also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update
the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases.
Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of
this problem is limited to the PCI_P2PDMA=n case.
A potential path to recover entropy would be to walk ACPI and determine the
limits for hotplug and PCI MMIO before kernel_randomize_memory(). On
smaller systems that could yield some KASLR address bits. This needs
additional investigation to determine if some limited ACPI table scanning
can happen this early without an open coded solution like
arch/x86/boot/compressed/acpi.c needs to deploy.
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Logan Gunthorpe <logang@deltatee.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Fixes: 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Tested-by: Yasunori Goto <y-goto@fujitsu.com>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: http://patch.msgid.link/692e08b2516d4_261c1100a3@dwillia2-mobl4.notmuch
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/kaslr.c | 10 +++++-----
drivers/pci/Kconfig | 6 ------
mm/Kconfig | 10 +++++++---
3 files changed, 12 insertions(+), 14 deletions(-)
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -111,12 +111,12 @@ void __init kernel_randomize_memory(void
/*
* Adapt physical memory region size based on available memory,
- * except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the
- * device BAR space assuming the direct map space is large enough
- * for creating a ZONE_DEVICE mapping in the direct map corresponding
- * to the physical BAR address.
+ * except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map
+ * any physical address into the direct-map. KASLR wants to reliably
+ * steal some physical address bits. Those design choices are in direct
+ * conflict.
*/
- if (!IS_ENABLED(CONFIG_PCI_P2PDMA) && (memory_tb < kaslr_regions[0].size_tb))
+ if (!IS_ENABLED(CONFIG_ZONE_DEVICE) && (memory_tb < kaslr_regions[0].size_tb))
kaslr_regions[0].size_tb = memory_tb;
/*
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -184,12 +184,6 @@ config PCI_P2PDMA
P2P DMA transactions must be between devices behind the same root
port.
- Enabling this option will reduce the entropy of x86 KASLR memory
- regions. For example - on a 46 bit system, the entropy goes down
- from 16 bits to 15 bits. The actual reduction in entropy depends
- on the physical address bits, on processor features, kernel config
- (5 level page table) and physical memory present on the system.
-
If unsure, say N.
config PCI_LABEL
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -994,10 +994,14 @@ config ZONE_DEVICE
Device memory hotplug support allows for establishing pmem,
or other device driver discovered memory regions, in the
memmap. This allows pfn_to_page() lookups of otherwise
- "device-physical" addresses which is needed for using a DAX
- mapping in an O_DIRECT operation, among other things.
+ "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and
+ DEVICE_PRIVATE features among others.
- If FS_DAX is enabled, then say Y.
+ Enabling this option will reduce the entropy of x86 KASLR memory
+ regions. For example - on a 46 bit system, the entropy goes down
+ from 16 bits to 15 bits. The actual reduction in entropy depends
+ on the physical address bits, on processor features, kernel config
+ (5 level page table) and physical memory present on the system.
#
# Helpers to mirror range of the CPU page tables of a process into device page
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 043/280] phy: rockchip: inno-usb2: fix communication disruption in gadget mode
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 042/280] x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 044/280] phy: freescale: imx8m-pcie: assert phy reset during power on Greg Kroah-Hartman
` (241 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Ceresoli, Théo Lebrun,
Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Ceresoli <luca.ceresoli@bootlin.com>
commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 upstream.
When the OTG USB port is used to power to SoC, configured as peripheral and
used in gadget mode, communication stops without notice about 6 seconds
after the gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be
powered by the only USB-C connector. That connector is the only one usable
in gadget mode. This implies the USB cable is connected from before boot
and never disconnects while the kernel runs.
The related code flow in the PHY driver code can be summarized as:
* the first time chg_detect_work starts (6 seconds after gadget is
configured and enumerated)
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y]
* rockchip_chg_detect_work() changes state and re-triggers itself a few
times until it reaches the DETECTED state:
-> rockchip_chg_detect_work():
if chg_state is DETECTED:
property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z]
At [Y] all existing communications stop. E.g. using a CDC serial gadget,
the /dev/tty* devices are still present on both host and device, but no
data is transferred anymore. The later call with a 'true' argument at [Z]
does not restore it.
Due to the lack of documentation, what chg_det.opmode does exactly is not
clear, however by code inspection it seems reasonable that is disables
something needed to keep the communication working, and testing proves that
disabling these lines lets gadget mode keep working. So prevent changes to
chg_det.opmode when there is a cable connected (VBUS present).
Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-2-dac8a02cd2ca@bootlin.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
@@ -717,7 +717,8 @@ static void rockchip_chg_detect_work(str
if (!rport->suspended)
rockchip_usb2phy_power_off(rport->phy);
/* put the controller in non-driving mode */
- property_enable(base, &rphy->phy_cfg->chg_det.opmode, false);
+ if (!vbus_attach)
+ property_enable(base, &rphy->phy_cfg->chg_det.opmode, false);
/* Start DCD processing stage 1 */
rockchip_chg_enable_dcd(rphy, true);
rphy->chg_state = USB_CHG_STATE_WAIT_FOR_DCD;
@@ -780,7 +781,8 @@ static void rockchip_chg_detect_work(str
fallthrough;
case USB_CHG_STATE_DETECTED:
/* put the controller in normal mode */
- property_enable(base, &rphy->phy_cfg->chg_det.opmode, true);
+ if (!vbus_attach)
+ property_enable(base, &rphy->phy_cfg->chg_det.opmode, true);
rockchip_usb2phy_otg_sm_work(&rport->otg_sm_work.work);
dev_dbg(&rport->phy->dev, "charger = %s\n",
chg_to_string(rphy->chg_type));
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 044/280] phy: freescale: imx8m-pcie: assert phy reset during power on
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 043/280] phy: rockchip: inno-usb2: fix communication disruption in gadget mode Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 045/280] phy: rockchip: inno-usb2: fix disconnection in gadget mode Greg Kroah-Hartman
` (240 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael Beims, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Beims <rafael.beims@toradex.com>
commit f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 upstream.
After U-Boot initializes PCIe with "pcie enum", Linux fails to detect
an NVMe disk on some boot cycles with:
phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110
Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to
lock when re-initialized without a reset cycle [1].
The issue reproduces on 7% of tested hardware platforms, with a 30-40%
failure rate per affected device across boot cycles.
Insert a reset cycle in the power-on routine to ensure the PHY is
initialized from a known state.
[1] https://community.nxp.com/t5/i-MX-Processors/iMX8MP-PCIe-initialization-in-U-Boot/m-p/2248437#M242401
Signed-off-by: Rafael Beims <rafael.beims@toradex.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251223150254.1075221-1-rafael@beims.me
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
@@ -91,7 +91,8 @@ static int imx8_pcie_phy_power_on(struct
writel(imx8_phy->tx_deemph_gen2,
imx8_phy->base + PCIE_PHY_TRSV_REG6);
break;
- case IMX8MP: /* Do nothing. */
+ case IMX8MP:
+ reset_control_assert(imx8_phy->reset);
break;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 045/280] phy: rockchip: inno-usb2: fix disconnection in gadget mode
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 044/280] phy: freescale: imx8m-pcie: assert phy reset during power on Greg Kroah-Hartman
@ 2026-02-04 14:36 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 046/280] phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 Greg Kroah-Hartman
` (239 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Louis Chauvet, Luca Ceresoli,
Théo Lebrun, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Chauvet <louis.chauvet@bootlin.com>
commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc upstream.
When the OTG USB port is used to power the SoC, configured as peripheral
and used in gadget mode, there is a disconnection about 6 seconds after the
gadget is configured and enumerated.
The problem was observed on a Radxa Rock Pi S board, which can only be
powered by the only USB-C connector. That connector is the only one usable
in gadget mode. This implies the USB cable is connected from before boot
and never disconnects while the kernel runs.
The problem happens because of the PHY driver code flow, summarized as:
* UDC start code (triggered via configfs at any time after boot)
-> phy_init
-> rockchip_usb2phy_init
-> schedule_delayed_work(otg_sm_work [A], 6 sec)
-> phy_power_on
-> rockchip_usb2phy_power_on
-> enable clock
-> rockchip_usb2phy_reset
* Now the gadget interface is up and running.
* 6 seconds later otg_sm_work starts [A]
-> rockchip_usb2phy_otg_sm_work():
if (B_IDLE state && VBUS present && ...):
schedule_delayed_work(&rport->chg_work [B], 0);
* immediately the chg_detect_work starts [B]
-> rockchip_chg_detect_work():
if chg_state is UNDEFINED:
if (!rport->suspended):
rockchip_usb2phy_power_off() <--- [X]
At [X], the PHY is powered off, causing a disconnection. This quickly
triggers a new connection and following re-enumeration, but any connection
that had been established during the 6 seconds is broken.
The code already checks for !rport->suspended (which, somewhat
counter-intuitively, means the PHY is powered on), so add a guard for VBUS
as well to avoid a disconnection when a cable is connected.
Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399")
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/
Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
Co-developed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-1-dac8a02cd2ca@bootlin.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
@@ -707,14 +707,16 @@ static void rockchip_chg_detect_work(str
container_of(work, struct rockchip_usb2phy_port, chg_work.work);
struct rockchip_usb2phy *rphy = dev_get_drvdata(rport->phy->dev.parent);
struct regmap *base = get_reg_base(rphy);
- bool is_dcd, tmout, vout;
+ bool is_dcd, tmout, vout, vbus_attach;
unsigned long delay;
+ vbus_attach = property_enabled(rphy->grf, &rport->port_cfg->utmi_bvalid);
+
dev_dbg(&rport->phy->dev, "chg detection work state = %d\n",
rphy->chg_state);
switch (rphy->chg_state) {
case USB_CHG_STATE_UNDEFINED:
- if (!rport->suspended)
+ if (!rport->suspended && !vbus_attach)
rockchip_usb2phy_power_off(rport->phy);
/* put the controller in non-driving mode */
if (!vbus_attach)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 046/280] phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-02-04 14:36 ` [PATCH 6.1 045/280] phy: rockchip: inno-usb2: fix disconnection in gadget mode Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 047/280] usb: dwc3: Check for USB4 IP_NAME Greg Kroah-Hartman
` (238 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wayne Chang, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Chang <waynec@nvidia.com>
commit b246caa68037aa495390a60d080acaeb84f45fff upstream.
The USB2 Bias Pad Control register manages analog parameters for signal
detection. Previously, the HS_DISCON_LEVEL relied on hardware reset
values, which may lead to the detection failure.
Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect
threshold is sufficient to guarantee reliable detection.
Fixes: bbf711682cd5 ("phy: tegra: xusb: Add Tegra186 support")
Cc: stable@vger.kernel.org
Signed-off-by: Wayne Chang <waynec@nvidia.com>
Link: https://patch.msgid.link/20251212032116.768307-1-waynec@nvidia.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/tegra/xusb-tegra186.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/phy/tegra/xusb-tegra186.c
+++ b/drivers/phy/tegra/xusb-tegra186.c
@@ -84,6 +84,7 @@
#define XUSB_PADCTL_USB2_BIAS_PAD_CTL0 0x284
#define BIAS_PAD_PD BIT(11)
#define HS_SQUELCH_LEVEL(x) (((x) & 0x7) << 0)
+#define HS_DISCON_LEVEL(x) (((x) & 0x7) << 3)
#define XUSB_PADCTL_USB2_BIAS_PAD_CTL1 0x288
#define USB2_TRK_START_TIMER(x) (((x) & 0x7f) << 12)
@@ -601,6 +602,8 @@ static void tegra186_utmi_bias_pad_power
value &= ~BIAS_PAD_PD;
value &= ~HS_SQUELCH_LEVEL(~0);
value |= HS_SQUELCH_LEVEL(priv->calib.hs_squelch);
+ value &= ~HS_DISCON_LEVEL(~0);
+ value |= HS_DISCON_LEVEL(0x7);
padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL0);
udelay(1);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 047/280] usb: dwc3: Check for USB4 IP_NAME
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 046/280] phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 048/280] usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor Greg Kroah-Hartman
` (237 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 upstream.
Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No
functional change except checking for the IP_NAME here. The driver will
treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4
will be introduced and checked separately.
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/e6f1827754c7a7ddc5eb7382add20bfe3a9b312f.1767390747.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 2 ++
drivers/usb/dwc3/core.h | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -905,6 +905,8 @@ static bool dwc3_core_is_valid(struct dw
reg = dwc3_readl(dwc->regs, DWC3_GSNPSID);
dwc->ip = DWC3_GSNPS_ID(reg);
+ if (dwc->ip == DWC4_IP)
+ dwc->ip = DWC32_IP;
/* This should read as U3 followed by revision number */
if (DWC3_IP_IS(DWC3)) {
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -1211,6 +1211,7 @@ struct dwc3 {
#define DWC3_IP 0x5533
#define DWC31_IP 0x3331
#define DWC32_IP 0x3332
+#define DWC4_IP 0x3430
u32 revision;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 048/280] usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 047/280] usb: dwc3: Check for USB4 IP_NAME Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 049/280] USB: OHCI/UHCI: Add soft dependencies on ehci_platform Greg Kroah-Hartman
` (236 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Johannes Brüderl
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Brüderl <johannes.bruederl@gmail.com>
commit 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd upstream.
Add USB_QUIRK_NO_BOS quirk flag to skip requesting the BOS descriptor
for devices that cannot handle it.
Add Elgato 4K X (0fd9:009b) to the quirk table. This device hangs when
the BOS descriptor is requested at SuperSpeed Plus (10Gbps).
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220027
Cc: stable <stable@kernel.org>
Signed-off-by: Johannes Brüderl <johannes.bruederl@gmail.com>
Link: https://patch.msgid.link/20251207090220.14807-1-johannes.bruederl@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/config.c | 5 +++++
drivers/usb/core/quirks.c | 3 +++
include/linux/usb/quirks.h | 3 +++
3 files changed, 11 insertions(+)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -1004,6 +1004,11 @@ int usb_get_bos_descriptor(struct usb_de
__u8 cap_type;
int ret;
+ if (dev->quirks & USB_QUIRK_NO_BOS) {
+ dev_dbg(ddev, "skipping BOS descriptor\n");
+ return -ENOMSG;
+ }
+
bos = kzalloc(sizeof(*bos), GFP_KERNEL);
if (!bos)
return -ENOMEM;
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -447,6 +447,9 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x0c45, 0x7056), .driver_info =
USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+ /* Elgato 4K X - BOS descriptor fetch hangs at SuperSpeed Plus */
+ { USB_DEVICE(0x0fd9, 0x009b), .driver_info = USB_QUIRK_NO_BOS },
+
/* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */
{ USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM },
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -75,4 +75,7 @@
/* short SET_ADDRESS request timeout */
#define USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT BIT(16)
+/* skip BOS descriptor request */
+#define USB_QUIRK_NO_BOS BIT(17)
+
#endif /* __LINUX_USB_QUIRKS_H */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 049/280] USB: OHCI/UHCI: Add soft dependencies on ehci_platform
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 048/280] usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 050/280] USB: serial: option: add Telit LE910 MBIM composition Greg Kroah-Hartman
` (235 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Shengwen Xiao, Huacai Chen,
Alan Stern
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhuacai@loongson.cn>
commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 upstream.
Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not
loaded first") said that ehci-hcd should be loaded before ohci-hcd and
uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft
dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci-
pci, which is not enough and we may still see the warnings in boot log.
To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on
ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f
is bogus, we only need the soft dependencies in the PCI level rather
than the HCD level.
However, there is really another neccessary soft dependencies between
ohci-platform/uhci-platform and ehci-platform, which is added by this
patch. The boot logs are below.
1. ohci-platform loaded before ehci-platform:
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1
ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
usb 1-4: new low-speed USB device number 2 using ohci-platform
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2
ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
usb 1-4: device descriptor read/all, error -62
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 1-4: new low-speed USB device number 3 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0
hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
2. ehci-platform loaded before ohci-platform:
ehci-platform 1f050000.usb: EHCI Host Controller
ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1
ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000
ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 4 ports detected
ohci-platform 1f058000.usb: Generic Platform OHCI controller
ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2
ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 4 ports detected
usb 2-4: new low-speed USB device number 2 using ohci-platform
input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0
hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
In the later case, there is no re-connection for USB-1.0/1.1 devices,
which is expected.
Cc: stable <stable@kernel.org>
Reported-by: Shengwen Xiao <atzlinux@sina.com>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260112084802.1995923-1-chenhuacai@loongson.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ohci-platform.c | 1 +
drivers/usb/host/uhci-platform.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/usb/host/ohci-platform.c
+++ b/drivers/usb/host/ohci-platform.c
@@ -379,3 +379,4 @@ MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_AUTHOR("Hauke Mehrtens");
MODULE_AUTHOR("Alan Stern");
MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: ehci_platform");
--- a/drivers/usb/host/uhci-platform.c
+++ b/drivers/usb/host/uhci-platform.c
@@ -194,3 +194,4 @@ static struct platform_driver uhci_platf
.of_match_table = platform_uhci_ids,
},
};
+MODULE_SOFTDEP("pre: ehci_platform");
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 050/280] USB: serial: option: add Telit LE910 MBIM composition
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 049/280] USB: OHCI/UHCI: Add soft dependencies on ehci_platform Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 051/280] USB: serial: ftdi_sio: add support for PICAXE AXE027 cable Greg Kroah-Hartman
` (234 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ulrich Mohr, Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ulrich Mohr <u.mohr@semex-engcon.com>
commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 upstream.
Add support for Telit LE910 module when operating in MBIM composition
with additional ttys. This USB product ID is used by the module
when AT#USBCFG is set to 7.
0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=1252 Rev=03.18
S: Manufacturer=Android
S: Product=LE910C1-EU
S: SerialNumber=0123456789ABCDEF
C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1505,6 +1505,7 @@ static const struct usb_device_id option
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */
.driver_info = NCTRL(2) | RSVD(3) },
{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */
{ USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
.driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
{ USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 051/280] USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 050/280] USB: serial: option: add Telit LE910 MBIM composition Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 052/280] nvme-pci: disable secondary temp for Wodposit WPBSNM8 Greg Kroah-Hartman
` (233 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ethan Nelson-Moore, Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
commit c0afe95e62984ceea171c3ea319beaf84a21181c upstream.
The vendor provides instructions to write "0403 bd90" to
/sys/bus/usb-serial/drivers/ftdi_sio/new_id; see:
https://picaxe.com/docs/picaxe_linux_instructions.pdf
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 2 ++
2 files changed, 3 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -850,6 +850,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) },
{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) },
{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) },
+ { USB_DEVICE(FTDI_VID, FTDI_AXE027_PID) },
{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) },
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -96,6 +96,8 @@
#define LMI_LM3S_EVAL_BOARD_PID 0xbcd9
#define LMI_LM3S_ICDI_BOARD_PID 0xbcda
+#define FTDI_AXE027_PID 0xBD90 /* PICAXE AXE027 USB download cable */
+
#define FTDI_TURTELIZER_PID 0xBDC8 /* JTAG/RS-232 adapter by egnite GmbH */
/* OpenDCC (www.opendcc.de) product id */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 052/280] nvme-pci: disable secondary temp for Wodposit WPBSNM8
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 051/280] USB: serial: ftdi_sio: add support for PICAXE AXE027 cable Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 053/280] ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref Greg Kroah-Hartman
` (232 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wu Haotian, Ilikara Zheng,
Keith Busch
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilikara Zheng <ilikara@aosc.io>
commit 340f4fc5508c2905a1f30de229e2a4b299d55735 upstream.
Secondary temperature thresholds (temp2_{min,max}) were not reported
properly on this NVMe SSD. This resulted in an error while attempting to
read these values with sensors(1):
ERROR: Can't get value of subfeature temp2_min: I/O error
ERROR: Can't get value of subfeature temp2_max: I/O error
Add the device to the nvme_id_table with the
NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non-
composite temperature thresholds.
Cc: stable@vger.kernel.org
Tested-by: Wu Haotian <rigoligo03@gmail.com>
Signed-off-by: Ilikara Zheng <ilikara@aosc.io>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3594,6 +3594,8 @@ static const struct pci_device_id nvme_i
.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
{ PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */
.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
+ { PCI_DEVICE(0x1fa0, 0x2283), /* Wodposit WPBSNM8-256GTP */
+ .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, },
{ PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */
.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
{ PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 053/280] ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 052/280] nvme-pci: disable secondary temp for Wodposit WPBSNM8 Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 054/280] hrtimer: Fix softirq base check in update_needs_ipi() Greg Kroah-Hartman
` (231 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Erkun, Baokun Li, Zhang Yi,
Theodore Tso, stable
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <yangerkun@huawei.com>
commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 upstream.
The error branch for ext4_xattr_inode_update_ref forget to release the
refcount for iloc.bh. Find this when review code.
Fixes: 57295e835408 ("ext4: guard against EA inode refcount underflow in xattr update")
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -984,6 +984,7 @@ static int ext4_xattr_inode_update_ref(h
ext4_error_inode(ea_inode, __func__, __LINE__, 0,
"EA inode %lu ref wraparound: ref_count=%lld ref_change=%d",
ea_inode->i_ino, ref_count, ref_change);
+ brelse(iloc.bh);
ret = -EFSCORRUPTED;
goto out;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 054/280] hrtimer: Fix softirq base check in update_needs_ipi()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 053/280] ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 055/280] EDAC/x38: Fix a resource leak in x38_probe1() Greg Kroah-Hartman
` (230 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Thomas Gleixner
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 upstream.
The 'clockid' field is not the correct way to check for a softirq base.
Fix the check to correctly compare the base type instead of the clockid.
Fixes: 1e7f7fbcd40c ("hrtimer: Avoid more SMP function calls in clock_was_set()")
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260107-hrtimer-clock-base-check-v1-1-afb5dbce94a1@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/hrtimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -939,7 +939,7 @@ static bool update_needs_ipi(struct hrti
return true;
/* Extra check for softirq clock bases */
- if (base->clockid < HRTIMER_BASE_MONOTONIC_SOFT)
+ if (base->index < HRTIMER_BASE_MONOTONIC_SOFT)
continue;
if (cpu_base->softirq_activated)
continue;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 055/280] EDAC/x38: Fix a resource leak in x38_probe1()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 054/280] hrtimer: Fix softirq base check in update_needs_ipi() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 056/280] EDAC/i3200: Fix a resource leak in i3200_probe1() Greg Kroah-Hartman
` (229 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Borislav Petkov (AMD)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
Fixes: df8bc08c192f ("edac x38: new MC driver module")
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251223124350.1496325-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/x38_edac.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/edac/x38_edac.c
+++ b/drivers/edac/x38_edac.c
@@ -341,9 +341,12 @@ static int x38_probe1(struct pci_dev *pd
layers[1].type = EDAC_MC_LAYER_CHANNEL;
layers[1].size = x38_channel_num;
layers[1].is_virt_csrow = false;
+
+
+ rc = -ENOMEM;
mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, 0);
if (!mci)
- return -ENOMEM;
+ goto unmap;
edac_dbg(3, "MC: init mci\n");
@@ -403,9 +406,9 @@ static int x38_probe1(struct pci_dev *pd
return 0;
fail:
+ edac_mc_free(mci);
+unmap:
iounmap(window);
- if (mci)
- edac_mc_free(mci);
return rc;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 056/280] EDAC/i3200: Fix a resource leak in i3200_probe1()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 055/280] EDAC/x38: Fix a resource leak in x38_probe1() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 057/280] x86/resctrl: Add missing resctrl initialization for Hygon Greg Kroah-Hartman
` (228 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Borislav Petkov (AMD)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit d42d5715dcb559342ff356327b241c53a67584d9 upstream.
If edac_mc_alloc() fails, also unmap the window.
[ bp: Use separate labels, turning it into the classic unwind pattern. ]
Fixes: dd8ef1db87a4 ("edac: i3200 memory controller driver")
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251223123202.1492038-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/i3200_edac.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -358,10 +358,11 @@ static int i3200_probe1(struct pci_dev *
layers[1].type = EDAC_MC_LAYER_CHANNEL;
layers[1].size = nr_channels;
layers[1].is_virt_csrow = false;
- mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers,
- sizeof(struct i3200_priv));
+
+ rc = -ENOMEM;
+ mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(struct i3200_priv));
if (!mci)
- return -ENOMEM;
+ goto unmap;
edac_dbg(3, "MC: init mci\n");
@@ -421,9 +422,9 @@ static int i3200_probe1(struct pci_dev *
return 0;
fail:
+ edac_mc_free(mci);
+unmap:
iounmap(window);
- if (mci)
- edac_mc_free(mci);
return rc;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 057/280] x86/resctrl: Add missing resctrl initialization for Hygon
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 056/280] EDAC/i3200: Fix a resource leak in i3200_probe1() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 058/280] x86/resctrl: Fix memory bandwidth counter width " Greg Kroah-Hartman
` (227 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaochen Shen, Borislav Petkov (AMD),
Reinette Chatre
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <shenxiaochen@open-hieco.net>
commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b upstream.
Hygon CPUs supporting Platform QoS features currently undergo partial resctrl
initialization through resctrl_cpu_detect() in the Hygon BSP init helper and
AMD/Hygon common initialization code. However, several critical data
structures remain uninitialized for Hygon CPUs in the following paths:
- get_mem_config()-> __rdt_get_mem_config_amd():
rdt_resource::membw,alloc_capable
hw_res::num_closid
- rdt_init_res_defs()->rdt_init_res_defs_amd():
rdt_resource::cache
hw_res::msr_base,msr_update
Add the missing AMD/Hygon common initialization to ensure proper Platform QoS
functionality on Hygon CPUs.
Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper")
Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251209062650.1536952-2-shenxiaochen@open-hieco.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/resctrl/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/cpu/resctrl/core.c
+++ b/arch/x86/kernel/cpu/resctrl/core.c
@@ -728,7 +728,8 @@ static __init bool get_mem_config(void)
if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
return __get_mem_config_intel(&hw_res->r_resctrl);
- else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+ else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
+ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
return __rdt_get_mem_config_amd(&hw_res->r_resctrl);
return false;
@@ -863,7 +864,8 @@ static __init void rdt_init_res_defs(voi
{
if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
rdt_init_res_defs_intel();
- else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+ else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
+ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
rdt_init_res_defs_amd();
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 058/280] x86/resctrl: Fix memory bandwidth counter width for Hygon
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 057/280] x86/resctrl: Add missing resctrl initialization for Hygon Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 059/280] mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free Greg Kroah-Hartman
` (226 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaochen Shen, Borislav Petkov (AMD),
Tony Luck, Reinette Chatre
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaochen Shen <shenxiaochen@open-hieco.net>
commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c upstream.
The memory bandwidth calculation relies on reading the hardware counter
and measuring the delta between samples. To ensure accurate measurement,
the software reads the counter frequently enough to prevent it from
rolling over twice between reads.
The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits.
Hygon CPUs provide a 32-bit width counter, but they do not support the
MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset
(from 24 bits).
Consequently, the kernel falls back to the 24-bit default counter width,
which causes incorrect overflow handling on Hygon CPUs.
Fix this by explicitly setting the counter width offset to 8 bits (resulting
in a 32-bit total counter width) for Hygon CPUs.
Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper")
Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251209062650.1536952-3-shenxiaochen@open-hieco.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/resctrl/core.c | 15 +++++++++++++--
arch/x86/kernel/cpu/resctrl/internal.h | 3 +++
2 files changed, 16 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/cpu/resctrl/core.c
+++ b/arch/x86/kernel/cpu/resctrl/core.c
@@ -896,8 +896,19 @@ void resctrl_cpu_detect(struct cpuinfo_x
c->x86_cache_occ_scale = ebx;
c->x86_cache_mbm_width_offset = eax & 0xff;
- if (c->x86_vendor == X86_VENDOR_AMD && !c->x86_cache_mbm_width_offset)
- c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_AMD;
+ if (!c->x86_cache_mbm_width_offset) {
+ switch (c->x86_vendor) {
+ case X86_VENDOR_AMD:
+ c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_AMD;
+ break;
+ case X86_VENDOR_HYGON:
+ c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_HYGON;
+ break;
+ default:
+ /* Leave c->x86_cache_mbm_width_offset as 0 */
+ break;
+ }
+ }
}
}
--- a/arch/x86/kernel/cpu/resctrl/internal.h
+++ b/arch/x86/kernel/cpu/resctrl/internal.h
@@ -31,6 +31,9 @@
#define MAX_MBA_BW_AMD 0x800
#define MBM_CNTR_WIDTH_OFFSET_AMD 20
+/* Hygon MBM counter width as an offset from MBM_CNTR_WIDTH_BASE */
+#define MBM_CNTR_WIDTH_OFFSET_HYGON 8
+
#define RMID_VAL_ERROR BIT_ULL(63)
#define RMID_VAL_UNAVAIL BIT_ULL(62)
/*
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 059/280] mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 058/280] x86/resctrl: Fix memory bandwidth counter width " Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 060/280] mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure Greg Kroah-Hartman
` (225 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan, Michal Hocko,
Brendan Jackman, Johannes Weiner, Suren Baghdasaryan,
Vlastimil Babka, Zi Yan, Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
commit b9efe36b5e3eb2e91aa3d706066428648af034fc upstream.
When page isolation loops indefinitely during memory offline, reading
/proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock,
causing hung task warnings.
Make procfs reads lock-free since percpu_pagelist_high_fraction is a
simple integer with naturally atomic reads, writers still serialize via
the mutex.
This prevents hung task warnings when reading the procfs file during
long-running memory offline operations.
[akpm@linux-foundation.org: add comment, per Michal]
Link: https://lkml.kernel.org/r/aS_y9AuJQFydLEXo@tiehlicka
Link: https://lkml.kernel.org/r/20251201060009.1420792-1-aboorvad@linux.ibm.com
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -9067,11 +9067,19 @@ int percpu_pagelist_high_fraction_sysctl
int old_percpu_pagelist_high_fraction;
int ret;
+ /*
+ * Avoid using pcp_batch_high_lock for reads as the value is read
+ * atomically and a race with offlining is harmless.
+ */
+
+ if (!write)
+ return proc_dointvec_minmax(table, write, buffer, length, ppos);
+
mutex_lock(&pcp_batch_high_lock);
old_percpu_pagelist_high_fraction = percpu_pagelist_high_fraction;
ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
- if (!write || ret < 0)
+ if (ret < 0)
goto out;
/* Sanity checking to avoid pcp imbalance */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 060/280] mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 059/280] mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 061/280] LoongArch: Fix PMU counter allocation for mixed-type event groups Greg Kroah-Hartman
` (224 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, chongjiapeng,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 9814cc832b88bd040fc2a1817c2b5469d0f7e862 upstream.
When a context DAMON sysfs directory setup is failed after setup of attrs/
directory, subdirectories of attrs/ directory are not cleaned up. As a
result, DAMON sysfs interface is nearly broken until the system reboots,
and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-3-sj@kernel.org
Fixes: c951cd3b8901 ("mm/damon: implement a minimal stub for sysfs-based DAMON interface")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: chongjiapeng <jiapeng.chong@linux.alibaba.com>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1772,7 +1772,7 @@ static int damon_sysfs_context_add_dirs(
err = damon_sysfs_context_set_targets(context);
if (err)
- goto put_attrs_out;
+ goto rmdir_put_attrs_out;
err = damon_sysfs_context_set_schemes(context);
if (err)
@@ -1782,7 +1782,8 @@ static int damon_sysfs_context_add_dirs(
put_targets_attrs_out:
kobject_put(&context->targets->kobj);
context->targets = NULL;
-put_attrs_out:
+rmdir_put_attrs_out:
+ damon_sysfs_attrs_rm_dirs(context->attrs);
kobject_put(&context->attrs->kobj);
context->attrs = NULL;
return err;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 061/280] LoongArch: Fix PMU counter allocation for mixed-type event groups
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 060/280] mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect Greg Kroah-Hartman
` (223 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lisa Robinson, Huacai Chen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lisa Robinson <lisa@bytefly.space>
commit a91f86e27087f250a5d9c89bb4a427b9c30fd815 upstream.
When validating a perf event group, validate_group() unconditionally
attempts to allocate hardware PMU counters for the leader, sibling
events and the new event being added.
This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event
is part of the group, the current code still tries to allocate a hardware
PMU counter for it, which can wrongly consume hardware PMU resources and
cause spurious allocation failures.
Fix this by only allocating PMU counters for hardware events during group
validation, and skipping software events.
A trimmed down reproducer is as simple as this:
#include <stdio.h>
#include <assert.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <linux/perf_event.h>
int main (int argc, char *argv[])
{
struct perf_event_attr attr = { 0 };
int fds[5];
attr.disabled = 1;
attr.exclude_kernel = 1;
attr.exclude_hv = 1;
attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP;
attr.size = sizeof (attr);
attr.type = PERF_TYPE_SOFTWARE;
attr.config = PERF_COUNT_SW_DUMMY;
fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0);
assert (fds[0] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_CPU_CYCLES;
fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[1] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_INSTRUCTIONS;
fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[2] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_BRANCH_MISSES;
fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[3] >= 0);
attr.type = PERF_TYPE_HARDWARE;
attr.config = PERF_COUNT_HW_CACHE_REFERENCES;
fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
assert (fds[4] >= 0);
printf ("PASSED\n");
return 0;
}
Cc: stable@vger.kernel.org
Fixes: b37042b2bb7c ("LoongArch: Add perf events support")
Signed-off-by: Lisa Robinson <lisa@bytefly.space>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/kernel/perf_event.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/arch/loongarch/kernel/perf_event.c
+++ b/arch/loongarch/kernel/perf_event.c
@@ -637,6 +637,18 @@ static const struct loongarch_perf_event
return pev;
}
+static inline bool loongarch_pmu_event_requires_counter(const struct perf_event *event)
+{
+ switch (event->attr.type) {
+ case PERF_TYPE_HARDWARE:
+ case PERF_TYPE_HW_CACHE:
+ case PERF_TYPE_RAW:
+ return true;
+ default:
+ return false;
+ }
+}
+
static int validate_group(struct perf_event *event)
{
struct cpu_hw_events fake_cpuc;
@@ -644,15 +656,18 @@ static int validate_group(struct perf_ev
memset(&fake_cpuc, 0, sizeof(fake_cpuc));
- if (loongarch_pmu_alloc_counter(&fake_cpuc, &leader->hw) < 0)
+ if (loongarch_pmu_event_requires_counter(leader) &&
+ loongarch_pmu_alloc_counter(&fake_cpuc, &leader->hw) < 0)
return -EINVAL;
for_each_sibling_event(sibling, leader) {
- if (loongarch_pmu_alloc_counter(&fake_cpuc, &sibling->hw) < 0)
+ if (loongarch_pmu_event_requires_counter(sibling) &&
+ loongarch_pmu_alloc_counter(&fake_cpuc, &sibling->hw) < 0)
return -EINVAL;
}
- if (loongarch_pmu_alloc_counter(&fake_cpuc, &event->hw) < 0)
+ if (loongarch_pmu_event_requires_counter(event) &&
+ loongarch_pmu_alloc_counter(&fake_cpuc, &event->hw) < 0)
return -EINVAL;
return 0;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 061/280] LoongArch: Fix PMU counter allocation for mixed-type event groups Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 15:31 ` Mario Limonciello
2026-02-04 14:37 ` [PATCH 6.1 063/280] drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare Greg Kroah-Hartman
` (222 subsequent siblings)
284 siblings, 1 reply; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kent.russell,
Mario Limonciello (AMD), Alex Deucher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <superm1@kernel.org>
commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
When an eGPU is unplugged the KFD topology should also be destroyed
for that GPU. This never happens because the fini_sw callbacks never
get to run. Run them manually before calling amdgpu_device_ip_fini_early()
when a device has already been disconnected.
This location is intentionally chosen to make sure that the kfd locking
refcount doesn't get incremented unintentionally.
Cc: kent.russell@amd.com
Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4102,6 +4102,14 @@ void amdgpu_device_fini_hw(struct amdgpu
/* disable ras feature must before hw fini */
amdgpu_ras_pre_fini(adev);
+ /*
+ * device went through surprise hotplug; we need to destroy topology
+ * before ip_fini_early to prevent kfd locking refcount issues by calling
+ * amdgpu_amdkfd_suspend()
+ */
+ if (drm_dev_is_unplugged(adev_to_drm(adev)))
+ amdgpu_amdkfd_device_fini_sw(adev);
+
amdgpu_device_ip_fini_early(adev);
amdgpu_irq_fini_hw(adev);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 063/280] drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 064/280] drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel Greg Kroah-Hartman
` (221 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dave Airlie, Lyude Paul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <lyude@redhat.com>
commit 9e9bc6be0fa0b6b6b73f4f831f3b77716d0a8d9e upstream.
For a while, I've been seeing a strange issue where some (usually not all)
of the display DMA channels will suddenly hang, particularly when there is
a visible cursor on the screen that is being frequently updated, and
especially when said cursor happens to go between two screens. While this
brings back lovely memories of fixing Intel Skylake bugs, I would quite
like to fix it :).
It turns out the problem that's happening here is that we're managing to
reach nv50_head_flush_set() in our atomic commit path without actually
holding nv50_disp->mutex. This means that cursor updates happening in
parallel (along with any other atomic updates that need to use the core
channel) will race with eachother, which eventually causes us to corrupt
the pushbuffer - leading to a plethora of various GSP errors, usually:
nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000218 00102680 00000004 00800003
nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 0000021c 00040509 00000004 00000001
nouveau 0000:c1:00.0: gsp: Xid:56 CMDre 00000000 00000000 00000000 00000001 00000001
The reason this is happening is because generally we check whether we need
to set nv50_atom->lock_core at the end of nv50_head_atomic_check().
However, curs507a_prepare is called from the fb_prepare callback, which
happens after the atomic check phase. As a result, this can lead to commits
that both touch the core channel but also don't grab nv50_disp->mutex.
So, fix this by making sure that we set nv50_atom->lock_core in
cus507a_prepare().
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
Cc: <stable@vger.kernel.org> # v4.18+
Link: https://patch.msgid.link/20251219215344.170852-2-lyude@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/dispnv50/curs507a.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/curs507a.c
@@ -83,6 +83,7 @@ curs507a_prepare(struct nv50_wndw *wndw,
asyh->curs.handle = handle;
asyh->curs.offset = offset;
asyh->set.curs = asyh->curs.visible;
+ nv50_atom(asyh->state.state)->lock_core = true;
}
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 064/280] drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 063/280] drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 065/280] drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() Greg Kroah-Hartman
` (220 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Neil Armstrong
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@nabladev.com>
commit 6ab3d4353bf75005eaa375677c9fed31148154d6 upstream.
The connector type for the DataImage SCF0700C48GGU18 panel is missing and
devm_drm_panel_bridge_add() requires connector type to be set. This leads
to a warning and a backtrace in the kernel log and panel does not work:
"
WARNING: CPU: 3 PID: 38 at drivers/gpu/drm/bridge/panel.c:379 devm_drm_of_get_bridge+0xac/0xb8
"
The warning is triggered by a check for valid connector type in
devm_drm_panel_bridge_add(). If there is no valid connector type
set for a panel, the warning is printed and panel is not added.
Fill in the missing connector type to fix the warning and make
the panel operational once again.
Cc: stable@vger.kernel.org
Fixes: 97ceb1fb08b6 ("drm/panel: simple: Add support for DataImage SCF0700C48GGU18")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260110152750.73848-1-marex@nabladev.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panel/panel-simple.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -1518,6 +1518,7 @@ static const struct panel_desc dataimage
},
.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
+ .connector_type = DRM_MODE_CONNECTOR_DPI,
};
static const struct display_timing dlc_dlc0700yzg_1_timing = {
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 065/280] drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 064/280] drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 066/280] dmaengine: apple-admac: Add "apple,t8103-admac" compatible Greg Kroah-Hartman
` (219 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Zack Rusin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit bf72b4b7bb7dbb643d204fa41e7463894a95999f upstream.
In vmw_compat_shader_add(), the return value check of vmw_shader_alloc()
is not proper. Modify the check for the return pointer 'res'.
Found by code review and compiled on ubuntu 20.04.
Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251224091105.1569464-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -917,8 +917,10 @@ int vmw_compat_shader_add(struct vmw_pri
ttm_bo_unreserve(&buf->base);
res = vmw_shader_alloc(dev_priv, buf, size, 0, shader_type);
- if (unlikely(ret != 0))
+ if (IS_ERR(res)) {
+ ret = PTR_ERR(res);
goto no_reserve;
+ }
ret = vmw_cmdbuf_res_add(man, vmw_cmdbuf_res_shader,
vmw_shader_key(user_key, shader_type),
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 066/280] dmaengine: apple-admac: Add "apple,t8103-admac" compatible
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 065/280] drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 067/280] dmaengine: at_hdmac: fix device leak on of_dma_xlate() Greg Kroah-Hartman
` (218 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neal Gompa, Janne Grunau, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
commit 76cba1e60b69c9cd53b9127d017a7dc5945455b1 upstream.
After discussion with the devicetree maintainers we agreed to not extend
lists with the generic compatible "apple,admac" anymore [1]. Use
"apple,t8103-admac" as base compatible as it is the SoC the driver and
bindings were written for.
[1]: https://lore.kernel.org/asahi/12ab93b7-1fc2-4ce0-926e-c8141cfe81bf@kernel.org/
Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver")
Cc: stable@vger.kernel.org
Reviewed-by: Neal Gompa <neal@gompa.dev>
Signed-off-by: Janne Grunau <j@jannau.net>
Link: https://patch.msgid.link/20251231-apple-admac-t8103-base-compat-v1-1-ec24a3708f76@jannau.net
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/apple-admac.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/dma/apple-admac.c
+++ b/drivers/dma/apple-admac.c
@@ -937,6 +937,7 @@ static int admac_remove(struct platform_
}
static const struct of_device_id admac_of_match[] = {
+ { .compatible = "apple,t8103-admac", },
{ .compatible = "apple,admac", },
{ }
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 067/280] dmaengine: at_hdmac: fix device leak on of_dma_xlate()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 066/280] dmaengine: apple-admac: Add "apple,t8103-admac" compatible Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 068/280] dmaengine: bcm-sba-raid: fix device leak on probe Greg Kroah-Hartman
` (217 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Johan Hovold, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
Make sure to drop the reference taken when looking up the DMA platform
device during of_dma_xlate() when releasing channel resources.
Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing
put_device() call in at_dma_xlate()") fixed the leak in a couple of
error paths but the reference is still leaking on successful allocation.
Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()")
Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2
Cc: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/at_hdmac.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1347,6 +1347,7 @@ static int atc_config(struct dma_chan *c
struct dma_slave_config *sconfig)
{
struct at_dma_chan *atchan = to_at_dma_chan(chan);
+ struct at_dma_slave *atslave;
dev_vdbg(chan2dev(chan), "%s\n", __func__);
@@ -1606,8 +1607,12 @@ static void atc_free_chan_resources(stru
/*
* Free atslave allocated in at_dma_xlate()
*/
- kfree(chan->private);
- chan->private = NULL;
+ atslave = chan->private;
+ if (atslave) {
+ put_device(atslave->dma_dev);
+ kfree(atslave);
+ chan->private = NULL;
+ }
dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 068/280] dmaengine: bcm-sba-raid: fix device leak on probe
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 067/280] dmaengine: at_hdmac: fix device leak on of_dma_xlate() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 069/280] dmaengine: dw: dmamux: fix OF node leak on route allocation failure Greg Kroah-Hartman
` (216 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7c3a46ebf15a9796b763a54272407fdbf945bed8 upstream.
Make sure to drop the reference taken when looking up the mailbox device
during probe on probe failures and on driver unbind.
Fixes: 743e1c8ffe4e ("dmaengine: Add Broadcom SBA RAID driver")
Cc: stable@vger.kernel.org # 4.13
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251117161258.10679-4-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/bcm-sba-raid.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/dma/bcm-sba-raid.c
+++ b/drivers/dma/bcm-sba-raid.c
@@ -1697,7 +1697,7 @@ static int sba_probe(struct platform_dev
/* Prealloc channel resource */
ret = sba_prealloc_channel_resources(sba);
if (ret)
- goto fail_free_mchan;
+ goto fail_put_mbox;
/* Check availability of debugfs */
if (!debugfs_initialized())
@@ -1727,6 +1727,8 @@ skip_debugfs:
fail_free_resources:
debugfs_remove_recursive(sba->root);
sba_freeup_channel_resources(sba);
+fail_put_mbox:
+ put_device(sba->mbox_dev);
fail_free_mchan:
mbox_free_channel(sba->mchan);
return ret;
@@ -1742,6 +1744,8 @@ static int sba_remove(struct platform_de
sba_freeup_channel_resources(sba);
+ put_device(sba->mbox_dev);
+
mbox_free_channel(sba->mchan);
return 0;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 069/280] dmaengine: dw: dmamux: fix OF node leak on route allocation failure
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 068/280] dmaengine: bcm-sba-raid: fix device leak on probe Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 070/280] dmaengine: idxd: fix device leaks on compat bind and unbind Greg Kroah-Hartman
` (215 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Johan Hovold,
Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ec25e60f9f95464aa11411db31d0906b3fb7b9f2 upstream.
Make sure to drop the reference taken to the DMA master OF node also on
late route allocation failures.
Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support")
Cc: stable@vger.kernel.org # 5.19
Cc: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20251117161258.10679-6-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/dw/rzn1-dmamux.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/dma/dw/rzn1-dmamux.c
+++ b/drivers/dma/dw/rzn1-dmamux.c
@@ -88,7 +88,7 @@ static void *rzn1_dmamux_route_allocate(
if (test_and_set_bit(map->req_idx, dmamux->used_chans)) {
ret = -EBUSY;
- goto free_map;
+ goto put_dma_spec_np;
}
mask = BIT(map->req_idx);
@@ -101,6 +101,8 @@ static void *rzn1_dmamux_route_allocate(
clear_bitmap:
clear_bit(map->req_idx, dmamux->used_chans);
+put_dma_spec_np:
+ of_node_put(dma_spec->np);
free_map:
kfree(map);
put_device:
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 070/280] dmaengine: idxd: fix device leaks on compat bind and unbind
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 069/280] dmaengine: dw: dmamux: fix OF node leak on route allocation failure Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 071/280] dmaengine: lpc18xx-dmamux: fix device leak on route allocation Greg Kroah-Hartman
` (214 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dave Jiang, Johan Hovold, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 799900f01792cf8b525a44764f065f83fcafd468 upstream.
Make sure to drop the reference taken when looking up the idxd device as
part of the compat bind and unbind sysfs interface.
Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
Cc: stable@vger.kernel.org # 5.15
Cc: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251117161258.10679-7-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/idxd/compat.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
--- a/drivers/dma/idxd/compat.c
+++ b/drivers/dma/idxd/compat.c
@@ -21,11 +21,16 @@ static ssize_t unbind_store(struct devic
int rc = -ENODEV;
dev = bus_find_device_by_name(bus, NULL, buf);
- if (dev && dev->driver) {
+ if (!dev)
+ return -ENODEV;
+
+ if (dev->driver) {
device_driver_detach(dev);
rc = count;
}
+ put_device(dev);
+
return rc;
}
static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
@@ -39,9 +44,12 @@ static ssize_t bind_store(struct device_
struct idxd_dev *idxd_dev;
dev = bus_find_device_by_name(bus, NULL, buf);
- if (!dev || dev->driver || drv != &dsa_drv.drv)
+ if (!dev)
return -ENODEV;
+ if (dev->driver || drv != &dsa_drv.drv)
+ goto err_put_dev;
+
idxd_dev = confdev_to_idxd_dev(dev);
if (is_idxd_dev(idxd_dev)) {
alt_drv = driver_find("idxd", bus);
@@ -54,13 +62,20 @@ static ssize_t bind_store(struct device_
alt_drv = driver_find("user", bus);
}
if (!alt_drv)
- return -ENODEV;
+ goto err_put_dev;
rc = device_driver_attach(alt_drv, dev);
if (rc < 0)
- return rc;
+ goto err_put_dev;
+
+ put_device(dev);
return count;
+
+err_put_dev:
+ put_device(dev);
+
+ return rc;
}
static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 071/280] dmaengine: lpc18xx-dmamux: fix device leak on route allocation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 070/280] dmaengine: idxd: fix device leaks on compat bind and unbind Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 072/280] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Greg Kroah-Hartman
` (213 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Vladimir Zapolskiy,
Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit d4d63059dee7e7cae0c4d9a532ed558bc90efb55 upstream.
Make sure to drop the reference taken when looking up the DMA mux
platform device during route allocation.
Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
Fixes: e5f4ae84be74 ("dmaengine: add driver for lpc18xx dmamux")
Cc: stable@vger.kernel.org # 4.3
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
Link: https://patch.msgid.link/20251117161258.10679-8-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/lpc18xx-dmamux.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
--- a/drivers/dma/lpc18xx-dmamux.c
+++ b/drivers/dma/lpc18xx-dmamux.c
@@ -55,30 +55,31 @@ static void *lpc18xx_dmamux_reserve(stru
struct lpc18xx_dmamux_data *dmamux = platform_get_drvdata(pdev);
unsigned long flags;
unsigned mux;
+ int ret = -EINVAL;
if (dma_spec->args_count != 3) {
dev_err(&pdev->dev, "invalid number of dma mux args\n");
- return ERR_PTR(-EINVAL);
+ goto err_put_pdev;
}
mux = dma_spec->args[0];
if (mux >= dmamux->dma_master_requests) {
dev_err(&pdev->dev, "invalid mux number: %d\n",
dma_spec->args[0]);
- return ERR_PTR(-EINVAL);
+ goto err_put_pdev;
}
if (dma_spec->args[1] > LPC18XX_DMAMUX_MAX_VAL) {
dev_err(&pdev->dev, "invalid dma mux value: %d\n",
dma_spec->args[1]);
- return ERR_PTR(-EINVAL);
+ goto err_put_pdev;
}
/* The of_node_put() will be done in the core for the node */
dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
if (!dma_spec->np) {
dev_err(&pdev->dev, "can't get dma master\n");
- return ERR_PTR(-EINVAL);
+ goto err_put_pdev;
}
spin_lock_irqsave(&dmamux->lock, flags);
@@ -87,7 +88,8 @@ static void *lpc18xx_dmamux_reserve(stru
dev_err(&pdev->dev, "dma request %u busy with %u.%u\n",
mux, mux, dmamux->muxes[mux].value);
of_node_put(dma_spec->np);
- return ERR_PTR(-EBUSY);
+ ret = -EBUSY;
+ goto err_put_pdev;
}
dmamux->muxes[mux].busy = true;
@@ -104,7 +106,14 @@ static void *lpc18xx_dmamux_reserve(stru
dev_dbg(&pdev->dev, "mapping dmamux %u.%u to dma request %u\n", mux,
dmamux->muxes[mux].value, mux);
+ put_device(&pdev->dev);
+
return &dmamux->muxes[mux];
+
+err_put_pdev:
+ put_device(&pdev->dev);
+
+ return ERR_PTR(ret);
}
static int lpc18xx_dmamux_probe(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 072/280] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 071/280] dmaengine: lpc18xx-dmamux: fix device leak on route allocation Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 073/280] dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() Greg Kroah-Hartman
` (212 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Bjorn Andersson,
Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
Fix a memory leak in gpi_peripheral_config() where the original memory
pointed to by gchan->config could be lost if krealloc() fails.
The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the
reference to the original memory
4. The original memory becomes unreachable and cannot be freed
Fix this by using a temporary variable to hold the krealloc() result
and only updating gchan->config when the allocation succeeds.
Found via static analysis and code review.
Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/qcom/gpi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/dma/qcom/gpi.c
+++ b/drivers/dma/qcom/gpi.c
@@ -1621,14 +1621,16 @@ static int
gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
{
struct gchan *gchan = to_gchan(chan);
+ void *new_config;
if (!config->peripheral_config)
return -EINVAL;
- gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
- if (!gchan->config)
+ new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
+ if (!new_config)
return -ENOMEM;
+ gchan->config = new_config;
memcpy(gchan->config, config->peripheral_config, config->peripheral_size);
return 0;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 073/280] dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 072/280] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 074/280] dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation Greg Kroah-Hartman
` (211 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Geert Uytterhoeven, Biju Das,
Claudiu Beznea, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
commit 747213b08a1ab6a76e3e3b3e7a209cc1d402b5d0 upstream.
After audio full duplex testing, playing the recorded file contains a few
playback frames from the previous time. The rz_dmac_terminate_all() does
not reset all the hardware descriptors queued previously, leading to the
wrong descriptor being picked up during the next DMA transfer. Fix the
above issue by resetting all the descriptor headers for a channel in
rz_dmac_terminate_all() as rz_dmac_lmdesc_recycle() points to the proper
descriptor header filled by the rz_dmac_prepare_descs_for_slave_sg().
Cc: stable@kernel.org
Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20251113195052.564338-1-biju.das.jz@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/sh/rz-dmac.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/dma/sh/rz-dmac.c
+++ b/drivers/dma/sh/rz-dmac.c
@@ -533,11 +533,16 @@ rz_dmac_prep_slave_sg(struct dma_chan *c
static int rz_dmac_terminate_all(struct dma_chan *chan)
{
struct rz_dmac_chan *channel = to_rz_dmac_chan(chan);
+ struct rz_lmdesc *lmdesc = channel->lmdesc.base;
unsigned long flags;
+ unsigned int i;
LIST_HEAD(head);
rz_dmac_disable_hw(channel);
spin_lock_irqsave(&channel->vc.lock, flags);
+ for (i = 0; i < DMAC_NR_LMDESC; i++)
+ lmdesc[i].header = 0;
+
list_splice_tail_init(&channel->ld_active, &channel->ld_free);
list_splice_tail_init(&channel->ld_queue, &channel->ld_free);
spin_unlock_irqrestore(&channel->vc.lock, flags);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 074/280] dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 073/280] dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 075/280] dmaengine: ti: dma-crossbar: fix device leak on am335x " Greg Kroah-Hartman
` (210 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Miaoqian Lin,
Johan Hovold, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit dc7e44db01fc2498644e3106db3e62a9883a93d5 upstream.
Make sure to drop the reference taken when looking up the crossbar
platform device during dra7x route allocation.
Note that commit 615a4bfc426e ("dmaengine: ti: Add missing put_device in
ti_dra7_xbar_route_allocate") fixed the leak in the error paths but the
reference is still leaking on successful allocation.
Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x")
Fixes: 615a4bfc426e ("dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate")
Cc: stable@vger.kernel.org # 4.2: 615a4bfc426e
Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251117161258.10679-14-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/ti/dma-crossbar.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/dma/ti/dma-crossbar.c
+++ b/drivers/dma/ti/dma-crossbar.c
@@ -287,6 +287,8 @@ static void *ti_dra7_xbar_route_allocate
ti_dra7_xbar_write(xbar->iomem, map->xbar_out, map->xbar_in);
+ put_device(&pdev->dev);
+
return map;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 075/280] dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 074/280] dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 076/280] dmaengine: ti: k3-udma: fix device leak on udma lookup Greg Kroah-Hartman
` (209 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Ujfalusi, Johan Hovold,
Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 4fc17b1c6d2e04ad13fd6c21cfbac68043ec03f9 upstream.
Make sure to drop the reference taken when looking up the crossbar
platform device during am335x route allocation.
Fixes: 42dbdcc6bf96 ("dmaengine: ti-dma-crossbar: Add support for crossbar on AM33xx/AM43xx")
Cc: stable@vger.kernel.org # 4.4
Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251117161258.10679-15-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/ti/dma-crossbar.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/dma/ti/dma-crossbar.c
+++ b/drivers/dma/ti/dma-crossbar.c
@@ -78,34 +78,35 @@ static void *ti_am335x_xbar_route_alloca
{
struct platform_device *pdev = of_find_device_by_node(ofdma->of_node);
struct ti_am335x_xbar_data *xbar = platform_get_drvdata(pdev);
- struct ti_am335x_xbar_map *map;
+ struct ti_am335x_xbar_map *map = ERR_PTR(-EINVAL);
if (dma_spec->args_count != 3)
- return ERR_PTR(-EINVAL);
+ goto out_put_pdev;
if (dma_spec->args[2] >= xbar->xbar_events) {
dev_err(&pdev->dev, "Invalid XBAR event number: %d\n",
dma_spec->args[2]);
- return ERR_PTR(-EINVAL);
+ goto out_put_pdev;
}
if (dma_spec->args[0] >= xbar->dma_requests) {
dev_err(&pdev->dev, "Invalid DMA request line number: %d\n",
dma_spec->args[0]);
- return ERR_PTR(-EINVAL);
+ goto out_put_pdev;
}
/* The of_node_put() will be done in the core for the node */
dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
if (!dma_spec->np) {
dev_err(&pdev->dev, "Can't get DMA master\n");
- return ERR_PTR(-EINVAL);
+ goto out_put_pdev;
}
map = kzalloc(sizeof(*map), GFP_KERNEL);
if (!map) {
of_node_put(dma_spec->np);
- return ERR_PTR(-ENOMEM);
+ map = ERR_PTR(-ENOMEM);
+ goto out_put_pdev;
}
map->dma_line = (u16)dma_spec->args[0];
@@ -119,6 +120,9 @@ static void *ti_am335x_xbar_route_alloca
ti_am335x_xbar_write(xbar->iomem, map->dma_line, map->mux_val);
+out_put_pdev:
+ put_device(&pdev->dev);
+
return map;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 076/280] dmaengine: ti: k3-udma: fix device leak on udma lookup
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 075/280] dmaengine: ti: dma-crossbar: fix device leak on am335x " Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 077/280] btrfs: fix deadlock in wait_current_trans() due to ignored transaction type Greg Kroah-Hartman
` (208 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Grygorii Strashko, Yu Kuai,
Johan Hovold, Vinod Koul
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 430f7803b69cd5e5694e5dfc884c6628870af36e upstream.
Make sure to drop the reference taken when looking up the UDMA platform
device.
Note that holding a reference to a platform device does not prevent its
driver data from going away so there is no point in keeping the
reference after the lookup helper returns.
Fixes: d70241913413 ("dmaengine: ti: k3-udma: Add glue layer for non DMAengine users")
Fixes: 1438cde8fe9c ("dmaengine: ti: k3-udma: add missing put_device() call in of_xudma_dev_get()")
Cc: stable@vger.kernel.org # 5.6: 1438cde8fe9c
Cc: Grygorii Strashko <grygorii.strashko@ti.com>
Cc: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251117161258.10679-17-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/ti/k3-udma-private.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/ti/k3-udma-private.c
+++ b/drivers/dma/ti/k3-udma-private.c
@@ -40,9 +40,9 @@ struct udma_dev *of_xudma_dev_get(struct
}
ud = platform_get_drvdata(pdev);
+ put_device(&pdev->dev);
if (!ud) {
pr_debug("UDMA has not been probed\n");
- put_device(&pdev->dev);
return ERR_PTR(-EPROBE_DEFER);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 077/280] btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 076/280] dmaengine: ti: k3-udma: fix device leak on udma lookup Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 078/280] io_uring: move local task_work in exit cancel loop Greg Kroah-Hartman
` (207 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Robbie Ko,
David Sterba, Motiejus Jakštys
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <robbieko@synology.com>
commit 5037b342825df7094a4906d1e2a9674baab50cb2 upstream.
When wait_current_trans() is called during start_transaction(), it
currently waits for a blocked transaction without considering whether
the given transaction type actually needs to wait for that particular
transaction state. The btrfs_blocked_trans_types[] array already defines
which transaction types should wait for which transaction states, but
this check was missing in wait_current_trans().
This can lead to a deadlock scenario involving two transactions and
pending ordered extents:
1. Transaction A is in TRANS_STATE_COMMIT_DOING state
2. A worker processing an ordered extent calls start_transaction()
with TRANS_JOIN
3. join_transaction() returns -EBUSY because Transaction A is in
TRANS_STATE_COMMIT_DOING
4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes
5. A new Transaction B is created (TRANS_STATE_RUNNING)
6. The ordered extent from step 2 is added to Transaction B's
pending ordered extents
7. Transaction B immediately starts commit by another task and
enters TRANS_STATE_COMMIT_START
8. The worker finally reaches wait_current_trans(), sees Transaction B
in TRANS_STATE_COMMIT_START (a blocked state), and waits
unconditionally
9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START
according to btrfs_blocked_trans_types[]
10. Transaction B is waiting for pending ordered extents to complete
11. Deadlock: Transaction B waits for ordered extent, ordered extent
waits for Transaction B
This can be illustrated by the following call stacks:
CPU0 CPU1
btrfs_finish_ordered_io()
start_transaction(TRANS_JOIN)
join_transaction()
# -EBUSY (Transaction A is
# TRANS_STATE_COMMIT_DOING)
# Transaction A completes
# Transaction B created
# ordered extent added to
# Transaction B's pending list
btrfs_commit_transaction()
# Transaction B enters
# TRANS_STATE_COMMIT_START
# waiting for pending ordered
# extents
wait_current_trans()
# waits for Transaction B
# (should not wait!)
Task bstore_kv_sync in btrfs_commit_transaction waiting for ordered
extents:
__schedule+0x2e7/0x8a0
schedule+0x64/0xe0
btrfs_commit_transaction+0xbf7/0xda0 [btrfs]
btrfs_sync_file+0x342/0x4d0 [btrfs]
__x64_sys_fdatasync+0x4b/0x80
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Task kworker in wait_current_trans waiting for transaction commit:
Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs]
__schedule+0x2e7/0x8a0
schedule+0x64/0xe0
wait_current_trans+0xb0/0x110 [btrfs]
start_transaction+0x346/0x5b0 [btrfs]
btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs]
btrfs_work_helper+0xe8/0x350 [btrfs]
process_one_work+0x1d3/0x3c0
worker_thread+0x4d/0x3e0
kthread+0x12d/0x150
ret_from_fork+0x1f/0x30
Fix this by passing the transaction type to wait_current_trans() and
checking btrfs_blocked_trans_types[cur_trans->state] against the given
type before deciding to wait. This ensures that transaction types which
are allowed to join during certain blocked states will not unnecessarily
wait and cause deadlocks.
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Cc: Motiejus Jakštys <motiejus@jakstys.lt>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/transaction.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -503,13 +503,14 @@ static inline int is_transaction_blocked
* when this is done, it is safe to start a new transaction, but the current
* transaction might not be fully on disk.
*/
-static void wait_current_trans(struct btrfs_fs_info *fs_info)
+static void wait_current_trans(struct btrfs_fs_info *fs_info, unsigned int type)
{
struct btrfs_transaction *cur_trans;
spin_lock(&fs_info->trans_lock);
cur_trans = fs_info->running_transaction;
- if (cur_trans && is_transaction_blocked(cur_trans)) {
+ if (cur_trans && is_transaction_blocked(cur_trans) &&
+ (btrfs_blocked_trans_types[cur_trans->state] & type)) {
refcount_inc(&cur_trans->use_count);
spin_unlock(&fs_info->trans_lock);
@@ -661,12 +662,12 @@ again:
sb_start_intwrite(fs_info->sb);
if (may_wait_transaction(fs_info, type))
- wait_current_trans(fs_info);
+ wait_current_trans(fs_info, type);
do {
ret = join_transaction(fs_info, type);
if (ret == -EBUSY) {
- wait_current_trans(fs_info);
+ wait_current_trans(fs_info, type);
if (unlikely(type == TRANS_ATTACH ||
type == TRANS_JOIN_NOSTART))
ret = -ENOENT;
@@ -948,7 +949,7 @@ out:
void btrfs_throttle(struct btrfs_fs_info *fs_info)
{
- wait_current_trans(fs_info);
+ wait_current_trans(fs_info, TRANS_START);
}
static bool should_end_transaction(struct btrfs_trans_handle *trans)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 078/280] io_uring: move local task_work in exit cancel loop
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 077/280] btrfs: fix deadlock in wait_current_trans() due to ignored transaction type Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 079/280] posix-clock: introduce posix_clock_context concept Greg Kroah-Hartman
` (206 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Lei, Jens Axboe
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <ming.lei@redhat.com>
commit da579f05ef0faada3559e7faddf761c75cdf85e1 upstream.
With IORING_SETUP_DEFER_TASKRUN, task work is queued to ctx->work_llist
(local work) rather than the fallback list. During io_ring_exit_work(),
io_move_task_work_from_local() was called once before the cancel loop,
moving work from work_llist to fallback_llist.
However, task work can be added to work_llist during the cancel loop
itself. There are two cases:
1) io_kill_timeouts() is called from io_uring_try_cancel_requests() to
cancel pending timeouts, and it adds task work via io_req_queue_tw_complete()
for each cancelled timeout:
2) URING_CMD requests like ublk can be completed via
io_uring_cmd_complete_in_task() from ublk_queue_rq() during canceling,
given ublk request queue is only quiesced when canceling the 1st uring_cmd.
Since io_allowed_defer_tw_run() returns false in io_ring_exit_work()
(kworker != submitter_task), io_run_local_work() is never invoked,
and the work_llist entries are never processed. This causes
io_uring_try_cancel_requests() to loop indefinitely, resulting in
100% CPU usage in kworker threads.
Fix this by moving io_move_task_work_from_local() inside the cancel
loop, ensuring any work on work_llist is moved to fallback before
each cancel attempt.
Cc: stable@vger.kernel.org
Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2867,11 +2867,11 @@ static __cold void io_ring_exit_work(str
* as nobody else will be looking for them.
*/
do {
- if (ctx->flags & IORING_SETUP_DEFER_TASKRUN)
- io_move_task_work_from_local(ctx);
-
- while (io_uring_try_cancel_requests(ctx, NULL, true))
+ do {
+ if (ctx->flags & IORING_SETUP_DEFER_TASKRUN)
+ io_move_task_work_from_local(ctx);
cond_resched();
+ } while (io_uring_try_cancel_requests(ctx, NULL, true));
if (ctx->sq_data) {
struct io_sq_data *sqd = ctx->sq_data;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 079/280] posix-clock: introduce posix_clock_context concept
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 078/280] io_uring: move local task_work in exit cancel loop Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 080/280] Fix memory leak in posix_clock_open() Greg Kroah-Hartman
` (205 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xabier Marquiegui, Richard Cochran,
Vinicius Costa Gomes, David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xabier Marquiegui <reibax@gmail.com>
[ Upstream commit 60c6946675fc06dd2fd2b7a4b6fd1c1f046f1056 ]
Add the necessary structure to support custom private-data per
posix-clock user.
The previous implementation of posix-clock assumed all file open
instances need access to the same clock structure on private_data.
The need for individual data structures per file open instance has been
identified when developing support for multiple timestamp event queue
users for ptp_clock.
Signed-off-by: Xabier Marquiegui <reibax@gmail.com>
Suggested-by: Richard Cochran <richardcochran@gmail.com>
Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: e859d375d169 ("posix-clock: Store file pointer in struct posix_clock_context")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ptp/ptp_chardev.c | 21 +++++++++++++--------
drivers/ptp/ptp_private.h | 16 +++++++++-------
include/linux/posix-clock.h | 35 +++++++++++++++++++++++++++--------
kernel/time/posix-clock.c | 36 +++++++++++++++++++++++++++---------
4 files changed, 76 insertions(+), 32 deletions(-)
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 6b36003567975..fcee202f4484c 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -103,14 +103,16 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
return 0;
}
-int ptp_open(struct posix_clock *pc, fmode_t fmode)
+int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode)
{
return 0;
}
-long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
+long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
+ unsigned long arg)
{
- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock);
+ struct ptp_clock *ptp =
+ container_of(pccontext->clk, struct ptp_clock, clock);
struct ptp_sys_offset_extended *extoff = NULL;
struct ptp_sys_offset_precise precise_offset;
struct system_device_crosststamp xtstamp;
@@ -434,9 +436,11 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
return err;
}
-__poll_t ptp_poll(struct posix_clock *pc, struct file *fp, poll_table *wait)
+__poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp,
+ poll_table *wait)
{
- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock);
+ struct ptp_clock *ptp =
+ container_of(pccontext->clk, struct ptp_clock, clock);
poll_wait(fp, &ptp->tsev_wq, wait);
@@ -445,10 +449,11 @@ __poll_t ptp_poll(struct posix_clock *pc, struct file *fp, poll_table *wait)
#define EXTTS_BUFSIZE (PTP_BUF_TIMESTAMPS * sizeof(struct ptp_extts_event))
-ssize_t ptp_read(struct posix_clock *pc,
- uint rdflags, char __user *buf, size_t cnt)
+ssize_t ptp_read(struct posix_clock_context *pccontext, uint rdflags,
+ char __user *buf, size_t cnt)
{
- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock);
+ struct ptp_clock *ptp =
+ container_of(pccontext->clk, struct ptp_clock, clock);
struct timestamp_event_queue *queue = &ptp->tsevq;
struct ptp_extts_event *event;
unsigned long flags;
diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index a54124269c2f4..a431eb79fe77d 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -131,16 +131,18 @@ extern struct class *ptp_class;
int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
enum ptp_pin_function func, unsigned int chan);
-long ptp_ioctl(struct posix_clock *pc,
- unsigned int cmd, unsigned long arg);
+long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
+ unsigned long arg);
-int ptp_open(struct posix_clock *pc, fmode_t fmode);
+int ptp_open(struct posix_clock_context *pccontext, fmode_t fmode);
-ssize_t ptp_read(struct posix_clock *pc,
- uint flags, char __user *buf, size_t cnt);
+int ptp_release(struct posix_clock_context *pccontext);
-__poll_t ptp_poll(struct posix_clock *pc,
- struct file *fp, poll_table *wait);
+ssize_t ptp_read(struct posix_clock_context *pccontext, uint flags, char __user *buf,
+ size_t cnt);
+
+__poll_t ptp_poll(struct posix_clock_context *pccontext, struct file *fp,
+ poll_table *wait);
/*
* see ptp_sysfs.c
diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h
index 468328b1e1dd5..ef8619f489203 100644
--- a/include/linux/posix-clock.h
+++ b/include/linux/posix-clock.h
@@ -14,6 +14,7 @@
#include <linux/rwsem.h>
struct posix_clock;
+struct posix_clock_context;
/**
* struct posix_clock_operations - functional interface to the clock
@@ -50,18 +51,18 @@ struct posix_clock_operations {
/*
* Optional character device methods:
*/
- long (*ioctl) (struct posix_clock *pc,
- unsigned int cmd, unsigned long arg);
+ long (*ioctl)(struct posix_clock_context *pccontext, unsigned int cmd,
+ unsigned long arg);
- int (*open) (struct posix_clock *pc, fmode_t f_mode);
+ int (*open)(struct posix_clock_context *pccontext, fmode_t f_mode);
- __poll_t (*poll) (struct posix_clock *pc,
- struct file *file, poll_table *wait);
+ __poll_t (*poll)(struct posix_clock_context *pccontext, struct file *file,
+ poll_table *wait);
- int (*release) (struct posix_clock *pc);
+ int (*release)(struct posix_clock_context *pccontext);
- ssize_t (*read) (struct posix_clock *pc,
- uint flags, char __user *buf, size_t cnt);
+ ssize_t (*read)(struct posix_clock_context *pccontext, uint flags,
+ char __user *buf, size_t cnt);
};
/**
@@ -90,6 +91,24 @@ struct posix_clock {
bool zombie;
};
+/**
+ * struct posix_clock_context - represents clock file operations context
+ *
+ * @clk: Pointer to the clock
+ * @private_clkdata: Pointer to user data
+ *
+ * Drivers should use struct posix_clock_context during specific character
+ * device file operation methods to access the posix clock.
+ *
+ * Drivers can store a private data structure during the open operation
+ * if they have specific information that is required in other file
+ * operations.
+ */
+struct posix_clock_context {
+ struct posix_clock *clk;
+ void *private_clkdata;
+};
+
/**
* posix_clock_register() - register a new clock
* @clk: Pointer to the clock. Caller must provide 'ops' field
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index 05e73d209aa87..706559ed75793 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -19,7 +19,8 @@
*/
static struct posix_clock *get_posix_clock(struct file *fp)
{
- struct posix_clock *clk = fp->private_data;
+ struct posix_clock_context *pccontext = fp->private_data;
+ struct posix_clock *clk = pccontext->clk;
down_read(&clk->rwsem);
@@ -39,6 +40,7 @@ static void put_posix_clock(struct posix_clock *clk)
static ssize_t posix_clock_read(struct file *fp, char __user *buf,
size_t count, loff_t *ppos)
{
+ struct posix_clock_context *pccontext = fp->private_data;
struct posix_clock *clk = get_posix_clock(fp);
int err = -EINVAL;
@@ -46,7 +48,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,
return -ENODEV;
if (clk->ops.read)
- err = clk->ops.read(clk, fp->f_flags, buf, count);
+ err = clk->ops.read(pccontext, fp->f_flags, buf, count);
put_posix_clock(clk);
@@ -55,6 +57,7 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,
static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)
{
+ struct posix_clock_context *pccontext = fp->private_data;
struct posix_clock *clk = get_posix_clock(fp);
__poll_t result = 0;
@@ -62,7 +65,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)
return EPOLLERR;
if (clk->ops.poll)
- result = clk->ops.poll(clk, fp, wait);
+ result = clk->ops.poll(pccontext, fp, wait);
put_posix_clock(clk);
@@ -72,6 +75,7 @@ static __poll_t posix_clock_poll(struct file *fp, poll_table *wait)
static long posix_clock_ioctl(struct file *fp,
unsigned int cmd, unsigned long arg)
{
+ struct posix_clock_context *pccontext = fp->private_data;
struct posix_clock *clk = get_posix_clock(fp);
int err = -ENOTTY;
@@ -79,7 +83,7 @@ static long posix_clock_ioctl(struct file *fp,
return -ENODEV;
if (clk->ops.ioctl)
- err = clk->ops.ioctl(clk, cmd, arg);
+ err = clk->ops.ioctl(pccontext, cmd, arg);
put_posix_clock(clk);
@@ -90,6 +94,7 @@ static long posix_clock_ioctl(struct file *fp,
static long posix_clock_compat_ioctl(struct file *fp,
unsigned int cmd, unsigned long arg)
{
+ struct posix_clock_context *pccontext = fp->private_data;
struct posix_clock *clk = get_posix_clock(fp);
int err = -ENOTTY;
@@ -97,7 +102,7 @@ static long posix_clock_compat_ioctl(struct file *fp,
return -ENODEV;
if (clk->ops.ioctl)
- err = clk->ops.ioctl(clk, cmd, arg);
+ err = clk->ops.ioctl(pccontext, cmd, arg);
put_posix_clock(clk);
@@ -110,6 +115,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
int err;
struct posix_clock *clk =
container_of(inode->i_cdev, struct posix_clock, cdev);
+ struct posix_clock_context *pccontext;
down_read(&clk->rwsem);
@@ -117,14 +123,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
err = -ENODEV;
goto out;
}
+ pccontext = kzalloc(sizeof(*pccontext), GFP_KERNEL);
+ if (!pccontext) {
+ err = -ENOMEM;
+ goto out;
+ }
+ pccontext->clk = clk;
+ fp->private_data = pccontext;
if (clk->ops.open)
- err = clk->ops.open(clk, fp->f_mode);
+ err = clk->ops.open(pccontext, fp->f_mode);
else
err = 0;
if (!err) {
get_device(clk->dev);
- fp->private_data = clk;
}
out:
up_read(&clk->rwsem);
@@ -133,14 +145,20 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
static int posix_clock_release(struct inode *inode, struct file *fp)
{
- struct posix_clock *clk = fp->private_data;
+ struct posix_clock_context *pccontext = fp->private_data;
+ struct posix_clock *clk;
int err = 0;
+ if (!pccontext)
+ return -ENODEV;
+ clk = pccontext->clk;
+
if (clk->ops.release)
- err = clk->ops.release(clk);
+ err = clk->ops.release(pccontext);
put_device(clk->dev);
+ kfree(pccontext);
fp->private_data = NULL;
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 080/280] Fix memory leak in posix_clock_open()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 079/280] posix-clock: introduce posix_clock_context concept Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 081/280] posix-clock: Store file pointer in struct posix_clock_context Greg Kroah-Hartman
` (204 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rohit Keshri, Oleg Nesterov,
Jakub Kicinski, David S. Miller, Thomas Gleixner, Linus Torvalds,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
[ Upstream commit 5b4cdd9c5676559b8a7c944ac5269b914b8c0bb8 ]
If the clk ops.open() function returns an error, we don't release the
pccontext we allocated for this clock.
Re-organize the code slightly to make it all more obvious.
Reported-by: Rohit Keshri <rkeshri@redhat.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Fixes: 60c6946675fc ("posix-clock: introduce posix_clock_context concept")
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linuxfoundation.org>
Stable-dep-of: e859d375d169 ("posix-clock: Store file pointer in struct posix_clock_context")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/time/posix-clock.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index 706559ed75793..a6487a9d60853 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -129,15 +129,17 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
goto out;
}
pccontext->clk = clk;
- fp->private_data = pccontext;
- if (clk->ops.open)
+ if (clk->ops.open) {
err = clk->ops.open(pccontext, fp->f_mode);
- else
- err = 0;
-
- if (!err) {
- get_device(clk->dev);
+ if (err) {
+ kfree(pccontext);
+ goto out;
+ }
}
+
+ fp->private_data = pccontext;
+ get_device(clk->dev);
+ err = 0;
out:
up_read(&clk->rwsem);
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 081/280] posix-clock: Store file pointer in struct posix_clock_context
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 080/280] Fix memory leak in posix_clock_open() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 082/280] ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE Greg Kroah-Hartman
` (203 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Cochran, Vadim Fedorenko,
Thomas Gleixner, Wojtek Wasko, David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <wwasko@nvidia.com>
[ Upstream commit e859d375d1694488015e6804bfeea527a0b25b9f ]
File descriptor based pc_clock_*() operations of dynamic posix clocks
have access to the file pointer and implement permission checks in the
generic code before invoking the relevant dynamic clock callback.
Character device operations (open, read, poll, ioctl) do not implement a
generic permission control and the dynamic clock callbacks have no
access to the file pointer to implement them.
Extend struct posix_clock_context with a struct file pointer and
initialize it in posix_clock_open(), so that all dynamic clock callbacks
can access it.
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Wojtek Wasko <wwasko@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/posix-clock.h | 6 +++++-
kernel/time/posix-clock.c | 1 +
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h
index ef8619f489203..a500d3160fe8c 100644
--- a/include/linux/posix-clock.h
+++ b/include/linux/posix-clock.h
@@ -95,10 +95,13 @@ struct posix_clock {
* struct posix_clock_context - represents clock file operations context
*
* @clk: Pointer to the clock
+ * @fp: Pointer to the file used to open the clock
* @private_clkdata: Pointer to user data
*
* Drivers should use struct posix_clock_context during specific character
- * device file operation methods to access the posix clock.
+ * device file operation methods to access the posix clock. In particular,
+ * the file pointer can be used to verify correct access mode for ioctl()
+ * calls.
*
* Drivers can store a private data structure during the open operation
* if they have specific information that is required in other file
@@ -106,6 +109,7 @@ struct posix_clock {
*/
struct posix_clock_context {
struct posix_clock *clk;
+ struct file *fp;
void *private_clkdata;
};
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index a6487a9d60853..b130bb56cc4e0 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -129,6 +129,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
goto out;
}
pccontext->clk = clk;
+ pccontext->fp = fp;
if (clk->ops.open) {
err = clk->ops.open(pccontext, fp->f_mode);
if (err) {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 082/280] ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 081/280] posix-clock: Store file pointer in struct posix_clock_context Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 083/280] testptp: Add support for testing ptp_clock_info .adjphase callback Greg Kroah-Hartman
` (202 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Cochran, Vadim Fedorenko,
Wojtek Wasko, Thomas Gleixner, David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <wwasko@nvidia.com>
[ Upstream commit b4e53b15c04e3852949003752f48f7a14ae39e86 ]
Many devices implement highly accurate clocks, which the kernel manages
as PTP Hardware Clocks (PHCs). Userspace applications rely on these
clocks to timestamp events, trace workload execution, correlate
timescales across devices, and keep various clocks in sync.
The kernel’s current implementation of PTP clocks does not enforce file
permissions checks for most device operations except for POSIX clock
operations, where file mode is verified in the POSIX layer before
forwarding the call to the PTP subsystem. Consequently, it is common
practice to not give unprivileged userspace applications any access to
PTP clocks whatsoever by giving the PTP chardevs 600 permissions. An
example of users running into this limitation is documented in [1].
Additionally, POSIX layer requires WRITE permission even for readonly
adjtime() calls which are used in PTP layer to return current frequency
offset applied to the PHC.
Add permission checks for functions that modify the state of a PTP
device. Continue enforcing permission checks for POSIX clock operations
(settime, adjtime) in the POSIX layer. Only require WRITE access for
dynamic clocks adjtime() if any flags are set in the modes field.
[1] https://lists.nwtime.org/sympa/arc/linuxptp-users/2024-01/msg00036.html
Changes in v4:
- Require FMODE_WRITE in ajtime() only for calls modifying the clock in
any way.
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Wojtek Wasko <wwasko@nvidia.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ptp/ptp_chardev.c | 16 ++++++++++++++++
kernel/time/posix-clock.c | 2 +-
2 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index fcee202f4484c..aa38a518e3d7b 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -150,6 +150,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
case PTP_EXTTS_REQUEST:
case PTP_EXTTS_REQUEST2:
+ if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+ err = -EACCES;
+ break;
+ }
memset(&req, 0, sizeof(req));
if (copy_from_user(&req.extts, (void __user *)arg,
@@ -191,6 +195,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
case PTP_PEROUT_REQUEST:
case PTP_PEROUT_REQUEST2:
+ if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+ err = -EACCES;
+ break;
+ }
memset(&req, 0, sizeof(req));
if (copy_from_user(&req.perout, (void __user *)arg,
@@ -259,6 +267,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
case PTP_ENABLE_PPS:
case PTP_ENABLE_PPS2:
+ if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+ err = -EACCES;
+ break;
+ }
memset(&req, 0, sizeof(req));
if (!capable(CAP_SYS_TIME))
@@ -397,6 +409,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
case PTP_PIN_SETFUNC:
case PTP_PIN_SETFUNC2:
+ if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+ err = -EACCES;
+ break;
+ }
if (copy_from_user(&pd, (void __user *)arg, sizeof(pd))) {
err = -EFAULT;
break;
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index b130bb56cc4e0..827abede72745 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -253,7 +253,7 @@ static int pc_clock_adjtime(clockid_t id, struct __kernel_timex *tx)
if (err)
return err;
- if ((cd.fp->f_mode & FMODE_WRITE) == 0) {
+ if (tx->modes && (cd.fp->f_mode & FMODE_WRITE) == 0) {
err = -EACCES;
goto out;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 083/280] testptp: Add support for testing ptp_clock_info .adjphase callback
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 082/280] ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 084/280] selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED Greg Kroah-Hartman
` (201 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Shuah Khan,
Richard Cochran, Maciek Machnikowski, Rahul Rameshbabu,
David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
[ Upstream commit 3a9a9a6139286584d1199f555fa4f96f592a3217 ]
Invoke clock_adjtime syscall with tx.modes set with ADJ_OFFSET when testptp
is invoked with a phase adjustment offset value. Support seconds and
nanoseconds for the offset value.
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Maciek Machnikowski <maciek@machnikowski.net>
Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ptp/testptp.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
index cfa9562f3cd83..9c3d36a40309b 100644
--- a/tools/testing/selftests/ptp/testptp.c
+++ b/tools/testing/selftests/ptp/testptp.c
@@ -134,6 +134,7 @@ static void usage(char *progname)
" 1 - external time stamp\n"
" 2 - periodic output\n"
" -n val shift the ptp clock time by 'val' nanoseconds\n"
+ " -o val phase offset (in nanoseconds) to be provided to the PHC servo\n"
" -p val enable output with a period of 'val' nanoseconds\n"
" -H val set output phase to 'val' nanoseconds (requires -p)\n"
" -w val set output pulse width to 'val' nanoseconds (requires -p)\n"
@@ -167,6 +168,7 @@ int main(int argc, char *argv[])
int adjfreq = 0x7fffffff;
int adjtime = 0;
int adjns = 0;
+ int adjphase = 0;
int capabilities = 0;
int extts = 0;
int flagtest = 0;
@@ -188,7 +190,7 @@ int main(int argc, char *argv[])
progname = strrchr(argv[0], '/');
progname = progname ? 1+progname : argv[0];
- while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:p:P:sSt:T:w:z"))) {
+ while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:z"))) {
switch (c) {
case 'c':
capabilities = 1;
@@ -228,6 +230,9 @@ int main(int argc, char *argv[])
case 'n':
adjns = atoi(optarg);
break;
+ case 'o':
+ adjphase = atoi(optarg);
+ break;
case 'p':
perout = atoll(optarg);
break;
@@ -327,6 +332,18 @@ int main(int argc, char *argv[])
}
}
+ if (adjphase) {
+ memset(&tx, 0, sizeof(tx));
+ tx.modes = ADJ_OFFSET | ADJ_NANO;
+ tx.offset = adjphase;
+
+ if (clock_adjtime(clkid, &tx) < 0) {
+ perror("clock_adjtime");
+ } else {
+ puts("phase adjustment okay");
+ }
+ }
+
if (gettime) {
if (clock_gettime(clkid, &ts)) {
perror("clock_gettime");
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 084/280] selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 083/280] testptp: Add support for testing ptp_clock_info .adjphase callback Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 085/280] selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE Greg Kroah-Hartman
` (200 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Maftei, David S. Miller,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Maftei <alex.maftei@amd.com>
[ Upstream commit c8ba75c4eb846888f8f2730690b99cb5bf7b337c ]
The -x option (where 'x' stands for eXtended) takes an argument which
represents the number of samples to request from the PTP device.
The help message will display the maximum number of samples allowed.
Providing an invalid argument will also display the maximum number of
samples allowed.
Signed-off-by: Alex Maftei <alex.maftei@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ptp/testptp.c | 44 +++++++++++++++++++++++++--
1 file changed, 42 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
index 9c3d36a40309b..2db6ff0316e7a 100644
--- a/tools/testing/selftests/ptp/testptp.c
+++ b/tools/testing/selftests/ptp/testptp.c
@@ -143,8 +143,9 @@ static void usage(char *progname)
" -S set the system time from the ptp clock time\n"
" -t val shift the ptp clock time by 'val' seconds\n"
" -T val set the ptp clock time to 'val' seconds\n"
+ " -x val get an extended ptp clock time with the desired number of samples (up to %d)\n"
" -z test combinations of rising/falling external time stamp flags\n",
- progname);
+ progname, PTP_MAX_SAMPLES);
}
int main(int argc, char *argv[])
@@ -158,6 +159,7 @@ int main(int argc, char *argv[])
struct timex tx;
struct ptp_clock_time *pct;
struct ptp_sys_offset *sysoff;
+ struct ptp_sys_offset_extended *soe;
char *progname;
unsigned int i;
@@ -176,6 +178,7 @@ int main(int argc, char *argv[])
int index = 0;
int list_pins = 0;
int pct_offset = 0;
+ int getextended = 0;
int n_samples = 0;
int pin_index = -1, pin_func;
int pps = -1;
@@ -190,7 +193,7 @@ int main(int argc, char *argv[])
progname = strrchr(argv[0], '/');
progname = progname ? 1+progname : argv[0];
- while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:z"))) {
+ while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:z"))) {
switch (c) {
case 'c':
capabilities = 1;
@@ -255,6 +258,15 @@ int main(int argc, char *argv[])
case 'w':
pulsewidth = atoi(optarg);
break;
+ case 'x':
+ getextended = atoi(optarg);
+ if (getextended < 1 || getextended > PTP_MAX_SAMPLES) {
+ fprintf(stderr,
+ "number of extended timestamp samples must be between 1 and %d; was asked for %d\n",
+ PTP_MAX_SAMPLES, getextended);
+ return -1;
+ }
+ break;
case 'z':
flagtest = 1;
break;
@@ -533,6 +545,34 @@ int main(int argc, char *argv[])
free(sysoff);
}
+ if (getextended) {
+ soe = calloc(1, sizeof(*soe));
+ if (!soe) {
+ perror("calloc");
+ return -1;
+ }
+
+ soe->n_samples = getextended;
+
+ if (ioctl(fd, PTP_SYS_OFFSET_EXTENDED, soe)) {
+ perror("PTP_SYS_OFFSET_EXTENDED");
+ } else {
+ printf("extended timestamp request returned %d samples\n",
+ getextended);
+
+ for (i = 0; i < getextended; i++) {
+ printf("sample #%2d: system time before: %lld.%09u\n",
+ i, soe->ts[i][0].sec, soe->ts[i][0].nsec);
+ printf(" phc time: %lld.%09u\n",
+ soe->ts[i][1].sec, soe->ts[i][1].nsec);
+ printf(" system time after: %lld.%09u\n",
+ soe->ts[i][2].sec, soe->ts[i][2].nsec);
+ }
+ }
+
+ free(soe);
+ }
+
close(fd);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 085/280] selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 084/280] selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 086/280] ptp: add testptp mask test Greg Kroah-Hartman
` (199 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Maftei, David S. Miller,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Maftei <alex.maftei@amd.com>
[ Upstream commit 3cf119ad5dc2b5c11385106d6d0ba86fbb47324c ]
The -X option was chosen because X looks like a cross, and the underlying
callback is 'get cross timestamp'.
Signed-off-by: Alex Maftei <alex.maftei@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ptp/testptp.c | 31 ++++++++++++++++++++++++++-
1 file changed, 30 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
index 2db6ff0316e7a..863699434296a 100644
--- a/tools/testing/selftests/ptp/testptp.c
+++ b/tools/testing/selftests/ptp/testptp.c
@@ -144,6 +144,7 @@ static void usage(char *progname)
" -t val shift the ptp clock time by 'val' seconds\n"
" -T val set the ptp clock time to 'val' seconds\n"
" -x val get an extended ptp clock time with the desired number of samples (up to %d)\n"
+ " -X get a ptp clock cross timestamp\n"
" -z test combinations of rising/falling external time stamp flags\n",
progname, PTP_MAX_SAMPLES);
}
@@ -160,6 +161,7 @@ int main(int argc, char *argv[])
struct ptp_clock_time *pct;
struct ptp_sys_offset *sysoff;
struct ptp_sys_offset_extended *soe;
+ struct ptp_sys_offset_precise *xts;
char *progname;
unsigned int i;
@@ -179,6 +181,7 @@ int main(int argc, char *argv[])
int list_pins = 0;
int pct_offset = 0;
int getextended = 0;
+ int getcross = 0;
int n_samples = 0;
int pin_index = -1, pin_func;
int pps = -1;
@@ -193,7 +196,7 @@ int main(int argc, char *argv[])
progname = strrchr(argv[0], '/');
progname = progname ? 1+progname : argv[0];
- while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:z"))) {
+ while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz"))) {
switch (c) {
case 'c':
capabilities = 1;
@@ -267,6 +270,9 @@ int main(int argc, char *argv[])
return -1;
}
break;
+ case 'X':
+ getcross = 1;
+ break;
case 'z':
flagtest = 1;
break;
@@ -573,6 +579,29 @@ int main(int argc, char *argv[])
free(soe);
}
+ if (getcross) {
+ xts = calloc(1, sizeof(*xts));
+ if (!xts) {
+ perror("calloc");
+ return -1;
+ }
+
+ if (ioctl(fd, PTP_SYS_OFFSET_PRECISE, xts)) {
+ perror("PTP_SYS_OFFSET_PRECISE");
+ } else {
+ puts("system and phc crosstimestamping request okay");
+
+ printf("device time: %lld.%09u\n",
+ xts->device.sec, xts->device.nsec);
+ printf("system time: %lld.%09u\n",
+ xts->sys_realtime.sec, xts->sys_realtime.nsec);
+ printf("monoraw time: %lld.%09u\n",
+ xts->sys_monoraw.sec, xts->sys_monoraw.nsec);
+ }
+
+ free(xts);
+ }
+
close(fd);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 086/280] ptp: add testptp mask test
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 085/280] selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 087/280] selftest/ptp: update ptp selftest to exercise the gettimex options Greg Kroah-Hartman
` (198 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xabier Marquiegui, Richard Cochran,
Vinicius Costa Gomes, David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xabier Marquiegui <reibax@gmail.com>
[ Upstream commit 26285e689c6cd2cf3849568c83b2ebe53f467143 ]
Add option to test timestamp event queue mask manipulation in testptp.
Option -F allows the user to specify a single channel that will be
applied on the mask filter via IOCTL.
The test program will maintain the file open until user input is
received.
This allows checking the effect of the IOCTL in debugfs.
eg:
Console 1:
```
Channel 12 exclusively enabled. Check on debugfs.
Press any key to continue
```
Console 2:
```
0x00000000 0x00000001 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000
```
Signed-off-by: Xabier Marquiegui <reibax@gmail.com>
Suggested-by: Richard Cochran <richardcochran@gmail.com>
Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ptp/testptp.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
index 863699434296a..b609efbdea55d 100644
--- a/tools/testing/selftests/ptp/testptp.c
+++ b/tools/testing/selftests/ptp/testptp.c
@@ -121,6 +121,7 @@ static void usage(char *progname)
" -d name device to open\n"
" -e val read 'val' external time stamp events\n"
" -f val adjust the ptp clock frequency by 'val' ppb\n"
+ " -F chan Enable single channel mask and keep device open for debugfs verification.\n"
" -g get the ptp clock time\n"
" -h prints this message\n"
" -i val index for event/trigger\n"
@@ -187,6 +188,7 @@ int main(int argc, char *argv[])
int pps = -1;
int seconds = 0;
int settime = 0;
+ int channel = -1;
int64_t t1, t2, tp;
int64_t interval, offset;
@@ -196,7 +198,7 @@ int main(int argc, char *argv[])
progname = strrchr(argv[0], '/');
progname = progname ? 1+progname : argv[0];
- while (EOF != (c = getopt(argc, argv, "cd:e:f:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz"))) {
+ while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz"))) {
switch (c) {
case 'c':
capabilities = 1;
@@ -210,6 +212,9 @@ int main(int argc, char *argv[])
case 'f':
adjfreq = atoi(optarg);
break;
+ case 'F':
+ channel = atoi(optarg);
+ break;
case 'g':
gettime = 1;
break;
@@ -602,6 +607,18 @@ int main(int argc, char *argv[])
free(xts);
}
+ if (channel >= 0) {
+ if (ioctl(fd, PTP_MASK_CLEAR_ALL)) {
+ perror("PTP_MASK_CLEAR_ALL");
+ } else if (ioctl(fd, PTP_MASK_EN_SINGLE, (unsigned int *)&channel)) {
+ perror("PTP_MASK_EN_SINGLE");
+ } else {
+ printf("Channel %d exclusively enabled. Check on debugfs.\n", channel);
+ printf("Press any key to continue\n.");
+ getchar();
+ }
+ }
+
close(fd);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 087/280] selftest/ptp: update ptp selftest to exercise the gettimex options
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 086/280] ptp: add testptp mask test Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 088/280] testptp: Add option to open PHC in readonly mode Greg Kroah-Hartman
` (197 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahesh Bandewar, Shuah Khan,
Richard Cochran, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Bandewar <maheshb@google.com>
[ Upstream commit 3d07b691ee707c00afaf365440975e81bb96cd9b ]
With the inclusion of commit c259acab839e ("ptp/ioctl: support
MONOTONIC{,_RAW} timestamps for PTP_SYS_OFFSET_EXTENDED") clock_gettime()
now allows retrieval of pre/post timestamps for CLOCK_MONOTONIC and
CLOCK_MONOTONIC_RAW timebases along with the previously supported
CLOCK_REALTIME.
This patch adds a command line option 'y' to the testptp program to
choose one of the allowed timebases [realtime aka system, monotonic,
and monotonic-raw).
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Link: https://patch.msgid.link/20241003101506.769418-1-maheshb@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 76868642e427 ("testptp: Add option to open PHC in readonly mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ptp/testptp.c | 62 ++++++++++++++++++++++++---
1 file changed, 57 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
index b609efbdea55d..2323a3329b298 100644
--- a/tools/testing/selftests/ptp/testptp.c
+++ b/tools/testing/selftests/ptp/testptp.c
@@ -146,6 +146,7 @@ static void usage(char *progname)
" -T val set the ptp clock time to 'val' seconds\n"
" -x val get an extended ptp clock time with the desired number of samples (up to %d)\n"
" -X get a ptp clock cross timestamp\n"
+ " -y val pre/post tstamp timebase to use {realtime|monotonic|monotonic-raw}\n"
" -z test combinations of rising/falling external time stamp flags\n",
progname, PTP_MAX_SAMPLES);
}
@@ -189,6 +190,7 @@ int main(int argc, char *argv[])
int seconds = 0;
int settime = 0;
int channel = -1;
+ clockid_t ext_clockid = CLOCK_REALTIME;
int64_t t1, t2, tp;
int64_t interval, offset;
@@ -198,7 +200,7 @@ int main(int argc, char *argv[])
progname = strrchr(argv[0], '/');
progname = progname ? 1+progname : argv[0];
- while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xz"))) {
+ while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z"))) {
switch (c) {
case 'c':
capabilities = 1;
@@ -278,6 +280,21 @@ int main(int argc, char *argv[])
case 'X':
getcross = 1;
break;
+ case 'y':
+ if (!strcasecmp(optarg, "realtime"))
+ ext_clockid = CLOCK_REALTIME;
+ else if (!strcasecmp(optarg, "monotonic"))
+ ext_clockid = CLOCK_MONOTONIC;
+ else if (!strcasecmp(optarg, "monotonic-raw"))
+ ext_clockid = CLOCK_MONOTONIC_RAW;
+ else {
+ fprintf(stderr,
+ "type needs to be realtime, monotonic or monotonic-raw; was given %s\n",
+ optarg);
+ return -1;
+ }
+ break;
+
case 'z':
flagtest = 1;
break;
@@ -564,6 +581,7 @@ int main(int argc, char *argv[])
}
soe->n_samples = getextended;
+ soe->clockid = ext_clockid;
if (ioctl(fd, PTP_SYS_OFFSET_EXTENDED, soe)) {
perror("PTP_SYS_OFFSET_EXTENDED");
@@ -572,12 +590,46 @@ int main(int argc, char *argv[])
getextended);
for (i = 0; i < getextended; i++) {
- printf("sample #%2d: system time before: %lld.%09u\n",
- i, soe->ts[i][0].sec, soe->ts[i][0].nsec);
+ switch (ext_clockid) {
+ case CLOCK_REALTIME:
+ printf("sample #%2d: real time before: %lld.%09u\n",
+ i, soe->ts[i][0].sec,
+ soe->ts[i][0].nsec);
+ break;
+ case CLOCK_MONOTONIC:
+ printf("sample #%2d: monotonic time before: %lld.%09u\n",
+ i, soe->ts[i][0].sec,
+ soe->ts[i][0].nsec);
+ break;
+ case CLOCK_MONOTONIC_RAW:
+ printf("sample #%2d: monotonic-raw time before: %lld.%09u\n",
+ i, soe->ts[i][0].sec,
+ soe->ts[i][0].nsec);
+ break;
+ default:
+ break;
+ }
printf(" phc time: %lld.%09u\n",
soe->ts[i][1].sec, soe->ts[i][1].nsec);
- printf(" system time after: %lld.%09u\n",
- soe->ts[i][2].sec, soe->ts[i][2].nsec);
+ switch (ext_clockid) {
+ case CLOCK_REALTIME:
+ printf(" real time after: %lld.%09u\n",
+ soe->ts[i][2].sec,
+ soe->ts[i][2].nsec);
+ break;
+ case CLOCK_MONOTONIC:
+ printf(" monotonic time after: %lld.%09u\n",
+ soe->ts[i][2].sec,
+ soe->ts[i][2].nsec);
+ break;
+ case CLOCK_MONOTONIC_RAW:
+ printf(" monotonic-raw time after: %lld.%09u\n",
+ soe->ts[i][2].sec,
+ soe->ts[i][2].nsec);
+ break;
+ default:
+ break;
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 088/280] testptp: Add option to open PHC in readonly mode
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 087/280] selftest/ptp: update ptp selftest to exercise the gettimex options Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 089/280] arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links Greg Kroah-Hartman
` (196 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Cochran, Vadim Fedorenko,
Wojtek Wasko, David S. Miller, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojtek Wasko <wwasko@nvidia.com>
[ Upstream commit 76868642e42795353106197abf9c607ad80f4c9e ]
PTP Hardware Clocks no longer require WRITE permission to perform
readonly operations, such as listing device capabilities or listening to
EXTTS events once they have been enabled by a process with WRITE
permissions.
Add '-r' option to testptp to open the PHC in readonly mode instead of
the default read-write mode. Skip enabling EXTTS if readonly mode is
requested.
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Wojtek Wasko <wwasko@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/ptp/testptp.c | 37 +++++++++++++++++----------
1 file changed, 23 insertions(+), 14 deletions(-)
diff --git a/tools/testing/selftests/ptp/testptp.c b/tools/testing/selftests/ptp/testptp.c
index 2323a3329b298..532fb6a5d0591 100644
--- a/tools/testing/selftests/ptp/testptp.c
+++ b/tools/testing/selftests/ptp/testptp.c
@@ -140,6 +140,7 @@ static void usage(char *progname)
" -H val set output phase to 'val' nanoseconds (requires -p)\n"
" -w val set output pulse width to 'val' nanoseconds (requires -p)\n"
" -P val enable or disable (val=1|0) the system clock PPS\n"
+ " -r open the ptp clock in readonly mode\n"
" -s set the ptp clock time from the system time\n"
" -S set the system time from the ptp clock time\n"
" -t val shift the ptp clock time by 'val' seconds\n"
@@ -188,6 +189,7 @@ int main(int argc, char *argv[])
int pin_index = -1, pin_func;
int pps = -1;
int seconds = 0;
+ int readonly = 0;
int settime = 0;
int channel = -1;
clockid_t ext_clockid = CLOCK_REALTIME;
@@ -200,7 +202,7 @@ int main(int argc, char *argv[])
progname = strrchr(argv[0], '/');
progname = progname ? 1+progname : argv[0];
- while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:sSt:T:w:x:Xy:z"))) {
+ while (EOF != (c = getopt(argc, argv, "cd:e:f:F:ghH:i:k:lL:n:o:p:P:rsSt:T:w:x:Xy:z"))) {
switch (c) {
case 'c':
capabilities = 1;
@@ -252,6 +254,9 @@ int main(int argc, char *argv[])
case 'P':
pps = atoi(optarg);
break;
+ case 'r':
+ readonly = 1;
+ break;
case 's':
settime = 1;
break;
@@ -308,7 +313,7 @@ int main(int argc, char *argv[])
}
}
- fd = open(device, O_RDWR);
+ fd = open(device, readonly ? O_RDONLY : O_RDWR);
if (fd < 0) {
fprintf(stderr, "opening %s: %s\n", device, strerror(errno));
return -1;
@@ -434,14 +439,16 @@ int main(int argc, char *argv[])
}
if (extts) {
- memset(&extts_request, 0, sizeof(extts_request));
- extts_request.index = index;
- extts_request.flags = PTP_ENABLE_FEATURE;
- if (ioctl(fd, PTP_EXTTS_REQUEST, &extts_request)) {
- perror("PTP_EXTTS_REQUEST");
- extts = 0;
- } else {
- puts("external time stamp request okay");
+ if (!readonly) {
+ memset(&extts_request, 0, sizeof(extts_request));
+ extts_request.index = index;
+ extts_request.flags = PTP_ENABLE_FEATURE;
+ if (ioctl(fd, PTP_EXTTS_REQUEST, &extts_request)) {
+ perror("PTP_EXTTS_REQUEST");
+ extts = 0;
+ } else {
+ puts("external time stamp request okay");
+ }
}
for (; extts; extts--) {
cnt = read(fd, &event, sizeof(event));
@@ -453,10 +460,12 @@ int main(int argc, char *argv[])
event.t.sec, event.t.nsec);
fflush(stdout);
}
- /* Disable the feature again. */
- extts_request.flags = 0;
- if (ioctl(fd, PTP_EXTTS_REQUEST, &extts_request)) {
- perror("PTP_EXTTS_REQUEST");
+ if (!readonly) {
+ /* Disable the feature again. */
+ extts_request.flags = 0;
+ if (ioctl(fd, PTP_EXTTS_REQUEST, &extts_request)) {
+ perror("PTP_EXTTS_REQUEST");
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 089/280] arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 088/280] testptp: Add option to open PHC in readonly mode Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 090/280] btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE Greg Kroah-Hartman
` (195 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Ulf Hansson,
Bjorn Andersson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 868b979c5328b867c95a6d5a93ba13ad0d3cd2f1 ]
To make sure that power rail is voted for, wire it up to its consumers.
Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20251202-topic-8280_mxc-v2-3-46cdf47a829e@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
index 6b0d4bc6c5419..e502360de601d 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
@@ -1819,8 +1819,12 @@ remoteproc_nsp0: remoteproc@1b300000 {
clocks = <&rpmhcc RPMH_CXO_CLK>;
clock-names = "xo";
- power-domains = <&rpmhpd SC8280XP_NSP>;
- power-domain-names = "nsp";
+ power-domains = <&rpmhpd SC8280XP_NSP>,
+ <&rpmhpd SC8280XP_CX>,
+ <&rpmhpd SC8280XP_MXC>;
+ power-domain-names = "nsp",
+ "cx",
+ "mxc";
memory-region = <&pil_nsp0_mem>;
@@ -1950,8 +1954,12 @@ remoteproc_nsp1: remoteproc@21300000 {
clocks = <&rpmhcc RPMH_CXO_CLK>;
clock-names = "xo";
- power-domains = <&rpmhpd SC8280XP_NSP>;
- power-domain-names = "nsp";
+ power-domains = <&rpmhpd SC8280XP_NSP>,
+ <&rpmhpd SC8280XP_CX>,
+ <&rpmhpd SC8280XP_MXC>;
+ power-domain-names = "nsp",
+ "cx",
+ "mxc";
memory-region = <&pil_nsp1_mem>;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 090/280] btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 089/280] arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 091/280] ata: libata: Add cpr_log to ata_dev_print_features() early return Greg Kroah-Hartman
` (194 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Mark Harmstone,
David Sterba, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <mark@harmstone.com>
[ Upstream commit 1d8f69f453c2e8a2d99b158e58e02ed65031fa6d ]
When the BLOCK_GROUP_TREE compat_ro flag is set, the extent root and
csum root fields are getting missed.
This is because EXTENT_TREE_V2 treated these differently, and when
they were split off this special-casing was mistakenly assigned to
BGT rather than the rump EXTENT_TREE_V2. There's no reason why the
existence of the block group tree should mean that we don't record the
details of the last commit's extent root and csum root.
Fix the code in backup_super_roots() so that the correct check gets
made.
Fixes: 1c56ab991903 ("btrfs: separate BLOCK_GROUP_TREE compat RO flag from EXTENT_TREE_V2")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Mark Harmstone <mark@harmstone.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/disk-io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8576ba4aa0b7d..52e083b63070d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1993,7 +1993,7 @@ static void backup_super_roots(struct btrfs_fs_info *info)
btrfs_set_backup_chunk_root_level(root_backup,
btrfs_header_level(info->chunk_root->node));
- if (!btrfs_fs_compat_ro(info, BLOCK_GROUP_TREE)) {
+ if (!btrfs_fs_incompat(info, EXTENT_TREE_V2)) {
struct btrfs_root *extent_root = btrfs_extent_root(info, 0);
struct btrfs_root *csum_root = btrfs_csum_root(info, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 091/280] ata: libata: Add cpr_log to ata_dev_print_features() early return
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 090/280] btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 092/280] ata: libata: Introduce ata_ncq_supported() Greg Kroah-Hartman
` (193 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Wolf, Damien Le Moal,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit a6bee5e5243ad02cae575becc4c83df66fc29573 ]
ata_dev_print_features() is supposed to return early and not print anything
if there are no features supported.
However, commit fe22e1c2f705 ("libata: support concurrent positioning
ranges log") added another feature to ata_dev_print_features() without
updating the early return conditional.
Add the missing feature to the early return conditional.
Fixes: fe22e1c2f705 ("libata: support concurrent positioning ranges log")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Tested-by: Wolf <wolf@yoxt.cc>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 14bcfebf20b8f..98d610c37e8c7 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2597,7 +2597,7 @@ static void ata_dev_config_cpr(struct ata_device *dev)
static void ata_dev_print_features(struct ata_device *dev)
{
- if (!(dev->flags & ATA_DFLAG_FEATURES_MASK))
+ if (!(dev->flags & ATA_DFLAG_FEATURES_MASK) && !dev->cpr_log)
return;
ata_dev_info(dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 092/280] ata: libata: Introduce ata_ncq_supported()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 091/280] ata: libata: Add cpr_log to ata_dev_print_features() early return Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 093/280] ata: libata: cleanup fua support detection Greg Kroah-Hartman
` (192 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Hannes Reinecke,
Chaitanya Kulkarni, Christoph Hellwig, Johannes Thumshirn,
Niklas Cassel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
[ Upstream commit fa5bde139ee43ab91087c01e690c61aec957c339 ]
Introduce the inline helper function ata_ncq_supported() to test if a
device supports NCQ commands. The function ata_ncq_enabled() is also
rewritten using this new helper function.
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/libata.h | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 363462d3f0773..99886930fb819 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -1694,21 +1694,35 @@ extern struct ata_device *ata_dev_next(struct ata_device *dev,
(dev) = ata_dev_next((dev), (link), ATA_DITER_##mode))
/**
- * ata_ncq_enabled - Test whether NCQ is enabled
- * @dev: ATA device to test for
+ * ata_ncq_supported - Test whether NCQ is supported
+ * @dev: ATA device to test
*
* LOCKING:
* spin_lock_irqsave(host lock)
*
* RETURNS:
- * 1 if NCQ is enabled for @dev, 0 otherwise.
+ * true if @dev supports NCQ, false otherwise.
*/
-static inline int ata_ncq_enabled(struct ata_device *dev)
+static inline bool ata_ncq_supported(struct ata_device *dev)
{
if (!IS_ENABLED(CONFIG_SATA_HOST))
- return 0;
- return (dev->flags & (ATA_DFLAG_PIO | ATA_DFLAG_NCQ_OFF |
- ATA_DFLAG_NCQ)) == ATA_DFLAG_NCQ;
+ return false;
+ return (dev->flags & (ATA_DFLAG_PIO | ATA_DFLAG_NCQ)) == ATA_DFLAG_NCQ;
+}
+
+/**
+ * ata_ncq_enabled - Test whether NCQ is enabled
+ * @dev: ATA device to test
+ *
+ * LOCKING:
+ * spin_lock_irqsave(host lock)
+ *
+ * RETURNS:
+ * true if NCQ is enabled for @dev, false otherwise.
+ */
+static inline bool ata_ncq_enabled(struct ata_device *dev)
+{
+ return ata_ncq_supported(dev) && !(dev->flags & ATA_DFLAG_NCQ_OFF);
}
static inline bool ata_fpdma_dsm_supported(struct ata_device *dev)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 093/280] ata: libata: cleanup fua support detection
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 092/280] ata: libata: Introduce ata_ncq_supported() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 094/280] ata: libata-core: Introduce ata_dev_config_lpm() Greg Kroah-Hartman
` (191 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Hannes Reinecke,
Chaitanya Kulkarni, Christoph Hellwig, Johannes Thumshirn,
Niklas Cassel, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
[ Upstream commit 4d2e4980a5289ae31a1cff40d258b68573182a37 ]
Move the detection of a device FUA support from
ata_scsiop_mode_sense()/ata_dev_supports_fua() to device scan time in
ata_dev_configure().
The function ata_dev_config_fua() is introduced to detect if a device
supports FUA and this support is indicated using the new device flag
ATA_DFLAG_FUA.
In order to blacklist known buggy devices, the horkage flag
ATA_HORKAGE_NO_FUA is introduced. Similarly to other horkage flags, the
libata.force= arguments "fua" and "nofua" are also introduced to allow
a user to control this horkage flag through the "force" libata
module parameter.
The ATA_DFLAG_FUA device flag is set only and only if all the following
conditions are met:
* libata.fua module parameter is set to 1
* The device supports the WRITE DMA FUA EXT command,
* The device is not marked with the ATA_HORKAGE_NO_FUA flag, either from
the blacklist or set by the user with libata.force=nofua
* The device supports NCQ (while this is not mandated by the standards,
this restriction is introduced to avoid problems with older non-NCQ
devices).
Enabling or diabling libata FUA support for all devices can now also be
done using the "force=[no]fua" module parameter when libata.fua is set
to 1.
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../admin-guide/kernel-parameters.txt | 3 ++
drivers/ata/libata-core.c | 30 ++++++++++++++++++-
drivers/ata/libata-scsi.c | 30 ++-----------------
include/linux/libata.h | 8 +++--
4 files changed, 39 insertions(+), 32 deletions(-)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 05ab068c1cc6d..b026eb1c4c7db 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2852,6 +2852,9 @@
* [no]setxfer: Indicate if transfer speed mode setting
should be skipped.
+ * [no]fua: Disable or enable FUA (Force Unit Access)
+ support for devices supporting this feature.
+
* dump_id: Dump IDENTIFY data.
* disable: Disable this device.
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 98d610c37e8c7..31c8156a4f3d3 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2513,6 +2513,28 @@ static void ata_dev_config_chs(struct ata_device *dev)
dev->heads, dev->sectors);
}
+static void ata_dev_config_fua(struct ata_device *dev)
+{
+ /* Ignore FUA support if its use is disabled globally */
+ if (!libata_fua)
+ goto nofua;
+
+ /* Ignore devices without support for WRITE DMA FUA EXT */
+ if (!(dev->flags & ATA_DFLAG_LBA48) || !ata_id_has_fua(dev->id))
+ goto nofua;
+
+ /* Ignore known bad devices and devices that lack NCQ support */
+ if (!ata_ncq_supported(dev) || (dev->horkage & ATA_HORKAGE_NO_FUA))
+ goto nofua;
+
+ dev->flags |= ATA_DFLAG_FUA;
+
+ return;
+
+nofua:
+ dev->flags &= ~ATA_DFLAG_FUA;
+}
+
static void ata_dev_config_devslp(struct ata_device *dev)
{
u8 *sata_setting = dev->link->ap->sector_buf;
@@ -2601,7 +2623,8 @@ static void ata_dev_print_features(struct ata_device *dev)
return;
ata_dev_info(dev,
- "Features:%s%s%s%s%s%s\n",
+ "Features:%s%s%s%s%s%s%s\n",
+ dev->flags & ATA_DFLAG_FUA ? " FUA" : "",
dev->flags & ATA_DFLAG_TRUSTED ? " Trust" : "",
dev->flags & ATA_DFLAG_DA ? " Dev-Attention" : "",
dev->flags & ATA_DFLAG_DEVSLP ? " Dev-Sleep" : "",
@@ -2762,6 +2785,7 @@ int ata_dev_configure(struct ata_device *dev)
ata_dev_config_chs(dev);
}
+ ata_dev_config_fua(dev);
ata_dev_config_devslp(dev);
ata_dev_config_sense_reporting(dev);
ata_dev_config_zac(dev);
@@ -4199,6 +4223,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
*/
{ "SATADOM-ML 3ME", NULL, ATA_HORKAGE_NO_LOG_DIR },
+ /* Buggy FUA */
+ { "Maxtor", "BANC1G10", ATA_HORKAGE_NO_FUA },
+
/* End Marker */
{ }
};
@@ -6351,6 +6378,7 @@ static const struct ata_force_param force_tbl[] __initconst = {
force_horkage_onoff(lpm, ATA_HORKAGE_NOLPM),
force_horkage_onoff(setxfer, ATA_HORKAGE_NOSETXFER),
force_horkage_on(dump_id, ATA_HORKAGE_DUMP_ID),
+ force_horkage_onoff(fua, ATA_HORKAGE_NO_FUA),
force_horkage_on(disable, ATA_HORKAGE_DISABLE),
};
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index c838bc8cc4f3d..430970db482a8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2283,30 +2283,6 @@ static unsigned int ata_msense_rw_recovery(u8 *buf, bool changeable)
return sizeof(def_rw_recovery_mpage);
}
-/*
- * We can turn this into a real blacklist if it's needed, for now just
- * blacklist any Maxtor BANC1G10 revision firmware
- */
-static int ata_dev_supports_fua(u16 *id)
-{
- unsigned char model[ATA_ID_PROD_LEN + 1], fw[ATA_ID_FW_REV_LEN + 1];
-
- if (!libata_fua)
- return 0;
- if (!ata_id_has_fua(id))
- return 0;
-
- ata_id_c_string(id, model, ATA_ID_PROD, sizeof(model));
- ata_id_c_string(id, fw, ATA_ID_FW_REV, sizeof(fw));
-
- if (strcmp(model, "Maxtor"))
- return 1;
- if (strcmp(fw, "BANC1G10"))
- return 1;
-
- return 0; /* blacklisted */
-}
-
/**
* ata_scsiop_mode_sense - Simulate MODE SENSE 6, 10 commands
* @args: device IDENTIFY data / SCSI command of interest.
@@ -2330,7 +2306,7 @@ static unsigned int ata_scsiop_mode_sense(struct ata_scsi_args *args, u8 *rbuf)
};
u8 pg, spg;
unsigned int ebd, page_control, six_byte;
- u8 dpofua, bp = 0xff;
+ u8 dpofua = 0, bp = 0xff;
u16 fp;
six_byte = (scsicmd[0] == MODE_SENSE);
@@ -2393,9 +2369,7 @@ static unsigned int ata_scsiop_mode_sense(struct ata_scsi_args *args, u8 *rbuf)
goto invalid_fld;
}
- dpofua = 0;
- if (ata_dev_supports_fua(args->id) && (dev->flags & ATA_DFLAG_LBA48) &&
- (!(dev->flags & ATA_DFLAG_PIO) || dev->multi_count))
+ if (dev->flags & ATA_DFLAG_FUA)
dpofua = 1 << 4;
if (six_byte) {
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 99886930fb819..d7f86de11d18e 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -90,6 +90,7 @@ enum {
ATA_DFLAG_ACPI_FAILED = (1 << 6), /* ACPI on devcfg has failed */
ATA_DFLAG_AN = (1 << 7), /* AN configured */
ATA_DFLAG_TRUSTED = (1 << 8), /* device supports trusted send/recv */
+ ATA_DFLAG_FUA = (1 << 9), /* device supports FUA */
ATA_DFLAG_DMADIR = (1 << 10), /* device requires DMADIR */
ATA_DFLAG_CFG_MASK = (1 << 12) - 1,
@@ -114,9 +115,9 @@ enum {
ATA_DFLAG_D_SENSE = (1 << 29), /* Descriptor sense requested */
ATA_DFLAG_ZAC = (1 << 30), /* ZAC device */
- ATA_DFLAG_FEATURES_MASK = ATA_DFLAG_TRUSTED | ATA_DFLAG_DA | \
- ATA_DFLAG_DEVSLP | ATA_DFLAG_NCQ_SEND_RECV | \
- ATA_DFLAG_NCQ_PRIO,
+ ATA_DFLAG_FEATURES_MASK = (ATA_DFLAG_TRUSTED | ATA_DFLAG_DA | \
+ ATA_DFLAG_DEVSLP | ATA_DFLAG_NCQ_SEND_RECV | \
+ ATA_DFLAG_NCQ_PRIO | ATA_DFLAG_FUA),
ATA_DEV_UNKNOWN = 0, /* unknown device */
ATA_DEV_ATA = 1, /* ATA device */
@@ -389,6 +390,7 @@ enum {
ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27), /* Disable NCQ on ATI chipset */
ATA_HORKAGE_NO_ID_DEV_LOG = (1 << 28), /* Identify device log missing */
ATA_HORKAGE_NO_LOG_DIR = (1 << 29), /* Do not read log directory */
+ ATA_HORKAGE_NO_FUA = (1 << 30), /* Do not use FUA */
/* DMA mask for user DMA control: User visible values; DO NOT
renumber */
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 094/280] ata: libata-core: Introduce ata_dev_config_lpm()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 093/280] ata: libata: cleanup fua support detection Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 095/280] ata: libata: Call ata_dev_config_lpm() for ATAPI devices Greg Kroah-Hartman
` (190 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Niklas Cassel,
Hannes Reinecke, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
[ Upstream commit d360121832d8a36871249271df5b9ff05f835f62 ]
If the port of a device does not support Device Initiated Power
Management (DIPM), that is, the port is flagged with ATA_FLAG_NO_DIPM,
the DIPM feature of a device should not be used. Though DIPM is disabled
by default on a device, the "Software Settings Preservation feature"
may keep DIPM enabled or DIPM may have been enabled by the system
firmware.
Introduce the function ata_dev_config_lpm() to always disable DIPM on a
device that supports this feature if the port of the device is flagged
with ATA_FLAG_NO_DIPM. ata_dev_config_lpm() is called from
ata_dev_configure(), ensuring that a device DIPM feature is disabled
when it cannot be used.
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20250701125321.69496-2-dlemoal@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 31c8156a4f3d3..1277b80726535 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2617,6 +2617,30 @@ static void ata_dev_config_cpr(struct ata_device *dev)
kfree(buf);
}
+/*
+ * Configure features related to link power management.
+ */
+static void ata_dev_config_lpm(struct ata_device *dev)
+{
+ struct ata_port *ap = dev->link->ap;
+ unsigned int err_mask;
+
+ /*
+ * Device Initiated Power Management (DIPM) is normally disabled by
+ * default on a device. However, DIPM may have been enabled and that
+ * setting kept even after COMRESET because of the Software Settings
+ * Preservation feature. So if the port does not support DIPM and the
+ * device does, disable DIPM on the device.
+ */
+ if (ap->flags & ATA_FLAG_NO_DIPM && ata_id_has_dipm(dev->id)) {
+ err_mask = ata_dev_set_feature(dev,
+ SETFEATURES_SATA_DISABLE, SATA_DIPM);
+ if (err_mask && err_mask != AC_ERR_DEV)
+ ata_dev_err(dev, "Disable DIPM failed, Emask 0x%x\n",
+ err_mask);
+ }
+}
+
static void ata_dev_print_features(struct ata_device *dev)
{
if (!(dev->flags & ATA_DFLAG_FEATURES_MASK) && !dev->cpr_log)
@@ -2785,6 +2809,7 @@ int ata_dev_configure(struct ata_device *dev)
ata_dev_config_chs(dev);
}
+ ata_dev_config_lpm(dev);
ata_dev_config_fua(dev);
ata_dev_config_devslp(dev);
ata_dev_config_sense_reporting(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 095/280] ata: libata: Call ata_dev_config_lpm() for ATAPI devices
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 094/280] ata: libata-core: Introduce ata_dev_config_lpm() Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 096/280] ata: libata: Print features also " Greg Kroah-Hartman
` (189 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Wolf, Damien Le Moal,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit 8f3fb33f8f3f825c708ece800c921977c157f9b6 ]
Commit d360121832d8 ("ata: libata-core: Introduce ata_dev_config_lpm()")
introduced ata_dev_config_lpm(). However, it only called this function for
ATA_DEV_ATA and ATA_DEV_ZAC devices, not for ATA_DEV_ATAPI devices.
Additionally, commit d99a9142e782 ("ata: libata-core: Move device LPM quirk
settings to ata_dev_config_lpm()") moved the LPM quirk application from
ata_dev_configure() to ata_dev_config_lpm(), causing LPM quirks for ATAPI
devices to no longer be applied.
Call ata_dev_config_lpm() also for ATAPI devices, such that LPM quirks are
applied for ATAPI devices with an entry in __ata_dev_quirks once again.
Fixes: d360121832d8 ("ata: libata-core: Introduce ata_dev_config_lpm()")
Fixes: d99a9142e782 ("ata: libata-core: Move device LPM quirk settings to ata_dev_config_lpm()")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Tested-by: Wolf <wolf@yoxt.cc>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Stable-dep-of: c8c6fb886f57 ("ata: libata: Print features also for ATAPI devices")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1277b80726535..3fb7f7a5181a9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2882,6 +2882,8 @@ int ata_dev_configure(struct ata_device *dev)
ata_mode_string(xfer_mask),
cdb_intr_string, atapi_an_string,
dma_dir_string);
+
+ ata_dev_config_lpm(dev);
}
/* determine max_sectors */
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 096/280] ata: libata: Print features also for ATAPI devices
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 095/280] ata: libata: Call ata_dev_config_lpm() for ATAPI devices Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 097/280] net: usb: dm9601: remove broken SR9700 support Greg Kroah-Hartman
` (188 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel, Wolf, Damien Le Moal,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit c8c6fb886f57d5bf71fb6de6334a143608d35707 ]
Commit d633b8a702ab ("libata: print feature list on device scan")
added a print of the features supported by the device for ATA_DEV_ATA and
ATA_DEV_ZAC devices, but not for ATA_DEV_ATAPI devices.
Fix this by printing the features also for ATAPI devices.
Before changes:
ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133
After changes:
ata1.00: ATAPI: Slimtype DVD A DU8AESH, 6C2M, max UDMA/133
ata1.00: Features: Dev-Attention HIPM DIPM
Fixes: d633b8a702ab ("libata: print feature list on device scan")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Tested-by: Wolf <wolf@yoxt.cc>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3fb7f7a5181a9..96b13b89f0a73 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2884,6 +2884,9 @@ int ata_dev_configure(struct ata_device *dev)
dma_dir_string);
ata_dev_config_lpm(dev);
+
+ if (print_info)
+ ata_dev_print_features(dev);
}
/* determine max_sectors */
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 097/280] net: usb: dm9601: remove broken SR9700 support
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 096/280] ata: libata: Print features also " Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 098/280] bonding: limit BOND_MODE_8023AD to Ethernet devices Greg Kroah-Hartman
` (187 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ethan Nelson-Moore, Peter Korsgaard,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
[ Upstream commit 7d7dbafefbe74f5a25efc4807af093b857a7612e ]
The SR9700 chip sends more than one packet in a USB transaction,
like the DM962x chips can optionally do, but the dm9601 driver does not
support this mode, and the hardware does not have the DM962x
MODE_CTL register to disable it, so this driver drops packets on SR9700
devices. The sr9700 driver correctly handles receiving more than one
packet per transaction.
While the dm9601 driver could be improved to handle this, the easiest
way to fix this issue in the short term is to remove the SR9700 device
ID from the dm9601 driver so the sr9700 driver is always used. This
device ID should not have been in more than one driver to begin with.
The "Fixes" commit was chosen so that the patch is automatically
included in all kernels that have the sr9700 driver, even though the
issue affects dm9601.
Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Acked-by: Peter Korsgaard <peter@korsgaard.com>
Link: https://patch.msgid.link/20260113063924.74464-1-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/dm9601.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 8b6d6a1b3c2ec..2b4716ccf0c5b 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -603,10 +603,6 @@ static const struct usb_device_id products[] = {
USB_DEVICE(0x0fe6, 0x8101), /* DM9601 USB to Fast Ethernet Adapter */
.driver_info = (unsigned long)&dm9601_info,
},
- {
- USB_DEVICE(0x0fe6, 0x9700), /* DM9601 USB to Fast Ethernet Adapter */
- .driver_info = (unsigned long)&dm9601_info,
- },
{
USB_DEVICE(0x0a46, 0x9000), /* DM9000E */
.driver_info = (unsigned long)&dm9601_info,
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 098/280] bonding: limit BOND_MODE_8023AD to Ethernet devices
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 097/280] net: usb: dm9601: remove broken SR9700 support Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 099/280] selftests/net: convert fib-onlink-tests.sh to run it in unique namespace Greg Kroah-Hartman
` (186 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9c081b17773615f24672,
Eric Dumazet, Andrew Lunn, Jay Vosburgh, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit c84fcb79e5dbde0b8d5aeeaf04282d2149aebcf6 ]
BOND_MODE_8023AD makes sense for ARPHRD_ETHER only.
syzbot reported:
BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline]
BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118
Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497
CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200
__asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
__hw_addr_create net/core/dev_addr_lists.c:63 [inline]
__hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118
__dev_mc_add net/core/dev_addr_lists.c:868 [inline]
dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886
bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180
do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963
do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165
rtnl_changelink net/core/rtnetlink.c:3776 [inline]
__rtnl_newlink net/core/rtnetlink.c:3935 [inline]
rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742
____sys_sendmsg+0x505/0x820 net/socket.c:2592
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646
__sys_sendmsg+0x164/0x220 net/socket.c:2678
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
</TASK>
The buggy address belongs to the variable:
lacpdu_mcast_addr+0x0/0x40
Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER")
Reported-by: syzbot+9c081b17773615f24672@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6966946b.a70a0220.245e30.0002.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20260113191201.3970737-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index cefe37c447a26..dd0ea86d7934a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1906,6 +1906,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
*/
if (!bond_has_slaves(bond)) {
if (bond_dev->type != slave_dev->type) {
+ if (slave_dev->type != ARPHRD_ETHER &&
+ BOND_MODE(bond) == BOND_MODE_8023AD) {
+ SLAVE_NL_ERR(bond_dev, slave_dev, extack,
+ "8023AD mode requires Ethernet devices");
+ return -EINVAL;
+ }
slave_dbg(bond_dev, slave_dev, "change device type from %d to %d\n",
bond_dev->type, slave_dev->type);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 099/280] selftests/net: convert fib-onlink-tests.sh to run it in unique namespace
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 098/280] bonding: limit BOND_MODE_8023AD to Ethernet devices Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 100/280] selftests: net: fib-onlink-tests: Convert to use namespaces by default Greg Kroah-Hartman
` (185 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Hangbin Liu,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 3a06833b2adc0a902f2469ad4ce41ccd64f1f3ab ]
Remove PEER_CMD, which is not used in this test
Here is the test result after conversion.
]# ./fib-onlink-tests.sh
Error: ipv4: FIB table does not exist.
Flush terminated
Error: ipv6: FIB table does not exist.
Flush terminated
########################################
Configuring interfaces
...
TEST: Gateway resolves to wrong nexthop device - VRF [ OK ]
Tests passed: 38
Tests failed: 0
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20231213060856.4030084-11-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 4f5f148dd7c0 ("selftests: net: fib-onlink-tests: Convert to use namespaces by default")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fib-onlink-tests.sh | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/net/fib-onlink-tests.sh b/tools/testing/selftests/net/fib-onlink-tests.sh
index c287b90b8af80..ec2d6ceb1f08d 100755
--- a/tools/testing/selftests/net/fib-onlink-tests.sh
+++ b/tools/testing/selftests/net/fib-onlink-tests.sh
@@ -3,6 +3,7 @@
# IPv4 and IPv6 onlink tests
+source lib.sh
PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
VERBOSE=0
@@ -74,9 +75,6 @@ TEST_NET4IN6[2]=10.2.1.254
# mcast address
MCAST6=ff02::1
-
-PEER_NS=bart
-PEER_CMD="ip netns exec ${PEER_NS}"
VRF=lisa
VRF_TABLE=1101
PBR_TABLE=101
@@ -176,8 +174,7 @@ setup()
set -e
# create namespace
- ip netns add ${PEER_NS}
- ip -netns ${PEER_NS} li set lo up
+ setup_ns PEER_NS
# add vrf table
ip li add ${VRF} type vrf table ${VRF_TABLE}
@@ -219,7 +216,7 @@ setup()
cleanup()
{
# make sure we start from a clean slate
- ip netns del ${PEER_NS} 2>/dev/null
+ cleanup_ns ${PEER_NS} 2>/dev/null
for n in 1 3 5 7; do
ip link del ${NETIFS[p${n}]} 2>/dev/null
done
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 100/280] selftests: net: fib-onlink-tests: Convert to use namespaces by default
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 099/280] selftests/net: convert fib-onlink-tests.sh to run it in unique namespace Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 101/280] can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error Greg Kroah-Hartman
` (184 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Ricardo B . Marlière, Ido Schimmel, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <rbm@suse.com>
[ Upstream commit 4f5f148dd7c0459229d2ab9a769b2e820f9ee6a2 ]
Currently, the test breaks if the SUT already has a default route
configured for IPv6. Fix by avoiding the use of the default namespace.
Fixes: 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route")
Suggested-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260113-selftests-net-fib-onlink-v2-1-89de2b931389@suse.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../testing/selftests/net/fib-onlink-tests.sh | 71 ++++++++-----------
1 file changed, 30 insertions(+), 41 deletions(-)
diff --git a/tools/testing/selftests/net/fib-onlink-tests.sh b/tools/testing/selftests/net/fib-onlink-tests.sh
index ec2d6ceb1f08d..c01be076b210d 100755
--- a/tools/testing/selftests/net/fib-onlink-tests.sh
+++ b/tools/testing/selftests/net/fib-onlink-tests.sh
@@ -120,7 +120,7 @@ log_subsection()
run_cmd()
{
- local cmd="$*"
+ local cmd="$1"
local out
local rc
@@ -145,7 +145,7 @@ get_linklocal()
local pfx
local addr
- addr=$(${pfx} ip -6 -br addr show dev ${dev} | \
+ addr=$(${pfx} ${IP} -6 -br addr show dev ${dev} | \
awk '{
for (i = 3; i <= NF; ++i) {
if ($i ~ /^fe80/)
@@ -173,58 +173,48 @@ setup()
set -e
- # create namespace
- setup_ns PEER_NS
+ # create namespaces
+ setup_ns ns1
+ IP="ip -netns $ns1"
+ setup_ns ns2
# add vrf table
- ip li add ${VRF} type vrf table ${VRF_TABLE}
- ip li set ${VRF} up
- ip ro add table ${VRF_TABLE} unreachable default metric 8192
- ip -6 ro add table ${VRF_TABLE} unreachable default metric 8192
+ ${IP} li add ${VRF} type vrf table ${VRF_TABLE}
+ ${IP} li set ${VRF} up
+ ${IP} ro add table ${VRF_TABLE} unreachable default metric 8192
+ ${IP} -6 ro add table ${VRF_TABLE} unreachable default metric 8192
# create test interfaces
- ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]}
- ip li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]}
- ip li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]}
- ip li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]}
+ ${IP} li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]}
+ ${IP} li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]}
+ ${IP} li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]}
+ ${IP} li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]}
# enslave vrf interfaces
for n in 5 7; do
- ip li set ${NETIFS[p${n}]} vrf ${VRF}
+ ${IP} li set ${NETIFS[p${n}]} vrf ${VRF}
done
# add addresses
for n in 1 3 5 7; do
- ip li set ${NETIFS[p${n}]} up
- ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
- ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
+ ${IP} li set ${NETIFS[p${n}]} up
+ ${IP} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+ ${IP} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
done
# move peer interfaces to namespace and add addresses
for n in 2 4 6 8; do
- ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up
- ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
- ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
+ ${IP} li set ${NETIFS[p${n}]} netns ${ns2} up
+ ip -netns $ns2 addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+ ip -netns $ns2 addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]} nodad
done
- ip -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64}
- ip -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64}
+ ${IP} -6 ro add default via ${V6ADDRS[p3]/::[0-9]/::64}
+ ${IP} -6 ro add table ${VRF_TABLE} default via ${V6ADDRS[p7]/::[0-9]/::64}
set +e
}
-cleanup()
-{
- # make sure we start from a clean slate
- cleanup_ns ${PEER_NS} 2>/dev/null
- for n in 1 3 5 7; do
- ip link del ${NETIFS[p${n}]} 2>/dev/null
- done
- ip link del ${VRF} 2>/dev/null
- ip ro flush table ${VRF_TABLE}
- ip -6 ro flush table ${VRF_TABLE}
-}
-
################################################################################
# IPv4 tests
#
@@ -241,7 +231,7 @@ run_ip()
# dev arg may be empty
[ -n "${dev}" ] && dev="dev ${dev}"
- run_cmd ip ro add table "${table}" "${prefix}"/32 via "${gw}" "${dev}" onlink
+ run_cmd "${IP} ro add table ${table} ${prefix}/32 via ${gw} ${dev} onlink"
log_test $? ${exp_rc} "${desc}"
}
@@ -257,8 +247,8 @@ run_ip_mpath()
# dev arg may be empty
[ -n "${dev}" ] && dev="dev ${dev}"
- run_cmd ip ro add table "${table}" "${prefix}"/32 \
- nexthop via ${nh1} nexthop via ${nh2}
+ run_cmd "${IP} ro add table ${table} ${prefix}/32 \
+ nexthop via ${nh1} nexthop via ${nh2}"
log_test $? ${exp_rc} "${desc}"
}
@@ -339,7 +329,7 @@ run_ip6()
# dev arg may be empty
[ -n "${dev}" ] && dev="dev ${dev}"
- run_cmd ip -6 ro add table "${table}" "${prefix}"/128 via "${gw}" "${dev}" onlink
+ run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 via ${gw} ${dev} onlink"
log_test $? ${exp_rc} "${desc}"
}
@@ -353,8 +343,8 @@ run_ip6_mpath()
local exp_rc="$6"
local desc="$7"
- run_cmd ip -6 ro add table "${table}" "${prefix}"/128 "${opts}" \
- nexthop via ${nh1} nexthop via ${nh2}
+ run_cmd "${IP} -6 ro add table ${table} ${prefix}/128 ${opts} \
+ nexthop via ${nh1} nexthop via ${nh2}"
log_test $? ${exp_rc} "${desc}"
}
@@ -491,10 +481,9 @@ do
esac
done
-cleanup
setup
run_onlink_tests
-cleanup
+cleanup_ns ${ns1} ${ns2}
if [ "$TESTS" != "none" ]; then
printf "\nTests passed: %3d\n" ${nsuccess}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 101/280] can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 100/280] selftests: net: fib-onlink-tests: Convert to use namespaces by default Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 102/280] sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT Greg Kroah-Hartman
` (183 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Marc Kleine-Budde,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 79a6d1bfe1148bc921b8d7f3371a7fbce44e30f7 ]
In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix
URB memory leak"), the URB was re-anchored before usb_submit_urb() in
gs_usb_receive_bulk_callback() to prevent a leak of this URB during
cleanup.
However, this patch did not take into account that usb_submit_urb() could
fail. The URB remains anchored and
usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops
infinitely since the anchor list never becomes empty.
To fix the bug, unanchor the URB when an usb_submit_urb() error occurs,
also print an info message.
Fixes: 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/all/20260110223836.3890248-1-kuba@kernel.org/
Link: https://patch.msgid.link/20260116-can_usb-fix-reanchor-v1-1-9d74e7289225@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/gs_usb.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index da05c2aa90d7b..f782c3aa179e0 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -660,6 +660,10 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
usb_anchor_urb(urb, &parent->rx_submitted);
rc = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!rc)
+ return;
+
+ usb_unanchor_urb(urb);
/* USB failure take down all interfaces */
if (rc == -ENODEV) {
@@ -668,6 +672,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
if (parent->canch[rc])
netif_device_detach(parent->canch[rc]->netdev);
}
+ } else if (rc != -ESHUTDOWN && net_ratelimit()) {
+ netdev_info(netdev, "failed to re-submit IN URB: %pe\n",
+ ERR_PTR(urb->status));
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 102/280] sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 101/280] can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 103/280] amd-xgbe: avoid misleading per-packet error log Greg Kroah-Hartman
` (182 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhen Chen, Xin Long, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit a80c9d945aef55b23b54838334345f20251dad83 ]
A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key
initialization fails:
==================================================================
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2
RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline]
RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401
Call Trace:
sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189
sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111
sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217
sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787
sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]
sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169
sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052
sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88
sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243
sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127
The issue is triggered when sctp_auth_asoc_init_active_key() fails in
sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the
command sequence is currently:
- SCTP_CMD_PEER_INIT
- SCTP_CMD_TIMER_STOP (T1_INIT)
- SCTP_CMD_TIMER_START (T1_COOKIE)
- SCTP_CMD_NEW_STATE (COOKIE_ECHOED)
- SCTP_CMD_ASSOC_SHKEY
- SCTP_CMD_GEN_COOKIE_ECHO
If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while
asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by
SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL
to be queued by sctp_datamsg_from_user().
Since command interpretation stops on failure, no COOKIE_ECHO should been
sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already
been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As
a result, the DATA chunk can be transmitted together with the COOKIE_ECHO
in sctp_outq_flush_data(), leading to the observed issue.
Similar to the other places where it calls sctp_auth_asoc_init_active_key()
right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY
immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting
T1_COOKIE. This ensures that if shared key generation fails, authenticated
DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT,
giving the client another chance to process INIT_ACK and retry key setup.
Fixes: 730fc3d05cd4 ("[SCTP]: Implete SCTP-AUTH parameter processing")
Reported-by: Zhen Chen <chenzhen126@huawei.com>
Tested-by: Zhen Chen <chenzhen126@huawei.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/44881224b375aa8853f5e19b4055a1a56d895813.1768324226.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/sm_statefuns.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index beae92ad25bb0..80a6b9fc964e5 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -602,6 +602,11 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
SCTP_PEER_INIT(initchunk));
+ /* SCTP-AUTH: generate the association shared keys so that
+ * we can potentially sign the COOKIE-ECHO.
+ */
+ sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
+
/* Reset init error count upon receipt of INIT-ACK. */
sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
@@ -616,11 +621,6 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net,
sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
SCTP_STATE(SCTP_STATE_COOKIE_ECHOED));
- /* SCTP-AUTH: generate the association shared keys so that
- * we can potentially sign the COOKIE-ECHO.
- */
- sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_SHKEY, SCTP_NULL());
-
/* 5.1 C) "A" shall then send the State Cookie received in the
* INIT ACK chunk in a COOKIE ECHO chunk, ...
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 103/280] amd-xgbe: avoid misleading per-packet error log
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 102/280] sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 104/280] gue: Fix skb memleak with inner IP protocol 0 Greg Kroah-Hartman
` (181 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raju Rangoju, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <Raju.Rangoju@amd.com>
[ Upstream commit c158f985cf6c2c36c99c4f67af2ff3f5ebe09f8f ]
On the receive path, packet can be damaged because of buffer
overflow in Rx FIFO. Avoid misleading per-packet error log when
packet->errors is set, this can flood the log. Instead, rely on the
standard rtnl_link_stats64 stats.
Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver")
Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Link: https://patch.msgid.link/20260114163037.2062606-1-Raju.Rangoju@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index b4d57da71de2a..3d6f8f3a83366 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -2105,7 +2105,7 @@ static void xgbe_get_stats64(struct net_device *netdev,
s->multicast = pstats->rxmulticastframes_g;
s->rx_length_errors = pstats->rxlengtherror;
s->rx_crc_errors = pstats->rxcrcerror;
- s->rx_fifo_errors = pstats->rxfifooverflow;
+ s->rx_over_errors = pstats->rxfifooverflow;
s->tx_packets = pstats->txframecount_gb;
s->tx_bytes = pstats->txoctetcount_gb;
@@ -2559,9 +2559,6 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
goto read_again;
if (error || packet->errors) {
- if (packet->errors)
- netif_err(pdata, rx_err, netdev,
- "error in received packet\n");
dev_kfree_skb(skb);
goto next_packet;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 104/280] gue: Fix skb memleak with inner IP protocol 0.
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 103/280] amd-xgbe: avoid misleading per-packet error log Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 105/280] netlink: add a proto specification for FOU Greg Kroah-Hartman
` (180 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4d8c7d16b0e95c0d0f0d,
Kuniyuki Iwashima, Eric Dumazet, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 9a56796ad258786d3624eef5aefba394fc9bdded ]
syzbot reported skb memleak below. [0]
The repro generated a GUE packet with its inner protocol 0.
gue_udp_recv() returns -guehdr->proto_ctype for "resubmit"
in ip_protocol_deliver_rcu(), but this only works with
non-zero protocol number.
Let's drop such packets.
Note that 0 is a valid number (IPv6 Hop-by-Hop Option).
I think it is not practical to encap HOPOPT in GUE, so once
someone starts to complain, we could pass down a resubmit
flag pointer to distinguish two zeros from the upper layer:
* no error
* resubmit HOPOPT
[0]
BUG: memory leak
unreferenced object 0xffff888109695a00 (size 240):
comm "syz.0.17", pid 6088, jiffies 4294943096
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@..............
backtrace (crc a84b336f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270
__build_skb+0x23/0x60 net/core/skbuff.c:474
build_skb+0x20/0x190 net/core/skbuff.c:490
__tun_build_skb drivers/net/tun.c:1541 [inline]
tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636
tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770
tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x45d/0x710 fs/read_write.c:686
ksys_write+0xa7/0x170 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 37dd0247797b1 ("gue: Receive side for Generic UDP Encapsulation")
Reported-by: syzbot+4d8c7d16b0e95c0d0f0d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6965534b.050a0220.38aacd.0001.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260115172533.693652-2-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/fou.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index c29c976a25965..9d4ae723d2e7d 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -213,6 +213,9 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
return gue_control_message(skb, guehdr);
proto_ctype = guehdr->proto_ctype;
+ if (unlikely(!proto_ctype))
+ goto drop;
+
__skb_pull(skb, sizeof(struct udphdr) + hdrlen);
skb_reset_transport_header(skb);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 105/280] netlink: add a proto specification for FOU
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 104/280] gue: Fix skb memleak with inner IP protocol 0 Greg Kroah-Hartman
@ 2026-02-04 14:37 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 106/280] net: fou: rename the source for linking Greg Kroah-Hartman
` (179 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanislav Fomichev, Jakub Kicinski,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 4eb77b4ecd3c5eaab83adf76e67e0a7ed2a24418 ]
FOU has a reasonably modern Genetlink family. Add a spec.
Acked-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/netlink/specs/fou.yaml | 128 +++++++++++++++++++++++++++
1 file changed, 128 insertions(+)
create mode 100644 Documentation/netlink/specs/fou.yaml
diff --git a/Documentation/netlink/specs/fou.yaml b/Documentation/netlink/specs/fou.yaml
new file mode 100644
index 0000000000000..266c386eedf3a
--- /dev/null
+++ b/Documentation/netlink/specs/fou.yaml
@@ -0,0 +1,128 @@
+name: fou
+
+protocol: genetlink-legacy
+
+doc: |
+ Foo-over-UDP.
+
+c-family-name: fou-genl-name
+c-version-name: fou-genl-version
+max-by-define: true
+kernel-policy: global
+
+definitions:
+ -
+ type: enum
+ name: encap_type
+ name-prefix: fou-encap-
+ enum-name:
+ entries: [ unspec, direct, gue ]
+
+attribute-sets:
+ -
+ name: fou
+ name-prefix: fou-attr-
+ attributes:
+ -
+ name: unspec
+ type: unused
+ -
+ name: port
+ type: u16
+ byte-order: big-endian
+ -
+ name: af
+ type: u8
+ -
+ name: ipproto
+ type: u8
+ -
+ name: type
+ type: u8
+ -
+ name: remcsum_nopartial
+ type: flag
+ -
+ name: local_v4
+ type: u32
+ -
+ name: local_v6
+ type: binary
+ checks:
+ min-len: 16
+ -
+ name: peer_v4
+ type: u32
+ -
+ name: peer_v6
+ type: binary
+ checks:
+ min-len: 16
+ -
+ name: peer_port
+ type: u16
+ byte-order: big-endian
+ -
+ name: ifindex
+ type: s32
+
+operations:
+ list:
+ -
+ name: unspec
+ doc: unused
+
+ -
+ name: add
+ doc: Add port.
+ attribute-set: fou
+
+ dont-validate: [ strict, dump ]
+ flags: [ admin-perm ]
+
+ do:
+ request: &all_attrs
+ attributes:
+ - port
+ - ipproto
+ - type
+ - remcsum_nopartial
+ - local_v4
+ - peer_v4
+ - local_v6
+ - peer_v6
+ - peer_port
+ - ifindex
+
+ -
+ name: del
+ doc: Delete port.
+ attribute-set: fou
+
+ dont-validate: [ strict, dump ]
+ flags: [ admin-perm ]
+
+ do:
+ request: &select_attrs
+ attributes:
+ - af
+ - ifindex
+ - port
+ - peer_port
+ - local_v4
+ - peer_v4
+ - local_v6
+ - peer_v6
+
+ -
+ name: get
+ doc: Get tunnel info.
+ attribute-set: fou
+ dont-validate: [ strict, dump ]
+
+ do:
+ request: *select_attrs
+ reply: *all_attrs
+
+ dump:
+ reply: *all_attrs
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 106/280] net: fou: rename the source for linking
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-02-04 14:37 ` [PATCH 6.1 105/280] netlink: add a proto specification for FOU Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 107/280] net: fou: use policy and operation tables generated from the spec Greg Kroah-Hartman
` (178 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanislav Fomichev, Jakub Kicinski,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 08d323234d10eab077cbf0093eeb5991478a261a ]
We'll need to link two objects together to form the fou module.
This means the source can't be called fou, the build system expects
fou.o to be the combined object.
Acked-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/Makefile | 1 +
net/ipv4/{fou.c => fou_core.c} | 0
2 files changed, 1 insertion(+)
rename net/ipv4/{fou.c => fou_core.c} (100%)
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index bbdd9c44f14e3..e694a5e5b0302 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -26,6 +26,7 @@ obj-$(CONFIG_IP_MROUTE) += ipmr.o
obj-$(CONFIG_IP_MROUTE_COMMON) += ipmr_base.o
obj-$(CONFIG_NET_IPIP) += ipip.o
gre-y := gre_demux.o
+fou-y := fou_core.o
obj-$(CONFIG_NET_FOU) += fou.o
obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
obj-$(CONFIG_NET_IPGRE) += ip_gre.o
diff --git a/net/ipv4/fou.c b/net/ipv4/fou_core.c
similarity index 100%
rename from net/ipv4/fou.c
rename to net/ipv4/fou_core.c
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 107/280] net: fou: use policy and operation tables generated from the spec
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 106/280] net: fou: rename the source for linking Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 108/280] fou: Dont allow 0 for FOU_ATTR_IPPROTO Greg Kroah-Hartman
` (177 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stanislav Fomichev, Jakub Kicinski,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 1d562c32e4392cc091c940918ee1ffd7bfcb9e96 ]
Generate and plug in the spec-based tables.
A little bit of renaming is needed in the FOU code.
Acked-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 7a9bc9e3f423 ("fou: Don't allow 0 for FOU_ATTR_IPPROTO.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/Makefile | 2 +-
net/ipv4/fou_core.c | 47 +++++++-------------------------------------
net/ipv4/fou_nl.c | 48 +++++++++++++++++++++++++++++++++++++++++++++
net/ipv4/fou_nl.h | 25 +++++++++++++++++++++++
4 files changed, 81 insertions(+), 41 deletions(-)
create mode 100644 net/ipv4/fou_nl.c
create mode 100644 net/ipv4/fou_nl.h
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index e694a5e5b0302..d1c8d4beb77d4 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -26,7 +26,7 @@ obj-$(CONFIG_IP_MROUTE) += ipmr.o
obj-$(CONFIG_IP_MROUTE_COMMON) += ipmr_base.o
obj-$(CONFIG_NET_IPIP) += ipip.o
gre-y := gre_demux.o
-fou-y := fou_core.o
+fou-y := fou_core.o fou_nl.o
obj-$(CONFIG_NET_FOU) += fou.o
obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
obj-$(CONFIG_NET_IPGRE) += ip_gre.o
diff --git a/net/ipv4/fou_core.c b/net/ipv4/fou_core.c
index 9d4ae723d2e7d..4ee6c424d96b7 100644
--- a/net/ipv4/fou_core.c
+++ b/net/ipv4/fou_core.c
@@ -19,6 +19,8 @@
#include <uapi/linux/fou.h>
#include <uapi/linux/genetlink.h>
+#include "fou_nl.h"
+
struct fou {
struct socket *sock;
u8 protocol;
@@ -662,20 +664,6 @@ static int fou_destroy(struct net *net, struct fou_cfg *cfg)
static struct genl_family fou_nl_family;
-static const struct nla_policy fou_nl_policy[FOU_ATTR_MAX + 1] = {
- [FOU_ATTR_PORT] = { .type = NLA_U16, },
- [FOU_ATTR_AF] = { .type = NLA_U8, },
- [FOU_ATTR_IPPROTO] = { .type = NLA_U8, },
- [FOU_ATTR_TYPE] = { .type = NLA_U8, },
- [FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },
- [FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },
- [FOU_ATTR_PEER_V4] = { .type = NLA_U32, },
- [FOU_ATTR_LOCAL_V6] = { .len = sizeof(struct in6_addr), },
- [FOU_ATTR_PEER_V6] = { .len = sizeof(struct in6_addr), },
- [FOU_ATTR_PEER_PORT] = { .type = NLA_U16, },
- [FOU_ATTR_IFINDEX] = { .type = NLA_S32, },
-};
-
static int parse_nl_config(struct genl_info *info,
struct fou_cfg *cfg)
{
@@ -767,7 +755,7 @@ static int parse_nl_config(struct genl_info *info,
return 0;
}
-static int fou_nl_cmd_add_port(struct sk_buff *skb, struct genl_info *info)
+int fou_nl_add_doit(struct sk_buff *skb, struct genl_info *info)
{
struct net *net = genl_info_net(info);
struct fou_cfg cfg;
@@ -780,7 +768,7 @@ static int fou_nl_cmd_add_port(struct sk_buff *skb, struct genl_info *info)
return fou_create(net, &cfg, NULL);
}
-static int fou_nl_cmd_rm_port(struct sk_buff *skb, struct genl_info *info)
+int fou_nl_del_doit(struct sk_buff *skb, struct genl_info *info)
{
struct net *net = genl_info_net(info);
struct fou_cfg cfg;
@@ -849,7 +837,7 @@ static int fou_dump_info(struct fou *fou, u32 portid, u32 seq,
return -EMSGSIZE;
}
-static int fou_nl_cmd_get_port(struct sk_buff *skb, struct genl_info *info)
+int fou_nl_get_doit(struct sk_buff *skb, struct genl_info *info)
{
struct net *net = genl_info_net(info);
struct fou_net *fn = net_generic(net, fou_net_id);
@@ -896,7 +884,7 @@ static int fou_nl_cmd_get_port(struct sk_buff *skb, struct genl_info *info)
return ret;
}
-static int fou_nl_dump(struct sk_buff *skb, struct netlink_callback *cb)
+int fou_nl_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
{
struct net *net = sock_net(skb->sk);
struct fou_net *fn = net_generic(net, fou_net_id);
@@ -919,33 +907,12 @@ static int fou_nl_dump(struct sk_buff *skb, struct netlink_callback *cb)
return skb->len;
}
-static const struct genl_small_ops fou_nl_ops[] = {
- {
- .cmd = FOU_CMD_ADD,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
- .doit = fou_nl_cmd_add_port,
- .flags = GENL_ADMIN_PERM,
- },
- {
- .cmd = FOU_CMD_DEL,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
- .doit = fou_nl_cmd_rm_port,
- .flags = GENL_ADMIN_PERM,
- },
- {
- .cmd = FOU_CMD_GET,
- .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
- .doit = fou_nl_cmd_get_port,
- .dumpit = fou_nl_dump,
- },
-};
-
static struct genl_family fou_nl_family __ro_after_init = {
.hdrsize = 0,
.name = FOU_GENL_NAME,
.version = FOU_GENL_VERSION,
.maxattr = FOU_ATTR_MAX,
- .policy = fou_nl_policy,
+ .policy = fou_nl_policy,
.netnsok = true,
.module = THIS_MODULE,
.small_ops = fou_nl_ops,
diff --git a/net/ipv4/fou_nl.c b/net/ipv4/fou_nl.c
new file mode 100644
index 0000000000000..6c3820f41dd5d
--- /dev/null
+++ b/net/ipv4/fou_nl.c
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: BSD-3-Clause
+/* Do not edit directly, auto-generated from: */
+/* Documentation/netlink/specs/fou.yaml */
+/* YNL-GEN kernel source */
+
+#include <net/netlink.h>
+#include <net/genetlink.h>
+
+#include "fou_nl.h"
+
+#include <linux/fou.h>
+
+/* Global operation policy for fou */
+const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX + 1] = {
+ [FOU_ATTR_PORT] = { .type = NLA_U16, },
+ [FOU_ATTR_AF] = { .type = NLA_U8, },
+ [FOU_ATTR_IPPROTO] = { .type = NLA_U8, },
+ [FOU_ATTR_TYPE] = { .type = NLA_U8, },
+ [FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },
+ [FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },
+ [FOU_ATTR_LOCAL_V6] = { .len = 16, },
+ [FOU_ATTR_PEER_V4] = { .type = NLA_U32, },
+ [FOU_ATTR_PEER_V6] = { .len = 16, },
+ [FOU_ATTR_PEER_PORT] = { .type = NLA_U16, },
+ [FOU_ATTR_IFINDEX] = { .type = NLA_S32, },
+};
+
+/* Ops table for fou */
+const struct genl_small_ops fou_nl_ops[3] = {
+ {
+ .cmd = FOU_CMD_ADD,
+ .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .doit = fou_nl_add_doit,
+ .flags = GENL_ADMIN_PERM,
+ },
+ {
+ .cmd = FOU_CMD_DEL,
+ .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .doit = fou_nl_del_doit,
+ .flags = GENL_ADMIN_PERM,
+ },
+ {
+ .cmd = FOU_CMD_GET,
+ .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .doit = fou_nl_get_doit,
+ .dumpit = fou_nl_get_dumpit,
+ },
+};
diff --git a/net/ipv4/fou_nl.h b/net/ipv4/fou_nl.h
new file mode 100644
index 0000000000000..b7a68121ce6f7
--- /dev/null
+++ b/net/ipv4/fou_nl.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+/* Do not edit directly, auto-generated from: */
+/* Documentation/netlink/specs/fou.yaml */
+/* YNL-GEN kernel header */
+
+#ifndef _LINUX_FOU_GEN_H
+#define _LINUX_FOU_GEN_H
+
+#include <net/netlink.h>
+#include <net/genetlink.h>
+
+#include <linux/fou.h>
+
+/* Global operation policy for fou */
+extern const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX + 1];
+
+/* Ops table for fou */
+extern const struct genl_small_ops fou_nl_ops[3];
+
+int fou_nl_add_doit(struct sk_buff *skb, struct genl_info *info);
+int fou_nl_del_doit(struct sk_buff *skb, struct genl_info *info);
+int fou_nl_get_doit(struct sk_buff *skb, struct genl_info *info);
+int fou_nl_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb);
+
+#endif /* _LINUX_FOU_GEN_H */
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 108/280] fou: Dont allow 0 for FOU_ATTR_IPPROTO.
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 107/280] net: fou: use policy and operation tables generated from the spec Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 109/280] l2tp: avoid one data-race in l2tp_tunnel_del_work() Greg Kroah-Hartman
` (176 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5 ]
fou_udp_recv() has the same problem mentioned in the previous
patch.
If FOU_ATTR_IPPROTO is set to 0, skb is not freed by
fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().
Let's forbid 0 for FOU_ATTR_IPPROTO.
Fixes: 23461551c0062 ("fou: Support for foo-over-udp RX path")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260115172533.693652-4-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/netlink/specs/fou.yaml | 2 ++
net/ipv4/fou_nl.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/Documentation/netlink/specs/fou.yaml b/Documentation/netlink/specs/fou.yaml
index 266c386eedf3a..e5753a30a29a2 100644
--- a/Documentation/netlink/specs/fou.yaml
+++ b/Documentation/netlink/specs/fou.yaml
@@ -36,6 +36,8 @@ attribute-sets:
-
name: ipproto
type: u8
+ checks:
+ min: 1
-
name: type
type: u8
diff --git a/net/ipv4/fou_nl.c b/net/ipv4/fou_nl.c
index 6c3820f41dd5d..5bb8133ed7a89 100644
--- a/net/ipv4/fou_nl.c
+++ b/net/ipv4/fou_nl.c
@@ -14,7 +14,7 @@
const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX + 1] = {
[FOU_ATTR_PORT] = { .type = NLA_U16, },
[FOU_ATTR_AF] = { .type = NLA_U8, },
- [FOU_ATTR_IPPROTO] = { .type = NLA_U8, },
+ [FOU_ATTR_IPPROTO] = NLA_POLICY_MIN(NLA_U8, 1),
[FOU_ATTR_TYPE] = { .type = NLA_U8, },
[FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },
[FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 109/280] l2tp: avoid one data-race in l2tp_tunnel_del_work()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 108/280] fou: Dont allow 0 for FOU_ATTR_IPPROTO Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 110/280] ipvlan: Make the addrs_lock be per port Greg Kroah-Hartman
` (175 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7312e82745f7fa2526db,
Eric Dumazet, James Chapman, Guillaume Nault, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf ]
We should read sk->sk_socket only when dealing with kernel sockets.
syzbot reported the following data-race:
BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:
sk_set_socket include/net/sock.h:2092 [inline]
sock_orphan include/net/sock.h:2118 [inline]
sk_common_release+0xae/0x230 net/core/sock.c:4003
udp_lib_close+0x15/0x20 include/net/udp.h:325
inet_release+0xce/0xf0 net/ipv4/af_inet.c:437
__sock_release net/socket.c:662 [inline]
sock_close+0x6b/0x150 net/socket.c:1455
__fput+0x29b/0x650 fs/file_table.c:468
____fput+0x1c/0x30 fs/file_table.c:496
task_work_run+0x131/0x1a0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1:
l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
worker_thread+0x582/0x770 kernel/workqueue.c:3421
kthread+0x489/0x510 kernel/kthread.c:463
ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
value changed: 0xffff88811b818000 -> 0x0000000000000000
Fixes: d00fa9adc528 ("l2tp: fix races with tunnel socket close")
Reported-by: syzbot+7312e82745f7fa2526db@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6968b029.050a0220.58bed.0016.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Link: https://patch.msgid.link/20260115092139.3066180-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/l2tp/l2tp_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 70da78ab95202..e0ca08ebd16a9 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1250,8 +1250,6 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
{
struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
del_work);
- struct sock *sk = tunnel->sock;
- struct socket *sock = sk->sk_socket;
l2tp_tunnel_closeall(tunnel);
@@ -1259,6 +1257,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
* the sk API to release it here.
*/
if (tunnel->fd < 0) {
+ struct socket *sock = tunnel->sock->sk_socket;
+
if (sock) {
kernel_sock_shutdown(sock, SHUT_RDWR);
sock_release(sock);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 110/280] ipvlan: Make the addrs_lock be per port
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 109/280] l2tp: avoid one data-race in l2tp_tunnel_del_work() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 111/280] octeontx2: cn10k: fix RX flowid TCAM mask handling Greg Kroah-Hartman
` (174 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Skorodumov, Paolo Abeni,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Skorodumov <dskr99@gmail.com>
[ Upstream commit d3ba32162488283c0a4c5bedd8817aec91748802 ]
Make the addrs_lock be per port, not per ipvlan dev.
Initial code seems to be written in the assumption,
that any address change must occur under RTNL.
But it is not so for the case of IPv6. So
1) Introduce per-port addrs_lock.
2) It was needed to fix places where it was forgotten
to take lock (ipvlan_open/ipvlan_close)
This appears to be a very minor problem though.
Since it's highly unlikely that ipvlan_add_addr() will
be called on 2 CPU simultaneously. But nevertheless,
this could cause:
1) False-negative of ipvlan_addr_busy(): one interface
iterated through all port->ipvlans + ipvlan->addrs
under some ipvlan spinlock, and another added IP
under its own lock. Though this is only possible
for IPv6, since looks like only ipvlan_addr6_event() can be
called without rtnl_lock.
2) Race since ipvlan_ht_addr_add(port) is called under
different ipvlan->addrs_lock locks
This should not affect performance, since add/remove IP
is a rare situation and spinlock is not taken on fast
paths.
Fixes: 8230819494b3 ("ipvlan: use per device spinlock to protect addrs list updates")
Signed-off-by: Dmitry Skorodumov <skorodumov.dmitry@huawei.com>
Reviewed-by: Paolo Abeni <pabeni@redhat.com>
Link: https://patch.msgid.link/20260112142417.4039566-2-skorodumov.dmitry@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ipvlan/ipvlan.h | 2 +-
drivers/net/ipvlan/ipvlan_core.c | 16 +++++------
drivers/net/ipvlan/ipvlan_main.c | 49 +++++++++++++++++++-------------
3 files changed, 37 insertions(+), 30 deletions(-)
diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
index 025e0c19ec255..fce3ced90bd3d 100644
--- a/drivers/net/ipvlan/ipvlan.h
+++ b/drivers/net/ipvlan/ipvlan.h
@@ -69,7 +69,6 @@ struct ipvl_dev {
DECLARE_BITMAP(mac_filters, IPVLAN_MAC_FILTER_SIZE);
netdev_features_t sfeatures;
u32 msg_enable;
- spinlock_t addrs_lock;
};
struct ipvl_addr {
@@ -90,6 +89,7 @@ struct ipvl_port {
struct net_device *dev;
possible_net_t pnet;
struct hlist_head hlhead[IPVLAN_HASH_SIZE];
+ spinlock_t addrs_lock; /* guards hash-table and addrs */
struct list_head ipvlans;
u16 mode;
u16 flags;
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index a8017424ab538..bf57e4427eb4f 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -107,17 +107,15 @@ void ipvlan_ht_addr_del(struct ipvl_addr *addr)
struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
const void *iaddr, bool is_v6)
{
- struct ipvl_addr *addr, *ret = NULL;
+ struct ipvl_addr *addr;
- rcu_read_lock();
- list_for_each_entry_rcu(addr, &ipvlan->addrs, anode) {
- if (addr_equal(is_v6, addr, iaddr)) {
- ret = addr;
- break;
- }
+ assert_spin_locked(&ipvlan->port->addrs_lock);
+
+ list_for_each_entry(addr, &ipvlan->addrs, anode) {
+ if (addr_equal(is_v6, addr, iaddr))
+ return addr;
}
- rcu_read_unlock();
- return ret;
+ return NULL;
}
bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index fbf2d5b67aafa..a9aeaa9b5779d 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -74,6 +74,7 @@ static int ipvlan_port_create(struct net_device *dev)
for (idx = 0; idx < IPVLAN_HASH_SIZE; idx++)
INIT_HLIST_HEAD(&port->hlhead[idx]);
+ spin_lock_init(&port->addrs_lock);
skb_queue_head_init(&port->backlog);
INIT_WORK(&port->wq, ipvlan_process_multicast);
ida_init(&port->ida);
@@ -179,6 +180,7 @@ static void ipvlan_uninit(struct net_device *dev)
static int ipvlan_open(struct net_device *dev)
{
struct ipvl_dev *ipvlan = netdev_priv(dev);
+ struct ipvl_port *port = ipvlan->port;
struct ipvl_addr *addr;
if (ipvlan->port->mode == IPVLAN_MODE_L3 ||
@@ -187,10 +189,10 @@ static int ipvlan_open(struct net_device *dev)
else
dev->flags &= ~IFF_NOARP;
- rcu_read_lock();
- list_for_each_entry_rcu(addr, &ipvlan->addrs, anode)
+ spin_lock_bh(&port->addrs_lock);
+ list_for_each_entry(addr, &ipvlan->addrs, anode)
ipvlan_ht_addr_add(ipvlan, addr);
- rcu_read_unlock();
+ spin_unlock_bh(&port->addrs_lock);
return 0;
}
@@ -204,10 +206,10 @@ static int ipvlan_stop(struct net_device *dev)
dev_uc_unsync(phy_dev, dev);
dev_mc_unsync(phy_dev, dev);
- rcu_read_lock();
- list_for_each_entry_rcu(addr, &ipvlan->addrs, anode)
+ spin_lock_bh(&ipvlan->port->addrs_lock);
+ list_for_each_entry(addr, &ipvlan->addrs, anode)
ipvlan_ht_addr_del(addr);
- rcu_read_unlock();
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
return 0;
}
@@ -574,7 +576,6 @@ int ipvlan_link_new(struct net *src_net, struct net_device *dev,
if (!tb[IFLA_MTU])
ipvlan_adjust_mtu(ipvlan, phy_dev);
INIT_LIST_HEAD(&ipvlan->addrs);
- spin_lock_init(&ipvlan->addrs_lock);
/* TODO Probably put random address here to be presented to the
* world but keep using the physical-dev address for the outgoing
@@ -652,13 +653,13 @@ void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
struct ipvl_dev *ipvlan = netdev_priv(dev);
struct ipvl_addr *addr, *next;
- spin_lock_bh(&ipvlan->addrs_lock);
+ spin_lock_bh(&ipvlan->port->addrs_lock);
list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
ipvlan_ht_addr_del(addr);
list_del_rcu(&addr->anode);
kfree_rcu(addr, rcu);
}
- spin_unlock_bh(&ipvlan->addrs_lock);
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
ida_simple_remove(&ipvlan->port->ida, dev->dev_id);
list_del_rcu(&ipvlan->pnode);
@@ -805,6 +806,8 @@ static int ipvlan_add_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
{
struct ipvl_addr *addr;
+ assert_spin_locked(&ipvlan->port->addrs_lock);
+
addr = kzalloc(sizeof(struct ipvl_addr), GFP_ATOMIC);
if (!addr)
return -ENOMEM;
@@ -835,16 +838,16 @@ static void ipvlan_del_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
{
struct ipvl_addr *addr;
- spin_lock_bh(&ipvlan->addrs_lock);
+ spin_lock_bh(&ipvlan->port->addrs_lock);
addr = ipvlan_find_addr(ipvlan, iaddr, is_v6);
if (!addr) {
- spin_unlock_bh(&ipvlan->addrs_lock);
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
return;
}
ipvlan_ht_addr_del(addr);
list_del_rcu(&addr->anode);
- spin_unlock_bh(&ipvlan->addrs_lock);
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
kfree_rcu(addr, rcu);
}
@@ -866,14 +869,14 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
{
int ret = -EINVAL;
- spin_lock_bh(&ipvlan->addrs_lock);
+ spin_lock_bh(&ipvlan->port->addrs_lock);
if (ipvlan_addr_busy(ipvlan->port, ip6_addr, true))
netif_err(ipvlan, ifup, ipvlan->dev,
"Failed to add IPv6=%pI6c addr for %s intf\n",
ip6_addr, ipvlan->dev->name);
else
ret = ipvlan_add_addr(ipvlan, ip6_addr, true);
- spin_unlock_bh(&ipvlan->addrs_lock);
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
return ret;
}
@@ -912,21 +915,24 @@ static int ipvlan_addr6_validator_event(struct notifier_block *unused,
struct in6_validator_info *i6vi = (struct in6_validator_info *)ptr;
struct net_device *dev = (struct net_device *)i6vi->i6vi_dev->dev;
struct ipvl_dev *ipvlan = netdev_priv(dev);
+ int ret = NOTIFY_OK;
if (!ipvlan_is_valid_dev(dev))
return NOTIFY_DONE;
switch (event) {
case NETDEV_UP:
+ spin_lock_bh(&ipvlan->port->addrs_lock);
if (ipvlan_addr_busy(ipvlan->port, &i6vi->i6vi_addr, true)) {
NL_SET_ERR_MSG(i6vi->extack,
"Address already assigned to an ipvlan device");
- return notifier_from_errno(-EADDRINUSE);
+ ret = notifier_from_errno(-EADDRINUSE);
}
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
break;
}
- return NOTIFY_OK;
+ return ret;
}
#endif
@@ -934,14 +940,14 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
{
int ret = -EINVAL;
- spin_lock_bh(&ipvlan->addrs_lock);
+ spin_lock_bh(&ipvlan->port->addrs_lock);
if (ipvlan_addr_busy(ipvlan->port, ip4_addr, false))
netif_err(ipvlan, ifup, ipvlan->dev,
"Failed to add IPv4=%pI4 on %s intf.\n",
ip4_addr, ipvlan->dev->name);
else
ret = ipvlan_add_addr(ipvlan, ip4_addr, false);
- spin_unlock_bh(&ipvlan->addrs_lock);
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
return ret;
}
@@ -983,21 +989,24 @@ static int ipvlan_addr4_validator_event(struct notifier_block *unused,
struct in_validator_info *ivi = (struct in_validator_info *)ptr;
struct net_device *dev = (struct net_device *)ivi->ivi_dev->dev;
struct ipvl_dev *ipvlan = netdev_priv(dev);
+ int ret = NOTIFY_OK;
if (!ipvlan_is_valid_dev(dev))
return NOTIFY_DONE;
switch (event) {
case NETDEV_UP:
+ spin_lock_bh(&ipvlan->port->addrs_lock);
if (ipvlan_addr_busy(ipvlan->port, &ivi->ivi_addr, false)) {
NL_SET_ERR_MSG(ivi->extack,
"Address already assigned to an ipvlan device");
- return notifier_from_errno(-EADDRINUSE);
+ ret = notifier_from_errno(-EADDRINUSE);
}
+ spin_unlock_bh(&ipvlan->port->addrs_lock);
break;
}
- return NOTIFY_OK;
+ return ret;
}
static struct notifier_block ipvlan_addr4_notifier_block __read_mostly = {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 111/280] octeontx2: cn10k: fix RX flowid TCAM mask handling
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 110/280] ipvlan: Make the addrs_lock be per port Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 112/280] net/sched: Enforce that teql can only be used as root qdisc Greg Kroah-Hartman
` (173 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Subbaraya Sundeep,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit ab9b218a1521133a4410722907fa7189566be9bc ]
The RX flowid programming initializes the TCAM mask to all ones, but
then overwrites it when clearing the MAC DA mask bits. This results
in losing the intended initialization and may affect other match fields.
Update the code to clear the MAC DA bits using an AND operation, making
the handling of mask[0] consistent with mask[1], where the field-specific
bits are cleared after initializing the mask to ~0ULL.
Fixes: 57d00d4364f3 ("octeontx2-pf: mcs: Match macsec ethertype along with DMAC")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Subbaraya Sundeep <sbhatta@marvell.com>
Link: https://patch.msgid.link/20260116164724.2733511-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
index 6da8d8f2a8701..60425e6ce0767 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
@@ -265,7 +265,7 @@ static int cn10k_mcs_write_rx_flowid(struct otx2_nic *pfvf,
req->data[0] = FIELD_PREP(MCS_TCAM0_MAC_DA_MASK, mac_da);
req->mask[0] = ~0ULL;
- req->mask[0] = ~MCS_TCAM0_MAC_DA_MASK;
+ req->mask[0] &= ~MCS_TCAM0_MAC_DA_MASK;
req->data[1] = FIELD_PREP(MCS_TCAM1_ETYPE_MASK, ETH_P_MACSEC);
req->mask[1] = ~0ULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 112/280] net/sched: Enforce that teql can only be used as root qdisc
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 111/280] octeontx2: cn10k: fix RX flowid TCAM mask handling Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 113/280] net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag Greg Kroah-Hartman
` (172 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, GangMin Kim, Victor Nogueira,
Jamal Hadi Salim, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b ]
Design intent of teql is that it is only supposed to be used as root qdisc.
We need to check for that constraint.
Although not important, I will describe the scenario that unearthed this
issue for the curious.
GangMin Kim <km.kim1503@gmail.com> managed to concot a scenario as follows:
ROOT qdisc 1:0 (QFQ)
├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s
└── class 1:2 (weight=1, lmax=1514) teql
GangMin sends a packet which is enqueued to 1:1 (netem).
Any invocation of dequeue by QFQ from this class will not return a packet
until after 6.4s. In the meantime, a second packet is sent and it lands on
1:2. teql's enqueue will return success and this will activate class 1:2.
Main issue is that teql only updates the parent visible qlen (sch->q.qlen)
at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's
peek always returns NULL), dequeue will never be called and thus the qlen
will remain as 0. With that in mind, when GangMin updates 1:2's lmax value,
the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's
qlen was not incremented, qfq fails to deactivate the class, but still
frees its pointers from the aggregate. So when the first packet is
rescheduled after 6.4 seconds (netem's delay), a dangling pointer is
accessed causing GangMin's causing a UAF.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: GangMin Kim <km.kim1503@gmail.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260114160243.913069-2-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_teql.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 7721239c185fb..0a7856e14a975 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -178,6 +178,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt,
if (m->dev == dev)
return -ELOOP;
+ if (sch->parent != TC_H_ROOT) {
+ NL_SET_ERR_MSG_MOD(extack, "teql can only be used as root");
+ return -EOPNOTSUPP;
+ }
+
q->m = m;
skb_queue_head_init(&q->q);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 113/280] net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 112/280] net/sched: Enforce that teql can only be used as root qdisc Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 114/280] crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec Greg Kroah-Hartman
` (171 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <jhs@mojatatu.com>
[ Upstream commit d837fbee92453fbb829f950c8e7cf76207d73f33 ]
This is more of a preventive patch to make the code more consistent and
to prevent possible exploits that employ child qlen manipulations on qfq.
use cl_is_active instead of relying on the child qdisc's qlen to determine
class activation.
Fixes: 462dbc9101acd ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260114160243.913069-3-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_qfq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 0047f35504348..51d962e5113bc 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -375,7 +375,7 @@ static void qfq_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)
/* Deschedule class and remove it from its parent aggregate. */
static void qfq_deact_rm_from_agg(struct qfq_sched *q, struct qfq_class *cl)
{
- if (cl->qdisc->q.qlen > 0) /* class is active */
+ if (cl_is_active(cl)) /* class is active */
qfq_deactivate_class(q, cl);
qfq_rm_from_agg(q, cl);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 114/280] crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 113/280] net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 115/280] serial: 8250_pci: Fix broken RS485 for F81504/508/512 Greg Kroah-Hartman
` (170 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Taeyang Lee, Herbert Xu, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeyang Lee <0wn@theori.io>
[ Upstream commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 ]
authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than
the minimum expected length, crypto_authenc_esn_decrypt() can advance past
the end of the destination scatterlist and trigger a NULL pointer dereference
in scatterwalk_map_and_copy(), leading to a kernel panic (DoS).
Add a minimum AAD length check to fail fast on invalid inputs.
Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface")
Reported-By: Taeyang Lee <0wn@theori.io>
Signed-off-by: Taeyang Lee <0wn@theori.io>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/authencesn.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/crypto/authencesn.c b/crypto/authencesn.c
index b60e61b1904cb..6487b35851d54 100644
--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -191,6 +191,9 @@ static int crypto_authenc_esn_encrypt(struct aead_request *req)
struct scatterlist *src, *dst;
int err;
+ if (assoclen < 8)
+ return -EINVAL;
+
sg_init_table(areq_ctx->src, 2);
src = scatterwalk_ffwd(areq_ctx->src, req->src, assoclen);
dst = src;
@@ -284,6 +287,9 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req)
u32 tmp[2];
int err;
+ if (assoclen < 8)
+ return -EINVAL;
+
cryptlen -= authsize;
if (req->src != dst) {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 115/280] serial: 8250_pci: Fix broken RS485 for F81504/508/512
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 114/280] crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 116/280] comedi: dmm32at: serialize use of paged registers Greg Kroah-Hartman
` (169 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Marnix Rijnart
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marnix Rijnart <marnix.rijnart@iwell.eu>
commit 27aff0a56b3c77ea1a73641c9b3c4172a8f7238f upstream.
Fintek F81504/508/512 can support both RTS_ON_SEND and RTS_AFTER_SEND,
but pci_fintek_rs485_supported only announces the former.
This makes it impossible to unset SER_RS485_RTS_ON_SEND from
userspace because of uart_sanitize_serial_rs485(). Some devices
with these chips need RTS low on TX, so they are effectively broken.
Fix this by announcing the support for SER_RS485_RTS_AFTER_SEND,
similar to commit 068d35a7be65 ("serial: sc16is7xx: announce support
for SER_RS485_RTS_ON_SEND").
Fixes: 4afeced55baa ("serial: core: fix sanitizing check for RTS settings")
Cc: stable <stable@kernel.org>
Signed-off-by: Marnix Rijnart <marnix.rijnart@iwell.eu>
Link: https://patch.msgid.link/20260112000931.61703-1-marnix.rijnart@iwell.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1583,7 +1583,7 @@ static int pci_fintek_rs485_config(struc
}
static const struct serial_rs485 pci_fintek_rs485_supported = {
- .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND,
+ .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND,
/* F81504/508/512 does not support RTS delay before or after send */
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 116/280] comedi: dmm32at: serialize use of paged registers
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 115/280] serial: 8250_pci: Fix broken RS485 for F81504/508/512 Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 117/280] w1: therm: Fix off-by-one buffer overflow in alarms_store Greg Kroah-Hartman
` (168 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Abbott
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 upstream.
Some of the hardware registers of the DMM-32-AT board are multiplexed,
using the least significant two bits of the Miscellaneous Control
register to select the function of registers at offsets 12 to 15:
00 => 8254 timer/counter registers are accessible
01 => 8255 digital I/O registers are accessible
10 => Reserved
11 => Calibration registers are accessible
The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two
bits of the register with value 00, which would interfere with access to
the 8255 registers by the `dm32at_8255_io()` function (used for Comedi
instruction handling on the digital I/O subdevice).
Make use of the generic Comedi device spin-lock `dev->spinlock` (which
is otherwise unused by this driver) to serialize access to the
miscellaneous control register and paged registers.
Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/drivers/dmm32at.c | 32 ++++++++++++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
--- a/drivers/comedi/drivers/dmm32at.c
+++ b/drivers/comedi/drivers/dmm32at.c
@@ -330,6 +330,7 @@ static int dmm32at_ai_cmdtest(struct com
static void dmm32at_setaitimer(struct comedi_device *dev, unsigned int nansec)
{
+ unsigned long irq_flags;
unsigned char lo1, lo2, hi2;
unsigned short both2;
@@ -342,6 +343,9 @@ static void dmm32at_setaitimer(struct co
/* set counter clocks to 10MHz, disable all aux dio */
outb(0, dev->iobase + DMM32AT_CTRDIO_CFG_REG);
+ /* serialize access to control register and paged registers */
+ spin_lock_irqsave(&dev->spinlock, irq_flags);
+
/* get access to the clock regs */
outb(DMM32AT_CTRL_PAGE_8254, dev->iobase + DMM32AT_CTRL_REG);
@@ -354,6 +358,8 @@ static void dmm32at_setaitimer(struct co
outb(lo2, dev->iobase + DMM32AT_CLK2);
outb(hi2, dev->iobase + DMM32AT_CLK2);
+ spin_unlock_irqrestore(&dev->spinlock, irq_flags);
+
/* enable the ai conversion interrupt and the clock to start scans */
outb(DMM32AT_INTCLK_ADINT |
DMM32AT_INTCLK_CLKEN | DMM32AT_INTCLK_CLKSEL,
@@ -363,13 +369,19 @@ static void dmm32at_setaitimer(struct co
static int dmm32at_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
{
struct comedi_cmd *cmd = &s->async->cmd;
+ unsigned long irq_flags;
int ret;
dmm32at_ai_set_chanspec(dev, s, cmd->chanlist[0], cmd->chanlist_len);
+ /* serialize access to control register and paged registers */
+ spin_lock_irqsave(&dev->spinlock, irq_flags);
+
/* reset the interrupt just in case */
outb(DMM32AT_CTRL_INTRST, dev->iobase + DMM32AT_CTRL_REG);
+ spin_unlock_irqrestore(&dev->spinlock, irq_flags);
+
/*
* wait for circuit to settle
* we don't have the 'insn' here but it's not needed
@@ -429,8 +441,13 @@ static irqreturn_t dmm32at_isr(int irq,
comedi_handle_events(dev, s);
}
+ /* serialize access to control register and paged registers */
+ spin_lock(&dev->spinlock);
+
/* reset the interrupt */
outb(DMM32AT_CTRL_INTRST, dev->iobase + DMM32AT_CTRL_REG);
+
+ spin_unlock(&dev->spinlock);
return IRQ_HANDLED;
}
@@ -481,14 +498,25 @@ static int dmm32at_ao_insn_write(struct
static int dmm32at_8255_io(struct comedi_device *dev,
int dir, int port, int data, unsigned long regbase)
{
+ unsigned long irq_flags;
+ int ret;
+
+ /* serialize access to control register and paged registers */
+ spin_lock_irqsave(&dev->spinlock, irq_flags);
+
/* get access to the DIO regs */
outb(DMM32AT_CTRL_PAGE_8255, dev->iobase + DMM32AT_CTRL_REG);
if (dir) {
outb(data, dev->iobase + regbase + port);
- return 0;
+ ret = 0;
+ } else {
+ ret = inb(dev->iobase + regbase + port);
}
- return inb(dev->iobase + regbase + port);
+
+ spin_unlock_irqrestore(&dev->spinlock, irq_flags);
+
+ return ret;
}
/* Make sure the board is there and put it to a known state */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 117/280] w1: therm: Fix off-by-one buffer overflow in alarms_store
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 116/280] comedi: dmm32at: serialize use of paged registers Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 118/280] w1: fix redundant counter decrement in w1_attach_slave_device() Greg Kroah-Hartman
` (167 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Krzysztof Kozlowski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 761fcf46a1bd797bd32d23f3ea0141ffd437668a upstream.
The sysfs buffer passed to alarms_store() is allocated with 'size + 1'
bytes and a NUL terminator is appended. However, the 'size' argument
does not account for this extra byte. The original code then allocated
'size' bytes and used strcpy() to copy 'buf', which always writes one
byte past the allocated buffer since strcpy() copies until the NUL
terminator at index 'size'.
Fix this by parsing the 'buf' parameter directly using simple_strtoll()
without allocating any intermediate memory or string copying. This
removes the overflow while simplifying the code.
Cc: stable@vger.kernel.org
Fixes: e2c94d6f5720 ("w1_therm: adding alarm sysfs entry")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20251216145007.44328-2-thorsten.blum@linux.dev
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/w1/slaves/w1_therm.c | 60 +++++++++++++------------------------------
1 file changed, 19 insertions(+), 41 deletions(-)
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -1846,53 +1846,35 @@ static ssize_t alarms_store(struct devic
struct w1_slave *sl = dev_to_w1_slave(device);
struct therm_info info;
u8 new_config_register[3]; /* array of data to be written */
- int temp, ret;
- char *token = NULL;
+ long long temp;
+ int ret = 0;
s8 tl, th; /* 1 byte per value + temp ring order */
- char *p_args, *orig;
+ const char *p = buf;
+ char *endp;
- p_args = orig = kmalloc(size, GFP_KERNEL);
- /* Safe string copys as buf is const */
- if (!p_args) {
- dev_warn(device,
- "%s: error unable to allocate memory %d\n",
- __func__, -ENOMEM);
- return size;
- }
- strcpy(p_args, buf);
-
- /* Split string using space char */
- token = strsep(&p_args, " ");
-
- if (!token) {
- dev_info(device,
- "%s: error parsing args %d\n", __func__, -EINVAL);
- goto free_m;
- }
-
- /* Convert 1st entry to int */
- ret = kstrtoint (token, 10, &temp);
+ temp = simple_strtoll(p, &endp, 10);
+ if (p == endp || *endp != ' ')
+ ret = -EINVAL;
+ else if (temp < INT_MIN || temp > INT_MAX)
+ ret = -ERANGE;
if (ret) {
dev_info(device,
"%s: error parsing args %d\n", __func__, ret);
- goto free_m;
+ return size;
}
tl = int_to_short(temp);
- /* Split string using space char */
- token = strsep(&p_args, " ");
- if (!token) {
- dev_info(device,
- "%s: error parsing args %d\n", __func__, -EINVAL);
- goto free_m;
- }
- /* Convert 2nd entry to int */
- ret = kstrtoint (token, 10, &temp);
+ p = endp + 1;
+ temp = simple_strtoll(p, &endp, 10);
+ if (p == endp)
+ ret = -EINVAL;
+ else if (temp < INT_MIN || temp > INT_MAX)
+ ret = -ERANGE;
if (ret) {
dev_info(device,
"%s: error parsing args %d\n", __func__, ret);
- goto free_m;
+ return size;
}
/* Prepare to cast to short by eliminating out of range values */
@@ -1915,7 +1897,7 @@ static ssize_t alarms_store(struct devic
dev_info(device,
"%s: error reading from the slave device %d\n",
__func__, ret);
- goto free_m;
+ return size;
}
/* Write data in the device RAM */
@@ -1923,7 +1905,7 @@ static ssize_t alarms_store(struct devic
dev_info(device,
"%s: Device not supported by the driver %d\n",
__func__, -ENODEV);
- goto free_m;
+ return size;
}
ret = SLAVE_SPECIFIC_FUNC(sl)->write_data(sl, new_config_register);
@@ -1932,10 +1914,6 @@ static ssize_t alarms_store(struct devic
"%s: error writing to the slave device %d\n",
__func__, ret);
-free_m:
- /* free allocated memory */
- kfree(orig);
-
return size;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 118/280] w1: fix redundant counter decrement in w1_attach_slave_device()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 117/280] w1: therm: Fix off-by-one buffer overflow in alarms_store Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 119/280] Revert "nfc/nci: Add the inconsistency check between the input data length and count" Greg Kroah-Hartman
` (166 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Krzysztof Kozlowski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit cc8f92e41eb76f450f05234fef2054afc3633100 upstream.
In w1_attach_slave_device(), if __w1_attach_slave_device() fails,
put_device() -> w1_slave_release() is called to do the cleanup job.
In w1_slave_release(), sl->family->refcnt and sl->master->slave_count
have already been decremented. There is no need to decrement twice
in w1_attach_slave_device().
Fixes: 2c927c0c73fd ("w1: Fix slave count on 1-Wire bus (resend)")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Link: https://patch.msgid.link/20251218111414.564403-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/w1/w1.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -767,8 +767,6 @@ int w1_attach_slave_device(struct w1_mas
if (err < 0) {
dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__,
sl->name);
- dev->slave_count--;
- w1_family_put(sl->family);
atomic_dec(&sl->master->refcnt);
kfree(sl);
return err;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 119/280] Revert "nfc/nci: Add the inconsistency check between the input data length and count"
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 118/280] w1: fix redundant counter decrement in w1_attach_slave_device() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 120/280] Input: i8042 - add quirks for MECHREVO Wujie 15X Pro Greg Kroah-Hartman
` (165 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thadeu Lima de Souza Cascardo,
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
commit f40ddcc0c0ca1a0122a7f4440b429f97d5832bdf upstream.
This reverts commit 068648aab72c9ba7b0597354ef4d81ffaac7b979.
NFC packets may have NUL-bytes. Checking for string length is not a correct
assumption here. As long as there is a check for the length copied from
copy_from_user, all should be fine.
The fix only prevented the syzbot reproducer from triggering the bug
because the packet is not enqueued anymore and the code that triggers the
bug is not exercised.
The fix even broke
testing/selftests/nci/nci_dev, making all tests there fail. After the
revert, 6 out of 8 tests pass.
Fixes: 068648aab72c ("nfc/nci: Add the inconsistency check between the input data length and count")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Link: https://patch.msgid.link/20260113202458.449455-1-cascardo@igalia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/virtual_ncidev.c | 4 ----
1 file changed, 4 deletions(-)
--- a/drivers/nfc/virtual_ncidev.c
+++ b/drivers/nfc/virtual_ncidev.c
@@ -121,10 +121,6 @@ static ssize_t virtual_ncidev_write(stru
kfree_skb(skb);
return -EFAULT;
}
- if (strnlen(skb->data, count) != count) {
- kfree_skb(skb);
- return -EINVAL;
- }
nci_recv_frame(ndev, skb);
return count;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 120/280] Input: i8042 - add quirks for MECHREVO Wujie 15X Pro
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 119/280] Revert "nfc/nci: Add the inconsistency check between the input data length and count" Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 121/280] Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA Greg Kroah-Hartman
` (164 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, gongqi, Dmitry Torokhov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: gongqi <550230171hxy@gmail.com>
commit 19a5d9ba6208e9006a2a9d5962aea4d6e427d8ab upstream.
The MECHREVO Wujie 15X Pro requires several i8042 quirks to function
correctly. Specifically, NOMUX, RESET_ALWAYS, NOLOOP, and NOPNP are
needed to ensure the keyboard and touchpad work reliably.
Signed-off-by: gongqi <550230171hxy@gmail.com>
Link: https://patch.msgid.link/20260122155501.376199-3-550230171hxy@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-acpipnpio.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -1176,6 +1176,13 @@ static const struct dmi_system_id i8042_
.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
},
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE Series-X5SP4NAG"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
/*
* A lot of modern Clevo barebones have touchpad and/or keyboard issues
* after suspend fixable with the forcenorestore quirk.
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 121/280] Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 120/280] Input: i8042 - add quirks for MECHREVO Wujie 15X Pro Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 122/280] scsi: storvsc: Process unsupported MODE_SENSE_10 Greg Kroah-Hartman
` (163 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, feng, Dmitry Torokhov
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: feng <alec.jiang@gmail.com>
commit 2934325f56150ad8dab8ab92cbe2997242831396 upstream.
The ASUS Zenbook UX425QA_UM425QA fails to initialize the keyboard after
a cold boot.
A quirk already exists for "ZenBook UX425", but some Zenbooks report
"Zenbook" with a lowercase 'b'. Since DMI matching is case-sensitive,
the existing quirk is not applied to these "extra special" Zenbooks.
Testing confirms that this model needs the same quirks as the ZenBook
UX425 variants.
Signed-off-by: feng <alec.jiang@gmail.com>
Link: https://patch.msgid.link/20260122013957.11184-1-alec.jiang@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-acpipnpio.h | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -116,6 +116,17 @@ static const struct dmi_system_id i8042_
.driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_NEVER)
},
{
+ /*
+ * ASUS Zenbook UX425QA_UM425QA
+ * Some Zenbooks report "Zenbook" with a lowercase b.
+ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Zenbook UX425QA_UM425QA"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER | SERIO_QUIRK_RESET_NEVER)
+ },
+ {
/* ASUS ZenBook UX425UA/QA */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 122/280] scsi: storvsc: Process unsupported MODE_SENSE_10
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 121/280] Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 123/280] arm64: dts: rockchip: remove dangerous max-link-speed from helios64 Greg Kroah-Hartman
` (162 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Long Li, Michael Kelley,
Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <longli@microsoft.com>
commit 9eacec5d18f98f89be520eeeef4b377acee3e4b8 upstream.
The Hyper-V host does not support MODE_SENSE_10 and MODE_SENSE. The
driver handles MODE_SENSE as unsupported command, but not for
MODE_SENSE_10. Add MODE_SENSE_10 to the same handling logic and return
correct code to SCSI layer.
Fixes: 89ae7d709357 ("Staging: hv: storvsc: Move the storage driver out of the staging area")
Cc: stable@kernel.org
Signed-off-by: Long Li <longli@microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Link: https://patch.msgid.link/20260117010302.294068-1-longli@linux.microsoft.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1136,7 +1136,7 @@ static void storvsc_on_io_completion(str
* The current SCSI handling on the host side does
* not correctly handle:
* INQUIRY command with page code parameter set to 0x80
- * MODE_SENSE command with cmd[2] == 0x1c
+ * MODE_SENSE and MODE_SENSE_10 command with cmd[2] == 0x1c
* MAINTENANCE_IN is not supported by HyperV FC passthrough
*
* Setup srb and scsi status so this won't be fatal.
@@ -1146,6 +1146,7 @@ static void storvsc_on_io_completion(str
if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) ||
(stor_pkt->vm_srb.cdb[0] == MODE_SENSE) ||
+ (stor_pkt->vm_srb.cdb[0] == MODE_SENSE_10) ||
(stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN &&
hv_dev_is_fc(device))) {
vstor_packet->vm_srb.scsi_status = 0;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 123/280] arm64: dts: rockchip: remove dangerous max-link-speed from helios64
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 122/280] scsi: storvsc: Process unsupported MODE_SENSE_10 Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 124/280] x86/kfence: avoid writing L1TF-vulnerable PTEs Greg Kroah-Hartman
` (161 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shawn Lin, Dragan Simic,
Geraldo Nascimento, Heiko Stuebner
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
commit 0368e4afcf20f377c81fa77b1c7d0dee4a625a44 upstream.
Shawn Lin from Rockchip strongly discourages attempts to use their
RK3399 PCIe core at 5.0 GT/s speed, citing concerns about catastrophic
failures that may happen. Even if the odds are low, drop from last user
of this non-default property for the RK3399 platform, helios64 board
dts.
Fixes: 755fff528b1b ("arm64: dts: rockchip: add variables for pcie completion to helios64")
Link: https://lore.kernel.org/all/e8524bf8-a90c-423f-8a58-9ef05a3db1dd@rock-chips.com/
Cc: stable@vger.kernel.org
Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/43bb639c120f599106fca2deee6c6599b2692c5c.1763415706.git.geraldogabriel@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts | 1 -
1 file changed, 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts
@@ -427,7 +427,6 @@
&pcie0 {
ep-gpios = <&gpio2 RK_PD4 GPIO_ACTIVE_HIGH>;
- max-link-speed = <2>;
num-lanes = <2>;
pinctrl-names = "default";
status = "okay";
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 124/280] x86/kfence: avoid writing L1TF-vulnerable PTEs
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 123/280] arm64: dts: rockchip: remove dangerous max-link-speed from helios64 Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 125/280] comedi: Fix getting range information for subdevices 16 to 255 Greg Kroah-Hartman
` (160 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Cooper, Marco Elver,
Alexander Potapenko, Dmitry Vyukov, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, H. Peter Anvin, Jann Horn,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <andrew.cooper3@citrix.com>
commit b505f1944535f83d369ae68813e7634d11b990d3 upstream.
For native, the choice of PTE is fine. There's real memory backing the
non-present PTE. However, for XenPV, Xen complains:
(XEN) d1 L1TF-vulnerable L1e 8010000018200066 - Shadowing
To explain, some background on XenPV pagetables:
Xen PV guests are control their own pagetables; they choose the new
PTE value, and use hypercalls to make changes so Xen can audit for
safety.
In addition to a regular reference count, Xen also maintains a type
reference count. e.g. SegDesc (referenced by vGDT/vLDT), Writable
(referenced with _PAGE_RW) or L{1..4} (referenced by vCR3 or a lower
pagetable level). This is in order to prevent e.g. a page being
inserted into the pagetables for which the guest has a writable mapping.
For non-present mappings, all other bits become software accessible,
and typically contain metadata rather a real frame address. There is
nothing that a reference count could sensibly be tied to. As such, even
if Xen could recognise the address as currently safe, nothing would
prevent that frame from changing owner to another VM in the future.
When Xen detects a PV guest writing a L1TF-PTE, it responds by
activating shadow paging. This is normally only used for the live phase
of migration, and comes with a reasonable overhead.
KFENCE only cares about getting #PF to catch wild accesses; it doesn't
care about the value for non-present mappings. Use a fully inverted PTE,
to avoid hitting the slow path when running under Xen.
While adjusting the logic, take the opportunity to skip all actions if the
PTE is already in the right state, half the number PVOps callouts, and
skip TLB maintenance on a !P -> P transition which benefits non-Xen cases
too.
Link: https://lkml.kernel.org/r/20260106180426.710013-1-andrew.cooper3@citrix.com
Fixes: 1dc0da6e9ec0 ("x86, kfence: enable KFENCE for x86")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Tested-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/kfence.h | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)
--- a/arch/x86/include/asm/kfence.h
+++ b/arch/x86/include/asm/kfence.h
@@ -42,10 +42,34 @@ static inline bool kfence_protect_page(u
{
unsigned int level;
pte_t *pte = lookup_address(addr, &level);
+ pteval_t val;
if (WARN_ON(!pte || level != PG_LEVEL_4K))
return false;
+ val = pte_val(*pte);
+
+ /*
+ * protect requires making the page not-present. If the PTE is
+ * already in the right state, there's nothing to do.
+ */
+ if (protect != !!(val & _PAGE_PRESENT))
+ return true;
+
+ /*
+ * Otherwise, invert the entire PTE. This avoids writing out an
+ * L1TF-vulnerable PTE (not present, without the high address bits
+ * set).
+ */
+ set_pte(pte, __pte(~val));
+
+ /*
+ * If the page was protected (non-present) and we're making it
+ * present, there is no need to flush the TLB at all.
+ */
+ if (!protect)
+ return true;
+
/*
* We need to avoid IPIs, as we may get KFENCE allocations or faults
* with interrupts disabled. Therefore, the below is best-effort, and
@@ -53,11 +77,6 @@ static inline bool kfence_protect_page(u
* lazy fault handling takes care of faults after the page is PRESENT.
*/
- if (protect)
- set_pte(pte, __pte(pte_val(*pte) & ~_PAGE_PRESENT));
- else
- set_pte(pte, __pte(pte_val(*pte) | _PAGE_PRESENT));
-
/*
* Flush this CPU's TLB, assuming whoever did the allocation/free is
* likely to continue running on this CPU.
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 125/280] comedi: Fix getting range information for subdevices 16 to 255
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 124/280] x86/kfence: avoid writing L1TF-vulnerable PTEs Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 126/280] iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection Greg Kroah-Hartman
` (159 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ian Abbott
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit 10d28cffb3f6ec7ad67f0a4cd32c2afa92909452 upstream.
The `COMEDI_RANGEINFO` ioctl does not work properly for subdevice
indices above 15. Currently, the only in-tree COMEDI drivers that
support more than 16 subdevices are the "8255" driver and the
"comedi_bond" driver. Making the ioctl work for subdevice indices up to
255 is achievable. It needs minor changes to the handling of the
`COMEDI_RANGEINFO` and `COMEDI_CHANINFO` ioctls that should be mostly
harmless to user-space, apart from making them less broken. Details
follow...
The `COMEDI_RANGEINFO` ioctl command gets the list of supported ranges
(usually with units of volts or milliamps) for a COMEDI subdevice or
channel. (Only some subdevices have per-channel range tables, indicated
by the `SDF_RANGETYPE` flag in the subdevice information.) It uses a
`range_type` value and a user-space pointer, both supplied by
user-space, but the `range_type` value should match what was obtained
using the `COMEDI_CHANINFO` ioctl (if the subdevice has per-channel
range tables) or `COMEDI_SUBDINFO` ioctl (if the subdevice uses a
single range table for all channels). Bits 15 to 0 of the `range_type`
value contain the length of the range table, which is the only part that
user-space should care about (so it can use a suitably sized buffer to
fetch the range table). Bits 23 to 16 store the channel index, which is
assumed to be no more than 255 if the subdevice has per-channel range
tables, and is set to 0 if the subdevice has a single range table. For
`range_type` values produced by the `COMEDI_SUBDINFO` ioctl, bits 31 to
24 contain the subdevice index, which is assumed to be no more than 255.
But for `range_type` values produced by the `COMEDI_CHANINFO` ioctl,
bits 27 to 24 contain the subdevice index, which is assumed to be no
more than 15, and bits 31 to 28 contain the COMEDI device's minor device
number for some unknown reason lost in the mists of time. The
`COMEDI_RANGEINFO` ioctl extract the length from bits 15 to 0 of the
user-supplied `range_type` value, extracts the channel index from bits
23 to 16 (only used if the subdevice has per-channel range tables),
extracts the subdevice index from bits 27 to 24, and ignores bits 31 to
28. So for subdevice indices 16 to 255, the `COMEDI_SUBDINFO` or
`COMEDI_CHANINFO` ioctl will report a `range_type` value that doesn't
work with the `COMEDI_RANGEINFO` ioctl. It will either get the range
table for the subdevice index modulo 16, or will fail with `-EINVAL`.
To fix this, always use bits 31 to 24 of the `range_type` value to hold
the subdevice index (assumed to be no more than 255). This affects the
`COMEDI_CHANINFO` and `COMEDI_RANGEINFO` ioctls. There should not be
anything in user-space that depends on the old, broken usage, although
it may now see different values in bits 31 to 28 of the `range_type`
values reported by the `COMEDI_CHANINFO` ioctl for subdevices that have
per-channel subdevices. User-space should not be trying to decode bits
31 to 16 of the `range_type` values anyway.
Fixes: ed9eccbe8970 ("Staging: add comedi core")
Cc: stable@vger.kernel.org #5.17+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20251203162438.176841-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/comedi/comedi_fops.c | 2 +-
drivers/comedi/range.c | 2 +-
include/uapi/linux/comedi.h | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/comedi/comedi_fops.c
+++ b/drivers/comedi/comedi_fops.c
@@ -1095,7 +1095,7 @@ static int do_chaninfo_ioctl(struct come
for (i = 0; i < s->n_chan; i++) {
int x;
- x = (dev->minor << 28) | (it->subdev << 24) | (i << 16) |
+ x = (it->subdev << 24) | (i << 16) |
(s->range_table_list[i]->length);
if (put_user(x, it->rangelist + i))
return -EFAULT;
--- a/drivers/comedi/range.c
+++ b/drivers/comedi/range.c
@@ -52,7 +52,7 @@ int do_rangeinfo_ioctl(struct comedi_dev
const struct comedi_lrange *lr;
struct comedi_subdevice *s;
- subd = (it->range_type >> 24) & 0xf;
+ subd = (it->range_type >> 24) & 0xff;
chan = (it->range_type >> 16) & 0xff;
if (!dev->attached)
--- a/include/uapi/linux/comedi.h
+++ b/include/uapi/linux/comedi.h
@@ -640,7 +640,7 @@ struct comedi_chaninfo {
/**
* struct comedi_rangeinfo - used to retrieve the range table for a channel
- * @range_type: Encodes subdevice index (bits 27:24), channel index
+ * @range_type: Encodes subdevice index (bits 31:24), channel index
* (bits 23:16) and range table length (bits 15:0).
* @range_ptr: Pointer to array of @struct comedi_krange to be filled
* in with the range table for the channel or subdevice.
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 126/280] iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 125/280] comedi: Fix getting range information for subdevices 16 to 255 Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 127/280] iio: adc: ad7280a: handle spi_setup() errors in probe() Greg Kroah-Hartman
` (158 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Lavra, Andy Shevchenko,
Lorenzo Bianconi, Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit c34e2e2d67b3bb8d5a6d09b0d6dac845cdd13fb3 upstream.
The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL
event_spec field, indicating support for IIO events. However, event
detection is not supported for all sensors, and if userspace tries to
configure accelerometer wakeup events on a sensor device that does not
support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL
pointer when trying to write to the wakeup register.
Define an additional struct iio_chan_spec array whose members have a NULL
event_spec field, and use this array instead of st_lsm6dsx_acc_channels for
sensors without event detection capability.
Fixes: b5969abfa8b8 ("iio: imu: st_lsm6dsx: add motion events")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
@@ -76,6 +76,13 @@ static const struct iio_chan_spec st_lsm
IIO_CHAN_SOFT_TIMESTAMP(3),
};
+static const struct iio_chan_spec st_lsm6ds0_acc_channels[] = {
+ ST_LSM6DSX_CHANNEL(IIO_ACCEL, 0x28, IIO_MOD_X, 0),
+ ST_LSM6DSX_CHANNEL(IIO_ACCEL, 0x2a, IIO_MOD_Y, 1),
+ ST_LSM6DSX_CHANNEL(IIO_ACCEL, 0x2c, IIO_MOD_Z, 2),
+ IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
static const struct iio_chan_spec st_lsm6dsx_gyro_channels[] = {
ST_LSM6DSX_CHANNEL(IIO_ANGL_VEL, 0x22, IIO_MOD_X, 0),
ST_LSM6DSX_CHANNEL(IIO_ANGL_VEL, 0x24, IIO_MOD_Y, 1),
@@ -117,8 +124,8 @@ static const struct st_lsm6dsx_settings
},
.channels = {
[ST_LSM6DSX_ID_ACC] = {
- .chan = st_lsm6dsx_acc_channels,
- .len = ARRAY_SIZE(st_lsm6dsx_acc_channels),
+ .chan = st_lsm6ds0_acc_channels,
+ .len = ARRAY_SIZE(st_lsm6ds0_acc_channels),
},
[ST_LSM6DSX_ID_GYRO] = {
.chan = st_lsm6ds0_gyro_channels,
@@ -1009,8 +1016,8 @@ static const struct st_lsm6dsx_settings
},
.channels = {
[ST_LSM6DSX_ID_ACC] = {
- .chan = st_lsm6dsx_acc_channels,
- .len = ARRAY_SIZE(st_lsm6dsx_acc_channels),
+ .chan = st_lsm6ds0_acc_channels,
+ .len = ARRAY_SIZE(st_lsm6ds0_acc_channels),
},
[ST_LSM6DSX_ID_GYRO] = {
.chan = st_lsm6dsx_gyro_channels,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 127/280] iio: adc: ad7280a: handle spi_setup() errors in probe()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 126/280] iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 128/280] spi: sprd-adi: Convert to platform remove callback returning void Greg Kroah-Hartman
` (157 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Zhigulin, Marcelo Schmitt,
Jonathan Cameron, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
[ Upstream commit 6b39824ac4c15783787e6434449772bfb2e31214 ]
The probe() function ignored the return value of spi_setup(), leaving SPI
configuration failures undetected. If spi_setup() fails, the driver should
stop initialization and propagate the error to the caller.
Add proper error handling: check the return value of spi_setup() and return
it on failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 2051f25d2a26 ("iio: adc: New driver for AD7280A Lithium Ion Battery Monitoring System")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Marcelo Schmitt <marcelo.schmitt@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad7280a.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/ad7280a.c b/drivers/iio/adc/ad7280a.c
index 9080c795dcb7e..10cc623bf62a3 100644
--- a/drivers/iio/adc/ad7280a.c
+++ b/drivers/iio/adc/ad7280a.c
@@ -1028,7 +1028,9 @@ static int ad7280_probe(struct spi_device *spi)
st->spi->max_speed_hz = AD7280A_MAX_SPI_CLK_HZ;
st->spi->mode = SPI_MODE_1;
- spi_setup(st->spi);
+ ret = spi_setup(st->spi);
+ if (ret < 0)
+ return ret;
st->ctrl_lb = FIELD_PREP(AD7280A_CTRL_LB_ACQ_TIME_MSK, st->acquisition_time) |
FIELD_PREP(AD7280A_CTRL_LB_THERMISTOR_MSK, st->thermistor_term_en);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 128/280] spi: sprd-adi: Convert to platform remove callback returning void
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 127/280] iio: adc: ad7280a: handle spi_setup() errors in probe() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 129/280] spi: sprd-adi: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
` (156 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit f7f785f125d03360d3766d96d04cf08b8472ce8f ]
The .remove() callback for a platform driver returns an int which makes
many driver authors wrongly assume it's possible to do error handling by
returning an error code. However the value returned is (mostly) ignored
and this typically results in resource leaks. To improve here there is a
quest to make the remove callback return void. In the first step of this
quest all drivers are converted to .remove_new() which already returns
void.
Trivially convert this driver from always returning zero in the remove
callback to the void returning variant.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20230303172041.2103336-71-u.kleine-koenig@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 383d4f5cffcc ("spi: spi-sprd-adi: Fix double free in probe error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sprd-adi.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index 1edbf44c05a72..3b158124d79f7 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -608,13 +608,12 @@ static int sprd_adi_probe(struct platform_device *pdev)
return ret;
}
-static int sprd_adi_remove(struct platform_device *pdev)
+static void sprd_adi_remove(struct platform_device *pdev)
{
struct spi_controller *ctlr = dev_get_drvdata(&pdev->dev);
struct sprd_adi *sadi = spi_controller_get_devdata(ctlr);
unregister_restart_handler(&sadi->restart_handler);
- return 0;
}
static struct sprd_adi_data sc9860_data = {
@@ -660,7 +659,7 @@ static struct platform_driver sprd_adi_driver = {
.of_match_table = sprd_adi_of_match,
},
.probe = sprd_adi_probe,
- .remove = sprd_adi_remove,
+ .remove_new = sprd_adi_remove,
};
module_platform_driver(sprd_adi_driver);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 129/280] spi: sprd-adi: Use devm_platform_get_and_ioremap_resource()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 128/280] spi: sprd-adi: Convert to platform remove callback returning void Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 130/280] spi: sprd: adi: Use devm_register_restart_handler() Greg Kroah-Hartman
` (155 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Li, Baolin Wang, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Li <yang.lee@linux.alibaba.com>
[ Upstream commit 8499d4b5970f5fd135ee8860075768562a5efe70 ]
According to commit 890cc39a8799 ("drivers: provide
devm_platform_get_and_ioremap_resource()"), convert
platform_get_resource(), devm_ioremap_resource() to a single
call to devm_platform_get_and_ioremap_resource(), as this is exactly
what this function does.
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230327060516.93509-1-yang.lee@linux.alibaba.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 383d4f5cffcc ("spi: spi-sprd-adi: Fix double free in probe error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sprd-adi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index 3b158124d79f7..22e39c4c12c4e 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -541,8 +541,7 @@ static int sprd_adi_probe(struct platform_device *pdev)
dev_set_drvdata(&pdev->dev, ctlr);
sadi = spi_controller_get_devdata(ctlr);
- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- sadi->base = devm_ioremap_resource(&pdev->dev, res);
+ sadi->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
if (IS_ERR(sadi->base)) {
ret = PTR_ERR(sadi->base);
goto put_ctlr;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 130/280] spi: sprd: adi: Use devm_register_restart_handler()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 129/280] spi: sprd-adi: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 131/280] spi: sprd-adi: switch to use spi_alloc_host() Greg Kroah-Hartman
` (154 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrew Davis, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <afd@ti.com>
[ Upstream commit 8e6a43961f24cf841d3c0d199521d0b284d948b9 ]
Use device life-cycle managed register function to simplify probe error
path and eliminate need for explicit remove function.
Signed-off-by: Andrew Davis <afd@ti.com>
Link: https://lore.kernel.org/r/20231117161006.87734-5-afd@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 383d4f5cffcc ("spi: spi-sprd-adi: Fix double free in probe error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sprd-adi.c | 30 ++++++++----------------------
1 file changed, 8 insertions(+), 22 deletions(-)
diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index 22e39c4c12c4e..24f1358e7e8ba 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -139,8 +139,7 @@ struct sprd_adi_data {
u32 slave_offset;
u32 slave_addr_size;
int (*read_check)(u32 val, u32 reg);
- int (*restart)(struct notifier_block *this,
- unsigned long mode, void *cmd);
+ int (*restart)(struct sys_off_data *data);
void (*wdg_rst)(void *p);
};
@@ -151,7 +150,6 @@ struct sprd_adi {
struct hwspinlock *hwlock;
unsigned long slave_vbase;
unsigned long slave_pbase;
- struct notifier_block restart_handler;
const struct sprd_adi_data *data;
};
@@ -371,11 +369,9 @@ static void sprd_adi_set_wdt_rst_mode(void *p)
#endif
}
-static int sprd_adi_restart(struct notifier_block *this, unsigned long mode,
- void *cmd, struct sprd_adi_wdg *wdg)
+static int sprd_adi_restart(struct sprd_adi *sadi, unsigned long mode,
+ const char *cmd, struct sprd_adi_wdg *wdg)
{
- struct sprd_adi *sadi = container_of(this, struct sprd_adi,
- restart_handler);
u32 val, reboot_mode = 0;
if (!cmd)
@@ -449,8 +445,7 @@ static int sprd_adi_restart(struct notifier_block *this, unsigned long mode,
return NOTIFY_DONE;
}
-static int sprd_adi_restart_sc9860(struct notifier_block *this,
- unsigned long mode, void *cmd)
+static int sprd_adi_restart_sc9860(struct sys_off_data *data)
{
struct sprd_adi_wdg wdg = {
.base = PMIC_WDG_BASE,
@@ -459,7 +454,7 @@ static int sprd_adi_restart_sc9860(struct notifier_block *this,
.wdg_clk = PMIC_CLK_EN,
};
- return sprd_adi_restart(this, mode, cmd, &wdg);
+ return sprd_adi_restart(data->cb_data, data->mode, data->cmd, &wdg);
}
static void sprd_adi_hw_init(struct sprd_adi *sadi)
@@ -591,9 +586,9 @@ static int sprd_adi_probe(struct platform_device *pdev)
}
if (sadi->data->restart) {
- sadi->restart_handler.notifier_call = sadi->data->restart;
- sadi->restart_handler.priority = 128;
- ret = register_restart_handler(&sadi->restart_handler);
+ ret = devm_register_restart_handler(&pdev->dev,
+ sadi->data->restart,
+ sadi);
if (ret) {
dev_err(&pdev->dev, "can not register restart handler\n");
goto put_ctlr;
@@ -607,14 +602,6 @@ static int sprd_adi_probe(struct platform_device *pdev)
return ret;
}
-static void sprd_adi_remove(struct platform_device *pdev)
-{
- struct spi_controller *ctlr = dev_get_drvdata(&pdev->dev);
- struct sprd_adi *sadi = spi_controller_get_devdata(ctlr);
-
- unregister_restart_handler(&sadi->restart_handler);
-}
-
static struct sprd_adi_data sc9860_data = {
.slave_offset = ADI_10BIT_SLAVE_OFFSET,
.slave_addr_size = ADI_10BIT_SLAVE_ADDR_SIZE,
@@ -658,7 +645,6 @@ static struct platform_driver sprd_adi_driver = {
.of_match_table = sprd_adi_of_match,
},
.probe = sprd_adi_probe,
- .remove_new = sprd_adi_remove,
};
module_platform_driver(sprd_adi_driver);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 131/280] spi: sprd-adi: switch to use spi_alloc_host()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 130/280] spi: sprd: adi: Use devm_register_restart_handler() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 132/280] spi: spi-sprd-adi: Fix double free in probe error path Greg Kroah-Hartman
` (153 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 0a3d087d09a8f52c02d0014bad63be99c53c4812 ]
Switch to use modern name function spi_alloc_host().
No functional changed.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://msgid.link/r/20231128093031.3707034-2-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 383d4f5cffcc ("spi: spi-sprd-adi: Fix double free in probe error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sprd-adi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index 24f1358e7e8ba..441cde971f7b8 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -529,7 +529,7 @@ static int sprd_adi_probe(struct platform_device *pdev)
pdev->id = of_alias_get_id(np, "spi");
num_chipselect = of_get_child_count(np);
- ctlr = spi_alloc_master(&pdev->dev, sizeof(struct sprd_adi));
+ ctlr = spi_alloc_host(&pdev->dev, sizeof(struct sprd_adi));
if (!ctlr)
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 132/280] spi: spi-sprd-adi: Fix double free in probe error path
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 131/280] spi: sprd-adi: switch to use spi_alloc_host() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 133/280] regmap: Fix race condition in hwspinlock irqsave routine Greg Kroah-Hartman
` (152 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Baolin Wang, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <gu_0233@qq.com>
[ Upstream commit 383d4f5cffcc8df930d95b06518a9d25a6d74aac ]
The driver currently uses spi_alloc_host() to allocate the controller
but registers it using devm_spi_register_controller().
If devm_register_restart_handler() fails, the code jumps to the
put_ctlr label and calls spi_controller_put(). However, since the
controller was registered via a devm function, the device core will
automatically call spi_controller_put() again when the probe fails.
This results in a double-free of the spi_controller structure.
Fix this by switching to devm_spi_alloc_host() and removing the
manual spi_controller_put() call.
Fixes: ac17750 ("spi: sprd: Add the support of restarting the system")
Signed-off-by: Felix Gu <gu_0233@qq.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://patch.msgid.link/tencent_AC7D389CE7E24318445E226F7CDCCC2F0D07@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sprd-adi.c | 33 ++++++++++-----------------------
1 file changed, 10 insertions(+), 23 deletions(-)
diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index 441cde971f7b8..3e546cd87157b 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -529,7 +529,7 @@ static int sprd_adi_probe(struct platform_device *pdev)
pdev->id = of_alias_get_id(np, "spi");
num_chipselect = of_get_child_count(np);
- ctlr = spi_alloc_host(&pdev->dev, sizeof(struct sprd_adi));
+ ctlr = devm_spi_alloc_host(&pdev->dev, sizeof(struct sprd_adi));
if (!ctlr)
return -ENOMEM;
@@ -537,10 +537,8 @@ static int sprd_adi_probe(struct platform_device *pdev)
sadi = spi_controller_get_devdata(ctlr);
sadi->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
- if (IS_ERR(sadi->base)) {
- ret = PTR_ERR(sadi->base);
- goto put_ctlr;
- }
+ if (IS_ERR(sadi->base))
+ return PTR_ERR(sadi->base);
sadi->slave_vbase = (unsigned long)sadi->base +
data->slave_offset;
@@ -552,18 +550,15 @@ static int sprd_adi_probe(struct platform_device *pdev)
if (ret > 0 || (IS_ENABLED(CONFIG_HWSPINLOCK) && ret == 0)) {
sadi->hwlock =
devm_hwspin_lock_request_specific(&pdev->dev, ret);
- if (!sadi->hwlock) {
- ret = -ENXIO;
- goto put_ctlr;
- }
+ if (!sadi->hwlock)
+ return -ENXIO;
} else {
switch (ret) {
case -ENOENT:
dev_info(&pdev->dev, "no hardware spinlock supplied\n");
break;
default:
- dev_err_probe(&pdev->dev, ret, "failed to find hwlock id\n");
- goto put_ctlr;
+ return dev_err_probe(&pdev->dev, ret, "failed to find hwlock id\n");
}
}
@@ -580,26 +575,18 @@ static int sprd_adi_probe(struct platform_device *pdev)
ctlr->transfer_one = sprd_adi_transfer_one;
ret = devm_spi_register_controller(&pdev->dev, ctlr);
- if (ret) {
- dev_err(&pdev->dev, "failed to register SPI controller\n");
- goto put_ctlr;
- }
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret, "failed to register SPI controller\n");
if (sadi->data->restart) {
ret = devm_register_restart_handler(&pdev->dev,
sadi->data->restart,
sadi);
- if (ret) {
- dev_err(&pdev->dev, "can not register restart handler\n");
- goto put_ctlr;
- }
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret, "can not register restart handler\n");
}
return 0;
-
-put_ctlr:
- spi_controller_put(ctlr);
- return ret;
}
static struct sprd_adi_data sc9860_data = {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 133/280] regmap: Fix race condition in hwspinlock irqsave routine
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 132/280] spi: spi-sprd-adi: Fix double free in probe error path Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 134/280] kconfig: refactor Makefile to reduce process forks Greg Kroah-Hartman
` (151 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cheng-Yu Lee, Yu-Chun Lin,
Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheng-Yu Lee <cylee12@realtek.com>
[ Upstream commit 4b58aac989c1e3fafb1c68a733811859df388250 ]
Previously, the address of the shared member '&map->spinlock_flags' was
passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race
condition where multiple contexts contending for the lock could overwrite
the shared flags variable, potentially corrupting the state for the
current lock owner.
Fix this by using a local stack variable 'flags' to store the IRQ state
temporarily.
Fixes: 8698b9364710 ("regmap: Add hardware spinlock support")
Signed-off-by: Cheng-Yu Lee <cylee12@realtek.com>
Co-developed-by: Yu-Chun Lin <eleanor.lin@realtek.com>
Signed-off-by: Yu-Chun Lin <eleanor.lin@realtek.com>
Link: https://patch.msgid.link/20260109032633.8732-1-eleanor.lin@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/regmap/regmap.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index bdbde64e4b21d..bc89790ff0ded 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -462,9 +462,11 @@ static void regmap_lock_hwlock_irq(void *__map)
static void regmap_lock_hwlock_irqsave(void *__map)
{
struct regmap *map = __map;
+ unsigned long flags = 0;
hwspin_lock_timeout_irqsave(map->hwlock, UINT_MAX,
- &map->spinlock_flags);
+ &flags);
+ map->spinlock_flags = flags;
}
static void regmap_unlock_hwlock(void *__map)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 134/280] kconfig: refactor Makefile to reduce process forks
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 133/280] regmap: Fix race condition in hwspinlock irqsave routine Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 135/280] kconfig: fix static linking of nconf Greg Kroah-Hartman
` (150 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Nicolas Schier,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit 3122c84409d578a5df8bcb1953547e0b871ac4c2 ]
Refactor Makefile and use read-file macro. For Make >= 4.2, it can read
out a file by using the built-in function.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
Stable-dep-of: baaecfcac559 ("kconfig: fix static linking of nconf")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/.gitignore | 4 +++-
scripts/kconfig/Makefile | 45 +++++++++++++++++++-----------------
scripts/kconfig/gconf-cfg.sh | 7 ++++--
scripts/kconfig/mconf-cfg.sh | 25 +++++++++++---------
scripts/kconfig/nconf-cfg.sh | 23 ++++++++++--------
scripts/kconfig/qconf-cfg.sh | 10 +++++---
scripts/remove-stale-files | 2 ++
7 files changed, 68 insertions(+), 48 deletions(-)
diff --git a/scripts/kconfig/.gitignore b/scripts/kconfig/.gitignore
index 500e7424b3ef9..c8a3f9cd52f02 100644
--- a/scripts/kconfig/.gitignore
+++ b/scripts/kconfig/.gitignore
@@ -1,5 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
/conf
/[gmnq]conf
-/[gmnq]conf-cfg
+/[gmnq]conf-cflags
+/[gmnq]conf-libs
+/qconf-bin
/qconf-moc.cc
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index b8ef0fb4bbef7..0b1d15efaeb0c 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -159,11 +159,12 @@ conf-objs := conf.o $(common-objs)
hostprogs += nconf
nconf-objs := nconf.o nconf.gui.o $(common-objs)
-HOSTLDLIBS_nconf = $(shell . $(obj)/nconf-cfg && echo $$libs)
-HOSTCFLAGS_nconf.o = $(shell . $(obj)/nconf-cfg && echo $$cflags)
-HOSTCFLAGS_nconf.gui.o = $(shell . $(obj)/nconf-cfg && echo $$cflags)
+HOSTLDLIBS_nconf = $(call read-file, $(obj)/nconf-libs)
+HOSTCFLAGS_nconf.o = $(call read-file, $(obj)/nconf-cflags)
+HOSTCFLAGS_nconf.gui.o = $(call read-file, $(obj)/nconf-cflags)
-$(obj)/nconf.o $(obj)/nconf.gui.o: $(obj)/nconf-cfg
+$(obj)/nconf: | $(obj)/nconf-libs
+$(obj)/nconf.o $(obj)/nconf.gui.o: | $(obj)/nconf-cflags
# mconf: Used for the menuconfig target based on lxdialog
hostprogs += mconf
@@ -171,27 +172,28 @@ lxdialog := $(addprefix lxdialog/, \
checklist.o inputbox.o menubox.o textbox.o util.o yesno.o)
mconf-objs := mconf.o $(lxdialog) $(common-objs)
-HOSTLDLIBS_mconf = $(shell . $(obj)/mconf-cfg && echo $$libs)
+HOSTLDLIBS_mconf = $(call read-file, $(obj)/mconf-libs)
$(foreach f, mconf.o $(lxdialog), \
- $(eval HOSTCFLAGS_$f = $$(shell . $(obj)/mconf-cfg && echo $$$$cflags)))
+ $(eval HOSTCFLAGS_$f = $$(call read-file, $(obj)/mconf-cflags)))
-$(addprefix $(obj)/, mconf.o $(lxdialog)): $(obj)/mconf-cfg
+$(obj)/mconf: | $(obj)/mconf-libs
+$(addprefix $(obj)/, mconf.o $(lxdialog)): | $(obj)/mconf-cflags
# qconf: Used for the xconfig target based on Qt
hostprogs += qconf
qconf-cxxobjs := qconf.o qconf-moc.o
qconf-objs := images.o $(common-objs)
-HOSTLDLIBS_qconf = $(shell . $(obj)/qconf-cfg && echo $$libs)
-HOSTCXXFLAGS_qconf.o = $(shell . $(obj)/qconf-cfg && echo $$cflags)
-HOSTCXXFLAGS_qconf-moc.o = $(shell . $(obj)/qconf-cfg && echo $$cflags)
-
-$(obj)/qconf.o: $(obj)/qconf-cfg
+HOSTLDLIBS_qconf = $(call read-file, $(obj)/qconf-libs)
+HOSTCXXFLAGS_qconf.o = -std=c++11 -fPIC $(call read-file, $(obj)/qconf-cflags)
+HOSTCXXFLAGS_qconf-moc.o = -std=c++11 -fPIC $(call read-file, $(obj)/qconf-cflags)
+$(obj)/qconf: | $(obj)/qconf-libs
+$(obj)/qconf.o $(obj)/qconf-moc.o: | $(obj)/qconf-cflags
quiet_cmd_moc = MOC $@
- cmd_moc = $(shell . $(obj)/qconf-cfg && echo $$moc) $< -o $@
+ cmd_moc = $(call read-file, $(obj)/qconf-bin)/moc $< -o $@
-$(obj)/qconf-moc.cc: $(src)/qconf.h $(obj)/qconf-cfg FORCE
+$(obj)/qconf-moc.cc: $(src)/qconf.h FORCE | $(obj)/qconf-bin
$(call if_changed,moc)
targets += qconf-moc.cc
@@ -200,15 +202,16 @@ targets += qconf-moc.cc
hostprogs += gconf
gconf-objs := gconf.o images.o $(common-objs)
-HOSTLDLIBS_gconf = $(shell . $(obj)/gconf-cfg && echo $$libs)
-HOSTCFLAGS_gconf.o = $(shell . $(obj)/gconf-cfg && echo $$cflags)
+HOSTLDLIBS_gconf = $(call read-file, $(obj)/gconf-libs)
+HOSTCFLAGS_gconf.o = $(call read-file, $(obj)/gconf-cflags)
-$(obj)/gconf.o: $(obj)/gconf-cfg
+$(obj)/gconf: | $(obj)/gconf-libs
+$(obj)/gconf.o: | $(obj)/gconf-cflags
# check if necessary packages are available, and configure build flags
-filechk_conf_cfg = $(CONFIG_SHELL) $<
+cmd_conf_cfg = $< $(addprefix $(obj)/$*conf-, cflags libs bin)
-$(obj)/%conf-cfg: $(src)/%conf-cfg.sh FORCE
- $(call filechk,conf_cfg)
+$(obj)/%conf-cflags $(obj)/%conf-libs $(obj)/%conf-bin: $(src)/%conf-cfg.sh
+ $(call cmd,conf_cfg)
-clean-files += *conf-cfg
+clean-files += *conf-cflags *conf-libs *conf-bin
diff --git a/scripts/kconfig/gconf-cfg.sh b/scripts/kconfig/gconf-cfg.sh
index cbd90c28c05f2..040d8f3388202 100755
--- a/scripts/kconfig/gconf-cfg.sh
+++ b/scripts/kconfig/gconf-cfg.sh
@@ -1,6 +1,9 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
+cflags=$1
+libs=$2
+
PKG="gtk+-2.0 gmodule-2.0 libglade-2.0"
if [ -z "$(command -v ${HOSTPKG_CONFIG})" ]; then
@@ -26,5 +29,5 @@ if ! ${HOSTPKG_CONFIG} --atleast-version=2.0.0 gtk+-2.0; then
exit 1
fi
-echo cflags=\"$(${HOSTPKG_CONFIG} --cflags $PKG)\"
-echo libs=\"$(${HOSTPKG_CONFIG} --libs $PKG)\"
+${HOSTPKG_CONFIG} --cflags ${PKG} > ${cflags}
+${HOSTPKG_CONFIG} --libs ${PKG} > ${libs}
diff --git a/scripts/kconfig/mconf-cfg.sh b/scripts/kconfig/mconf-cfg.sh
index 025b565e0b7cd..1e61f50a59050 100755
--- a/scripts/kconfig/mconf-cfg.sh
+++ b/scripts/kconfig/mconf-cfg.sh
@@ -1,19 +1,22 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
+cflags=$1
+libs=$2
+
PKG="ncursesw"
PKG2="ncurses"
if [ -n "$(command -v ${HOSTPKG_CONFIG})" ]; then
if ${HOSTPKG_CONFIG} --exists $PKG; then
- echo cflags=\"$(${HOSTPKG_CONFIG} --cflags $PKG)\"
- echo libs=\"$(${HOSTPKG_CONFIG} --libs $PKG)\"
+ ${HOSTPKG_CONFIG} --cflags ${PKG} > ${cflags}
+ ${HOSTPKG_CONFIG} --libs ${PKG} > ${libs}
exit 0
fi
- if ${HOSTPKG_CONFIG} --exists $PKG2; then
- echo cflags=\"$(${HOSTPKG_CONFIG} --cflags $PKG2)\"
- echo libs=\"$(${HOSTPKG_CONFIG} --libs $PKG2)\"
+ if ${HOSTPKG_CONFIG} --exists ${PKG2}; then
+ ${HOSTPKG_CONFIG} --cflags ${PKG2} > ${cflags}
+ ${HOSTPKG_CONFIG} --libs ${PKG2} > ${libs}
exit 0
fi
fi
@@ -22,22 +25,22 @@ fi
# (Even if it is installed, some distributions such as openSUSE cannot
# find ncurses by pkg-config.)
if [ -f /usr/include/ncursesw/ncurses.h ]; then
- echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncursesw\"
- echo libs=\"-lncursesw\"
+ echo -D_GNU_SOURCE -I/usr/include/ncursesw > ${cflags}
+ echo -lncursesw > ${libs}
exit 0
fi
if [ -f /usr/include/ncurses/ncurses.h ]; then
- echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncurses\"
- echo libs=\"-lncurses\"
+ echo -D_GNU_SOURCE -I/usr/include/ncurses > ${cflags}
+ echo -lncurses > ${libs}
exit 0
fi
# As a final fallback before giving up, check if $HOSTCC knows of a default
# ncurses installation (e.g. from a vendor-specific sysroot).
if echo '#include <ncurses.h>' | ${HOSTCC} -E - >/dev/null 2>&1; then
- echo cflags=\"-D_GNU_SOURCE\"
- echo libs=\"-lncurses\"
+ echo -D_GNU_SOURCE > ${cflags}
+ echo -lncurses > ${libs}
exit 0
fi
diff --git a/scripts/kconfig/nconf-cfg.sh b/scripts/kconfig/nconf-cfg.sh
index 3a10bac2adb3a..f871a2160e363 100755
--- a/scripts/kconfig/nconf-cfg.sh
+++ b/scripts/kconfig/nconf-cfg.sh
@@ -1,19 +1,22 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
+cflags=$1
+libs=$2
+
PKG="ncursesw menuw panelw"
PKG2="ncurses menu panel"
if [ -n "$(command -v ${HOSTPKG_CONFIG})" ]; then
if ${HOSTPKG_CONFIG} --exists $PKG; then
- echo cflags=\"$(${HOSTPKG_CONFIG} --cflags $PKG)\"
- echo libs=\"$(${HOSTPKG_CONFIG} --libs $PKG)\"
+ ${HOSTPKG_CONFIG} --cflags ${PKG} > ${cflags}
+ ${HOSTPKG_CONFIG} --libs ${PKG} > ${libs}
exit 0
fi
if ${HOSTPKG_CONFIG} --exists $PKG2; then
- echo cflags=\"$(${HOSTPKG_CONFIG} --cflags $PKG2)\"
- echo libs=\"$(${HOSTPKG_CONFIG} --libs $PKG2)\"
+ ${HOSTPKG_CONFIG} --cflags ${PKG2} > ${cflags}
+ ${HOSTPKG_CONFIG} --libs ${PKG2} > ${libs}
exit 0
fi
fi
@@ -22,20 +25,20 @@ fi
# (Even if it is installed, some distributions such as openSUSE cannot
# find ncurses by pkg-config.)
if [ -f /usr/include/ncursesw/ncurses.h ]; then
- echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncursesw\"
- echo libs=\"-lncursesw -lmenuw -lpanelw\"
+ echo -D_GNU_SOURCE -I/usr/include/ncursesw > ${cflags}
+ echo -lncursesw -lmenuw -lpanelw > ${libs}
exit 0
fi
if [ -f /usr/include/ncurses/ncurses.h ]; then
- echo cflags=\"-D_GNU_SOURCE -I/usr/include/ncurses\"
- echo libs=\"-lncurses -lmenu -lpanel\"
+ echo -D_GNU_SOURCE -I/usr/include/ncurses > ${cflags}
+ echo -lncurses -lmenu -lpanel > ${libs}
exit 0
fi
if [ -f /usr/include/ncurses.h ]; then
- echo cflags=\"-D_GNU_SOURCE\"
- echo libs=\"-lncurses -lmenu -lpanel\"
+ echo -D_GNU_SOURCE > ${cflags}
+ echo -lncurses -lmenu -lpanel > ${libs}
exit 0
fi
diff --git a/scripts/kconfig/qconf-cfg.sh b/scripts/kconfig/qconf-cfg.sh
index ad652cb539474..117f36e568fc5 100755
--- a/scripts/kconfig/qconf-cfg.sh
+++ b/scripts/kconfig/qconf-cfg.sh
@@ -1,6 +1,10 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
+cflags=$1
+libs=$2
+bin=$3
+
PKG="Qt5Core Qt5Gui Qt5Widgets"
if [ -z "$(command -v ${HOSTPKG_CONFIG})" ]; then
@@ -11,9 +15,9 @@ if [ -z "$(command -v ${HOSTPKG_CONFIG})" ]; then
fi
if ${HOSTPKG_CONFIG} --exists $PKG; then
- echo cflags=\"-std=c++11 -fPIC $(${HOSTPKG_CONFIG} --cflags $PKG)\"
- echo libs=\"$(${HOSTPKG_CONFIG} --libs $PKG)\"
- echo moc=\"$(${HOSTPKG_CONFIG} --variable=host_bins Qt5Core)/moc\"
+ ${HOSTPKG_CONFIG} --cflags ${PKG} > ${cflags}
+ ${HOSTPKG_CONFIG} --libs ${PKG} > ${libs}
+ ${HOSTPKG_CONFIG} --variable=host_bins Qt5Core > ${bin}
exit 0
fi
diff --git a/scripts/remove-stale-files b/scripts/remove-stale-files
index ccadfa3afb2b8..64b14aa5aebf4 100755
--- a/scripts/remove-stale-files
+++ b/scripts/remove-stale-files
@@ -47,3 +47,5 @@ rm -f arch/riscv/purgatory/kexec-purgatory.c
rm -f scripts/extract-cert
rm -f arch/x86/purgatory/kexec-purgatory.c
+
+rm -f scripts/kconfig/[gmnq]conf-cfg
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 135/280] kconfig: fix static linking of nconf
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 134/280] kconfig: refactor Makefile to reduce process forks Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 136/280] riscv: clocksource: Fix stimecmp update hazard on RV32 Greg Kroah-Hartman
` (149 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arusekk, Nicolas Schier, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Kozdra <floss@arusekk.pl>
[ Upstream commit baaecfcac559bcac73206df447eb5c385fa22f2a ]
When running make nconfig with a static linking host toolchain,
the libraries are linked in an incorrect order,
resulting in errors similar to the following:
$ MAKEFLAGS='HOSTCC=cc\ -static' make nconfig
/usr/bin/ld: /usr/lib64/gcc/x86_64-unknown-linux-gnu/14.2.1/../../../../lib64/libpanel.a(p_new.o): in function `new_panel':
(.text+0x13): undefined reference to `_nc_panelhook_sp'
/usr/bin/ld: (.text+0x6c): undefined reference to `_nc_panelhook_sp'
Fixes: 1c5af5cf9308 ("kconfig: refactor ncurses package checks for building mconf and nconf")
Signed-off-by: Arusekk <floss@arusekk.pl>
Link: https://patch.msgid.link/20260110114808.22595-1-floss@arusekk.pl
[nsc: Added comment about library order]
Signed-off-by: Nicolas Schier <nsc@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/nconf-cfg.sh | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/scripts/kconfig/nconf-cfg.sh b/scripts/kconfig/nconf-cfg.sh
index f871a2160e363..59814eb3616c6 100755
--- a/scripts/kconfig/nconf-cfg.sh
+++ b/scripts/kconfig/nconf-cfg.sh
@@ -4,8 +4,9 @@
cflags=$1
libs=$2
-PKG="ncursesw menuw panelw"
-PKG2="ncurses menu panel"
+# Keep library order for static linking (HOSTCC='cc -static')
+PKG="menuw panelw ncursesw"
+PKG2="menu panel ncurses"
if [ -n "$(command -v ${HOSTPKG_CONFIG})" ]; then
if ${HOSTPKG_CONFIG} --exists $PKG; then
@@ -26,19 +27,19 @@ fi
# find ncurses by pkg-config.)
if [ -f /usr/include/ncursesw/ncurses.h ]; then
echo -D_GNU_SOURCE -I/usr/include/ncursesw > ${cflags}
- echo -lncursesw -lmenuw -lpanelw > ${libs}
+ echo -lmenuw -lpanelw -lncursesw > ${libs}
exit 0
fi
if [ -f /usr/include/ncurses/ncurses.h ]; then
echo -D_GNU_SOURCE -I/usr/include/ncurses > ${cflags}
- echo -lncurses -lmenu -lpanel > ${libs}
+ echo -lmenu -lpanel -lncurses > ${libs}
exit 0
fi
if [ -f /usr/include/ncurses.h ]; then
echo -D_GNU_SOURCE > ${cflags}
- echo -lncurses -lmenu -lpanel > ${libs}
+ echo -lmenu -lpanel -lncurses > ${libs}
exit 0
fi
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 136/280] riscv: clocksource: Fix stimecmp update hazard on RV32
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 135/280] kconfig: fix static linking of nconf Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 137/280] scsi: core: Wake up the error handler when final completions race against each other Greg Kroah-Hartman
` (148 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Naohiko Shimizu, Anup Patel,
Paul Walmsley, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naohiko Shimizu <naohiko.shimizu@gmail.com>
[ Upstream commit eaa9bb1d39d59e7c17b06cec12622b7c586ab629 ]
On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
separate 32-bit writes. A race condition exists if the timer triggers
during these two writes.
The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
recommends a specific 3-step sequence to avoid spurious interrupts
when updating 64-bit comparison registers on 32-bit systems:
1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
2. Set the high-order bits (stimecmph) to the desired value.
3. Set the low-order bits (stimecmp) to the desired value.
Current implementation writes the LSB first without ensuring a future
value, which may lead to a transient state where the 64-bit comparison
is incorrectly evaluated as "expired" by the hardware. This results in
spurious timer interrupts.
This patch adopts the spec-recommended 3-step sequence to ensure the
intermediate 64-bit state is never smaller than the current time.
Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available")
Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://patch.msgid.link/20260104135938.524-2-naohiko.shimizu@gmail.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-riscv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c
index a01c2bd241349..e36cecede518a 100644
--- a/drivers/clocksource/timer-riscv.c
+++ b/drivers/clocksource/timer-riscv.c
@@ -37,8 +37,9 @@ static int riscv_clock_next_event(unsigned long delta,
csr_set(CSR_IE, IE_TIE);
if (static_branch_likely(&riscv_sstc_available)) {
#if defined(CONFIG_32BIT)
- csr_write(CSR_STIMECMP, next_tval & 0xFFFFFFFF);
+ csr_write(CSR_STIMECMP, ULONG_MAX);
csr_write(CSR_STIMECMPH, next_tval >> 32);
+ csr_write(CSR_STIMECMP, next_tval & 0xFFFFFFFF);
#else
csr_write(CSR_STIMECMP, next_tval);
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 137/280] scsi: core: Wake up the error handler when final completions race against each other
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 136/280] riscv: clocksource: Fix stimecmp update hazard on RV32 Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 138/280] ALSA: usb: Increase volume range that triggers a warning Greg Kroah-Hartman
` (147 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Jeffery, Bart Van Assche,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Jeffery <djeffery@redhat.com>
[ Upstream commit fe2f8ad6f0999db3b318359a01ee0108c703a8c3 ]
The fragile ordering between marking commands completed or failed so
that the error handler only wakes when the last running command
completes or times out has race conditions. These race conditions can
cause the SCSI layer to fail to wake the error handler, leaving I/O
through the SCSI host stuck as the error state cannot advance.
First, there is an memory ordering issue within scsi_dec_host_busy().
The write which clears SCMD_STATE_INFLIGHT may be reordered with reads
counting in scsi_host_busy(). While the local CPU will see its own
write, reordering can allow other CPUs in scsi_dec_host_busy() or
scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to
see a host busy equal to the host_failed count.
This race condition can be prevented with a memory barrier on the error
path to force the write to be visible before counting host busy
commands.
Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By
counting busy commands before incrementing host_failed, it can race with a
final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does
not see host_failed incremented but scsi_eh_inc_host_failed() counts busy
commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(),
resulting in neither waking the error handler task.
This needs the call to scsi_host_busy() to be moved after host_failed is
incremented to close the race condition.
Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq")
Signed-off-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260113161036.6730-1-djeffery@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_error.c | 11 ++++++++++-
drivers/scsi/scsi_lib.c | 8 ++++++++
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index c1a454b3bbbf1..79dc157661ce9 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -277,11 +277,20 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
{
struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
struct Scsi_Host *shost = scmd->device->host;
- unsigned int busy = scsi_host_busy(shost);
+ unsigned int busy;
unsigned long flags;
spin_lock_irqsave(shost->host_lock, flags);
shost->host_failed++;
+ spin_unlock_irqrestore(shost->host_lock, flags);
+ /*
+ * The counting of busy requests needs to occur after adding to
+ * host_failed or after the lock acquire for adding to host_failed
+ * to prevent a race with host unbusy and missing an eh wakeup.
+ */
+ busy = scsi_host_busy(shost);
+
+ spin_lock_irqsave(shost->host_lock, flags);
scsi_eh_wakeup(shost, busy);
spin_unlock_irqrestore(shost->host_lock, flags);
}
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index df61d7b906653..ddc986ff51615 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -280,6 +280,14 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
rcu_read_lock();
__clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
if (unlikely(scsi_host_in_recovery(shost))) {
+ /*
+ * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
+ * other CPUs before counting busy requests. Otherwise,
+ * reordering can cause CPUs to race and miss an eh wakeup
+ * when no CPU sees all busy requests as done or timed out.
+ */
+ smp_mb();
+
unsigned int busy = scsi_host_busy(shost);
spin_lock_irqsave(shost->host_lock, flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 138/280] ALSA: usb: Increase volume range that triggers a warning
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 137/280] scsi: core: Wake up the error handler when final completions race against each other Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 139/280] netdevsim: fix a race issue related to the operation on bpf_bound_progs list Greg Kroah-Hartman
` (146 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jaroslav Kysela, Takashi Iwai,
linux-sound, Arun Raghavan, Takashi Iwai, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Raghavan <arunr@valvesoftware.com>
[ Upstream commit 6b971191fcfc9e3c2c0143eea22534f1f48dbb62 ]
On at least the HyperX Cloud III, the range is 18944 (-18944 -> 0 in
steps of 1), so the original check for 255 steps is definitely obsolete.
Let's give ourselves a little more headroom before we emit a warning.
Fixes: 80acefff3bc7 ("ALSA: usb-audio - Add volume range check and warn if it too big")
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: linux-sound@vger.kernel.org
Signed-off-by: Arun Raghavan <arunr@valvesoftware.com>
Link: https://patch.msgid.link/20260116225804.3845935-1-arunr@valvesoftware.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 1540e9f1c2e3f..ec6aad748cd4b 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1807,11 +1807,10 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer,
range = (cval->max - cval->min) / cval->res;
/*
- * Are there devices with volume range more than 255? I use a bit more
- * to be sure. 384 is a resolution magic number found on Logitech
- * devices. It will definitively catch all buggy Logitech devices.
+ * There are definitely devices with a range of ~20,000, so let's be
+ * conservative and allow for a bit more.
*/
- if (range > 384) {
+ if (range > 65535) {
usb_audio_warn(mixer->chip,
"Warning! Unlikely big volume range (=%u), cval->res is probably wrong.",
range);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 139/280] netdevsim: fix a race issue related to the operation on bpf_bound_progs list
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 138/280] ALSA: usb: Increase volume range that triggers a warning Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 140/280] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M Greg Kroah-Hartman
` (145 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yinhao Hu, Kaiyan Mei, Yun Lu,
Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <luyun@kylinos.cn>
[ Upstream commit b97d5eedf4976cc94321243be83b39efe81a0e15 ]
The netdevsim driver lacks a protection mechanism for operations on the
bpf_bound_progs list. When the nsim_bpf_create_prog() performs
list_add_tail, it is possible that nsim_bpf_destroy_prog() is
simultaneously performs list_del. Concurrent operations on the list may
lead to list corruption and trigger a kernel crash as follows:
[ 417.290971] kernel BUG at lib/list_debug.c:62!
[ 417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[ 417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1
[ 417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 417.291007] Workqueue: events bpf_prog_free_deferred
[ 417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0
[ 417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff <0f> 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8
[ 417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246
[ 417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000
[ 417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180
[ 417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003
[ 417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20
[ 417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000
[ 417.291074] FS: 0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000
[ 417.291079] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0
[ 417.291088] PKRU: 55555554
[ 417.291091] Call Trace:
[ 417.291096] <TASK>
[ 417.291103] nsim_bpf_destroy_prog+0x31/0x80 [netdevsim]
[ 417.291154] __bpf_prog_offload_destroy+0x2a/0x80
[ 417.291163] bpf_prog_dev_bound_destroy+0x6f/0xb0
[ 417.291171] bpf_prog_free_deferred+0x18e/0x1a0
[ 417.291178] process_one_work+0x18a/0x3a0
[ 417.291188] worker_thread+0x27b/0x3a0
[ 417.291197] ? __pfx_worker_thread+0x10/0x10
[ 417.291207] kthread+0xe5/0x120
[ 417.291214] ? __pfx_kthread+0x10/0x10
[ 417.291221] ret_from_fork+0x31/0x50
[ 417.291230] ? __pfx_kthread+0x10/0x10
[ 417.291236] ret_from_fork_asm+0x1a/0x30
[ 417.291246] </TASK>
Add a mutex lock, to prevent simultaneous addition and deletion operations
on the list.
Fixes: 31d3ad832948 ("netdevsim: add bpf offload support")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Signed-off-by: Yun Lu <luyun@kylinos.cn>
Link: https://patch.msgid.link/20260116095308.11441-1-luyun_611@163.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/netdevsim/bpf.c | 6 ++++++
drivers/net/netdevsim/dev.c | 2 ++
drivers/net/netdevsim/netdevsim.h | 1 +
3 files changed, 9 insertions(+)
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 50854265864d1..7064a3397be23 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -244,7 +244,9 @@ static int nsim_bpf_create_prog(struct nsim_dev *nsim_dev,
&state->state, &nsim_bpf_string_fops);
debugfs_create_bool("loaded", 0400, state->ddir, &state->is_loaded);
+ mutex_lock(&nsim_dev->progs_list_lock);
list_add_tail(&state->l, &nsim_dev->bpf_bound_progs);
+ mutex_unlock(&nsim_dev->progs_list_lock);
prog->aux->offload->dev_priv = state;
@@ -273,12 +275,16 @@ static int nsim_bpf_translate(struct bpf_prog *prog)
static void nsim_bpf_destroy_prog(struct bpf_prog *prog)
{
struct nsim_bpf_bound_prog *state;
+ struct nsim_dev *nsim_dev;
state = prog->aux->offload->dev_priv;
+ nsim_dev = state->nsim_dev;
WARN(state->is_loaded,
"offload state destroyed while program still bound");
debugfs_remove_recursive(state->ddir);
+ mutex_lock(&nsim_dev->progs_list_lock);
list_del(&state->l);
+ mutex_unlock(&nsim_dev->progs_list_lock);
kfree(state);
}
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index cdf7a70d66591..971796b30605a 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -1550,6 +1550,7 @@ int nsim_drv_probe(struct nsim_bus_dev *nsim_bus_dev)
nsim_dev->max_macs = NSIM_DEV_MAX_MACS_DEFAULT;
nsim_dev->test1 = NSIM_DEV_TEST1_DEFAULT;
spin_lock_init(&nsim_dev->fa_cookie_lock);
+ mutex_init(&nsim_dev->progs_list_lock);
dev_set_drvdata(&nsim_bus_dev->dev, nsim_dev);
@@ -1684,6 +1685,7 @@ void nsim_drv_remove(struct nsim_bus_dev *nsim_bus_dev)
devl_resources_unregister(devlink);
kfree(nsim_dev->vfconfigs);
kfree(nsim_dev->fa_cookie);
+ mutex_destroy(&nsim_dev->progs_list_lock);
devl_unlock(devlink);
devlink_free(devlink);
dev_set_drvdata(&nsim_bus_dev->dev, NULL);
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 02e3518e9a7e2..c28f5a9f92302 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -272,6 +272,7 @@ struct nsim_dev {
u32 prog_id_gen;
struct list_head bpf_bound_progs;
struct list_head bpf_bound_maps;
+ struct mutex progs_list_lock;
struct netdev_phys_item_id switch_id;
struct list_head port_list;
bool fw_update_status;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 140/280] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 139/280] netdevsim: fix a race issue related to the operation on bpf_bound_progs list Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 141/280] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue Greg Kroah-Hartman
` (144 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jijie Shao, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <shaojijie@huawei.com>
[ Upstream commit d57c67c956a1bad15115eba6e59d77a6dfeba01d ]
HCLGE_FD_AD_COUNTER_NUM_M should be at GENMASK(19, 13),
rather than at GENMASK(20, 13), because bit 20 is
HCLGE_FD_AD_NXT_STEP_B.
This patch corrects the wrong definition.
Fixes: 117328680288 ("net: hns3: Add input key and action config support for flow director")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Link: https://patch.msgid.link/20260119132840.410513-2-shaojijie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
index 43cada51d8cb3..0b9d3fc749b95 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
@@ -731,7 +731,7 @@ struct hclge_fd_tcam_config_3_cmd {
#define HCLGE_FD_AD_QID_M GENMASK(11, 2)
#define HCLGE_FD_AD_USE_COUNTER_B 12
#define HCLGE_FD_AD_COUNTER_NUM_S 13
-#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(20, 13)
+#define HCLGE_FD_AD_COUNTER_NUM_M GENMASK(19, 13)
#define HCLGE_FD_AD_NXT_STEP_B 20
#define HCLGE_FD_AD_NXT_KEY_S 21
#define HCLGE_FD_AD_NXT_KEY_M GENMASK(25, 21)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 141/280] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 140/280] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 142/280] mISDN: annotate data-race around dev->work Greg Kroah-Hartman
` (143 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jijie Shao, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <shaojijie@huawei.com>
[ Upstream commit f87e034d16e43af984380a95c32c25201b7759a7 ]
Use next_input_key instead of counter_id to set HCLGE_FD_AD_NXT_KEY.
Fixes: 117328680288 ("net: hns3: Add input key and action config support for flow director")
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Link: https://patch.msgid.link/20260119132840.410513-3-shaojijie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index a92f056b25613..42173a076163f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -5717,7 +5717,7 @@ static int hclge_fd_ad_config(struct hclge_dev *hdev, u8 stage, int loc,
HCLGE_FD_AD_COUNTER_NUM_S, action->counter_id);
hnae3_set_bit(ad_data, HCLGE_FD_AD_NXT_STEP_B, action->use_next_stage);
hnae3_set_field(ad_data, HCLGE_FD_AD_NXT_KEY_M, HCLGE_FD_AD_NXT_KEY_S,
- action->counter_id);
+ action->next_input_key);
req->ad_data = cpu_to_le64(ad_data);
ret = hclge_cmd_send(&hdev->hw, &desc, 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 142/280] mISDN: annotate data-race around dev->work
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 141/280] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 143/280] ipv6: annotate data-race in ndisc_router_discovery() Greg Kroah-Hartman
` (142 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8175dbf174d487afab81e936a862a8d9b8a1ccb6 ]
dev->work can re read locklessly in mISDN_read()
and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations.
BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read
write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:
misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline]
mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:
mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112
do_loop_readv_writev fs/read_write.c:847 [inline]
vfs_readv+0x3fb/0x690 fs/read_write.c:1020
do_readv+0xe7/0x210 fs/read_write.c:1080
__do_sys_readv fs/read_write.c:1165 [inline]
__se_sys_readv fs/read_write.c:1162 [inline]
__x64_sys_readv+0x45/0x50 fs/read_write.c:1162
x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x00000000 -> 0x00000001
Fixes: 1b2b03f8e514 ("Add mISDN core files")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260118132528.2349573-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/isdn/mISDN/timerdev.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/isdn/mISDN/timerdev.c b/drivers/isdn/mISDN/timerdev.c
index abdf36ac3bee5..74d6ed49dc368 100644
--- a/drivers/isdn/mISDN/timerdev.c
+++ b/drivers/isdn/mISDN/timerdev.c
@@ -109,14 +109,14 @@ mISDN_read(struct file *filep, char __user *buf, size_t count, loff_t *off)
spin_unlock_irq(&dev->lock);
if (filep->f_flags & O_NONBLOCK)
return -EAGAIN;
- wait_event_interruptible(dev->wait, (dev->work ||
+ wait_event_interruptible(dev->wait, (READ_ONCE(dev->work) ||
!list_empty(list)));
if (signal_pending(current))
return -ERESTARTSYS;
spin_lock_irq(&dev->lock);
}
if (dev->work)
- dev->work = 0;
+ WRITE_ONCE(dev->work, 0);
if (!list_empty(list)) {
timer = list_first_entry(list, struct mISDNtimer, list);
list_del(&timer->list);
@@ -141,13 +141,16 @@ mISDN_poll(struct file *filep, poll_table *wait)
if (*debug & DEBUG_TIMER)
printk(KERN_DEBUG "%s(%p, %p)\n", __func__, filep, wait);
if (dev) {
+ u32 work;
+
poll_wait(filep, &dev->wait, wait);
mask = 0;
- if (dev->work || !list_empty(&dev->expired))
+ work = READ_ONCE(dev->work);
+ if (work || !list_empty(&dev->expired))
mask |= (EPOLLIN | EPOLLRDNORM);
if (*debug & DEBUG_TIMER)
printk(KERN_DEBUG "%s work(%d) empty(%d)\n", __func__,
- dev->work, list_empty(&dev->expired));
+ work, list_empty(&dev->expired));
}
return mask;
}
@@ -172,7 +175,7 @@ misdn_add_timer(struct mISDNtimerdev *dev, int timeout)
struct mISDNtimer *timer;
if (!timeout) {
- dev->work = 1;
+ WRITE_ONCE(dev->work, 1);
wake_up_interruptible(&dev->wait);
id = 0;
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 143/280] ipv6: annotate data-race in ndisc_router_discovery()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 142/280] mISDN: annotate data-race around dev->work Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 144/280] usbnet: limit max_mtu based on devices hard_mtu Greg Kroah-Hartman
` (141 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Rocco Yue,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9a063f96d87efc3a6cc667f8de096a3d38d74bb5 ]
syzbot found that ndisc_router_discovery() could read and write
in6_dev->ra_mtu without holding a lock [1]
This looks fine, IFLA_INET6_RA_MTU is best effort.
Add READ_ONCE()/WRITE_ONCE() to document the race.
Note that we might also reject illegal MTU values
(mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch.
[1]
BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery
read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1:
ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558
ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841
icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989
ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438
ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489
NF_HOOK include/linux/netfilter.h:318 [inline]
ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500
ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590
dst_input include/net/dst.h:474 [inline]
ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79
...
write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0:
ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559
ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841
icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989
ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438
ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489
NF_HOOK include/linux/netfilter.h:318 [inline]
ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500
ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590
dst_input include/net/dst.h:474 [inline]
ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79
...
value changed: 0x00000000 -> 0xe5400659
Fixes: 49b99da2c9ce ("ipv6: add IFLA_INET6_RA_MTU to expose mtu value")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Rocco Yue <rocco.yue@mediatek.com>
Link: https://patch.msgid.link/20260118152941.2563857-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ndisc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 1a6408a24d21c..affbf12d44f57 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1572,8 +1572,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
mtu = ntohl(n);
- if (in6_dev->ra_mtu != mtu) {
- in6_dev->ra_mtu = mtu;
+ if (READ_ONCE(in6_dev->ra_mtu) != mtu) {
+ WRITE_ONCE(in6_dev->ra_mtu, mtu);
send_ifinfo_notify = true;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 144/280] usbnet: limit max_mtu based on devices hard_mtu
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 143/280] ipv6: annotate data-race in ndisc_router_discovery() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 145/280] drm/amd/pm: Dont clear SI SMC table when setting power limit Greg Kroah-Hartman
` (140 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Vivier, Stefano Brivio,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Vivier <lvivier@redhat.com>
[ Upstream commit c7159e960f1472a5493ac99aff0086ab1d683594 ]
The usbnet driver initializes net->max_mtu to ETH_MAX_MTU before calling
the device's bind() callback. When the bind() callback sets
dev->hard_mtu based the device's actual capability (from CDC Ethernet's
wMaxSegmentSize descriptor), max_mtu is never updated to reflect this
hardware limitation).
This allows userspace (DHCP or IPv6 RA) to configure MTU larger than the
device can handle, leading to silent packet drops when the backend sends
packet exceeding the device's buffer size.
Fix this by limiting net->max_mtu to the device's hard_mtu after the
bind callback returns.
See https://gitlab.com/qemu-project/qemu/-/issues/3268 and
https://bugs.passt.top/attachment.cgi?bugid=189
Fixes: f77f0aee4da4 ("net: use core MTU range checking in USB NIC drivers")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Link: https://bugs.passt.top/show_bug.cgi?id=189
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Link: https://patch.msgid.link/20260119075518.2774373-1-lvivier@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/usbnet.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 6bdf035e35f56..10bde8a8bb1ef 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1794,9 +1794,12 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
if ((dev->driver_info->flags & FLAG_NOARP) != 0)
net->flags |= IFF_NOARP;
- /* maybe the remote can't receive an Ethernet MTU */
- if (net->mtu > (dev->hard_mtu - net->hard_header_len))
- net->mtu = dev->hard_mtu - net->hard_header_len;
+ if (net->max_mtu > (dev->hard_mtu - net->hard_header_len))
+ net->max_mtu = dev->hard_mtu - net->hard_header_len;
+
+ if (net->mtu > net->max_mtu)
+ net->mtu = net->max_mtu;
+
} else if (!info->in || !info->out)
status = usbnet_get_endpoints (dev, udev);
else {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 145/280] drm/amd/pm: Dont clear SI SMC table when setting power limit
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 144/280] usbnet: limit max_mtu based on devices hard_mtu Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 146/280] drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) Greg Kroah-Hartman
` (139 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit d5077426e1a76d269e518e048bde2e9fc49b32ad ]
There is no reason to clear the SMC table.
We also don't need to recalculate the power limit then.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e214d626253f5b180db10dedab161b7caa41f5e9)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 2395d0a831846..a8278fa75ff9a 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -2257,8 +2257,6 @@ static int si_populate_smc_tdp_limits(struct amdgpu_device *adev,
if (scaling_factor == 0)
return -EINVAL;
- memset(smc_table, 0, sizeof(SISLANDS_SMC_STATETABLE));
-
ret = si_calculate_adjusted_tdp_limits(adev,
false, /* ??? */
adev->pm.dpm.tdp_adjustment,
@@ -2312,16 +2310,8 @@ static int si_populate_smc_tdp_limits_2(struct amdgpu_device *adev,
if (ni_pi->enable_power_containment) {
SISLANDS_SMC_STATETABLE *smc_table = &si_pi->smc_statetable;
- u32 scaling_factor = si_get_smc_power_scaling_factor(adev);
int ret;
- memset(smc_table, 0, sizeof(SISLANDS_SMC_STATETABLE));
-
- smc_table->dpm2Params.NearTDPLimit =
- cpu_to_be32(si_scale_power_for_smc(adev->pm.dpm.near_tdp_limit_adjusted, scaling_factor) * 1000);
- smc_table->dpm2Params.SafePowerLimit =
- cpu_to_be32(si_scale_power_for_smc((adev->pm.dpm.near_tdp_limit_adjusted * SISLANDS_DPM2_TDP_SAFE_LIMIT_PERCENT) / 100, scaling_factor) * 1000);
-
ret = amdgpu_si_copy_bytes_to_smc(adev,
(si_pi->state_table_start +
offsetof(SISLANDS_SMC_STATETABLE, dpm2Params) +
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 146/280] drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2)
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 145/280] drm/amd/pm: Dont clear SI SMC table when setting power limit Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 147/280] be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list Greg Kroah-Hartman
` (138 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Timur Kristóf,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
[ Upstream commit 764a90eb02268a23b1bb98be5f4a13671346804a ]
Radeon 430 and 520 are OEM GPUs from 2016~2017
They have the same device id: 0x6611 and revision: 0x87
On the Radeon 430, powertune is buggy and throttles the GPU,
never allowing it to reach its maximum SCLK. Work around this
bug by raising the TDP limits we program to the SMC from
24W (specified by the VBIOS on Radeon 430) to 32W.
Disabling powertune entirely is not a viable workaround,
because it causes the Radeon 520 to heat up above 100 C,
which I prefer to avoid.
Additionally, revise the maximum SCLK limit. Considering the
above issue, these GPUs never reached a high SCLK on Linux,
and the workarounds were added before the GPUs were released,
so the workaround likely didn't target these specifically.
Use 780 MHz (the maximum SCLK according to the VBIOS on the
Radeon 430). Note that the Radeon 520 VBIOS has a higher
maximum SCLK: 905 MHz, but in practice it doesn't seem to
perform better with the higher clock, only heats up more.
v2:
Move the workaround to si_populate_smc_tdp_limits.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 966d70f1e160bdfdecaf7ff2b3f22ad088516e9f)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index a8278fa75ff9a..bcc4d9fa5b0d2 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -2265,6 +2265,12 @@ static int si_populate_smc_tdp_limits(struct amdgpu_device *adev,
if (ret)
return ret;
+ if (adev->pdev->device == 0x6611 && adev->pdev->revision == 0x87) {
+ /* Workaround buggy powertune on Radeon 430 and 520. */
+ tdp_limit = 32;
+ near_tdp_limit = 28;
+ }
+
smc_table->dpm2Params.TDPLimit =
cpu_to_be32(si_scale_power_for_smc(tdp_limit, scaling_factor) * 1000);
smc_table->dpm2Params.NearTDPLimit =
@@ -3448,10 +3454,15 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
(adev->pdev->revision == 0x80) ||
(adev->pdev->revision == 0x81) ||
(adev->pdev->revision == 0x83) ||
- (adev->pdev->revision == 0x87) ||
+ (adev->pdev->revision == 0x87 &&
+ adev->pdev->device != 0x6611) ||
(adev->pdev->device == 0x6604) ||
(adev->pdev->device == 0x6605)) {
max_sclk = 75000;
+ } else if (adev->pdev->revision == 0x87 &&
+ adev->pdev->device == 0x6611) {
+ /* Radeon 430 and 520 */
+ max_sclk = 78000;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 147/280] be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 146/280] drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets Greg Kroah-Hartman
` (137 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Vatoropin, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <a.vatoropin@crpt.ru>
[ Upstream commit 8215794403d264739cc676668087512950b2ff31 ]
When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is
set to false, the driver may request the PMAC_ID from the firmware of the
network card, and this function will store that PMAC_ID at the provided
address pmac_id. This is the contract of this function.
However, there is a location within the driver where both
pmac_id_valid == false and pmac_id == NULL are being passed. This could
result in dereferencing a NULL pointer.
To resolve this issue, it is necessary to pass the address of a stub
variable to the function.
Fixes: 95046b927a54 ("be2net: refactor MAC-addr setup code")
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Link: https://patch.msgid.link/20260120113734.20193-1-a.vatoropin@crpt.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/emulex/benet/be_cmds.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index e764d2be4948a..12c48ad9a32d6 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -3796,6 +3796,7 @@ int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac)
{
int status;
bool pmac_valid = false;
+ u32 pmac_id;
eth_zero_addr(mac);
@@ -3808,7 +3809,7 @@ int be_cmd_get_perm_mac(struct be_adapter *adapter, u8 *mac)
adapter->if_handle, 0);
} else {
status = be_cmd_get_mac_from_list(adapter, mac, &pmac_valid,
- NULL, adapter->if_handle, 0);
+ &pmac_id, adapter->if_handle, 0);
}
return status;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 147/280] be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-19 21:34 ` Nathan Gao
2026-02-04 14:38 ` [PATCH 6.1 149/280] bonding: provide a net pointer to __skb_flow_dissect() Greg Kroah-Hartman
` (136 subsequent siblings)
284 siblings, 1 reply; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Taehee Yoo, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 04708606fd7bdc34b69089a4ff848ff36d7088f9 ]
Both send_mcast4() and send_mcast6() use sleep 2 to wait for the tunnel
connection between the gateway and the relay, and for the listener
socket to be created in the LISTENER namespace.
However, tests sometimes fail because packets are sent before the
connection is fully established.
Increase the waiting time to make the tests more reliable, and use
wait_local_port_listen() to explicitly wait for the listener socket.
Fixes: c08e8baea78e ("selftests: add amt interface selftest script")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Link: https://patch.msgid.link/20260120133930.863845-1-ap420073@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/amt.sh | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/amt.sh b/tools/testing/selftests/net/amt.sh
index 7e7ed6c558da9..ea40b469a8c11 100755
--- a/tools/testing/selftests/net/amt.sh
+++ b/tools/testing/selftests/net/amt.sh
@@ -73,6 +73,8 @@
# +------------------------+
#==============================================================================
+source lib.sh
+
readonly LISTENER=$(mktemp -u listener-XXXXXXXX)
readonly GATEWAY=$(mktemp -u gateway-XXXXXXXX)
readonly RELAY=$(mktemp -u relay-XXXXXXXX)
@@ -240,14 +242,15 @@ test_ipv6_forward()
send_mcast4()
{
- sleep 2
+ sleep 5
+ wait_local_port_listen ${LISTENER} 4000 udp
ip netns exec "${SOURCE}" bash -c \
'printf "%s %128s" 172.17.0.2 | nc -w 1 -u 239.0.0.1 4000' &
}
send_mcast6()
{
- sleep 2
+ wait_local_port_listen ${LISTENER} 6000 udp
ip netns exec "${SOURCE}" bash -c \
'printf "%s %128s" 2001:db8:3::2 | nc -w 1 -u ff0e::5:6 6000' &
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 149/280] bonding: provide a net pointer to __skb_flow_dissect()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 150/280] octeontx2-af: Fix error handling Greg Kroah-Hartman
` (135 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c46409299c70a221415e,
Eric Dumazet, Matteo Croce, Stanislav Fomichev, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5f9b329096596b7e53e07d041d7fca4cbe1be752 ]
After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect")
we have to provide a net pointer to __skb_flow_dissect(),
either via skb->dev, skb->sk, or a user provided pointer.
In the following case, syzbot was able to cook a bare skb.
WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053
Call Trace:
<TASK>
bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline]
__bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157
bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline]
bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline]
bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515
xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388
bpf_prog_run_xdp include/net/xdp.h:700 [inline]
bpf_test_run+0x6b2/0x7d0 net/bpf/test_run.c:421
bpf_prog_test_run_xdp+0x795/0x10e0 net/bpf/test_run.c:1390
bpf_prog_test_run+0x2c7/0x340 kernel/bpf/syscall.c:4703
__sys_bpf+0x562/0x860 kernel/bpf/syscall.c:6182
__do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
Fixes: 58deb77cc52d ("bonding: balance ICMP echoes in layer3+4 mode")
Reported-by: syzbot+c46409299c70a221415e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/696faa23.050a0220.4cb9c.001f.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Matteo Croce <mcroce@redhat.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20260120161744.1893263-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index dd0ea86d7934a..b0bc811aaab91 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4128,8 +4128,9 @@ static bool bond_flow_dissect(struct bonding *bond, struct sk_buff *skb, const v
case BOND_XMIT_POLICY_ENCAP23:
case BOND_XMIT_POLICY_ENCAP34:
memset(fk, 0, sizeof(*fk));
- return __skb_flow_dissect(NULL, skb, &flow_keys_bonding,
- fk, data, l2_proto, nhoff, hlen, 0);
+ return __skb_flow_dissect(dev_net(bond->dev), skb,
+ &flow_keys_bonding, fk, data,
+ l2_proto, nhoff, hlen, 0);
default:
break;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 150/280] octeontx2-af: Fix error handling
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 149/280] bonding: provide a net pointer to __skb_flow_dissect() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 151/280] vsock/virtio: fix potential underflow in virtio_transport_get_credit() Greg Kroah-Hartman
` (134 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratheesh Kannoth, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <rkannoth@marvell.com>
[ Upstream commit 19e4175e997a5b85eab97d522f00cc99abd1873c ]
This commit adds error handling and rollback logic to
rvu_mbox_handler_attach_resources() to properly clean up partially
attached resources when rvu_attach_block() fails.
Fixes: 746ea74241fa0 ("octeontx2-af: Add RVU block LF provisioning support")
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Link: https://patch.msgid.link/20260121033934.1900761-1-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/marvell/octeontx2/af/rvu.c | 86 ++++++++++++++-----
1 file changed, 64 insertions(+), 22 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index d9c68f8166aff..7034a977102ea 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -1540,8 +1540,8 @@ static int rvu_get_attach_blkaddr(struct rvu *rvu, int blktype,
return -ENODEV;
}
-static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,
- int num_lfs, struct rsrc_attach *attach)
+static int rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,
+ int num_lfs, struct rsrc_attach *attach)
{
struct rvu_pfvf *pfvf = rvu_get_pfvf(rvu, pcifunc);
struct rvu_hwinfo *hw = rvu->hw;
@@ -1551,21 +1551,21 @@ static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,
u64 cfg;
if (!num_lfs)
- return;
+ return -EINVAL;
blkaddr = rvu_get_attach_blkaddr(rvu, blktype, pcifunc, attach);
if (blkaddr < 0)
- return;
+ return -EFAULT;
block = &hw->block[blkaddr];
if (!block->lf.bmap)
- return;
+ return -ESRCH;
for (slot = 0; slot < num_lfs; slot++) {
/* Allocate the resource */
lf = rvu_alloc_rsrc(&block->lf);
if (lf < 0)
- return;
+ return -EFAULT;
cfg = (1ULL << 63) | (pcifunc << 8) | slot;
rvu_write64(rvu, blkaddr, block->lfcfg_reg |
@@ -1576,6 +1576,8 @@ static void rvu_attach_block(struct rvu *rvu, int pcifunc, int blktype,
/* Set start MSIX vector for this LF within this PF/VF */
rvu_set_msix_offset(rvu, pfvf, block, lf);
}
+
+ return 0;
}
static int rvu_check_rsrc_availability(struct rvu *rvu,
@@ -1713,22 +1715,31 @@ int rvu_mbox_handler_attach_resources(struct rvu *rvu,
int err;
/* If first request, detach all existing attached resources */
- if (!attach->modify)
- rvu_detach_rsrcs(rvu, NULL, pcifunc);
+ if (!attach->modify) {
+ err = rvu_detach_rsrcs(rvu, NULL, pcifunc);
+ if (err)
+ return err;
+ }
mutex_lock(&rvu->rsrc_lock);
/* Check if the request can be accommodated */
err = rvu_check_rsrc_availability(rvu, attach, pcifunc);
if (err)
- goto exit;
+ goto fail1;
/* Now attach the requested resources */
- if (attach->npalf)
- rvu_attach_block(rvu, pcifunc, BLKTYPE_NPA, 1, attach);
+ if (attach->npalf) {
+ err = rvu_attach_block(rvu, pcifunc, BLKTYPE_NPA, 1, attach);
+ if (err)
+ goto fail1;
+ }
- if (attach->nixlf)
- rvu_attach_block(rvu, pcifunc, BLKTYPE_NIX, 1, attach);
+ if (attach->nixlf) {
+ err = rvu_attach_block(rvu, pcifunc, BLKTYPE_NIX, 1, attach);
+ if (err)
+ goto fail2;
+ }
if (attach->sso) {
/* RVU func doesn't know which exact LF or slot is attached
@@ -1738,33 +1749,64 @@ int rvu_mbox_handler_attach_resources(struct rvu *rvu,
*/
if (attach->modify)
rvu_detach_block(rvu, pcifunc, BLKTYPE_SSO);
- rvu_attach_block(rvu, pcifunc, BLKTYPE_SSO,
- attach->sso, attach);
+ err = rvu_attach_block(rvu, pcifunc, BLKTYPE_SSO,
+ attach->sso, attach);
+ if (err)
+ goto fail3;
}
if (attach->ssow) {
if (attach->modify)
rvu_detach_block(rvu, pcifunc, BLKTYPE_SSOW);
- rvu_attach_block(rvu, pcifunc, BLKTYPE_SSOW,
- attach->ssow, attach);
+ err = rvu_attach_block(rvu, pcifunc, BLKTYPE_SSOW,
+ attach->ssow, attach);
+ if (err)
+ goto fail4;
}
if (attach->timlfs) {
if (attach->modify)
rvu_detach_block(rvu, pcifunc, BLKTYPE_TIM);
- rvu_attach_block(rvu, pcifunc, BLKTYPE_TIM,
- attach->timlfs, attach);
+ err = rvu_attach_block(rvu, pcifunc, BLKTYPE_TIM,
+ attach->timlfs, attach);
+ if (err)
+ goto fail5;
}
if (attach->cptlfs) {
if (attach->modify &&
rvu_attach_from_same_block(rvu, BLKTYPE_CPT, attach))
rvu_detach_block(rvu, pcifunc, BLKTYPE_CPT);
- rvu_attach_block(rvu, pcifunc, BLKTYPE_CPT,
- attach->cptlfs, attach);
+ err = rvu_attach_block(rvu, pcifunc, BLKTYPE_CPT,
+ attach->cptlfs, attach);
+ if (err)
+ goto fail6;
}
-exit:
+ mutex_unlock(&rvu->rsrc_lock);
+ return 0;
+
+fail6:
+ if (attach->timlfs)
+ rvu_detach_block(rvu, pcifunc, BLKTYPE_TIM);
+
+fail5:
+ if (attach->ssow)
+ rvu_detach_block(rvu, pcifunc, BLKTYPE_SSOW);
+
+fail4:
+ if (attach->sso)
+ rvu_detach_block(rvu, pcifunc, BLKTYPE_SSO);
+
+fail3:
+ if (attach->nixlf)
+ rvu_detach_block(rvu, pcifunc, BLKTYPE_NIX);
+
+fail2:
+ if (attach->npalf)
+ rvu_detach_block(rvu, pcifunc, BLKTYPE_NPA);
+
+fail1:
mutex_unlock(&rvu->rsrc_lock);
return err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 151/280] vsock/virtio: fix potential underflow in virtio_transport_get_credit()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 150/280] octeontx2-af: Fix error handling Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 152/280] vsock/virtio: cap TX credit to local buffer size Greg Kroah-Hartman
` (133 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, Melbin K Mathew,
Luigi Leonardi, Michael S. Tsirkin, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melbin K Mathew <mlbnkm1@gmail.com>
[ Upstream commit 3ef3d52a1a9860d094395c7a3e593f3aa26ff012 ]
The credit calculation in virtio_transport_get_credit() uses unsigned
arithmetic:
ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
are in flight, the subtraction can underflow and produce a large
positive value, potentially allowing more data to be queued than the
peer can handle.
Reuse virtio_transport_has_space() which already handles this case and
add a comment to make it clear why we are doing that.
Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com>
[Stefano: use virtio_transport_has_space() instead of duplicating the code]
[Stefano: tweak the commit message]
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Link: https://patch.msgid.link/20260121093628.9941-2-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/virtio_transport_common.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index a65da57fe26fd..76329191102a0 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -28,6 +28,7 @@
static void virtio_transport_cancel_close_work(struct vsock_sock *vsk,
bool cancel_timeout);
+static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs);
static const struct virtio_transport *
virtio_transport_get_ops(struct vsock_sock *vsk)
@@ -284,9 +285,7 @@ u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 credit)
u32 ret;
spin_lock_bh(&vvs->tx_lock);
- ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
- if (ret > credit)
- ret = credit;
+ ret = min_t(u32, credit, virtio_transport_has_space(vvs));
vvs->tx_cnt += ret;
spin_unlock_bh(&vvs->tx_lock);
@@ -588,11 +587,14 @@ u32 virtio_transport_seqpacket_has_data(struct vsock_sock *vsk)
}
EXPORT_SYMBOL_GPL(virtio_transport_seqpacket_has_data);
-static s64 virtio_transport_has_space(struct vsock_sock *vsk)
+static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs)
{
- struct virtio_vsock_sock *vvs = vsk->trans;
s64 bytes;
+ /* Use s64 arithmetic so if the peer shrinks peer_buf_alloc while
+ * we have bytes in flight (tx_cnt - peer_fwd_cnt), the subtraction
+ * does not underflow.
+ */
bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
if (bytes < 0)
bytes = 0;
@@ -606,7 +608,7 @@ s64 virtio_transport_stream_has_space(struct vsock_sock *vsk)
s64 bytes;
spin_lock_bh(&vvs->tx_lock);
- bytes = virtio_transport_has_space(vsk);
+ bytes = virtio_transport_has_space(vvs);
spin_unlock_bh(&vvs->tx_lock);
return bytes;
@@ -1207,7 +1209,7 @@ static bool virtio_transport_space_update(struct sock *sk,
spin_lock_bh(&vvs->tx_lock);
vvs->peer_buf_alloc = le32_to_cpu(hdr->buf_alloc);
vvs->peer_fwd_cnt = le32_to_cpu(hdr->fwd_cnt);
- space_available = virtio_transport_has_space(vsk);
+ space_available = virtio_transport_has_space(vvs);
spin_unlock_bh(&vvs->tx_lock);
return space_available;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 152/280] vsock/virtio: cap TX credit to local buffer size
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 151/280] vsock/virtio: fix potential underflow in virtio_transport_get_credit() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 153/280] net/sched: act_ife: avoid possible NULL deref Greg Kroah-Hartman
` (132 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, Melbin K Mathew,
Luigi Leonardi, Michael S. Tsirkin, Paolo Abeni, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melbin K Mathew <mlbnkm1@gmail.com>
[ Upstream commit 8ee784fdf006cbe8739cfa093f54d326cbf54037 ]
The virtio transports derives its TX credit directly from peer_buf_alloc,
which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.
On the host side this means that the amount of data we are willing to
queue for a connection is scaled by a guest-chosen buffer size, rather
than the host's own vsock configuration. A malicious guest can advertise
a large buffer and read slowly, causing the host to allocate a
correspondingly large amount of sk_buff memory.
The same thing would happen in the guest with a malicious host, since
virtio transports share the same code base.
Introduce a small helper, virtio_transport_tx_buf_size(), that
returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume
peer_buf_alloc.
This ensures the effective TX window is bounded by both the peer's
advertised buffer and our own buf_alloc (already clamped to
buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer
cannot force the other to queue more data than allowed by its own
vsock settings.
On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with
32 guest vsock connections advertising 2 GiB each and reading slowly
drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only
recovered after killing the QEMU process. That said, if QEMU memory is
limited with cgroups, the maximum memory used will be limited.
With this patch applied:
Before:
MemFree: ~61.6 GiB
Slab: ~142 MiB
SUnreclaim: ~117 MiB
After 32 high-credit connections:
MemFree: ~61.5 GiB
Slab: ~178 MiB
SUnreclaim: ~152 MiB
Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest
remains responsive.
Compatibility with non-virtio transports:
- VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per
socket based on the local vsk->buffer_* values; the remote side
cannot enlarge those queues beyond what the local endpoint
configured.
- Hyper-V's vsock transport uses fixed-size VMBus ring buffers and
an MTU bound; there is no peer-controlled credit field comparable
to peer_buf_alloc, and the remote endpoint cannot drive in-flight
kernel memory above those ring sizes.
- The loopback path reuses virtio_transport_common.c, so it
naturally follows the same semantics as the virtio transport.
This change is limited to virtio_transport_common.c and thus affects
virtio-vsock, vhost-vsock, and loopback, bringing them in line with the
"remote window intersected with local policy" behaviour that VMCI and
Hyper-V already effectively have.
Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com>
[Stefano: small adjustments after changing the previous patch]
[Stefano: tweak the commit message]
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Link: https://patch.msgid.link/20260121093628.9941-4-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/virtio_transport_common.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 76329191102a0..bb44a95b43d5a 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -532,6 +532,15 @@ virtio_transport_seqpacket_dequeue(struct vsock_sock *vsk,
}
EXPORT_SYMBOL_GPL(virtio_transport_seqpacket_dequeue);
+static u32 virtio_transport_tx_buf_size(struct virtio_vsock_sock *vvs)
+{
+ /* The peer advertises its receive buffer via peer_buf_alloc, but we
+ * cap it to our local buf_alloc so a remote peer cannot force us to
+ * queue more data than our own buffer configuration allows.
+ */
+ return min(vvs->peer_buf_alloc, vvs->buf_alloc);
+}
+
int
virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk,
struct msghdr *msg,
@@ -541,7 +550,7 @@ virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk,
spin_lock_bh(&vvs->tx_lock);
- if (len > vvs->peer_buf_alloc) {
+ if (len > virtio_transport_tx_buf_size(vvs)) {
spin_unlock_bh(&vvs->tx_lock);
return -EMSGSIZE;
}
@@ -595,7 +604,8 @@ static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs)
* we have bytes in flight (tx_cnt - peer_fwd_cnt), the subtraction
* does not underflow.
*/
- bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
+ bytes = (s64)virtio_transport_tx_buf_size(vvs) -
+ (vvs->tx_cnt - vvs->peer_fwd_cnt);
if (bytes < 0)
bytes = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 153/280] net/sched: act_ife: avoid possible NULL deref
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 152/280] vsock/virtio: cap TX credit to local buffer size Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 154/280] x86: make page fault handling disable interrupts properly Greg Kroah-Hartman
` (131 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5cf914f193dffde3bd3c,
Eric Dumazet, Yotam Gigi, Jamal Hadi Salim, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 27880b0b0d35ad1c98863d09788254e36f874968 ]
tcf_ife_encode() must make sure ife_encode() does not return NULL.
syzbot reported:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166
CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
<TASK>
ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101
tcf_ife_encode net/sched/act_ife.c:841 [inline]
tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877
tc_act include/net/tc_wrapper.h:130 [inline]
tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152
tcf_exts_exec include/net/pkt_cls.h:349 [inline]
mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42
tc_classify include/net/tc_wrapper.h:197 [inline]
__tcf_classify net/sched/cls_api.c:1764 [inline]
tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860
multiq_classify net/sched/sch_multiq.c:39 [inline]
multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66
dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147
__dev_xmit_skb net/core/dev.c:4262 [inline]
__dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798
Fixes: 295a6e06d21e ("net/sched: act_ife: Change to use ife module")
Reported-by: syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6970d61d.050a0220.706b.0010.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yotam Gigi <yotam.gi@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260121133724.3400020-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_ife.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index a4505b926a1e4..2e2283ce2d886 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -820,6 +820,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
/* could be stupid policy setup or mtu config
* so lets be conservative.. */
if ((action == TC_ACT_SHOT) || exceed_mtu) {
+drop:
qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
return TC_ACT_SHOT;
}
@@ -828,6 +829,8 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
skb_push(skb, skb->dev->hard_header_len);
ife_meta = ife_encode(skb, metalen);
+ if (!ife_meta)
+ goto drop;
spin_lock(&ife->tcf_lock);
@@ -843,8 +846,7 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a,
if (err < 0) {
/* too corrupt to keep around if overwritten */
spin_unlock(&ife->tcf_lock);
- qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
- return TC_ACT_SHOT;
+ goto drop;
}
skboff += err;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 154/280] x86: make page fault handling disable interrupts properly
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 153/280] net/sched: act_ife: avoid possible NULL deref Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 155/280] leds: led-class: Only Add LED to leds_list when it is fully ready Greg Kroah-Hartman
` (130 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cedric Xing, Dave Hansen,
Peter Zijlstra, Thomas Gleixner, Linus Torvalds, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cedric Xing <cedric.xing@intel.com>
[ Upstream commit 614da1d3d4cdbd6e41aea06bc97ec15aacff6daf ]
There's a big comment in the x86 do_page_fault() about our interrupt
disabling code:
* User address page fault handling might have reenabled
* interrupts. Fixing up all potential exit points of
* do_user_addr_fault() and its leaf functions is just not
* doable w/o creating an unholy mess or turning the code
* upside down.
but it turns out that comment is subtly wrong, and the code as a result
is also wrong.
Because it's certainly true that we may have re-enabled interrupts when
handling user page faults. And it's most certainly true that we don't
want to bother fixing up all the cases.
But what isn't true is that it's limited to user address page faults.
The confusion stems from the fact that we have logic here that depends
on the address range of the access, but other code then depends on the
_context_ the access was done in. The two are not related, even though
both of them are about user-vs-kernel.
In other words, both user and kernel addresses can cause interrupts to
have been enabled (eg when __bad_area_nosemaphore() gets called for user
accesses to kernel addresses). As a result we should make sure to
disable interrupts again regardless of the address range before
returning to the low-level fault handling code.
The __bad_area_nosemaphore() code actually did disable interrupts again
after enabling them, just not consistently. Ironically, as noted in the
original comment, fixing up all the cases is just not worth it, when the
simple solution is to just do it unconditionally in one single place.
So remove the incomplete case that unsuccessfully tried to do what the
comment said was "not doable" in commit ca4c6a9858c2 ("x86/traps: Make
interrupt enable/disable symmetric in C code"), and just make it do the
simple and straightforward thing.
Signed-off-by: Cedric Xing <cedric.xing@intel.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Fixes: ca4c6a9858c2 ("x86/traps: Make interrupt enable/disable symmetric in C code")
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/fault.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2fc007752ceb1..54f8fe0ea5a93 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -835,8 +835,6 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
force_sig_pkuerr((void __user *)address, pkey);
else
force_sig_fault(SIGSEGV, si_code, (void __user *)address);
-
- local_irq_disable();
}
static noinline void
@@ -1429,15 +1427,12 @@ handle_page_fault(struct pt_regs *regs, unsigned long error_code,
do_kern_addr_fault(regs, error_code, address);
} else {
do_user_addr_fault(regs, error_code, address);
- /*
- * User address page fault handling might have reenabled
- * interrupts. Fixing up all potential exit points of
- * do_user_addr_fault() and its leaf functions is just not
- * doable w/o creating an unholy mess or turning the code
- * upside down.
- */
- local_irq_disable();
}
+ /*
+ * page fault handling might have reenabled interrupts,
+ * make sure to disable them again.
+ */
+ local_irq_disable();
}
DEFINE_IDTENTRY_RAW_ERRORCODE(exc_page_fault)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 155/280] leds: led-class: Only Add LED to leds_list when it is fully ready
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 154/280] x86: make page fault handling disable interrupts properly Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 156/280] of: fix reference count leak in of_alias_scan() Greg Kroah-Hartman
` (129 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Sebastian Reichel,
Lee Jones
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <johannes.goede@oss.qualcomm.com>
commit d1883cefd31752f0504b94c3bcfa1f6d511d6e87 upstream.
Before this change the LED was added to leds_list before led_init_core()
gets called adding it the list before led_classdev.set_brightness_work gets
initialized.
This leaves a window where led_trigger_register() of a LED's default
trigger will call led_trigger_set() which calls led_set_brightness()
which in turn will end up queueing the *uninitialized*
led_classdev.set_brightness_work.
This race gets hit by the lenovo-thinkpad-t14s EC driver which registers
2 LEDs with a default trigger provided by snd_ctl_led.ko in quick
succession. The first led_classdev_register() causes an async modprobe of
snd_ctl_led to run and that async modprobe manages to exactly hit
the window where the second LED is on the leds_list without led_init_core()
being called for it, resulting in:
------------[ cut here ]------------
WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390
Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025
...
Call trace:
__flush_work+0x344/0x390 (P)
flush_work+0x2c/0x50
led_trigger_set+0x1c8/0x340
led_trigger_register+0x17c/0x1c0
led_trigger_register_simple+0x84/0xe8
snd_ctl_led_init+0x40/0xf88 [snd_ctl_led]
do_one_initcall+0x5c/0x318
do_init_module+0x9c/0x2b8
load_module+0x7e0/0x998
Close the race window by moving the adding of the LED to leds_list to
after the led_init_core() call.
Cc: stable@vger.kernel.org
Fixes: d23a22a74fde ("leds: delay led_set_brightness if stopping soft-blink")
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: Sebastian Reichel <sre@kernel.org>
Link: https://patch.msgid.link/20251211163727.366441-1-johannes.goede@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/led-class.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -410,11 +410,6 @@ int led_classdev_register_ext(struct dev
#ifdef CONFIG_LEDS_BRIGHTNESS_HW_CHANGED
led_cdev->brightness_hw_changed = -1;
#endif
- /* add to the list of leds */
- down_write(&leds_list_lock);
- list_add_tail(&led_cdev->node, &leds_list);
- up_write(&leds_list_lock);
-
if (!led_cdev->max_brightness)
led_cdev->max_brightness = LED_FULL;
@@ -422,6 +417,11 @@ int led_classdev_register_ext(struct dev
led_init_core(led_cdev);
+ /* add to the list of leds */
+ down_write(&leds_list_lock);
+ list_add_tail(&led_cdev->node, &leds_list);
+ up_write(&leds_list_lock);
+
#ifdef CONFIG_LEDS_TRIGGERS
led_trigger_set_default(led_cdev);
#endif
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 156/280] of: fix reference count leak in of_alias_scan()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 155/280] leds: led-class: Only Add LED to leds_list when it is fully ready Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 157/280] of: platform: Use default match table for /firmware Greg Kroah-Hartman
` (128 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Rob Herring (Arm)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
commit 81122fba08fa3ccafab6ed272a5c6f2203923a7e upstream.
of_find_node_by_path() returns a device_node with its refcount
incremented. When kstrtoint() fails or dt_alloc() fails, the function
continues to the next iteration without calling of_node_put(), causing
a reference count leak.
Add of_node_put(np) before continue on both error paths to properly
release the device_node reference.
Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Link: https://patch.msgid.link/20260117091238.481243-1-geoffreyhe2@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/base.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1956,13 +1956,17 @@ void of_alias_scan(void * (*dt_alloc)(u6
end--;
len = end - start;
- if (kstrtoint(end, 10, &id) < 0)
+ if (kstrtoint(end, 10, &id) < 0) {
+ of_node_put(np);
continue;
+ }
/* Allocate an alias_prop with enough space for the stem */
ap = dt_alloc(sizeof(*ap) + len + 1, __alignof__(*ap));
- if (!ap)
+ if (!ap) {
+ of_node_put(np);
continue;
+ }
memset(ap, 0, sizeof(*ap) + len + 1);
ap->alias = start;
of_alias_add(ap, np, id, start, len);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 157/280] of: platform: Use default match table for /firmware
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 156/280] of: fix reference count leak in of_alias_scan() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 158/280] iio: adc: ad9467: fix ad9434 vref mask Greg Kroah-Hartman
` (127 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sudeep Holla, Rob Herring (Arm)
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring (Arm) <robh@kernel.org>
commit 48e6a9c4a20870e09f85ff1a3628275d6bce31c0 upstream.
Calling of_platform_populate() without a match table will only populate
the immediate child nodes under /firmware. This is usually fine, but in
the case of something like a "simple-mfd" node such as
"raspberrypi,bcm2835-firmware", those child nodes will not be populated.
And subsequent calls won't work either because the /firmware node is
marked as processed already.
Switch the call to of_platform_default_populate() to solve this problem.
It should be a nop for existing cases.
Fixes: 3aa0582fdb82 ("of: platform: populate /firmware/ node from of_platform_default_populate_init()")
Cc: stable@vger.kernel.org
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://patch.msgid.link/20260114015158.692170-2-robh@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/platform.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -587,7 +587,7 @@ static int __init of_platform_default_po
node = of_find_node_by_path("/firmware");
if (node) {
- of_platform_populate(node, NULL, NULL, NULL);
+ of_platform_default_populate(node, NULL, NULL);
of_node_put(node);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 158/280] iio: adc: ad9467: fix ad9434 vref mask
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 157/280] of: platform: Use default match table for /firmware Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 159/280] iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver Greg Kroah-Hartman
` (126 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Nuno Sá,
David Lechner, Tomas Melin, Stable, Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Melin <tomas.melin@vaisala.com>
commit 92452b1760ff2d1d411414965d4d06f75e1bda9a upstream.
The mask setting is 5 bits wide for the ad9434
(ref. data sheet register 0x18 FLEX_VREF). Apparently the settings
from ad9265 were copied by mistake when support for the device was added
to the driver.
Fixes: 4606d0f4b05f ("iio: adc: ad9467: add support for AD9434 high-speed ADC")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Tomas Melin <tomas.melin@vaisala.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad9467.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad9467.c
+++ b/drivers/iio/adc/ad9467.c
@@ -90,7 +90,7 @@
#define CHIPID_AD9434 0x6A
#define AD9434_DEF_OUTPUT_MODE 0x00
-#define AD9434_REG_VREF_MASK 0xC0
+#define AD9434_REG_VREF_MASK GENMASK(4, 0)
/*
* Analog Devices AD9467 16-Bit, 200/250 MSPS ADC
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 159/280] iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 158/280] iio: adc: ad9467: fix ad9434 vref mask Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 160/280] iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl Greg Kroah-Hartman
` (125 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Stable, Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
commit dbdb442218cd9d613adeab31a88ac973f22c4873 upstream.
at91_adc_interrupt can call at91_adc_touch_data_handler function
to start the work by schedule_work(&st->touch_st.workq).
If we remove the module which will call at91_adc_remove to
make cleanup, it will free indio_dev through iio_device_unregister but
quite a bit later. While the work mentioned above will be used. The
sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| at91_adc_workq_handler
at91_adc_remove |
iio_device_unregister(indio_dev) |
//free indio_dev a bit later |
| iio_push_to_buffers(indio_dev)
| //use indio_dev
Fix it by ensuring that the work is canceled before proceeding with
the cleanup in at91_adc_remove.
Fixes: 23ec2774f1cc ("iio: adc: at91-sama5d2_adc: add support for position and pressure channels")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/at91-sama5d2_adc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/adc/at91-sama5d2_adc.c
+++ b/drivers/iio/adc/at91-sama5d2_adc.c
@@ -2521,6 +2521,7 @@ static int at91_adc_remove(struct platfo
struct at91_adc_state *st = iio_priv(indio_dev);
iio_device_unregister(indio_dev);
+ cancel_work_sync(&st->touch_st.workq);
at91_adc_dma_disable(st);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 160/280] iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 159/280] iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 161/280] ALSA: ctxfi: Fix potential OOB access in audio mixer handling Greg Kroah-Hartman
` (124 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andreas Kübrich,
Jonathan Cameron
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kübrich, Andreas <andreas.kuebrich@spektra-dresden.de>
commit 441ac29923c9172bc5e4b2c4f52ae756192f5715 upstream.
The chip info for this variant (I2C, four channels, 14 bit, internal
reference) seems to have been left out due to oversight, so
ad5686_chip_info_tbl[ID_AD5695R] is all zeroes. Initialisation of an
AD5695R still succeeds, but the resulting IIO device has no channels and no
/dev/iio:device* node.
Add the missing chip info to the table.
Fixes: 4177381b4401 ("iio:dac:ad5686: Add AD5671R/75R/94/94R/95R/96/96R support")
Signed-off-by: Andreas Kübrich <andreas.kuebrich@spektra-dresden.de>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/ad5686.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/iio/dac/ad5686.c
+++ b/drivers/iio/dac/ad5686.c
@@ -427,6 +427,12 @@ static const struct ad5686_chip_info ad5
.num_channels = 4,
.regmap_type = AD5686_REGMAP,
},
+ [ID_AD5695R] = {
+ .channels = ad5685r_channels,
+ .int_vref_mv = 2500,
+ .num_channels = 4,
+ .regmap_type = AD5686_REGMAP,
+ },
[ID_AD5696] = {
.channels = ad5686_channels,
.num_channels = 4,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 161/280] ALSA: ctxfi: Fix potential OOB access in audio mixer handling
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 160/280] iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 162/280] ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() Greg Kroah-Hartman
` (123 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Salvatore Bonaccorso,
Karsten Hohmeier, Takashi Iwai
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 61006c540cbdedea83b05577dc7fb7fa18fe1276 upstream.
In the audio mixer handling code of ctxfi driver, the conf field is
used as a kind of loop index, and it's referred in the index callbacks
(amixer_index() and sum_index()).
As spotted recently by fuzzers, the current code causes OOB access at
those functions.
| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48
| index 8 is out of range for type 'unsigned char [8]'
After the analysis, the cause was found to be the lack of the proper
(re-)initialization of conj field.
This patch addresses those OOB accesses by adding the proper
initializations of the loop indices.
Reported-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Karsten Hohmeier <linux@hohmatik.de>
Closes: https://bugs.debian.org/1121535
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/all/aSk8KJI35H7gFru6@eldamar.lan/
Link: https://patch.msgid.link/20260119133212.189129-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/ctxfi/ctamixer.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/ctxfi/ctamixer.c
+++ b/sound/pci/ctxfi/ctamixer.c
@@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer
/* Set amixer specific operations */
amixer->rsc.ops = &amixer_basic_rsc_ops;
+ amixer->rsc.conj = 0;
amixer->ops = &amixer_ops;
amixer->input = NULL;
amixer->sum = NULL;
@@ -369,6 +370,7 @@ static int sum_rsc_init(struct sum *sum,
return err;
sum->rsc.ops = &sum_basic_rsc_ops;
+ sum->rsc.conj = 0;
return 0;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 162/280] ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 161/280] ALSA: ctxfi: Fix potential OOB access in audio mixer handling Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 163/280] mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function Greg Kroah-Hartman
` (122 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey Konovalov, Berk Cem Goksel,
Takashi Iwai
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Berk Cem Goksel <berkcgoksel@gmail.com>
commit 930e69757b74c3ae083b0c3c7419bfe7f0edc7b2 upstream.
When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees
mixer->id_elems but the controls already added to the card still
reference the freed memory. Later when snd_card_register() runs,
the OSS mixer layer calls their callbacks and hits a use-after-free read.
Call trace:
get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411
get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241
mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381
snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887
...
snd_card_register+0x4ed/0x6d0 sound/core/init.c:923
usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025
Fix by calling snd_ctl_remove() for all mixer controls before freeing
id_elems. We save the next pointer first because snd_ctl_remove()
frees the current element.
Fixes: 6639b6c2367f ("[ALSA] usb-audio - add mixer control notifications")
Cc: stable@vger.kernel.org
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Signed-off-by: Berk Cem Goksel <berkcgoksel@gmail.com>
Link: https://patch.msgid.link/20260120102855.7300-1-berkcgoksel@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2940,10 +2940,23 @@ static int parse_audio_unit(struct mixer
static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
{
+ struct usb_mixer_elem_list *list, *next;
+ int id;
+
/* kill pending URBs */
snd_usb_mixer_disconnect(mixer);
- kfree(mixer->id_elems);
+ /* Unregister controls first, snd_ctl_remove() frees the element */
+ if (mixer->id_elems) {
+ for (id = 0; id < MAX_ID_ELEMS; id++) {
+ for (list = mixer->id_elems[id]; list; list = next) {
+ next = list->next_id_elem;
+ if (list->kctl)
+ snd_ctl_remove(mixer->chip->card, list->kctl);
+ }
+ }
+ kfree(mixer->id_elems);
+ }
if (mixer->urb) {
kfree(mixer->urb->transfer_buffer);
usb_free_urb(mixer->urb);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 163/280] mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 162/280] ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 164/280] wifi: ath10k: fix dma_free_coherent() pointer Greg Kroah-Hartman
` (121 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matthew Schwartz, Ricky WU,
Ulf Hansson
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <matthew.schwartz@linux.dev>
commit 122610220134b32c742cc056eaf64f7017ac8cd9 upstream.
rtsx_pci_sdmmc does not have an sdmmc_card_busy function, so any voltage
switches cause a kernel warning, "mmc0: cannot verify signal voltage
switch."
Copy the sdmmc_card_busy function from rtsx_pci_usb to rtsx_pci_sdmmc to
fix this.
Fixes: ff984e57d36e ("mmc: Add realtek pcie sdmmc host driver")
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Tested-by: Ricky WU <ricky_wu@realtek.com>
Reviewed-by: Ricky WU <ricky_wu@realtek.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/rtsx_pci_sdmmc.c | 41 ++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -1307,6 +1307,46 @@ out:
return err;
}
+static int sdmmc_card_busy(struct mmc_host *mmc)
+{
+ struct realtek_pci_sdmmc *host = mmc_priv(mmc);
+ struct rtsx_pcr *pcr = host->pcr;
+ int err;
+ u8 stat;
+ u8 mask = SD_DAT3_STATUS | SD_DAT2_STATUS | SD_DAT1_STATUS
+ | SD_DAT0_STATUS;
+
+ mutex_lock(&pcr->pcr_mutex);
+
+ rtsx_pci_start_run(pcr);
+
+ err = rtsx_pci_write_register(pcr, SD_BUS_STAT,
+ SD_CLK_TOGGLE_EN | SD_CLK_FORCE_STOP,
+ SD_CLK_TOGGLE_EN);
+ if (err)
+ goto out;
+
+ mdelay(1);
+
+ err = rtsx_pci_read_register(pcr, SD_BUS_STAT, &stat);
+ if (err)
+ goto out;
+
+ err = rtsx_pci_write_register(pcr, SD_BUS_STAT,
+ SD_CLK_TOGGLE_EN | SD_CLK_FORCE_STOP, 0);
+out:
+ mutex_unlock(&pcr->pcr_mutex);
+
+ if (err)
+ return err;
+
+ /* check if any pin between dat[0:3] is low */
+ if ((stat & mask) != mask)
+ return 1;
+ else
+ return 0;
+}
+
static int sdmmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
{
struct realtek_pci_sdmmc *host = mmc_priv(mmc);
@@ -1405,6 +1445,7 @@ static const struct mmc_host_ops realtek
.get_ro = sdmmc_get_ro,
.get_cd = sdmmc_get_cd,
.start_signal_voltage_switch = sdmmc_switch_voltage,
+ .card_busy = sdmmc_card_busy,
.execute_tuning = sdmmc_execute_tuning,
.init_sd_express = sdmmc_init_sd_express,
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 164/280] wifi: ath10k: fix dma_free_coherent() pointer
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 163/280] mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 165/280] wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() Greg Kroah-Hartman
` (120 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Baochen Qiang,
Jeff Johnson
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
commit 9282a1e171ad8d2205067e8ec3bbe4e3cef4f29f upstream.
dma_alloc_coherent() allocates a DMA mapped buffer and stores the
addresses in XXX_unaligned fields. Those should be reused when freeing
the buffer rather than the aligned addresses.
Fixes: 2a1e1ad3fd37 ("ath10k: Add support for 64 bit ce descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260105210439.20131-2-fourier.thomas@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath10k/ce.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -1791,8 +1791,8 @@ static void _ath10k_ce_free_pipe(struct
(ce_state->src_ring->nentries *
sizeof(struct ce_desc) +
CE_DESC_RING_ALIGN),
- ce_state->src_ring->base_addr_owner_space,
- ce_state->src_ring->base_addr_ce_space);
+ ce_state->src_ring->base_addr_owner_space_unaligned,
+ ce_state->src_ring->base_addr_ce_space_unaligned);
kfree(ce_state->src_ring);
}
@@ -1801,8 +1801,8 @@ static void _ath10k_ce_free_pipe(struct
(ce_state->dest_ring->nentries *
sizeof(struct ce_desc) +
CE_DESC_RING_ALIGN),
- ce_state->dest_ring->base_addr_owner_space,
- ce_state->dest_ring->base_addr_ce_space);
+ ce_state->dest_ring->base_addr_owner_space_unaligned,
+ ce_state->dest_ring->base_addr_ce_space_unaligned);
kfree(ce_state->dest_ring);
}
@@ -1822,8 +1822,8 @@ static void _ath10k_ce_free_pipe_64(stru
(ce_state->src_ring->nentries *
sizeof(struct ce_desc_64) +
CE_DESC_RING_ALIGN),
- ce_state->src_ring->base_addr_owner_space,
- ce_state->src_ring->base_addr_ce_space);
+ ce_state->src_ring->base_addr_owner_space_unaligned,
+ ce_state->src_ring->base_addr_ce_space_unaligned);
kfree(ce_state->src_ring);
}
@@ -1832,8 +1832,8 @@ static void _ath10k_ce_free_pipe_64(stru
(ce_state->dest_ring->nentries *
sizeof(struct ce_desc_64) +
CE_DESC_RING_ALIGN),
- ce_state->dest_ring->base_addr_owner_space,
- ce_state->dest_ring->base_addr_ce_space);
+ ce_state->dest_ring->base_addr_owner_space_unaligned,
+ ce_state->dest_ring->base_addr_ce_space_unaligned);
kfree(ce_state->dest_ring);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 165/280] wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 164/280] wifi: ath10k: fix dma_free_coherent() pointer Greg Kroah-Hartman
@ 2026-02-04 14:38 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 166/280] wifi: rsi: Fix memory corruption due to not set vif driver data size Greg Kroah-Hartman
` (119 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:38 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Jeff Chen,
Johannes Berg
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 2120f3a3738a65730c81bf10447b1ff776078915 upstream.
The "i" iterator variable is used to count two different things but
unfortunately we can't store two different numbers in the same variable.
Use "i" for the outside loop and "j" for the inside loop.
Cc: stable@vger.kernel.org
Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/aWAM2MGUWRP0zWUd@stanley.mountain
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -827,7 +827,7 @@ void mwifiex_update_rxreor_flags(struct
static void mwifiex_update_ampdu_rxwinsize(struct mwifiex_adapter *adapter,
bool coex_flag)
{
- u8 i;
+ u8 i, j;
u32 rx_win_size;
struct mwifiex_private *priv;
@@ -867,8 +867,8 @@ static void mwifiex_update_ampdu_rxwinsi
if (rx_win_size != priv->add_ba_param.rx_win_size) {
if (!priv->media_connected)
continue;
- for (i = 0; i < MAX_NUM_TID; i++)
- mwifiex_11n_delba(priv, i);
+ for (j = 0; j < MAX_NUM_TID; j++)
+ mwifiex_11n_delba(priv, j);
}
}
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 166/280] wifi: rsi: Fix memory corruption due to not set vif driver data size
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-02-04 14:38 ` [PATCH 6.1 165/280] wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 167/280] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA Greg Kroah-Hartman
` (118 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Johannes Berg
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@nabladev.com>
commit 4f431d88ea8093afc7ba55edf4652978c5a68f33 upstream.
The struct ieee80211_vif contains trailing space for vif driver data,
when struct ieee80211_vif is allocated, the total memory size that is
allocated is sizeof(struct ieee80211_vif) + size of vif driver data.
The size of vif driver data is set by each WiFi driver as needed.
The RSI911x driver does not set vif driver data size, no trailing space
for vif driver data is therefore allocated past struct ieee80211_vif .
The RSI911x driver does however use the vif driver data to store its
vif driver data structure "struct vif_priv". An access to vif->drv_priv
leads to access out of struct ieee80211_vif bounds and corruption of
some memory.
In case of the failure observed locally, rsi_mac80211_add_interface()
would write struct vif_priv *vif_info = (struct vif_priv *)vif->drv_priv;
vif_info->vap_id = vap_idx. This write corrupts struct fq_tin member
struct list_head new_flows . The flow = list_first_entry(head, struct
fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus
address, which when accessed causes a crash.
The trigger is very simple, boot the machine with init=/bin/sh , mount
devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1",
"ip link set wlan0 down" and the crash occurs.
Fix this by setting the correct size of vif driver data, which is the
size of "struct vif_priv", so that memory is allocated and the driver
can store its driver data in it, instead of corrupting memory around
it.
Cc: stable@vger.kernel.org
Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Link: https://patch.msgid.link/20260109235817.150330-1-marex@nabladev.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -2022,6 +2022,7 @@ int rsi_mac80211_attach(struct rsi_commo
hw->queues = MAX_HW_QUEUES;
hw->extra_tx_headroom = RSI_NEEDED_HEADROOM;
+ hw->vif_data_size = sizeof(struct vif_priv);
hw->max_rates = 1;
hw->max_rate_tries = MAX_RETRIES;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 167/280] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 166/280] wifi: rsi: Fix memory corruption due to not set vif driver data size Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 168/280] arm64: Set __nocfi on swsusp_arch_resume() Greg Kroah-Hartman
` (117 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Mark Brown,
Will Deacon, Catalin Marinas
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4 upstream.
The code to restore a ZA context doesn't attempt to allocate the task's
sve_state before setting TIF_SME. Consequently, restoring a ZA context
can place a task into an invalid state where TIF_SME is set but the
task's sve_state is NULL.
In legitimate but uncommon cases where the ZA signal context was NOT
created by the kernel in the context of the same task (e.g. if the task
is saved/restored with something like CRIU), we have no guarantee that
sve_state had been allocated previously. In these cases, userspace can
enter streaming mode without trapping while sve_state is NULL, causing a
later NULL pointer dereference when the kernel attempts to store the
register state:
| # ./sigreturn-za
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
| Mem abort info:
| ESR = 0x0000000096000046
| EC = 0x25: DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| FSC = 0x06: level 2 translation fault
| Data abort info:
| ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000
| CM = 0, WnR = 1, TnD = 0, TagAccess = 0
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
| user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00
| [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000
| Internal error: Oops: 0000000096000046 [#1] SMP
| Modules linked in:
| CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT
| Hardware name: linux,dummy-virt (DT)
| pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
| pc : sve_save_state+0x4/0xf0
| lr : fpsimd_save_user_state+0xb0/0x1c0
| sp : ffff80008070bcc0
| x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658
| x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000
| x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40
| x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000
| x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c
| x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020
| x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0
| x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48
| x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000
| x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440
| Call trace:
| sve_save_state+0x4/0xf0 (P)
| fpsimd_thread_switch+0x48/0x198
| __switch_to+0x20/0x1c0
| __schedule+0x36c/0xce0
| schedule+0x34/0x11c
| exit_to_user_mode_loop+0x124/0x188
| el0_interrupt+0xc8/0xd8
| __el0_irq_handler_common+0x18/0x24
| el0t_64_irq_handler+0x10/0x1c
| el0t_64_irq+0x198/0x19c
| Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800)
| ---[ end trace 0000000000000000 ]---
Fix this by having restore_za_context() ensure that the task's sve_state
is allocated, matching what we do when taking an SME trap. Any live
SVE/SSVE state (which is restored earlier from a separate signal
context) must be preserved, and hence this is not zeroed.
Fixes: 39782210eb7e ("arm64/sme: Implement ZA signal handling")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/signal.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -433,6 +433,10 @@ static int restore_za_context(struct use
fpsimd_flush_task_state(current);
/* From now, fpsimd_thread_switch() won't touch thread.sve_state */
+ sve_alloc(current, false);
+ if (!current->thread.sve_state)
+ return -ENOMEM;
+
sme_alloc(current, true);
if (!current->thread.za_state) {
current->thread.svcr &= ~SVCR_ZA_MASK;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 168/280] arm64: Set __nocfi on swsusp_arch_resume()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 167/280] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 169/280] octeontx2: Fix otx2_dma_map_page() error return code Greg Kroah-Hartman
` (116 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeson Gao, Zhaoyang Huang,
Will Deacon, Mark Rutland, Catalin Marinas
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
commit e2f8216ca2d8e61a23cb6ec355616339667e0ba6 upstream.
A DABT is reported[1] on an android based system when resume from hiberate.
This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*()
and does not have a CFI hash, but swsusp_arch_resume() will attempt to
verify the CFI hash when calling a copy of swsusp_arch_suspend_exit().
Given that there's an existing requirement that the entrypoint to
swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text
section, we cannot fix this by marking swsusp_arch_suspend_exit() with
SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in
swsusp_arch_resume().
Mark swsusp_arch_resume() as __nocfi to disable the CFI check.
[1]
[ 22.991934][ T1] Unable to handle kernel paging request at virtual address 0000000109170ffc
[ 22.991934][ T1] Mem abort info:
[ 22.991934][ T1] ESR = 0x0000000096000007
[ 22.991934][ T1] EC = 0x25: DABT (current EL), IL = 32 bits
[ 22.991934][ T1] SET = 0, FnV = 0
[ 22.991934][ T1] EA = 0, S1PTW = 0
[ 22.991934][ T1] FSC = 0x07: level 3 translation fault
[ 22.991934][ T1] Data abort info:
[ 22.991934][ T1] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
[ 22.991934][ T1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 22.991934][ T1] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 22.991934][ T1] [0000000109170ffc] user address but active_mm is swapper
[ 22.991934][ T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP
[ 22.991934][ T1] Dumping ftrace buffer:
[ 22.991934][ T1] (ftrace buffer empty)
[ 22.991934][ T1] Modules linked in:
[ 22.991934][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419
[ 22.991934][ T1] Hardware name: Unisoc UMS9360-base Board (DT)
[ 22.991934][ T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 22.991934][ T1] pc : swsusp_arch_resume+0x2ac/0x344
[ 22.991934][ T1] lr : swsusp_arch_resume+0x294/0x344
[ 22.991934][ T1] sp : ffffffc08006b960
[ 22.991934][ T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000
[ 22.991934][ T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820
[ 22.991934][ T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000
[ 22.991934][ T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058
[ 22.991934][ T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004
[ 22.991934][ T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000
[ 22.991934][ T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000
[ 22.991934][ T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b
[ 22.991934][ T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530
[ 22.991934][ T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000
[ 22.991934][ T1] Call trace:
[ 22.991934][ T1] swsusp_arch_resume+0x2ac/0x344
[ 22.991934][ T1] hibernation_restore+0x158/0x18c
[ 22.991934][ T1] load_image_and_restore+0xb0/0xec
[ 22.991934][ T1] software_resume+0xf4/0x19c
[ 22.991934][ T1] software_resume_initcall+0x34/0x78
[ 22.991934][ T1] do_one_initcall+0xe8/0x370
[ 22.991934][ T1] do_initcall_level+0xc8/0x19c
[ 22.991934][ T1] do_initcalls+0x70/0xc0
[ 22.991934][ T1] do_basic_setup+0x1c/0x28
[ 22.991934][ T1] kernel_init_freeable+0xe0/0x148
[ 22.991934][ T1] kernel_init+0x20/0x1a8
[ 22.991934][ T1] ret_from_fork+0x10/0x20
[ 22.991934][ T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110)
Co-developed-by: Jeson Gao <jeson.gao@unisoc.com>
Signed-off-by: Jeson Gao <jeson.gao@unisoc.com>
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Acked-by: Will Deacon <will@kernel.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
[catalin.marinas@arm.com: commit log updated by Mark Rutland]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/hibernate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -397,7 +397,7 @@ int swsusp_arch_suspend(void)
* Memory allocated by get_safe_page() will be dealt with by the hibernate code,
* we don't need to free it here.
*/
-int swsusp_arch_resume(void)
+int __nocfi swsusp_arch_resume(void)
{
int rc;
void *zero_page;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 169/280] octeontx2: Fix otx2_dma_map_page() error return code
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 168/280] arm64: Set __nocfi on swsusp_arch_resume() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 170/280] slimbus: core: fix runtime PM imbalance on report present Greg Kroah-Hartman
` (115 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
commit d998b0e5afffa90d0f03770bad31083767079858 upstream.
0 is a valid DMA address [1] so using it as the error value can lead to
errors. The error value of dma_map_XXX() functions is DMA_MAPPING_ERROR
which is ~0. The callers of otx2_dma_map_page() use dma_mapping_error()
to test the return value of otx2_dma_map_page(). This means that they
would not detect an error in otx2_dma_map_page().
Make otx2_dma_map_page() return the raw value of dma_map_page_attrs().
[1] https://lore.kernel.org/all/f977f68b-cec5-4ab7-b4bd-2cf6aca46267@intel.com
Fixes: caa2da34fd25 ("octeontx2-pf: Initialize and config queues")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Link: https://patch.msgid.link/20260114123107.42387-2-fourier.thomas@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
@@ -864,13 +864,8 @@ static inline dma_addr_t otx2_dma_map_pa
size_t offset, size_t size,
enum dma_data_direction dir)
{
- dma_addr_t iova;
-
- iova = dma_map_page_attrs(pfvf->dev, page,
+ return dma_map_page_attrs(pfvf->dev, page,
offset, size, dir, DMA_ATTR_SKIP_CPU_SYNC);
- if (unlikely(dma_mapping_error(pfvf->dev, iova)))
- return (dma_addr_t)NULL;
- return iova;
}
static inline void otx2_dma_unmap_page(struct otx2_nic *pfvf,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 170/280] slimbus: core: fix runtime PM imbalance on report present
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 169/280] octeontx2: Fix otx2_dma_map_page() error return code Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 171/280] slimbus: core: fix device reference leak " Greg Kroah-Hartman
` (114 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 0eb4ff6596114aabba1070a66afa2c2f5593739f upstream.
Make sure to balance the runtime PM usage count in case slimbus device
or address allocation fails on report present, which would otherwise
prevent the controller from suspending.
Fixes: 4b14e62ad3c9 ("slimbus: Add support for 'clock-pause' feature")
Cc: stable@vger.kernel.org # 4.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251126145329.5022-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/slimbus/core.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/drivers/slimbus/core.c
+++ b/drivers/slimbus/core.c
@@ -496,21 +496,23 @@ int slim_device_report_present(struct sl
if (ctrl->sched.clk_state != SLIM_CLK_ACTIVE) {
dev_err(ctrl->dev, "slim ctrl not active,state:%d, ret:%d\n",
ctrl->sched.clk_state, ret);
- goto slimbus_not_active;
+ goto out_put_rpm;
}
sbdev = slim_get_device(ctrl, e_addr);
- if (IS_ERR(sbdev))
- return -ENODEV;
+ if (IS_ERR(sbdev)) {
+ ret = -ENODEV;
+ goto out_put_rpm;
+ }
if (sbdev->is_laddr_valid) {
*laddr = sbdev->laddr;
- return 0;
+ ret = 0;
+ } else {
+ ret = slim_device_alloc_laddr(sbdev, true);
}
- ret = slim_device_alloc_laddr(sbdev, true);
-
-slimbus_not_active:
+out_put_rpm:
pm_runtime_mark_last_busy(ctrl->dev);
pm_runtime_put_autosuspend(ctrl->dev);
return ret;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 171/280] slimbus: core: fix device reference leak on report present
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 170/280] slimbus: core: fix runtime PM imbalance on report present Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 172/280] intel_th: fix device leak on output open() Greg Kroah-Hartman
` (113 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 9391380eb91ea5ac792aae9273535c8da5b9aa01 upstream.
Slimbus devices can be allocated dynamically upon reception of
report-present messages.
Make sure to drop the reference taken when looking up already registered
devices.
Note that this requires taking an extra reference in case the device has
not yet been registered and has to be allocated.
Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support")
Cc: stable@vger.kernel.org # 4.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251126145329.5022-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/slimbus/core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/slimbus/core.c
+++ b/drivers/slimbus/core.c
@@ -378,6 +378,8 @@ struct slim_device *slim_get_device(stru
sbdev = slim_alloc_device(ctrl, e_addr, NULL);
if (!sbdev)
return ERR_PTR(-ENOMEM);
+
+ get_device(&sbdev->dev);
}
return sbdev;
@@ -512,6 +514,7 @@ int slim_device_report_present(struct sl
ret = slim_device_alloc_laddr(sbdev, true);
}
+ put_device(&sbdev->dev);
out_put_rpm:
pm_runtime_mark_last_busy(ctrl->dev);
pm_runtime_put_autosuspend(ctrl->dev);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 172/280] intel_th: fix device leak on output open()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 171/280] slimbus: core: fix device reference leak " Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 173/280] uacce: fix cdev handling in the cleanup path Greg Kroah-Hartman
` (112 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Shishkin, Ma Ke,
Johan Hovold
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 upstream.
Make sure to drop the reference taken when looking up the th device
during output device open() on errors and on close().
Note that a recent commit fixed the leak in a couple of open() error
paths but not all of them, and the reference is still leaking on
successful open().
Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices")
Fixes: 6d5925b667e4 ("intel_th: Fix error handling in intel_th_output_open")
Cc: stable@vger.kernel.org # 4.4: 6d5925b667e4
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ma Ke <make24@iscas.ac.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251208153524.68637-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/core.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -810,9 +810,12 @@ static int intel_th_output_open(struct i
int err;
dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev);
- if (!dev || !dev->driver) {
+ if (!dev)
+ return -ENODEV;
+
+ if (!dev->driver) {
err = -ENODEV;
- goto out_no_device;
+ goto out_put_device;
}
thdrv = to_intel_th_driver(dev->driver);
@@ -836,12 +839,22 @@ static int intel_th_output_open(struct i
out_put_device:
put_device(dev);
-out_no_device:
+
return err;
}
+static int intel_th_output_release(struct inode *inode, struct file *file)
+{
+ struct intel_th_device *thdev = file->private_data;
+
+ put_device(&thdev->dev);
+
+ return 0;
+}
+
static const struct file_operations intel_th_output_fops = {
.open = intel_th_output_open,
+ .release = intel_th_output_release,
.llseek = noop_llseek,
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 173/280] uacce: fix cdev handling in the cleanup path
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 172/280] intel_th: fix device leak on output open() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 174/280] uacce: implement mremap in uacce_vm_ops to return -EPERM Greg Kroah-Hartman
` (111 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenkai Lin, Chenghai Huang,
Zhangfei Gao
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenkai Lin <linwenkai6@hisilicon.com>
commit a3bece3678f6c88db1f44c602b2a63e84b4040ac upstream.
When cdev_device_add fails, it internally releases the cdev memory,
and if cdev_device_del is then executed, it will cause a hang error.
To fix it, we check the return value of cdev_device_add() and clear
uacce->cdev to avoid calling cdev_device_del in the uacce_remove.
Fixes: 015d239ac014 ("uacce: add uacce driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Link: https://patch.msgid.link/20251202061256.4158641-2-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/uacce/uacce.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/misc/uacce/uacce.c
+++ b/drivers/misc/uacce/uacce.c
@@ -500,6 +500,8 @@ EXPORT_SYMBOL_GPL(uacce_alloc);
*/
int uacce_register(struct uacce_device *uacce)
{
+ int ret;
+
if (!uacce)
return -ENODEV;
@@ -510,7 +512,11 @@ int uacce_register(struct uacce_device *
uacce->cdev->ops = &uacce_fops;
uacce->cdev->owner = THIS_MODULE;
- return cdev_device_add(uacce->cdev, &uacce->dev);
+ ret = cdev_device_add(uacce->cdev, &uacce->dev);
+ if (ret)
+ uacce->cdev = NULL;
+
+ return ret;
}
EXPORT_SYMBOL_GPL(uacce_register);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 174/280] uacce: implement mremap in uacce_vm_ops to return -EPERM
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 173/280] uacce: fix cdev handling in the cleanup path Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 175/280] uacce: ensure safe queue release with state management Greg Kroah-Hartman
` (110 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Shen, Chenghai Huang,
Zhangfei Gao
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Shen <shenyang39@huawei.com>
commit 02695347be532b628f22488300d40c4eba48b9b7 upstream.
The current uacce_vm_ops does not support the mremap operation of
vm_operations_struct. Implement .mremap to return -EPERM to remind
users.
The reason we need to explicitly disable mremap is that when the
driver does not implement .mremap, it uses the default mremap
method. This could lead to a risk scenario:
An application might first mmap address p1, then mremap to p2,
followed by munmap(p1), and finally munmap(p2). Since the default
mremap copies the original vma's vm_private_data (i.e., q) to the
new vma, both munmap operations would trigger vma_close, causing
q->qfr to be freed twice(qfr will be set to null here, so repeated
release is ok).
Fixes: 015d239ac014 ("uacce: add uacce driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yang Shen <shenyang39@huawei.com>
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Link: https://patch.msgid.link/20251202061256.4158641-4-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/uacce/uacce.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/misc/uacce/uacce.c
+++ b/drivers/misc/uacce/uacce.c
@@ -208,8 +208,14 @@ static void uacce_vma_close(struct vm_ar
kfree(qfr);
}
+static int uacce_vma_mremap(struct vm_area_struct *area)
+{
+ return -EPERM;
+}
+
static const struct vm_operations_struct uacce_vm_ops = {
.close = uacce_vma_close,
+ .mremap = uacce_vma_mremap,
};
static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 175/280] uacce: ensure safe queue release with state management
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 174/280] uacce: implement mremap in uacce_vm_ops to return -EPERM Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 176/280] netrom: fix double-free in nr_route_frame() Greg Kroah-Hartman
` (109 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chenghai Huang, Yang Shen,
Zhangfei Gao
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenghai Huang <huangchenghai2@huawei.com>
commit 26c08dabe5475d99a13f353d8dd70e518de45663 upstream.
Directly calling `put_queue` carries risks since it cannot
guarantee that resources of `uacce_queue` have been fully released
beforehand. So adding a `stop_queue` operation for the
UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to
the final resource release ensures safety.
Queue states are defined as follows:
- UACCE_Q_ZOMBIE: Initial state
- UACCE_Q_INIT: After opening `uacce`
- UACCE_Q_STARTED: After `start` is issued via `ioctl`
When executing `poweroff -f` in virt while accelerator are still
working, `uacce_fops_release` and `uacce_remove` may execute
concurrently. This can cause `uacce_put_queue` within
`uacce_fops_release` to access a NULL `ops` pointer. Therefore, add
state checks to prevent accessing freed pointers.
Fixes: 015d239ac014 ("uacce: add uacce driver")
Cc: stable@vger.kernel.org
Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
Signed-off-by: Yang Shen <shenyang39@huawei.com>
Acked-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Link: https://patch.msgid.link/20251202061256.4158641-5-huangchenghai2@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/uacce/uacce.c | 28 +++++++++++++++++++++-------
1 file changed, 21 insertions(+), 7 deletions(-)
--- a/drivers/misc/uacce/uacce.c
+++ b/drivers/misc/uacce/uacce.c
@@ -37,20 +37,34 @@ static int uacce_start_queue(struct uacc
return 0;
}
-static int uacce_put_queue(struct uacce_queue *q)
+static int uacce_stop_queue(struct uacce_queue *q)
{
struct uacce_device *uacce = q->uacce;
- if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue)
+ if (q->state != UACCE_Q_STARTED)
+ return 0;
+
+ if (uacce->ops->stop_queue)
uacce->ops->stop_queue(q);
- if ((q->state == UACCE_Q_INIT || q->state == UACCE_Q_STARTED) &&
- uacce->ops->put_queue)
+ q->state = UACCE_Q_INIT;
+
+ return 0;
+}
+
+static void uacce_put_queue(struct uacce_queue *q)
+{
+ struct uacce_device *uacce = q->uacce;
+
+ uacce_stop_queue(q);
+
+ if (q->state != UACCE_Q_INIT)
+ return;
+
+ if (uacce->ops->put_queue)
uacce->ops->put_queue(q);
q->state = UACCE_Q_ZOMBIE;
-
- return 0;
}
static long uacce_fops_unl_ioctl(struct file *filep,
@@ -77,7 +91,7 @@ static long uacce_fops_unl_ioctl(struct
ret = uacce_start_queue(q);
break;
case UACCE_CMD_PUT_Q:
- ret = uacce_put_queue(q);
+ ret = uacce_stop_queue(q);
break;
default:
if (uacce->ops->ioctl)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 176/280] netrom: fix double-free in nr_route_frame()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 175/280] uacce: ensure safe queue release with state management Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 177/280] perf/x86/intel: Do not enable BTS for guests Greg Kroah-Hartman
` (108 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+999115c3bf275797dc27,
Jeongjun Park, Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <aha310510@gmail.com>
commit ba1096c315283ee3292765f6aea4cca15816c4f7 upstream.
In nr_route_frame(), old_skb is immediately freed without checking if
nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,
the caller function will free old_skb again, causing a double-free bug.
Therefore, to prevent this, we need to modify it to check whether
nr_neigh->ax25 is NULL before freeing old_skb.
Cc: <stable@vger.kernel.org>
Reported-by: syzbot+999115c3bf275797dc27@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69694d6f.050a0220.58bed.0029.GAE@google.com/
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20260119063359.10604-1-aha310510@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netrom/nr_route.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -752,7 +752,7 @@ int nr_route_frame(struct sk_buff *skb,
unsigned char *dptr;
ax25_cb *ax25s;
int ret;
- struct sk_buff *skbn;
+ struct sk_buff *nskb, *oskb;
/*
* Reject malformed packets early. Check that it contains at least 2
@@ -811,14 +811,16 @@ int nr_route_frame(struct sk_buff *skb,
/* We are going to change the netrom headers so we should get our
own skb, we also did not know until now how much header space
we had to reserve... - RXQ */
- if ((skbn=skb_copy_expand(skb, dev->hard_header_len, 0, GFP_ATOMIC)) == NULL) {
+ nskb = skb_copy_expand(skb, dev->hard_header_len, 0, GFP_ATOMIC);
+
+ if (!nskb) {
nr_node_unlock(nr_node);
nr_node_put(nr_node);
dev_put(dev);
return 0;
}
- kfree_skb(skb);
- skb=skbn;
+ oskb = skb;
+ skb = nskb;
skb->data[14]--;
dptr = skb_push(skb, 1);
@@ -837,6 +839,9 @@ int nr_route_frame(struct sk_buff *skb,
nr_node_unlock(nr_node);
nr_node_put(nr_node);
+ if (ret)
+ kfree_skb(oskb);
+
return ret;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 177/280] perf/x86/intel: Do not enable BTS for guests
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 176/280] netrom: fix double-free in nr_route_frame() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 178/280] irqchip/gic-v3-its: Avoid truncating memory addresses Greg Kroah-Hartman
` (107 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan H . Schönherr,
Peter Zijlstra, Fernand Sieber
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernand Sieber <sieberf@amazon.com>
commit 91dcfae0ff2b9b9ab03c1ec95babaceefbffb9f4 upstream.
By default when users program perf to sample branch instructions
(PERF_COUNT_HW_BRANCH_INSTRUCTIONS) with a sample period of 1, perf
interprets this as a special case and enables BTS (Branch Trace Store)
as an optimization to avoid taking an interrupt on every branch.
Since BTS doesn't virtualize, this optimization doesn't make sense when
the request originates from a guest. Add an additional check that
prevents this optimization for virtualized events (exclude_host).
Reported-by: Jan H. Schönherr <jschoenh@amazon.de>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Fernand Sieber <sieberf@amazon.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251211183604.868641-1-sieberf@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/events/perf_event.h | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -1421,13 +1421,22 @@ static inline bool intel_pmu_has_bts_per
struct hw_perf_event *hwc = &event->hw;
unsigned int hw_event, bts_event;
- if (event->attr.freq)
+ /*
+ * Only use BTS for fixed rate period==1 events.
+ */
+ if (event->attr.freq || period != 1)
+ return false;
+
+ /*
+ * BTS doesn't virtualize.
+ */
+ if (event->attr.exclude_host)
return false;
hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
- return hw_event == bts_event && period == 1;
+ return hw_event == bts_event;
}
static inline bool intel_pmu_has_bts(struct perf_event *event)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 178/280] irqchip/gic-v3-its: Avoid truncating memory addresses
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 177/280] perf/x86/intel: Do not enable BTS for guests Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 179/280] can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
` (106 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Thomas Gleixner,
Marc Zyngier
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream.
On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem
allocations to be backed by addresses physical memory above the 32-bit
address limit, as found while experimenting with larger VMSPLIT
configurations.
This caused the qemu virt model to crash in the GICv3 driver, which
allocates the 'itt' object using GFP_KERNEL. Since all memory below
the 4GB physical address limit is in ZONE_DMA in this configuration,
kmalloc() defaults to higher addresses for ZONE_NORMAL, and the
ITS driver stores the physical address in a 32-bit 'unsigned long'
variable.
Change the itt_addr variable to the correct phys_addr_t type instead,
along with all other variables in this driver that hold a physical
address.
The gicv5 driver correctly uses u64 variables, while all other irqchip
drivers don't call virt_to_phys or similar interfaces. It's expected that
other device drivers have similar issues, but fixing this one is
sufficient for booting a virtio based guest.
Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-gic-v3-its.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -613,7 +613,7 @@ static struct its_collection *its_build_
struct its_cmd_block *cmd,
struct its_cmd_desc *desc)
{
- unsigned long itt_addr;
+ phys_addr_t itt_addr;
u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites);
itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt);
@@ -784,7 +784,7 @@ static struct its_vpe *its_build_vmapp_c
struct its_cmd_desc *desc)
{
struct its_vpe *vpe = valid_vpe(its, desc->its_vmapp_cmd.vpe);
- unsigned long vpt_addr, vconf_addr;
+ phys_addr_t vpt_addr, vconf_addr;
u64 target;
bool alloc;
@@ -2399,10 +2399,10 @@ retry_baser:
baser->psz = psz;
tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz;
- pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n",
+ pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n",
&its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp),
its_base_type_string[type],
- (unsigned long)virt_to_phys(base),
+ (u64)virt_to_phys(base),
indirect ? "indirect" : "flat", (int)esz,
psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 179/280] can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 178/280] irqchip/gic-v3-its: Avoid truncating memory addresses Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 180/280] can: kvaser_usb: kvaser_usb_read_bulk_callback(): " Greg Kroah-Hartman
` (105 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 0ce73a0eb5a27070957b67fd74059b6da89cc516 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").
In ems_usb_open(), the URBs for USB-in transfers are allocated, added to
the dev->rx_submitted anchor and submitted. In the complete callback
ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In
ems_usb_close() the URBs are freed by calling
usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in ems_usb_close().
Fix the memory leak by anchoring the URB in the
ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.
Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-1-4b8cb2915571@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/ems_usb.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -486,11 +486,17 @@ resubmit_urb:
urb->transfer_buffer, RX_BUFFER_SIZE,
ems_usb_read_bulk_callback, dev);
+ usb_anchor_urb(urb, &dev->rx_submitted);
+
retval = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!retval)
+ return;
+
+ usb_unanchor_urb(urb);
if (retval == -ENODEV)
netif_device_detach(netdev);
- else if (retval)
+ else
netdev_err(netdev,
"failed resubmitting read bulk urb: %d\n", retval);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 180/280] can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 179/280] can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 181/280] can: mcba_usb: mcba_usb_read_bulk_callback(): " Greg Kroah-Hartman
` (104 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 248e8e1a125fa875158df521b30f2cc7e27eeeaa upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").
In kvaser_usb_set_{,data_}bittiming() -> kvaser_usb_setup_rx_urbs(), the
URBs for USB-in transfers are allocated, added to the dev->rx_submitted
anchor and submitted. In the complete callback
kvaser_usb_read_bulk_callback(), the URBs are processed and resubmitted. In
kvaser_usb_remove_interfaces() the URBs are freed by calling
usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the
kvaser_usb_read_bulk_callback() to the dev->rx_submitted anchor.
Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-3-4b8cb2915571@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -349,7 +349,14 @@ resubmit_urb:
urb->transfer_buffer, KVASER_USB_RX_BUFFER_SIZE,
kvaser_usb_read_bulk_callback, dev);
+ usb_anchor_urb(urb, &dev->rx_submitted);
+
err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!err)
+ return;
+
+ usb_unanchor_urb(urb);
+
if (err == -ENODEV) {
for (i = 0; i < dev->nchannels; i++) {
if (!dev->nets[i])
@@ -357,7 +364,7 @@ resubmit_urb:
netif_device_detach(dev->nets[i]->netdev);
}
- } else if (err) {
+ } else {
dev_err(&dev->intf->dev,
"Failed resubmitting read bulk urb: %d\n", err);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 181/280] can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 180/280] can: kvaser_usb: kvaser_usb_read_bulk_callback(): " Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 182/280] can: usb_8dev: usb_8dev_read_bulk_callback(): " Greg Kroah-Hartman
` (103 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 710a7529fb13c5a470258ff5508ed3c498d54729 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").
In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are
allocated, added to the priv->rx_submitted anchor and submitted. In the
complete callback mcba_usb_read_bulk_callback(), the URBs are processed and
resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by
calling usb_kill_anchored_urbs(&priv->rx_submitted).
However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the
mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.
Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-4-4b8cb2915571@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/mcba_usb.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -608,11 +608,17 @@ resubmit_urb:
urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE,
mcba_usb_read_bulk_callback, priv);
+ usb_anchor_urb(urb, &priv->rx_submitted);
+
retval = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!retval)
+ return;
+
+ usb_unanchor_urb(urb);
if (retval == -ENODEV)
netif_device_detach(netdev);
- else if (retval)
+ else
netdev_err(netdev, "failed resubmitting read bulk urb: %d\n",
retval);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 182/280] can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 181/280] can: mcba_usb: mcba_usb_read_bulk_callback(): " Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 183/280] migrate: correct lock ordering for hugetlb file folios Greg Kroah-Hartman
` (102 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit f7a980b3b8f80fe367f679da376cf76e800f9480 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").
In usb_8dev_open() -> usb_8dev_start(), the URBs for USB-in transfers are
allocated, added to the priv->rx_submitted anchor and submitted. In the
complete callback usb_8dev_read_bulk_callback(), the URBs are processed and
resubmitted. In usb_8dev_close() -> unlink_all_urbs() the URBs are freed by
calling usb_kill_anchored_urbs(&priv->rx_submitted).
However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in usb_kill_anchored_urbs().
Fix the memory leak by anchoring the URB in the
usb_8dev_read_bulk_callback() to the priv->rx_submitted anchor.
Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-5-4b8cb2915571@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/usb_8dev.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -541,11 +541,17 @@ resubmit_urb:
urb->transfer_buffer, RX_BUFFER_SIZE,
usb_8dev_read_bulk_callback, priv);
+ usb_anchor_urb(urb, &priv->rx_submitted);
+
retval = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!retval)
+ return;
+
+ usb_unanchor_urb(urb);
if (retval == -ENODEV)
netif_device_detach(netdev);
- else if (retval)
+ else
netdev_err(netdev,
"failed resubmitting read bulk urb: %d\n", retval);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 183/280] migrate: correct lock ordering for hugetlb file folios
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 182/280] can: usb_8dev: usb_8dev_read_bulk_callback(): " Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 184/280] bpf: Do not let BPF test infra emit invalid GSO types to stack Greg Kroah-Hartman
` (101 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Wilcox (Oracle),
syzbot+2d9c96466c978346b55f, David Hildenbrand (Red Hat), Zi Yan,
Alistair Popple, Byungchul Park, Gregory Price, Jann Horn,
Joshua Hahn, Liam Howlett, Lorenzo Stoakes, Matthew Brost,
Rakie Kim, Rik van Riel, Vlastimil Babka, Ying Huang,
Andrew Morton, Lance Yang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <willy@infradead.org>
commit b7880cb166ab62c2409046b2347261abf701530e upstream.
Syzbot has found a deadlock (analyzed by Lance Yang):
1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock).
2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire
folio_lock.
migrate_pages()
-> migrate_hugetlbs()
-> unmap_and_move_huge_page() <- Takes folio_lock!
-> remove_migration_ptes()
-> __rmap_walk_file()
-> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)!
hugetlbfs_fallocate()
-> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)!
-> hugetlbfs_zero_partial_page()
-> filemap_lock_hugetlb_folio()
-> filemap_lock_folio()
-> __filemap_get_folio <- Waits for folio_lock!
The migration path is the one taking locks in the wrong order according to
the documentation at the top of mm/rmap.c. So expand the scope of the
existing i_mmap_lock to cover the calls to remove_migration_ptes() too.
This is (mostly) how it used to be after commit c0d0381ade79. That was
removed by 336bf30eb765 for both file & anon hugetlb pages when it should
only have been removed for anon hugetlb pages.
Link: https://lkml.kernel.org/r/20260109041345.3863089-2-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Fixes: 336bf30eb765 ("hugetlbfs: fix anon huge page migration race")
Reported-by: syzbot+2d9c96466c978346b55f@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/68e9715a.050a0220.1186a4.000d.GAE@google.com
Debugged-by: Lance Yang <lance.yang@linux.dev>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Jann Horn <jannh@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/migrate.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1357,6 +1357,7 @@ static int unmap_and_move_huge_page(new_
struct page *new_hpage;
struct anon_vma *anon_vma = NULL;
struct address_space *mapping = NULL;
+ enum ttu_flags ttu = 0;
/*
* Migratability of hugepages depends on architectures and their size.
@@ -1409,8 +1410,6 @@ static int unmap_and_move_huge_page(new_
goto put_anon;
if (folio_mapped(src)) {
- enum ttu_flags ttu = 0;
-
if (!folio_test_anon(src)) {
/*
* In shared mappings, try_to_unmap could potentially
@@ -1427,9 +1426,6 @@ static int unmap_and_move_huge_page(new_
try_to_migrate(src, ttu);
page_was_mapped = 1;
-
- if (ttu & TTU_RMAP_LOCKED)
- i_mmap_unlock_write(mapping);
}
if (!folio_mapped(src))
@@ -1437,7 +1433,11 @@ static int unmap_and_move_huge_page(new_
if (page_was_mapped)
remove_migration_ptes(src,
- rc == MIGRATEPAGE_SUCCESS ? dst : src, false);
+ rc == MIGRATEPAGE_SUCCESS ? dst : src,
+ ttu ? true : false);
+
+ if (ttu & TTU_RMAP_LOCKED)
+ i_mmap_unlock_write(mapping);
unlock_put_anon:
folio_unlock(dst);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 184/280] bpf: Do not let BPF test infra emit invalid GSO types to stack
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 183/280] migrate: correct lock ordering for hugetlb file folios Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 185/280] bpf: Reject narrower access to pointer ctx fields Greg Kroah-Hartman
` (100 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yinhao Hu, Kaiyan Mei, Dongliang Mu,
Daniel Borkmann, Martin KaFai Lau, Shung-Hsi Yu
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit 04a899573fb87273a656f178b5f920c505f68875 upstream.
Yinhao et al. reported that their fuzzer tool was able to trigger a
skb_warn_bad_offload() from netif_skb_features() -> gso_features_check().
When a BPF program - triggered via BPF test infra - pushes the packet
to the loopback device via bpf_clone_redirect() then mentioned offload
warning can be seen. GSO-related features are then rightfully disabled.
We get into this situation due to convert___skb_to_skb() setting
gso_segs and gso_size but not gso_type. Technically, it makes sense
that this warning triggers since the GSO properties are malformed due
to the gso_type. Potentially, the gso_type could be marked non-trustworthy
through setting it at least to SKB_GSO_DODGY without any other specific
assumptions, but that also feels wrong given we should not go further
into the GSO engine in the first place.
The checks were added in 121d57af308d ("gso: validate gso_type in GSO
handlers") because there were malicious (syzbot) senders that combine
a protocol with a non-matching gso_type. If we would want to drop such
packets, gso_features_check() currently only returns feature flags via
netif_skb_features(), so one location for potentially dropping such skbs
could be validate_xmit_unreadable_skb(), but then otoh it would be
an additional check in the fast-path for a very corner case. Given
bpf_clone_redirect() is the only place where BPF test infra could emit
such packets, lets reject them right there.
Fixes: 850a88cc4096 ("bpf: Expose __sk_buff wire_len/gso_segs to BPF_PROG_TEST_RUN")
Fixes: cf62089b0edd ("bpf: Add gso_size to __sk_buff")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20251020075441.127980-1-daniel@iogearbox.net
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bpf/test_run.c | 5 +++++
net/core/filter.c | 7 +++++++
2 files changed, 12 insertions(+)
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -1047,6 +1047,11 @@ static int convert___skb_to_skb(struct s
if (__skb->gso_segs > GSO_MAX_SEGS)
return -EINVAL;
+
+ /* Currently GSO type is zero/unset. If this gets extended with
+ * a small list of accepted GSO types in future, the filter for
+ * an unset GSO type in bpf_clone_redirect() can be lifted.
+ */
skb_shinfo(skb)->gso_segs = __skb->gso_segs;
skb_shinfo(skb)->gso_size = __skb->gso_size;
skb_shinfo(skb)->hwtstamps.hwtstamp = __skb->hwtstamp;
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2444,6 +2444,13 @@ BPF_CALL_3(bpf_clone_redirect, struct sk
if (unlikely(flags & (~(BPF_F_INGRESS) | BPF_F_REDIRECT_INTERNAL)))
return -EINVAL;
+ /* BPF test infra's convert___skb_to_skb() can create type-less
+ * GSO packets. gso_features_check() will detect this as a bad
+ * offload. However, lets not leak them out in the first place.
+ */
+ if (unlikely(skb_is_gso(skb) && !skb_shinfo(skb)->gso_type))
+ return -EBADMSG;
+
dev = dev_get_by_index_rcu(dev_net(skb->dev), ifindex);
if (unlikely(!dev))
return -EINVAL;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 185/280] bpf: Reject narrower access to pointer ctx fields
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 184/280] bpf: Do not let BPF test infra emit invalid GSO types to stack Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 186/280] mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure Greg Kroah-Hartman
` (99 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0ef84a7bdf5301d4cbec,
Paul Chaignon, Martin KaFai Lau, Eduard Zingerman, Shung-Hsi Yu
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Chaignon <paul.chaignon@gmail.com>
commit e09299225d5ba3916c91ef70565f7d2187e4cca0 upstream.
The following BPF program, simplified from a syzkaller repro, causes a
kernel warning:
r0 = *(u8 *)(r1 + 169);
exit;
With pointer field sk being at offset 168 in __sk_buff. This access is
detected as a narrower read in bpf_skb_is_valid_access because it
doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed
and later proceeds to bpf_convert_ctx_access. Note that for the
"is_narrower_load" case in the convert_ctx_accesses(), the insn->off
is aligned, so the cnt may not be 0 because it matches the
offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,
the target_size stays 0 and the verifier errors with a kernel warning:
verifier bug: error during ctx access conversion(1)
This patch fixes that to return a proper "invalid bpf_context access
off=X size=Y" error on the load instruction.
The same issue affects multiple other fields in context structures that
allow narrow access. Some other non-affected fields (for sk_msg,
sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for
consistency.
Note this syzkaller crash was reported in the "Closes" link below, which
used to be about a different bug, fixed in
commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions
in insn_def_regno()"). Because syzbot somehow confused the two bugs,
the new crash and repro didn't get reported to the mailing list.
Fixes: f96da09473b52 ("bpf: simplify narrower ctx access")
Fixes: 0df1a55afa832 ("bpf: Warn on internal verifier errors")
Reported-by: syzbot+0ef84a7bdf5301d4cbec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0ef84a7bdf5301d4cbec
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/3b8dcee67ff4296903351a974ddd9c4dca768b64.1753194596.git.paul.chaignon@gmail.com
[shung-hsi.yu: offset(struct bpf_sock_ops, skb_hwtstamp) case was
dropped becasuse it was only added in v6.2 with commit 9bb053490f1a
("bpf: Add hwtstamp field for the sockops prog")]
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/cgroup.c | 8 ++++----
net/core/filter.c | 18 +++++++++---------
2 files changed, 13 insertions(+), 13 deletions(-)
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -2384,22 +2384,22 @@ static bool cg_sockopt_is_valid_access(i
}
switch (off) {
- case offsetof(struct bpf_sockopt, sk):
+ case bpf_ctx_range_ptr(struct bpf_sockopt, sk):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_SOCKET;
break;
- case offsetof(struct bpf_sockopt, optval):
+ case bpf_ctx_range_ptr(struct bpf_sockopt, optval):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_PACKET;
break;
- case offsetof(struct bpf_sockopt, optval_end):
+ case bpf_ctx_range_ptr(struct bpf_sockopt, optval_end):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_PACKET_END;
break;
- case offsetof(struct bpf_sockopt, retval):
+ case bpf_ctx_range(struct bpf_sockopt, retval):
if (size != size_default)
return false;
return prog->expected_attach_type == BPF_CGROUP_GETSOCKOPT;
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -8522,7 +8522,7 @@ static bool bpf_skb_is_valid_access(int
if (size != sizeof(__u64))
return false;
break;
- case offsetof(struct __sk_buff, sk):
+ case bpf_ctx_range_ptr(struct __sk_buff, sk):
if (type == BPF_WRITE || size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_SOCK_COMMON_OR_NULL;
@@ -9106,7 +9106,7 @@ static bool sock_addr_is_valid_access(in
return false;
}
break;
- case offsetof(struct bpf_sock_addr, sk):
+ case bpf_ctx_range_ptr(struct bpf_sock_addr, sk):
if (type != BPF_READ)
return false;
if (size != sizeof(__u64))
@@ -9160,17 +9160,17 @@ static bool sock_ops_is_valid_access(int
if (size != sizeof(__u64))
return false;
break;
- case offsetof(struct bpf_sock_ops, sk):
+ case bpf_ctx_range_ptr(struct bpf_sock_ops, sk):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_SOCKET_OR_NULL;
break;
- case offsetof(struct bpf_sock_ops, skb_data):
+ case bpf_ctx_range_ptr(struct bpf_sock_ops, skb_data):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_PACKET;
break;
- case offsetof(struct bpf_sock_ops, skb_data_end):
+ case bpf_ctx_range_ptr(struct bpf_sock_ops, skb_data_end):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_PACKET_END;
@@ -9245,17 +9245,17 @@ static bool sk_msg_is_valid_access(int o
return false;
switch (off) {
- case offsetof(struct sk_msg_md, data):
+ case bpf_ctx_range_ptr(struct sk_msg_md, data):
info->reg_type = PTR_TO_PACKET;
if (size != sizeof(__u64))
return false;
break;
- case offsetof(struct sk_msg_md, data_end):
+ case bpf_ctx_range_ptr(struct sk_msg_md, data_end):
info->reg_type = PTR_TO_PACKET_END;
if (size != sizeof(__u64))
return false;
break;
- case offsetof(struct sk_msg_md, sk):
+ case bpf_ctx_range_ptr(struct sk_msg_md, sk):
if (size != sizeof(__u64))
return false;
info->reg_type = PTR_TO_SOCKET;
@@ -11444,7 +11444,7 @@ static bool sk_lookup_is_valid_access(in
return false;
switch (off) {
- case offsetof(struct bpf_sk_lookup, sk):
+ case bpf_ctx_range_ptr(struct bpf_sk_lookup, sk):
info->reg_type = PTR_TO_SOCKET_OR_NULL;
return size == sizeof(__u64);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 186/280] mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 185/280] bpf: Reject narrower access to pointer ctx fields Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 187/280] mm/damon/sysfs-scheme: cleanup access_pattern " Greg Kroah-Hartman
` (98 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, chongjiapeng,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit dc7e1d75fd8c505096d0cddeca9e2efb2b55aaf9 upstream.
When a DAMOS-scheme DAMON sysfs directory setup fails after setup of
quotas/ directory, subdirectories of quotas/ directory are not cleaned up.
As a result, DAMON sysfs interface is nearly broken until the system
reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-4-sj@kernel.org
Fixes: 1b32234ab087 ("mm/damon/sysfs: support DAMOS watermarks")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: chongjiapeng <jiapeng.chong@linux.alibaba.com>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -859,7 +859,7 @@ static int damon_sysfs_scheme_add_dirs(s
goto put_access_pattern_out;
err = damon_sysfs_scheme_set_watermarks(scheme);
if (err)
- goto put_quotas_access_pattern_out;
+ goto rmdir_put_quotas_access_pattern_out;
err = damon_sysfs_scheme_set_stats(scheme);
if (err)
goto put_watermarks_quotas_access_pattern_out;
@@ -868,7 +868,8 @@ static int damon_sysfs_scheme_add_dirs(s
put_watermarks_quotas_access_pattern_out:
kobject_put(&scheme->watermarks->kobj);
scheme->watermarks = NULL;
-put_quotas_access_pattern_out:
+rmdir_put_quotas_access_pattern_out:
+ damon_sysfs_quotas_rm_dirs(scheme->quotas);
kobject_put(&scheme->quotas->kobj);
scheme->quotas = NULL;
put_access_pattern_out:
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 187/280] mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 186/280] mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 188/280] Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work Greg Kroah-Hartman
` (97 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, chongjiapeng,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 392b3d9d595f34877dd745b470c711e8ebcd225c upstream.
When a DAMOS-scheme DAMON sysfs directory setup fails after setup of
access_pattern/ directory, subdirectories of access_pattern/ directory are
not cleaned up. As a result, DAMON sysfs interface is nearly broken until
the system reboots, and the memory for the unremoved directory is leaked.
Cleanup the directories under such failures.
Link: https://lkml.kernel.org/r/20251225023043.18579-5-sj@kernel.org
Fixes: 9bbb820a5bd5 ("mm/damon/sysfs: support DAMOS quotas")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: chongjiapeng <jiapeng.chong@linux.alibaba.com>
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -856,7 +856,7 @@ static int damon_sysfs_scheme_add_dirs(s
return err;
err = damon_sysfs_scheme_set_quotas(scheme);
if (err)
- goto put_access_pattern_out;
+ goto rmdir_put_access_pattern_out;
err = damon_sysfs_scheme_set_watermarks(scheme);
if (err)
goto rmdir_put_quotas_access_pattern_out;
@@ -872,7 +872,8 @@ rmdir_put_quotas_access_pattern_out:
damon_sysfs_quotas_rm_dirs(scheme->quotas);
kobject_put(&scheme->quotas->kobj);
scheme->quotas = NULL;
-put_access_pattern_out:
+rmdir_put_access_pattern_out:
+ damon_sysfs_access_pattern_rm_dirs(scheme->access_pattern);
kobject_put(&scheme->access_pattern->kobj);
scheme->access_pattern = NULL;
return err;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 188/280] Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 187/280] mm/damon/sysfs-scheme: cleanup access_pattern " Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 189/280] net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() Greg Kroah-Hartman
` (96 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jia-Hong Su, Luiz Augusto von Dentz,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Hong Su <s11242586@gmail.com>
[ Upstream commit 0c3cd7a0b862c37acbee6d9502107146cc944398 ]
hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling
hci_uart_register_dev(), which calls proto->open() to initialize
hu->priv. However, if a TTY write wakeup occurs during this window,
hci_uart_tx_wakeup() may schedule write_work before hu->priv is
initialized, leading to a NULL pointer dereference in
hci_uart_write_work() when proto->dequeue() accesses hu->priv.
The race condition is:
CPU0 CPU1
---- ----
hci_uart_set_proto()
set_bit(HCI_UART_PROTO_INIT)
hci_uart_register_dev()
tty write wakeup
hci_uart_tty_wakeup()
hci_uart_tx_wakeup()
schedule_work(&hu->write_work)
proto->open(hu)
// initializes hu->priv
hci_uart_write_work()
hci_uart_dequeue()
proto->dequeue(hu)
// accesses hu->priv (NULL!)
Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open()
succeeds, ensuring hu->priv is initialized before any work can be
scheduled.
Fixes: 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization")
Link: https://lore.kernel.org/linux-bluetooth/6969764f.170a0220.2b9fc4.35a7@mx.google.com/
Signed-off-by: Jia-Hong Su <s11242586@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_ldisc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 6a90fc69ef444..2752857dbccf3 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -687,6 +687,8 @@ static int hci_uart_register_dev(struct hci_uart *hu)
return err;
}
+ set_bit(HCI_UART_PROTO_INIT, &hu->flags);
+
if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))
return 0;
@@ -714,8 +716,6 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id)
hu->proto = p;
- set_bit(HCI_UART_PROTO_INIT, &hu->flags);
-
err = hci_uart_register_dev(hu);
if (err) {
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 189/280] net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 188/280] Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 190/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Greg Kroah-Hartman
` (95 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Tariq Toukan,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 108948f723b13874b7ebf6b3f1cc598a7de38622 ]
In esw_acl_ingress_lgcy_setup(), if esw_acl_table_create() fails,
the function returns directly without releasing the previously
created counter, leading to a memory leak.
Fix this by jumping to the out label instead of returning directly,
which aligns with the error handling logic of other paths in this
function.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260120134640.2717808-1-zilin@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
index 093ed86a0acd8..db51c500ed359 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
@@ -188,7 +188,7 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,
if (IS_ERR(vport->ingress.acl)) {
err = PTR_ERR(vport->ingress.acl);
vport->ingress.acl = NULL;
- return err;
+ goto out;
}
err = esw_acl_ingress_lgcy_groups_create(esw, vport);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 190/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix error message
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 189/280] net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 191/280] bonding: annotate data-races around slave->last_rx Greg Kroah-Hartman
` (94 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Marc Kleine-Budde,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 494fc029f662c331e06b7c2031deff3c64200eed ]
Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback():
unanchor URL on usb_submit_urb() error") a failing resubmit URB will print
an info message.
In the case of a short read where netdev has not yet been assigned,
initialize as NULL to avoid dereferencing an undefined value. Also report
the error value of the failed resubmit.
Fixes: 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/all/20260119181904.1209979-1-kuba@kernel.org/
Link: https://patch.msgid.link/20260120-gs_usb-fix-error-message-v1-1-6be04de572bc@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/gs_usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index f782c3aa179e0..8859e65d4470b 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -526,7 +526,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
{
struct gs_usb *parent = urb->context;
struct gs_can *dev;
- struct net_device *netdev;
+ struct net_device *netdev = NULL;
int rc;
struct net_device_stats *stats;
struct gs_host_frame *hf = urb->transfer_buffer;
@@ -674,7 +674,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
}
} else if (rc != -ESHUTDOWN && net_ratelimit()) {
netdev_info(netdev, "failed to re-submit IN URB: %pe\n",
- ERR_PTR(urb->status));
+ ERR_PTR(rc));
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 191/280] bonding: annotate data-races around slave->last_rx
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 190/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 192/280] net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() Greg Kroah-Hartman
` (93 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, syzbot, Jakub Kicinski,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f6c3665b6dc53c3ab7d31b585446a953a74340ef ]
slave->last_rx and slave->target_last_arp_rx[...] can be read and written
locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.
syzbot reported:
BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate
write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:
bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335
bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533
__netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039
__netif_receive_skb_one_core net/core/dev.c:6150 [inline]
__netif_receive_skb+0x59/0x270 net/core/dev.c:6265
netif_receive_skb_internal net/core/dev.c:6351 [inline]
netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
...
write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:
bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335
bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533
__netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039
__netif_receive_skb_one_core net/core/dev.c:6150 [inline]
__netif_receive_skb+0x59/0x270 net/core/dev.c:6265
netif_receive_skb_internal net/core/dev.c:6351 [inline]
netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
br_netif_receive_skb net/bridge/br_input.c:30 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
...
value changed: 0x0000000100005365 -> 0x0000000100005366
Fixes: f5b2b966f032 ("[PATCH] bonding: Validate probe replies in ARP monitor")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://patch.msgid.link/20260122162914.2299312-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_main.c | 18 ++++++++++--------
drivers/net/bonding/bond_options.c | 8 ++++----
include/net/bonding.h | 13 +++++++------
3 files changed, 21 insertions(+), 18 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b0bc811aaab91..71912ddfa7149 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3082,8 +3082,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32
__func__, &sip);
return;
}
- slave->last_rx = jiffies;
- slave->target_last_arp_rx[i] = jiffies;
+ WRITE_ONCE(slave->last_rx, jiffies);
+ WRITE_ONCE(slave->target_last_arp_rx[i], jiffies);
}
static int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
@@ -3302,8 +3302,8 @@ static void bond_validate_na(struct bonding *bond, struct slave *slave,
__func__, saddr);
return;
}
- slave->last_rx = jiffies;
- slave->target_last_arp_rx[i] = jiffies;
+ WRITE_ONCE(slave->last_rx, jiffies);
+ WRITE_ONCE(slave->target_last_arp_rx[i], jiffies);
}
static int bond_na_rcv(const struct sk_buff *skb, struct bonding *bond,
@@ -3373,7 +3373,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond,
(slave_do_arp_validate_only(bond) && is_ipv6) ||
#endif
!slave_do_arp_validate_only(bond))
- slave->last_rx = jiffies;
+ WRITE_ONCE(slave->last_rx, jiffies);
return RX_HANDLER_ANOTHER;
} else if (is_arp) {
return bond_arp_rcv(skb, bond, slave);
@@ -3441,7 +3441,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
if (slave->link != BOND_LINK_UP) {
if (bond_time_in_interval(bond, last_tx, 1) &&
- bond_time_in_interval(bond, slave->last_rx, 1)) {
+ bond_time_in_interval(bond, READ_ONCE(slave->last_rx), 1)) {
bond_propose_link_state(slave, BOND_LINK_UP);
slave_state_changed = 1;
@@ -3465,8 +3465,10 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
* when the source ip is 0, so don't take the link down
* if we don't know our ip yet
*/
- if (!bond_time_in_interval(bond, last_tx, bond->params.missed_max) ||
- !bond_time_in_interval(bond, slave->last_rx, bond->params.missed_max)) {
+ if (!bond_time_in_interval(bond, last_tx,
+ bond->params.missed_max) ||
+ !bond_time_in_interval(bond, READ_ONCE(slave->last_rx),
+ bond->params.missed_max)) {
bond_propose_link_state(slave, BOND_LINK_DOWN);
slave_state_changed = 1;
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 1235878d87159..9473e76c6dc9d 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -1133,7 +1133,7 @@ static void _bond_options_arp_ip_target_set(struct bonding *bond, int slot,
if (slot >= 0 && slot < BOND_MAX_ARP_TARGETS) {
bond_for_each_slave(bond, slave, iter)
- slave->target_last_arp_rx[slot] = last_rx;
+ WRITE_ONCE(slave->target_last_arp_rx[slot], last_rx);
targets[slot] = target;
}
}
@@ -1202,8 +1202,8 @@ static int bond_option_arp_ip_target_rem(struct bonding *bond, __be32 target)
bond_for_each_slave(bond, slave, iter) {
targets_rx = slave->target_last_arp_rx;
for (i = ind; (i < BOND_MAX_ARP_TARGETS-1) && targets[i+1]; i++)
- targets_rx[i] = targets_rx[i+1];
- targets_rx[i] = 0;
+ WRITE_ONCE(targets_rx[i], READ_ONCE(targets_rx[i+1]));
+ WRITE_ONCE(targets_rx[i], 0);
}
for (i = ind; (i < BOND_MAX_ARP_TARGETS-1) && targets[i+1]; i++)
targets[i] = targets[i+1];
@@ -1358,7 +1358,7 @@ static void _bond_options_ns_ip6_target_set(struct bonding *bond, int slot,
if (slot >= 0 && slot < BOND_MAX_NS_TARGETS) {
bond_for_each_slave(bond, slave, iter) {
- slave->target_last_arp_rx[slot] = last_rx;
+ WRITE_ONCE(slave->target_last_arp_rx[slot], last_rx);
slave_set_ns_maddr(bond, slave, target, &targets[slot]);
}
targets[slot] = *target;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index bfd3e4e58f861..bdfbe77c18420 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -525,13 +525,14 @@ static inline int bond_is_ip6_target_ok(struct in6_addr *addr)
static inline unsigned long slave_oldest_target_arp_rx(struct bonding *bond,
struct slave *slave)
{
+ unsigned long tmp, ret = READ_ONCE(slave->target_last_arp_rx[0]);
int i = 1;
- unsigned long ret = slave->target_last_arp_rx[0];
-
- for (; (i < BOND_MAX_ARP_TARGETS) && bond->params.arp_targets[i]; i++)
- if (time_before(slave->target_last_arp_rx[i], ret))
- ret = slave->target_last_arp_rx[i];
+ for (; (i < BOND_MAX_ARP_TARGETS) && bond->params.arp_targets[i]; i++) {
+ tmp = READ_ONCE(slave->target_last_arp_rx[i]);
+ if (time_before(tmp, ret))
+ ret = tmp;
+ }
return ret;
}
@@ -541,7 +542,7 @@ static inline unsigned long slave_last_rx(struct bonding *bond,
if (bond->params.arp_all_targets == BOND_ARP_TARGETS_ALL)
return slave_oldest_target_arp_rx(bond, slave);
- return slave->last_rx;
+ return READ_ONCE(slave->last_rx);
}
static inline void slave_update_last_tx(struct slave *slave)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 192/280] net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 191/280] bonding: annotate data-races around slave->last_rx Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 193/280] ipv6: use the right ifindex when replying to icmpv6 from localhost Greg Kroah-Hartman
` (92 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Maxime Chevallier,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 09f979d1f312627b31d2ee1e46f9692e442610cd ]
In mvpp2_ethtool_cls_rule_ins(), the ethtool_rule is allocated by
ethtool_rx_flow_rule_create(). If the subsequent conversion to flow
type fails, the function jumps to the clean_rule label.
However, the clean_rule label only frees efs, skipping the cleanup
of ethtool_rule, which leads to a memory leak.
Fix this by jumping to the clean_eth_rule label, which properly calls
ethtool_rx_flow_rule_destroy() before freeing efs.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
Fixes: f4f1ba18195d ("net: mvpp2: cls: Report an error for unsupported flow types")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20260123065716.2248324-1-zilin@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
index d2757cc116139..038382a0b8e9f 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c
@@ -1389,7 +1389,7 @@ int mvpp2_ethtool_cls_rule_ins(struct mvpp2_port *port,
efs->rule.flow_type = mvpp2_cls_ethtool_flow_to_type(info->fs.flow_type);
if (efs->rule.flow_type < 0) {
ret = efs->rule.flow_type;
- goto clean_rule;
+ goto clean_eth_rule;
}
ret = mvpp2_cls_rfs_parse_rule(&efs->rule);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 193/280] ipv6: use the right ifindex when replying to icmpv6 from localhost
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 192/280] net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 194/280] net: wwan: t7xx: fix potential skb->frags overflow in RX path Greg Kroah-Hartman
` (91 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
David Ahern, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 03cbcdf93866e61beb0063392e6dbb701f03aea2 ]
When replying to a ICMPv6 echo request that comes from localhost address
the right output ifindex is 1 (lo) and not rt6i_idev dev index. Use the
skb device ifindex instead. This fixes pinging to a local address from
localhost source address.
$ ping6 -I ::1 2001:1:1::2 -c 3
PING 2001:1:1::2 (2001:1:1::2) from ::1 : 56 data bytes
64 bytes from 2001:1:1::2: icmp_seq=1 ttl=64 time=0.037 ms
64 bytes from 2001:1:1::2: icmp_seq=2 ttl=64 time=0.069 ms
64 bytes from 2001:1:1::2: icmp_seq=3 ttl=64 time=0.122 ms
2001:1:1::2 ping statistics
3 packets transmitted, 3 received, 0% packet loss, time 2032ms
rtt min/avg/max/mdev = 0.037/0.076/0.122/0.035 ms
Fixes: 1b70d792cf67 ("ipv6: Use rt6i_idev index for echo replies to a local address")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260121194409.6749-1-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/icmp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 7d88fd314c390..7ba3c642ab3c3 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -765,7 +765,9 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
fl6.daddr = ipv6_hdr(skb)->saddr;
if (saddr)
fl6.saddr = *saddr;
- fl6.flowi6_oif = icmp6_iif(skb);
+ fl6.flowi6_oif = ipv6_addr_loopback(&fl6.daddr) ?
+ skb->dev->ifindex :
+ icmp6_iif(skb);
fl6.fl6_icmp_type = type;
fl6.flowi6_mark = mark;
fl6.flowi6_uid = sock_net_uid(net, NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 194/280] net: wwan: t7xx: fix potential skb->frags overflow in RX path
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 193/280] ipv6: use the right ifindex when replying to icmpv6 from localhost Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 195/280] rocker: fix memory leak in rocker_world_port_post_fini() Greg Kroah-Hartman
` (90 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kery Qi, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <qikeyu2017@gmail.com>
[ Upstream commit f0813bcd2d9d97fdbdf2efb9532ab03ae92e99e6 ]
When receiving data in the DPMAIF RX path,
the t7xx_dpmaif_set_frag_to_skb() function adds
page fragments to an skb without checking if the number of
fragments has exceeded MAX_SKB_FRAGS. This could lead to a buffer overflow
in skb_shinfo(skb)->frags[] array, corrupting adjacent memory and
potentially causing kernel crashes or other undefined behavior.
This issue was identified through static code analysis by comparing with a
similar vulnerability fixed in the mt76 driver commit b102f0c522cf ("mt76:
fix array overflow on receiving too many fragments for a packet").
The vulnerability could be triggered if the modem firmware sends packets
with excessive fragments. While under normal protocol conditions (MTU 3080
bytes, BAT buffer 3584 bytes),
a single packet should not require additional
fragments, the kernel should not blindly trust firmware behavior.
Malicious, buggy, or compromised firmware could potentially craft packets
with more fragments than the kernel expects.
Fix this by adding a bounds check before calling skb_add_rx_frag() to
ensure nr_frags does not exceed MAX_SKB_FRAGS.
The check must be performed before unmapping to avoid a page leak
and double DMA unmap during device teardown.
Fixes: d642b012df70a ("net: wwan: t7xx: Add data path interface")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
Link: https://patch.msgid.link/20260122170401.1986-2-qikeyu2017@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
index f4f924d75103a..bdf1451fbc87d 100644
--- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
+++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_rx.c
@@ -430,6 +430,7 @@ static int t7xx_dpmaif_set_frag_to_skb(const struct dpmaif_rx_queue *rxq,
struct sk_buff *skb)
{
unsigned long long data_bus_addr, data_base_addr;
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
struct device *dev = rxq->dpmaif_ctrl->dev;
struct dpmaif_bat_page *page_info;
unsigned int data_len;
@@ -437,18 +438,22 @@ static int t7xx_dpmaif_set_frag_to_skb(const struct dpmaif_rx_queue *rxq,
page_info = rxq->bat_frag->bat_skb;
page_info += t7xx_normal_pit_bid(pkt_info);
- dma_unmap_page(dev, page_info->data_bus_addr, page_info->data_len, DMA_FROM_DEVICE);
if (!page_info->page)
return -EINVAL;
+ if (shinfo->nr_frags >= MAX_SKB_FRAGS)
+ return -EINVAL;
+
+ dma_unmap_page(dev, page_info->data_bus_addr, page_info->data_len, DMA_FROM_DEVICE);
+
data_bus_addr = le32_to_cpu(pkt_info->pd.data_addr_h);
data_bus_addr = (data_bus_addr << 32) + le32_to_cpu(pkt_info->pd.data_addr_l);
data_base_addr = page_info->data_bus_addr;
data_offset = data_bus_addr - data_base_addr;
data_offset += page_info->offset;
data_len = FIELD_GET(PD_PIT_DATA_LEN, le32_to_cpu(pkt_info->header));
- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page_info->page,
+ skb_add_rx_frag(skb, shinfo->nr_frags, page_info->page,
data_offset, data_len, page_info->data_len);
page_info->page = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 195/280] rocker: fix memory leak in rocker_world_port_post_fini()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 194/280] net: wwan: t7xx: fix potential skb->frags overflow in RX path Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 196/280] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() Greg Kroah-Hartman
` (89 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kery Qi, Simon Horman,
Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <qikeyu2017@gmail.com>
[ Upstream commit 8d7ba71e46216b8657a82ca2ec118bc93812a4d0 ]
In rocker_world_port_pre_init(), rocker_port->wpriv is allocated with
kzalloc(wops->port_priv_size, GFP_KERNEL). However, in
rocker_world_port_post_fini(), the memory is only freed when
wops->port_post_fini callback is set:
if (!wops->port_post_fini)
return;
wops->port_post_fini(rocker_port);
kfree(rocker_port->wpriv);
Since rocker_ofdpa_ops does not implement port_post_fini callback
(it is NULL), the wpriv memory allocated for each port is never freed
when ports are removed. This leads to a memory leak of
sizeof(struct ofdpa_port) bytes per port on every device removal.
Fix this by always calling kfree(rocker_port->wpriv) regardless of
whether the port_post_fini callback exists.
Fixes: e420114eef4a ("rocker: introduce worlds infrastructure")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260123211030.2109-2-qikeyu2017@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/rocker/rocker_main.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
index 2e2826c901fcc..b741d335b1dc4 100644
--- a/drivers/net/ethernet/rocker/rocker_main.c
+++ b/drivers/net/ethernet/rocker/rocker_main.c
@@ -1525,9 +1525,8 @@ static void rocker_world_port_post_fini(struct rocker_port *rocker_port)
{
struct rocker_world_ops *wops = rocker_port->rocker->wops;
- if (!wops->port_post_fini)
- return;
- wops->port_post_fini(rocker_port);
+ if (wops->port_post_fini)
+ wops->port_post_fini(rocker_port);
kfree(rocker_port->wpriv);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 196/280] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 195/280] rocker: fix memory leak in rocker_world_port_post_fini() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 197/280] ice: stop counting UDP csum mismatch as rx_errors Greg Kroah-Hartman
` (88 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f2d245f1d76bbfa50e4c,
Kuniyuki Iwashima, Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 165c34fb6068ff153e3fc99a932a80a9d5755709 ]
syzbot reported various memory leaks related to NFC, struct
nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]
The leading log hinted that nfc_llcp_send_ui_frame() failed
to allocate skb due to sock_error(sk) being -ENXIO.
ENXIO is set by nfc_llcp_socket_release() when struct
nfc_llcp_local is destroyed by local_cleanup().
The problem is that there is no synchronisation between
nfc_llcp_send_ui_frame() and local_cleanup(), and skb
could be put into local->tx_queue after it was purged in
local_cleanup():
CPU1 CPU2
---- ----
nfc_llcp_send_ui_frame() local_cleanup()
|- do { '
|- pdu = nfc_alloc_send_skb(..., &err)
| .
| |- nfc_llcp_socket_release(local, false, ENXIO);
| |- skb_queue_purge(&local->tx_queue); |
| ' |
|- skb_queue_tail(&local->tx_queue, pdu); |
... |
|- pdu = nfc_alloc_send_skb(..., &err) |
^._________________________________.'
local_cleanup() is called for struct nfc_llcp_local only
after nfc_llcp_remove_local() unlinks it from llcp_devices.
If we hold local->tx_queue.lock then, we can synchronise
the thread and nfc_llcp_send_ui_frame().
Let's do that and check list_empty(&local->list) before
queuing skb to local->tx_queue in nfc_llcp_send_ui_frame().
[0]:
[ 56.074943][ T6096] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6)
[ 64.318868][ T5813] kmemleak: 6 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
BUG: memory leak
unreferenced object 0xffff8881272f6800 (size 1024):
comm "syz.0.17", pid 6096, jiffies 4294942766
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
27 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
backtrace (crc da58d84d):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
__do_kmalloc_node mm/slub.c:5645 [inline]
__kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658
kmalloc_noprof include/linux/slab.h:961 [inline]
sk_prot_alloc+0x11a/0x1b0 net/core/sock.c:2239
sk_alloc+0x36/0x360 net/core/sock.c:2295
nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979
llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044
nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31
__sock_create+0x1a9/0x340 net/socket.c:1605
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xb9/0x1a0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x1b/0x30 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810fbd9800 (size 240):
comm "syz.0.17", pid 6096, jiffies 4294942850
hex dump (first 32 bytes):
68 f0 ff 08 81 88 ff ff 68 f0 ff 08 81 88 ff ff h.......h.......
00 00 00 00 00 00 00 00 00 68 2f 27 81 88 ff ff .........h/'....
backtrace (crc 6cc652b1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4979 [inline]
slab_alloc_node mm/slub.c:5284 [inline]
kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5336
__alloc_skb+0x203/0x240 net/core/skbuff.c:660
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0x69/0x3f0 net/core/skbuff.c:6671
sock_alloc_send_pskb+0x379/0x3e0 net/core/sock.c:2965
sock_alloc_send_skb include/net/sock.h:1859 [inline]
nfc_alloc_send_skb+0x45/0x80 net/nfc/core.c:724
nfc_llcp_send_ui_frame+0x162/0x360 net/nfc/llcp_commands.c:766
llcp_sock_sendmsg+0x14c/0x1d0 net/nfc/llcp_sock.c:814
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x2d8/0x2f0 net/socket.c:2244
__do_sys_sendto net/socket.c:2251 [inline]
__se_sys_sendto net/socket.c:2247 [inline]
__x64_sys_sendto+0x28/0x30 net/socket.c:2247
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 94f418a20664 ("NFC: UI frame sending routine implementation")
Reported-by: syzbot+f2d245f1d76bbfa50e4c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/697569c7.a00a0220.33ccc7.0014.GAE@google.com/T/#u
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260125010214.1572439-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/llcp_commands.c | 17 ++++++++++++++++-
net/nfc/llcp_core.c | 4 +++-
2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index e2680a3bef799..b652323bc2c12 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -778,8 +778,23 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
if (likely(frag_len > 0))
skb_put_data(pdu, msg_ptr, frag_len);
+ spin_lock(&local->tx_queue.lock);
+
+ if (list_empty(&local->list)) {
+ spin_unlock(&local->tx_queue.lock);
+
+ kfree_skb(pdu);
+
+ len -= remaining_len;
+ if (len == 0)
+ len = -ENXIO;
+ break;
+ }
+
/* No need to check for the peer RW for UI frames */
- skb_queue_tail(&local->tx_queue, pdu);
+ __skb_queue_tail(&local->tx_queue, pdu);
+
+ spin_unlock(&local->tx_queue.lock);
remaining_len -= frag_len;
msg_ptr += frag_len;
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 18be13fb9b75a..ced99d2a90cc1 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -314,7 +314,9 @@ static struct nfc_llcp_local *nfc_llcp_remove_local(struct nfc_dev *dev)
spin_lock(&llcp_devices_lock);
list_for_each_entry_safe(local, tmp, &llcp_devices, list)
if (local->dev == dev) {
- list_del(&local->list);
+ spin_lock(&local->tx_queue.lock);
+ list_del_init(&local->list);
+ spin_unlock(&local->tx_queue.lock);
spin_unlock(&llcp_devices_lock);
return local;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 197/280] ice: stop counting UDP csum mismatch as rx_errors
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 196/280] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 198/280] net/mlx5e: Report rx_discards_phy via rx_dropped Greg Kroah-Hartman
` (87 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tony Nguyen, Jake Keller, IWL,
Jesse Brandeburg, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <jbrandeburg@cloudflare.com>
[ Upstream commit 05faf2c0a76581d0a7fdbb8ec46477ba183df95b ]
Since the beginning, the Intel ice driver has counted receive checksum
offload mismatches into the rx_errors member of the rtnl_link_stats64
struct. In ethtool -S these show up as rx_csum_bad.nic.
I believe counting these in rx_errors is fundamentally wrong, as it's
pretty clear from the comments in if_link.h and from every other statistic
the driver is summing into rx_errors, that all of them would cause a
"hardware drop" except for the UDP checksum mismatch, as well as the fact
that all the other causes for rx_errors are L2 reasons, and this L4 UDP
"mismatch" is an outlier.
A last nail in the coffin is that rx_errors is monitored in production and
can indicate a bad NIC/cable/Switch port, but instead some random series of
UDP packets with bad checksums will now trigger this alert. This false
positive makes the alert useless and affects us as well as other companies.
This packet with presumably a bad UDP checksum is *already* passed to the
stack, just not marked as offloaded by the hardware/driver. If it is
dropped by the stack it will show up as UDP_MIB_CSUMERRORS.
And one more thing, none of the other Intel drivers, and at least bnxt_en
and mlx5 both don't appear to count UDP offload mismatches as rx_errors.
Here is a related customer complaint:
https://community.intel.com/t5/Ethernet-Products/ice-rx-errros-is-too-sensitive-to-IP-TCP-attack-packets-Intel/td-p/1662125
Fixes: 4f1fe43c920b ("ice: Add more Rx errors to netdev's rx_error counter")
Cc: Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Jake Keller <jacob.e.keller@intel.com>
Cc: IWL <intel-wired-lan@lists.osuosl.org>
Signed-off-by: Jesse Brandeburg <jbrandeburg@cloudflare.com>
Acked-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 9a540b85756f4..2737050aae218 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -6546,7 +6546,6 @@ void ice_update_vsi_stats(struct ice_vsi *vsi)
pf->stats.illegal_bytes +
pf->stats.rx_len_errors +
pf->stats.rx_undersize +
- pf->hw_csum_rx_error +
pf->stats.rx_jabber +
pf->stats.rx_fragments +
pf->stats.rx_oversize;
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 198/280] net/mlx5e: Report rx_discards_phy via rx_dropped
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 197/280] ice: stop counting UDP csum mismatch as rx_errors Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 199/280] net/mlx5e: Account for netdev stats in ndo_get_stats64 Greg Kroah-Hartman
` (86 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Yafang Shao,
Saeed Mahameed, Leon Romanovsky, Gal Pressman, Simon Horman,
Tariq Toukan, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <laoar.shao@gmail.com>
[ Upstream commit c9cfced17365b1df8c6ae6cd5db56aebd7ed9b57 ]
We noticed a high number of rx_discards_phy events on certain servers while
running `ethtool -S`. However, this critical counter is not currently
included in the standard /proc/net/dev statistics file, making it difficult
to monitor effectively—especially given the diversity of vendors across a
large fleet of servers.
Let's report it via the standard rx_dropped metric.
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Cc: Saeed Mahameed <saeedm@nvidia.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Gal Pressman <gal@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20241210022706.6665-1-laoar.shao@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 476681f10cc1 ("net/mlx5e: Account for netdev stats in ndo_get_stats64")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 73011870e5ff6..1d7fe4ffdd734 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3667,6 +3667,7 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
}
stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer;
+ stats->rx_dropped = PPORT_2863_GET(pstats, if_in_discards);
stats->rx_length_errors =
PPORT_802_3_GET(pstats, a_in_range_length_errors) +
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 199/280] net/mlx5e: Account for netdev stats in ndo_get_stats64
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 198/280] net/mlx5e: Report rx_discards_phy via rx_dropped Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 200/280] nfc: nci: Fix race between rfkill and nci_unregister_device() Greg Kroah-Hartman
` (85 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Tariq Toukan,
Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit 476681f10cc1e0e56e26856684e75d4678b072b2 ]
The driver's ndo_get_stats64 callback is only reporting mlx5 counters,
without accounting for the netdev stats, causing errors from the network
stack to be invisible in statistics.
Add netdev_stats_to_stats64() call to first populate the counters, then
add mlx5 counters on top, ensuring both are accounted for (where
appropriate).
Fixes: f62b8bb8f2d3 ("net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/1769411695-18820-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/en_main.c | 20 ++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 1d7fe4ffdd734..2d0b57583ea35 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3650,6 +3650,8 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
mlx5e_queue_update_stats(priv);
}
+ netdev_stats_to_stats64(stats, &dev->stats);
+
if (mlx5e_is_uplink_rep(priv)) {
struct mlx5e_vport_stats *vstats = &priv->stats.vport;
@@ -3666,21 +3668,21 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
mlx5e_fold_sw_stats64(priv, stats);
}
- stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer;
- stats->rx_dropped = PPORT_2863_GET(pstats, if_in_discards);
+ stats->rx_missed_errors += priv->stats.qcnt.rx_out_of_buffer;
+ stats->rx_dropped += PPORT_2863_GET(pstats, if_in_discards);
- stats->rx_length_errors =
+ stats->rx_length_errors +=
PPORT_802_3_GET(pstats, a_in_range_length_errors) +
PPORT_802_3_GET(pstats, a_out_of_range_length_field) +
PPORT_802_3_GET(pstats, a_frame_too_long_errors) +
VNIC_ENV_GET(&priv->stats.vnic, eth_wqe_too_small);
- stats->rx_crc_errors =
+ stats->rx_crc_errors +=
PPORT_802_3_GET(pstats, a_frame_check_sequence_errors);
- stats->rx_frame_errors = PPORT_802_3_GET(pstats, a_alignment_errors);
- stats->tx_aborted_errors = PPORT_2863_GET(pstats, if_out_discards);
- stats->rx_errors = stats->rx_length_errors + stats->rx_crc_errors +
- stats->rx_frame_errors;
- stats->tx_errors = stats->tx_aborted_errors + stats->tx_carrier_errors;
+ stats->rx_frame_errors += PPORT_802_3_GET(pstats, a_alignment_errors);
+ stats->tx_aborted_errors += PPORT_2863_GET(pstats, if_out_discards);
+ stats->rx_errors += stats->rx_length_errors + stats->rx_crc_errors +
+ stats->rx_frame_errors;
+ stats->tx_errors += stats->tx_aborted_errors + stats->tx_carrier_errors;
}
static void mlx5e_nic_set_rx_mode(struct mlx5e_priv *priv)
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 200/280] nfc: nci: Fix race between rfkill and nci_unregister_device().
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 199/280] net/mlx5e: Account for netdev stats in ndo_get_stats64 Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 201/280] net: bridge: fix static key check Greg Kroah-Hartman
` (84 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f9c5fd1a0874f9069dce,
Kuniyuki Iwashima, Simon Horman, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit d2492688bb9fed6ab6e313682c387ae71a66ebae ]
syzbot reported the splat below [0] without a repro.
It indicates that struct nci_dev.cmd_wq had been destroyed before
nci_close_device() was called via rfkill.
nci_dev.cmd_wq is only destroyed in nci_unregister_device(), which
(I think) was called from virtual_ncidev_close() when syzbot close()d
an fd of virtual_ncidev.
The problem is that nci_unregister_device() destroys nci_dev.cmd_wq
first and then calls nfc_unregister_device(), which removes the
device from rfkill by rfkill_unregister().
So, the device is still visible via rfkill even after nci_dev.cmd_wq
is destroyed.
Let's unregister the device from rfkill first in nci_unregister_device().
Note that we cannot call nfc_unregister_device() before
nci_close_device() because
1) nfc_unregister_device() calls device_del() which frees
all memory allocated by devm_kzalloc() and linked to
ndev->conn_info_list
2) nci_rx_work() could try to queue nci_conn_info to
ndev->conn_info_list which could be leaked
Thus, nfc_unregister_device() is split into two functions so we
can remove rfkill interfaces only before nci_close_device().
[0]:
DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: syz.0.8675/6349
WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4854 [inline], CPU#0: syz.0.8675/6349
WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x39d/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: syz.0.8675/6349
Modules linked in:
CPU: 0 UID: 0 PID: 6349 Comm: syz.0.8675 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4854 [inline]
RIP: 0010:__lock_acquire+0x3a4/0x2cf0 kernel/locking/lockdep.c:5187
Code: 18 00 4c 8b 74 24 08 75 27 90 e8 17 f2 fc 02 85 c0 74 1c 83 3d 50 e0 4e 0e 00 75 13 48 8d 3d 43 f7 51 0e 48 c7 c6 8b 3a de 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f
RSP: 0018:ffffc9000c767680 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 0000000000040000 RCX: 0000000000080000
RDX: ffffc90013080000 RSI: ffffffff8dde3a8b RDI: ffffffff8ff24ca0
RBP: 0000000000000003 R08: ffffffff8fef35a3 R09: 1ffffffff1fde6b4
R10: dffffc0000000000 R11: fffffbfff1fde6b5 R12: 00000000000012a2
R13: ffff888030338ba8 R14: ffff888030338000 R15: ffff888030338b30
FS: 00007fa5995f66c0(0000) GS:ffff8881256f8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e72f842d0 CR3: 00000000485a0000 CR4: 00000000003526f0
Call Trace:
<TASK>
lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
touch_wq_lockdep_map+0xcb/0x180 kernel/workqueue.c:3940
__flush_workqueue+0x14b/0x14f0 kernel/workqueue.c:3982
nci_close_device+0x302/0x630 net/nfc/nci/core.c:567
nci_dev_down+0x3b/0x50 net/nfc/nci/core.c:639
nfc_dev_down+0x152/0x290 net/nfc/core.c:161
nfc_rfkill_set_block+0x2d/0x100 net/nfc/core.c:179
rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346
rfkill_fop_write+0x461/0x5a0 net/rfkill/core.c:1301
vfs_write+0x29a/0xb90 fs/read_write.c:684
ksys_write+0x150/0x270 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa59b39acb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa5995f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa59b615fa0 RCX: 00007fa59b39acb9
RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000007
RBP: 00007fa59b408bf7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa59b616038 R14: 00007fa59b615fa0 R15: 00007ffc82218788
</TASK>
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Reported-by: syzbot+f9c5fd1a0874f9069dce@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/695e7f56.050a0220.1c677c.036c.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260127040411.494931-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/nfc/nfc.h | 2 ++
net/nfc/core.c | 27 ++++++++++++++++++++++++---
net/nfc/nci/core.c | 4 +++-
3 files changed, 29 insertions(+), 4 deletions(-)
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 5dee575fbe86a..b82f4f2a27fb8 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -215,6 +215,8 @@ static inline void nfc_free_device(struct nfc_dev *dev)
int nfc_register_device(struct nfc_dev *dev);
+void nfc_unregister_rfkill(struct nfc_dev *dev);
+void nfc_remove_device(struct nfc_dev *dev);
void nfc_unregister_device(struct nfc_dev *dev);
/**
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 5352571b62148..a02ede8b067bd 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -1147,14 +1147,14 @@ int nfc_register_device(struct nfc_dev *dev)
EXPORT_SYMBOL(nfc_register_device);
/**
- * nfc_unregister_device - unregister a nfc device in the nfc subsystem
+ * nfc_unregister_rfkill - unregister a nfc device in the rfkill subsystem
*
* @dev: The nfc device to unregister
*/
-void nfc_unregister_device(struct nfc_dev *dev)
+void nfc_unregister_rfkill(struct nfc_dev *dev)
{
- int rc;
struct rfkill *rfk = NULL;
+ int rc;
pr_debug("dev_name=%s\n", dev_name(&dev->dev));
@@ -1175,7 +1175,16 @@ void nfc_unregister_device(struct nfc_dev *dev)
rfkill_unregister(rfk);
rfkill_destroy(rfk);
}
+}
+EXPORT_SYMBOL(nfc_unregister_rfkill);
+/**
+ * nfc_remove_device - remove a nfc device in the nfc subsystem
+ *
+ * @dev: The nfc device to remove
+ */
+void nfc_remove_device(struct nfc_dev *dev)
+{
if (dev->ops->check_presence) {
del_timer_sync(&dev->check_pres_timer);
cancel_work_sync(&dev->check_pres_work);
@@ -1188,6 +1197,18 @@ void nfc_unregister_device(struct nfc_dev *dev)
device_del(&dev->dev);
mutex_unlock(&nfc_devlist_mutex);
}
+EXPORT_SYMBOL(nfc_remove_device);
+
+/**
+ * nfc_unregister_device - unregister a nfc device in the nfc subsystem
+ *
+ * @dev: The nfc device to unregister
+ */
+void nfc_unregister_device(struct nfc_dev *dev)
+{
+ nfc_unregister_rfkill(dev);
+ nfc_remove_device(dev);
+}
EXPORT_SYMBOL(nfc_unregister_device);
static int __init nfc_init(void)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 6196bb512dfc1..2ffdbbf90eb70 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1291,6 +1291,8 @@ void nci_unregister_device(struct nci_dev *ndev)
{
struct nci_conn_info *conn_info, *n;
+ nfc_unregister_rfkill(ndev->nfc_dev);
+
/* This set_bit is not protected with specialized barrier,
* However, it is fine because the mutex_lock(&ndev->req_lock);
* in nci_close_device() will help to emit one.
@@ -1308,7 +1310,7 @@ void nci_unregister_device(struct nci_dev *ndev)
/* conn_info is allocated with devm_kzalloc */
}
- nfc_unregister_device(ndev->nfc_dev);
+ nfc_remove_device(ndev->nfc_dev);
}
EXPORT_SYMBOL(nci_unregister_device);
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 201/280] net: bridge: fix static key check
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 200/280] nfc: nci: Fix race between rfkill and nci_unregister_device() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 202/280] scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() Greg Kroah-Hartman
` (83 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kaiser, Florian Westphal,
Nikolay Aleksandrov, Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
[ Upstream commit cc0cf10fdaeadf5542d64a55b5b4120d3df90b7d ]
Fix the check if netfilter's static keys are available. netfilter defines
and exports static keys if CONFIG_JUMP_LABEL is enabled. (HAVE_JUMP_LABEL
is never defined.)
Fixes: 971502d77faa ("bridge: netfilter: unroll NF_HOOK helper in bridge input path")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20260127101925.1754425-1-martin@kaiser.cx
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index f11345720c275..e33500771b30f 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -243,7 +243,7 @@ static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)
int ret;
net = dev_net(skb->dev);
-#ifdef HAVE_JUMP_LABEL
+#ifdef CONFIG_JUMP_LABEL
if (!static_key_false(&nf_hooks_needed[NFPROTO_BRIDGE][NF_BR_PRE_ROUTING]))
goto frame_finish;
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 202/280] scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 201/280] net: bridge: fix static key check Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 203/280] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion Greg Kroah-Hartman
` (82 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kery Qi, Martin K. Petersen,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kery Qi <qikeyu2017@gmail.com>
[ Upstream commit b2d6b1d443009ed4da2d69f5423ab38e5780505a ]
The code in sbp_make_tpg() limits "tpgt" to UINT_MAX but the data type of
"tpg->tport_tpgt" is u16. This causes a type truncation issue.
When a user creates a TPG via configfs mkdir, for example:
mkdir /sys/kernel/config/target/sbp/<wwn>/tpgt_70000
The value 70000 passes the "tpgt > UINT_MAX" check since 70000 is far less
than 4294967295. However, when assigned to the u16 field tpg->tport_tpgt,
the value is silently truncated to 4464 (70000 & 0xFFFF). This causes the
value the user specified to differ from what is actually stored, leading to
confusion and potential unexpected behavior.
Fix this by changing the type of "tpgt" to u16 and using kstrtou16() which
will properly reject values outside the u16 range.
Fixes: a511ce339780 ("sbp-target: Initial merge of firewire/ieee-1394 target mode support")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
Link: https://patch.msgid.link/20260121114515.1829-2-qikeyu2017@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/sbp/sbp_target.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index 504670994fb46..97a5565fb14e9 100644
--- a/drivers/target/sbp/sbp_target.c
+++ b/drivers/target/sbp/sbp_target.c
@@ -1986,12 +1986,12 @@ static struct se_portal_group *sbp_make_tpg(struct se_wwn *wwn,
container_of(wwn, struct sbp_tport, tport_wwn);
struct sbp_tpg *tpg;
- unsigned long tpgt;
+ u16 tpgt;
int ret;
if (strstr(name, "tpgt_") != name)
return ERR_PTR(-EINVAL);
- if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX)
+ if (kstrtou16(name + 5, 10, &tpgt))
return ERR_PTR(-EINVAL);
if (tport->tpg) {
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 203/280] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 202/280] scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 204/280] gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler Greg Kroah-Hartman
` (81 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tagir Garaev, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tagir Garaev <tgaraev653@gmail.com>
[ Upstream commit 213c4e51267fd825cd21a08a055450cac7e0b7fb ]
The headphone GPIO should be set to the inverse of speaker_en.
When speakers are enabled, headphones should be disabled and vice versa.
Currently both GPIOs are set to the same value (speaker_en), causing
audio to play through both speakers and headphones simultaneously
when headphones are plugged in.
Tested on Huawei Matebook (BOD-WXX9) with ES8336 codec.
Fixes: 6e1ff1459e00 ("ASoC: Intel: sof_es8336: support a separate gpio to control headphone")
Signed-off-by: Tagir Garaev <tgaraev653@gmail.com>
Link: https://patch.msgid.link/20260121152435.101698-1-tgaraev653@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_es8336.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
index e22d767b6e97a..41dab5dcf79a3 100644
--- a/sound/soc/intel/boards/sof_es8336.c
+++ b/sound/soc/intel/boards/sof_es8336.c
@@ -120,7 +120,7 @@ static void pcm_pop_work_events(struct work_struct *work)
gpiod_set_value_cansleep(priv->gpio_speakers, priv->speaker_en);
if (quirk & SOF_ES8336_HEADPHONE_GPIO)
- gpiod_set_value_cansleep(priv->gpio_headphone, priv->speaker_en);
+ gpiod_set_value_cansleep(priv->gpio_headphone, !priv->speaker_en);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 204/280] gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 203/280] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 205/280] dma/pool: distinguish between missing and exhausted atomic pools Greg Kroah-Hartman
` (80 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Denis Sergeev, Mika Westerberg,
Bartosz Golaszewski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Sergeev <denserg.edu@gmail.com>
[ Upstream commit c0ae43d303e45764918fa8c1dc13d6a5db59c479 ]
The BIT() macro uses unsigned long, which is 32 bits on 32-bit
architectures. When iterating over GPIO pins with index >= 32,
the expression (*value & BIT(i)) causes undefined behavior due
to shifting by a value >= type width.
Since 'value' is a pointer to u64, use BIT_ULL() to ensure correct
64-bit mask on all architectures.
Found by Linux Verification Center (linuxtesting.org) with Svace.
Fixes: 2c4d00cb8fc5 ("gpiolib: acpi: Use BIT() macro to increase readability")
Signed-off-by: Denis Sergeev <denserg.edu@gmail.com>
Reviewed-by: Mika Westerberg <westeri@kernel.org>
Link: https://lore.kernel.org/r/20260126035914.16586-1-denserg.edu@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index baa77a8e83652..11338f47d884d 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -1184,7 +1184,7 @@ acpi_gpio_adr_space_handler(u32 function, acpi_physical_address address,
mutex_unlock(&achip->conn_lock);
if (function == ACPI_WRITE)
- gpiod_set_raw_value_cansleep(desc, !!(*value & BIT(i)));
+ gpiod_set_raw_value_cansleep(desc, !!(*value & BIT_ULL(i)));
else
*value |= (u64)gpiod_get_raw_value_cansleep(desc) << i;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 205/280] dma/pool: distinguish between missing and exhausted atomic pools
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 204/280] gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 206/280] pinctrl: meson: mark the GPIO controller as sleeping Greg Kroah-Hartman
` (79 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sai Sree Kartheek Adivi,
Robin Murphy, Marek Szyprowski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sai Sree Kartheek Adivi <s-adivi@ti.com>
[ Upstream commit 56c430c7f06d838fe3b2077dbbc4cc0bf992312b ]
Currently, dma_alloc_from_pool() unconditionally warns and dumps a stack
trace when an allocation fails, with the message "Failed to get suitable
pool".
This conflates two distinct failure modes:
1. Configuration error: No atomic pool is available for the requested
DMA mask (a fundamental system setup issue)
2. Resource Exhaustion: A suitable pool exists but is currently full (a
recoverable runtime state)
This lack of distinction prevents drivers from using __GFP_NOWARN to
suppress error messages during temporary pressure spikes, such as when
awaiting synchronous reclaim of descriptors.
Refactor the error handling to distinguish these cases:
- If no suitable pool is found, keep the unconditional WARN regarding
the missing pool.
- If a pool was found but is exhausted, respect __GFP_NOWARN and update
the warning message to explicitly state "DMA pool exhausted".
Fixes: 9420139f516d ("dma-pool: fix coherent pool allocations for IOMMU mappings")
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi@ti.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260128133554.3056582-1-s-adivi@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/dma/pool.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/dma/pool.c b/kernel/dma/pool.c
index 1e9d4cb018693..8fc6e3b8f8372 100644
--- a/kernel/dma/pool.c
+++ b/kernel/dma/pool.c
@@ -268,15 +268,20 @@ struct page *dma_alloc_from_pool(struct device *dev, size_t size,
{
struct gen_pool *pool = NULL;
struct page *page;
+ bool pool_found = false;
while ((pool = dma_guess_pool(pool, gfp))) {
+ pool_found = true;
page = __dma_alloc_from_pool(dev, size, pool, cpu_addr,
phys_addr_ok);
if (page)
return page;
}
- WARN(1, "Failed to get suitable pool for %s\n", dev_name(dev));
+ if (pool_found)
+ WARN(!(gfp & __GFP_NOWARN), "DMA pool exhausted for %s\n", dev_name(dev));
+ else
+ WARN(1, "Failed to get suitable pool for %s\n", dev_name(dev));
return NULL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 206/280] pinctrl: meson: mark the GPIO controller as sleeping
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 205/280] dma/pool: distinguish between missing and exhausted atomic pools Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 207/280] riscv: compat: fix COMPAT_UTS_MACHINE definition Greg Kroah-Hartman
` (78 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski,
Bartosz Golaszewski, Martin Blumenstingl, Neil Armstrong,
Linus Walleij
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
commit 28f24068387169722b508bba6b5257cb68b86e74 upstream.
The GPIO controller is configured as non-sleeping but it uses generic
pinctrl helpers which use a mutex for synchronization.
This can cause the following lockdep splat with shared GPIOs enabled on
boards which have multiple devices using the same GPIO:
BUG: sleeping function called from invalid context at
kernel/locking/mutex.c:591
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name:
kworker/u25:3
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
irq event stamp: 46379
hardirqs last enabled at (46379): [<ffff8000813acb24>]
_raw_spin_unlock_irqrestore+0x74/0x78
hardirqs last disabled at (46378): [<ffff8000813abf38>]
_raw_spin_lock_irqsave+0x84/0x88
softirqs last enabled at (46330): [<ffff8000800c71b4>]
handle_softirqs+0x4c4/0x4dc
softirqs last disabled at (46295): [<ffff800080010674>]
__do_softirq+0x14/0x20
CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C
6.19.0-rc4-next-20260105+ #11963 PREEMPT
Tainted: [C]=CRAP
Hardware name: Khadas VIM3 (DT)
Workqueue: events_unbound deferred_probe_work_func
Call trace:
show_stack+0x18/0x24 (C)
dump_stack_lvl+0x90/0xd0
dump_stack+0x18/0x24
__might_resched+0x144/0x248
__might_sleep+0x48/0x98
__mutex_lock+0x5c/0x894
mutex_lock_nested+0x24/0x30
pinctrl_get_device_gpio_range+0x44/0x128
pinctrl_gpio_set_config+0x40/0xdc
gpiochip_generic_config+0x28/0x3c
gpio_do_set_config+0xa8/0x194
gpiod_set_config+0x34/0xfc
gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy]
gpio_do_set_config+0xa8/0x194
gpiod_set_transitory+0x4c/0xf0
gpiod_configure_flags+0xa4/0x480
gpiod_find_and_request+0x1a0/0x574
gpiod_get_index+0x58/0x84
devm_gpiod_get_index+0x20/0xb4
devm_gpiod_get+0x18/0x24
mmc_pwrseq_emmc_probe+0x40/0xb8
platform_probe+0x5c/0xac
really_probe+0xbc/0x298
__driver_probe_device+0x78/0x12c
driver_probe_device+0xdc/0x164
__device_attach_driver+0xb8/0x138
bus_for_each_drv+0x80/0xdc
__device_attach+0xa8/0x1b0
Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs")
Cc: stable@vger.kernel.org
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -619,7 +619,7 @@ static int meson_gpiolib_register(struct
pc->chip.set = meson_gpio_set;
pc->chip.base = -1;
pc->chip.ngpio = pc->data->num_pins;
- pc->chip.can_sleep = false;
+ pc->chip.can_sleep = true;
ret = gpiochip_add_data(&pc->chip, pc);
if (ret) {
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 207/280] riscv: compat: fix COMPAT_UTS_MACHINE definition
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 206/280] pinctrl: meson: mark the GPIO controller as sleeping Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 208/280] ASoC: fsl: imx-card: Do not force slot width to sample width Greg Kroah-Hartman
` (77 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Han Gao,
Guo Ren (Alibaba Damo Academy), Paul Walmsley
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Han Gao <gaohan@iscas.ac.cn>
commit 0ea05c4f7527a98f5946f96c829733788934311d upstream.
The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv".
Change it to "riscv32" to reflect the correct 32-bit compat name.
Fixes: 06d0e3723647 ("riscv: compat: Add basic compat data type implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Han Gao <gaohan@iscas.ac.cn>
Reviewed-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
Link: https://patch.msgid.link/20260127190711.2264664-1-gaohan@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/compat.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/include/asm/compat.h
+++ b/arch/riscv/include/asm/compat.h
@@ -2,7 +2,7 @@
#ifndef __ASM_COMPAT_H
#define __ASM_COMPAT_H
-#define COMPAT_UTS_MACHINE "riscv\0\0"
+#define COMPAT_UTS_MACHINE "riscv32\0\0"
/*
* Architecture specific compatibility types
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 208/280] ASoC: fsl: imx-card: Do not force slot width to sample width
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 207/280] riscv: compat: fix COMPAT_UTS_MACHINE definition Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 209/280] scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() Greg Kroah-Hartman
` (76 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Shengjiu Wang,
Mark Brown
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@gmail.com>
commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream.
imx-card currently sets the slot width to the physical sample width
for I2S links. This breaks controllers that use fixed-width slots
(e.g. 32-bit FIFO words), causing the unused bits in the slot to
contain undefined data when playing 16-bit streams.
Do not override the slot width in the machine driver and let the CPU
DAI select an appropriate default instead. This matches the behavior
of simple-audio-card and avoids embedding controller-specific policy
in the machine driver.
On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots,
playing 16-bit audio resulted in spurious frequencies and an incorrect
SAI data waveform, as the slot width was forced to 16 bits. After this
change, audio artifacts are eliminated and the 16-bit samples correctly
occupy the first half of the 32-bit slot, with the remaining bits padded
with zeroes.
Cc: stable@vger.kernel.org
Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/fsl/imx-card.c | 1 -
1 file changed, 1 deletion(-)
--- a/sound/soc/fsl/imx-card.c
+++ b/sound/soc/fsl/imx-card.c
@@ -314,7 +314,6 @@ static int imx_aif_hw_params(struct snd_
SND_SOC_DAIFMT_PDM;
} else {
slots = 2;
- slot_width = params_physical_width(params);
fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) |
SND_SOC_DAIFMT_I2S;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 209/280] scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 208/280] ASoC: fsl: imx-card: Do not force slot width to sample width Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 210/280] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO Greg Kroah-Hartman
` (75 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream.
If nonemb_cmd->va fails to be allocated, free the allocation previously
made by alloc_mcc_wrb().
Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/be2iscsi/be_mgmt.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru
&nonemb_cmd->dma,
GFP_KERNEL);
if (!nonemb_cmd->va) {
+ free_mcc_wrb(ctrl, tag);
mutex_unlock(&ctrl->mbox_lock);
return 0;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 210/280] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 209/280] scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 211/280] scsi: qla2xxx: edif: Fix dma_free_coherent() size Greg Kroah-Hartman
` (74 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Heng, Mark Brown
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <zhangheng@kylinos.cn>
commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d upstream.
Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the
issue where the internal microphone was not detected.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220983
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260126014952.3674450-1-zhangheng@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/amd/yc/acp6x-mach.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -528,6 +528,14 @@ static const struct dmi_system_id yc_acp
DMI_MATCH(DMI_PRODUCT_NAME, "GOH-X"),
}
},
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "RB"),
+ DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"),
+ }
+ },
+
{}
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 211/280] scsi: qla2xxx: edif: Fix dma_free_coherent() size
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 210/280] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 212/280] efivarfs: fix error propagation in efivar_entry_get() Greg Kroah-Hartman
` (73 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Martin K. Petersen
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream.
Earlier in the function, the ha->flt buffer is allocated with size
sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error
path with size SFP_DEV_SIZE.
Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_os.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4464,7 +4464,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
fail_elsrej:
dma_pool_destroy(ha->purex_dma_pool);
fail_flt:
- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE,
+ dma_free_coherent(&ha->pdev->dev, sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE,
ha->flt, ha->flt_dma);
fail_flt_buffer:
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 212/280] efivarfs: fix error propagation in efivar_entry_get()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 211/280] scsi: qla2xxx: edif: Fix dma_free_coherent() size Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 213/280] mptcp: only reset subflow errors when propagated Greg Kroah-Hartman
` (72 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kohei Enju, Ard Biesheuvel
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kohei Enju <kohei@enjuk.jp>
commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 upstream.
efivar_entry_get() always returns success even if the underlying
__efivar_entry_get() fails, masking errors.
This may result in uninitialized heap memory being copied to userspace
in the efivarfs_file_read() path.
Fix it by returning the error from __efivar_entry_get().
Fixes: 2d82e6227ea1 ("efi: vars: Move efivar caching layer into efivarfs")
Cc: <stable@vger.kernel.org> # v6.1+
Signed-off-by: Kohei Enju <kohei@enjuk.jp>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/efivarfs/vars.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/efivarfs/vars.c
+++ b/fs/efivarfs/vars.c
@@ -609,7 +609,7 @@ int efivar_entry_get(struct efivar_entry
err = __efivar_entry_get(entry, attributes, size, data);
efivar_unlock();
- return 0;
+ return err;
}
/**
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 213/280] mptcp: only reset subflow errors when propagated
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 212/280] efivarfs: fix error propagation in efivar_entry_get() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 214/280] flex_proportions: make fprop_new_period() hardirq safe Greg Kroah-Hartman
` (71 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream.
Some subflow socket errors need to be reported to the MPTCP socket: the
initial subflow connect (MP_CAPABLE), and the ones from the fallback
sockets. The others are not propagated.
The issue is that sock_error() was used to retrieve the error, which was
also resetting the sk_err field. Because of that, when notifying the
userspace about subflow close events later on from the MPTCP worker, the
ssk->sk_err field was always 0.
Now, the error (sk_err) is only reset when propagating it to the msk.
Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk")
Cc: stable@vger.kernel.org
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -807,11 +807,8 @@ static bool __mptcp_ofo_queue(struct mpt
static bool __mptcp_subflow_error_report(struct sock *sk, struct sock *ssk)
{
- int err = sock_error(ssk);
int ssk_state;
-
- if (!err)
- return false;
+ int err;
/* only propagate errors on fallen-back sockets or
* on MPC connect
@@ -819,6 +816,10 @@ static bool __mptcp_subflow_error_report
if (sk->sk_state != TCP_SYN_SENT && !__mptcp_check_fallback(mptcp_sk(sk)))
return false;
+ err = sock_error(ssk);
+ if (!err)
+ return false;
+
/* We need to propagate only transition to CLOSE state.
* Orphaned socket will see such state change via
* subflow_sched_work_if_closed() and that path will properly
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 214/280] flex_proportions: make fprop_new_period() hardirq safe
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 213/280] mptcp: only reset subflow errors when propagated Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 215/280] scripts: generate_rust_analyzer: Add compiler_builtins -> core dep Greg Kroah-Hartman
` (70 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Bernd Schubert,
Matthew Wilcox (Oracle), Joanne Koong, Miklos Szeredi,
Andrew Morton
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc upstream.
Bernd has reported a lockdep splat from flexible proportions code that is
essentially complaining about the following race:
<timer fires>
run_timer_softirq - we are in softirq context
call_timer_fn
writeout_period
fprop_new_period
write_seqcount_begin(&p->sequence);
<hardirq is raised>
...
blk_mq_end_request()
blk_update_request()
ext4_end_bio()
folio_end_writeback()
__wb_writeout_add()
__fprop_add_percpu_max()
if (unlikely(max_frac < FPROP_FRAC_BASE)) {
fprop_fraction_percpu()
seq = read_seqcount_begin(&p->sequence);
- sees odd sequence so loops indefinitely
Note that a deadlock like this is only possible if the bdi has configured
maximum fraction of writeout throughput which is very rare in general but
frequent for example for FUSE bdis. To fix this problem we have to make
sure write section of the sequence counter is irqsafe.
Link: https://lkml.kernel.org/r/20260121112729.24463-2-jack@suse.cz
Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()")
Signed-off-by: Jan Kara <jack@suse.cz>
Reported-by: Bernd Schubert <bernd@bsbernd.com>
Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Joanne Koong <joannelkoong@gmail.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/flex_proportions.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/flex_proportions.c b/lib/flex_proportions.c
index 84ecccddc771..012d5614efb9 100644
--- a/lib/flex_proportions.c
+++ b/lib/flex_proportions.c
@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_global *p)
bool fprop_new_period(struct fprop_global *p, int periods)
{
s64 events = percpu_counter_sum(&p->events);
+ unsigned long flags;
/*
* Don't do anything if there are no events.
*/
if (events <= 1)
return false;
- preempt_disable_nested();
+ local_irq_save(flags);
write_seqcount_begin(&p->sequence);
if (periods < 64)
events -= events >> periods;
@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_global *p, int periods)
percpu_counter_add(&p->events, -events);
p->period += periods;
write_seqcount_end(&p->sequence);
- preempt_enable_nested();
+ local_irq_restore(flags);
return true;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 295+ messages in thread
* [PATCH 6.1 215/280] scripts: generate_rust_analyzer: Add compiler_builtins -> core dep
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 214/280] flex_proportions: make fprop_new_period() hardirq safe Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 216/280] drm/amdgpu/soc21: fix xclk for APUs Greg Kroah-Hartman
` (69 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tamir Duberstein, Jesung Yang,
Benno Lossin, Miguel Ojeda
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamir Duberstein <tamird@kernel.org>
commit 5157c328edb35bac05ce77da473c3209d20e0bbb upstream.
Add a dependency edge from `compiler_builtins` to `core` to
`scripts/generate_rust_analyzer.py` to match `rust/Makefile`. This has
been incorrect since commit 8c4555ccc55c ("scripts: add
`generate_rust_analyzer.py`")
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
Reviewed-by: Jesung Yang <y.j3ms.n@gmail.com>
Acked-by: Benno Lossin <lossin@kernel.org>
Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250723-rust-analyzer-pin-init-v1-1-3c6956173c78@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/generate_rust_analyzer.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/scripts/generate_rust_analyzer.py
+++ b/scripts/generate_rust_analyzer.py
@@ -73,7 +73,7 @@ def generate_crates(srctree, objtree, sy
append_crate(
"compiler_builtins",
srctree / "rust" / "compiler_builtins.rs",
- [],
+ ["core"],
)
append_crate(
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 216/280] drm/amdgpu/soc21: fix xclk for APUs
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 215/280] scripts: generate_rust_analyzer: Add compiler_builtins -> core dep Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 217/280] drm/amdgpu/gfx10: fix wptr reset in KGQ init Greg Kroah-Hartman
` (68 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jesse Zhang, Alex Deucher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit e7fbff9e7622a00c2b53cb14df481916f0019742 upstream.
The reference clock is supposed to be 100Mhz, but it
appears to actually be slightly lower (99.81Mhz).
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/14451
Reviewed-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 637fee3954d4bd509ea9d95ad1780fc174489860)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/soc21.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
@@ -202,7 +202,13 @@ static u32 soc21_get_config_memsize(stru
static u32 soc21_get_xclk(struct amdgpu_device *adev)
{
- return adev->clock.spll.reference_freq;
+ u32 reference_clock = adev->clock.spll.reference_freq;
+
+ /* reference clock is actually 99.81 Mhz rather than 100 Mhz */
+ if ((adev->flags & AMD_IS_APU) && reference_clock == 10000)
+ return 9981;
+
+ return reference_clock;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 217/280] drm/amdgpu/gfx10: fix wptr reset in KGQ init
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 216/280] drm/amdgpu/soc21: fix xclk for APUs Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 218/280] drm/amdgpu/gfx11: " Greg Kroah-Hartman
` (67 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Jesse Zhang,
Alex Deucher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit cc4f433b14e05eaa4a98fd677b836e9229422387 upstream.
wptr is a 64 bit value and we need to update the
full value, not just 32 bits. Align with what we
already do for KCQs.
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e80b1d1aa1073230b6c25a1a72e88f37e425ccda)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -6584,7 +6584,7 @@ static int gfx_v10_0_gfx_init_queue(stru
memcpy(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd));
/* reset the ring */
ring->wptr = 0;
- *ring->wptr_cpu_addr = 0;
+ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0);
amdgpu_ring_clear_ring(ring);
#ifdef BRING_UP_DEBUG
mutex_lock(&adev->srbm_mutex);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 218/280] drm/amdgpu/gfx11: fix wptr reset in KGQ init
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 217/280] drm/amdgpu/gfx10: fix wptr reset in KGQ init Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 219/280] gpio: rockchip: Stop calling pinctrl for set_direction Greg Kroah-Hartman
` (66 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Jesse Zhang,
Alex Deucher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit b1f810471c6a6bd349f7f9f2f2fed96082056d46 upstream.
wptr is a 64 bit value and we need to update the
full value, not just 32 bits. Align with what we
already do for KCQs.
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1f16866bdb1daed7a80ca79ae2837a9832a74fbc)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -3716,7 +3716,7 @@ static int gfx_v11_0_gfx_init_queue(stru
memcpy(mqd, adev->gfx.me.mqd_backup[mqd_idx], sizeof(*mqd));
/* reset the ring */
ring->wptr = 0;
- *ring->wptr_cpu_addr = 0;
+ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0);
amdgpu_ring_clear_ring(ring);
#ifdef BRING_UP_DEBUG
mutex_lock(&adev->srbm_mutex);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 219/280] gpio: rockchip: Stop calling pinctrl for set_direction
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 218/280] drm/amdgpu/gfx11: " Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 220/280] mm/rmap: fix two comments related to huge_pmd_unshare() Greg Kroah-Hartman
` (65 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Stuebner, Robin Murphy,
Bartosz Golaszewski
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 7ca497be00163610afb663867db24ac408752f13 upstream.
Marking the whole controller as sleeping due to the pinctrl calls in the
.direction_{input,output} callbacks has the unfortunate side effect that
legitimate invocations of .get and .set, which cannot themselves sleep,
in atomic context now spew WARN()s from gpiolib.
However, as Heiko points out, the driver doing this is a bit silly to
begin with, as the pinctrl .gpio_set_direction hook doesn't even care
about the direction, the hook is only used to claim the mux. And sure
enough, the .gpio_request_enable hook exists to serve this very purpose,
so switch to that and remove the problematic business entirely.
Cc: stable@vger.kernel.org
Fixes: 20cf2aed89ac ("gpio: rockchip: mark the GPIO controller as sleeping")
Suggested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://lore.kernel.org/r/bddc0469f25843ca5ae0cf578ab3671435ae98a7.1769429546.git.robin.murphy@arm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Backport past pinctrl API change for the deleted calls ]
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-rockchip.c | 8 --------
drivers/pinctrl/pinctrl-rockchip.c | 9 ++++-----
2 files changed, 4 insertions(+), 13 deletions(-)
--- a/drivers/gpio/gpio-rockchip.c
+++ b/drivers/gpio/gpio-rockchip.c
@@ -19,7 +19,6 @@
#include <linux/of_address.h>
#include <linux/of_device.h>
#include <linux/of_irq.h>
-#include <linux/pinctrl/consumer.h>
#include <linux/pinctrl/pinconf-generic.h>
#include <linux/regmap.h>
@@ -157,12 +156,6 @@ static int rockchip_gpio_set_direction(s
unsigned long flags;
u32 data = input ? 0 : 1;
-
- if (input)
- pinctrl_gpio_direction_input(bank->pin_base + offset);
- else
- pinctrl_gpio_direction_output(bank->pin_base + offset);
-
raw_spin_lock_irqsave(&bank->slock, flags);
rockchip_gpio_writel_bit(bank, offset, data, bank->gpio_regs->port_ddr);
raw_spin_unlock_irqrestore(&bank->slock, flags);
@@ -584,7 +577,6 @@ static int rockchip_gpiolib_register(str
gc->ngpio = bank->nr_pins;
gc->label = bank->name;
gc->parent = bank->dev;
- gc->can_sleep = true;
ret = gpiochip_add_data(gc, bank);
if (ret) {
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -2750,10 +2750,9 @@ static int rockchip_pmx_set(struct pinct
return 0;
}
-static int rockchip_pmx_gpio_set_direction(struct pinctrl_dev *pctldev,
- struct pinctrl_gpio_range *range,
- unsigned offset,
- bool input)
+static int rockchip_pmx_gpio_request_enable(struct pinctrl_dev *pctldev,
+ struct pinctrl_gpio_range *range,
+ unsigned int offset)
{
struct rockchip_pinctrl *info = pinctrl_dev_get_drvdata(pctldev);
struct rockchip_pin_bank *bank;
@@ -2767,7 +2766,7 @@ static const struct pinmux_ops rockchip_
.get_function_name = rockchip_pmx_get_func_name,
.get_function_groups = rockchip_pmx_get_groups,
.set_mux = rockchip_pmx_set,
- .gpio_set_direction = rockchip_pmx_gpio_set_direction,
+ .gpio_request_enable = rockchip_pmx_gpio_request_enable,
};
/*
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 220/280] mm/rmap: fix two comments related to huge_pmd_unshare()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 219/280] gpio: rockchip: Stop calling pinctrl for set_direction Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 221/280] arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s Greg Kroah-Hartman
` (64 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand (Red Hat),
Rik van Riel, Laurence Oberman, Lorenzo Stoakes, Oscar Salvador,
Liu Shixin, Harry Yoo, Lance Yang, Uschakow, Stanislav,
Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David Hildenbrand (Red Hat)" <david@kernel.org>
[ Upstream commit a8682d500f691b6dfaa16ae1502d990aeb86e8be ]
PMD page table unsharing no longer touches the refcount of a PMD page
table. Also, it is not about dropping the refcount of a "PMD page" but
the "PMD page table".
Let's just simplify by saying that the PMD page table was unmapped,
consequently also unmapping the folio that was mapped into this page.
This code should be deduplicated in the future.
Link: https://lkml.kernel.org/r/20251223214037.580860-4-david@kernel.org
Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count")
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: "Uschakow, Stanislav" <suschako@amazon.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/rmap.c | 20 ++++----------------
1 file changed, 4 insertions(+), 16 deletions(-)
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1574,14 +1574,8 @@ static bool try_to_unmap_one(struct foli
mmu_notifier_invalidate_range(mm,
range.start, range.end);
/*
- * The ref count of the PMD page was
- * dropped which is part of the way map
- * counting is done for shared PMDs.
- * Return 'true' here. When there is
- * no other sharing, huge_pmd_unshare
- * returns false and we will unmap the
- * actual page and drop map count
- * to zero.
+ * The PMD table was unmapped,
+ * consequently unmapping the folio.
*/
page_vma_mapped_walk_done(&pvmw);
break;
@@ -1965,14 +1959,8 @@ static bool try_to_migrate_one(struct fo
range.start, range.end);
/*
- * The ref count of the PMD page was
- * dropped which is part of the way map
- * counting is done for shared PMDs.
- * Return 'true' here. When there is
- * no other sharing, huge_pmd_unshare
- * returns false and we will unmap the
- * actual page and drop map count
- * to zero.
+ * The PMD table was unmapped,
+ * consequently unmapping the folio.
*/
page_vma_mapped_walk_done(&pvmw);
break;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 221/280] arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 220/280] mm/rmap: fix two comments related to huge_pmd_unshare() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 222/280] xen: make remove callback of xen driver void returned Greg Kroah-Hartman
` (63 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Geraldo Nascimento,
Shawn Lin, Heiko Stuebner, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geraldo Nascimento <geraldogabriel@gmail.com>
[ Upstream commit ce652c98a7bfa0b7c675ef5cd85c44c186db96af ]
This is already the default in rk3399-base.dtsi, remove redundant
declaration from rk3399-nanopi-r4s.dtsi.
Fixes: db792e9adbf8 ("rockchip: rk3399: Add support for FriendlyARM NanoPi R4S")
Cc: stable@vger.kernel.org
Reported-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Dragan Simic <dsimic@manjaro.org>
Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://patch.msgid.link/6694456a735844177c897581f785cc00c064c7d1.1763415706.git.geraldogabriel@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
[ adapted file path from rk3399-nanopi-r4s.dtsi to rk3399-nanopi-r4s.dts ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts | 1 -
1 file changed, 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts
@@ -73,7 +73,6 @@
};
&pcie0 {
- max-link-speed = <1>;
num-lanes = <1>;
vpcie3v3-supply = <&vcc3v3_sys>;
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 222/280] xen: make remove callback of xen driver void returned
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 221/280] arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 223/280] scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() Greg Kroah-Hartman
` (62 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Juergen Gross, Dawei Li, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Li <set_pte_at@outlook.com>
[ Upstream commit 7cffcade57a429667447c4f41d8414bbcf1b3aaa ]
Since commit fc7a6209d571 ("bus: Make remove callback return void")
forces bus_type::remove be void-returned, it doesn't make much sense for
any bus based driver implementing remove callbalk to return non-void to
its caller.
This change is for xen bus based drivers.
Acked-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Dawei Li <set_pte_at@outlook.com>
Link: https://lore.kernel.org/r/TYCP286MB23238119AB4DF190997075C9CAE39@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM
Signed-off-by: Juergen Gross <jgross@suse.com>
Stable-dep-of: 901a5f309dab ("scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkback/xenbus.c | 4 +---
drivers/block/xen-blkfront.c | 3 +--
drivers/char/tpm/xen-tpmfront.c | 3 +--
drivers/gpu/drm/xen/xen_drm_front.c | 3 +--
drivers/input/misc/xen-kbdfront.c | 5 ++---
drivers/net/xen-netback/xenbus.c | 3 +--
drivers/net/xen-netfront.c | 4 +---
drivers/pci/xen-pcifront.c | 4 +---
drivers/scsi/xen-scsifront.c | 4 +---
drivers/tty/hvc/hvc_xen.c | 4 ++--
drivers/usb/host/xen-hcd.c | 4 +---
drivers/video/fbdev/xen-fbfront.c | 6 ++----
drivers/xen/pvcalls-back.c | 3 +--
drivers/xen/pvcalls-front.c | 3 +--
drivers/xen/xen-pciback/xenbus.c | 4 +---
drivers/xen/xen-scsiback.c | 4 +---
include/xen/xenbus.h | 2 +-
net/9p/trans_xen.c | 3 +--
sound/xen/xen_snd_front.c | 3 +--
19 files changed, 22 insertions(+), 47 deletions(-)
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -524,7 +524,7 @@ static int xen_vbd_create(struct xen_blk
return 0;
}
-static int xen_blkbk_remove(struct xenbus_device *dev)
+static void xen_blkbk_remove(struct xenbus_device *dev)
{
struct backend_info *be = dev_get_drvdata(&dev->dev);
@@ -547,8 +547,6 @@ static int xen_blkbk_remove(struct xenbu
/* Put the reference we set in xen_blkif_alloc(). */
xen_blkif_put(be->blkif);
}
-
- return 0;
}
int xen_blkbk_flush_diskcache(struct xenbus_transaction xbt,
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2469,7 +2469,7 @@ static void blkback_changed(struct xenbu
}
}
-static int blkfront_remove(struct xenbus_device *xbdev)
+static void blkfront_remove(struct xenbus_device *xbdev)
{
struct blkfront_info *info = dev_get_drvdata(&xbdev->dev);
@@ -2490,7 +2490,6 @@ static int blkfront_remove(struct xenbus
}
kfree(info);
- return 0;
}
static int blkfront_is_ready(struct xenbus_device *dev)
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -360,14 +360,13 @@ static int tpmfront_probe(struct xenbus_
return tpm_chip_register(priv->chip);
}
-static int tpmfront_remove(struct xenbus_device *dev)
+static void tpmfront_remove(struct xenbus_device *dev)
{
struct tpm_chip *chip = dev_get_drvdata(&dev->dev);
struct tpm_private *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
ring_free(priv);
dev_set_drvdata(&chip->dev, NULL);
- return 0;
}
static int tpmfront_resume(struct xenbus_device *dev)
--- a/drivers/gpu/drm/xen/xen_drm_front.c
+++ b/drivers/gpu/drm/xen/xen_drm_front.c
@@ -717,7 +717,7 @@ static int xen_drv_probe(struct xenbus_d
return xenbus_switch_state(xb_dev, XenbusStateInitialising);
}
-static int xen_drv_remove(struct xenbus_device *dev)
+static void xen_drv_remove(struct xenbus_device *dev)
{
struct xen_drm_front_info *front_info = dev_get_drvdata(&dev->dev);
int to = 100;
@@ -751,7 +751,6 @@ static int xen_drv_remove(struct xenbus_
xen_drm_drv_fini(front_info);
xenbus_frontend_closed(dev);
- return 0;
}
static const struct xenbus_device_id xen_driver_ids[] = {
--- a/drivers/input/misc/xen-kbdfront.c
+++ b/drivers/input/misc/xen-kbdfront.c
@@ -51,7 +51,7 @@ module_param_array(ptr_size, int, NULL,
MODULE_PARM_DESC(ptr_size,
"Pointing device width, height in pixels (default 800,600)");
-static int xenkbd_remove(struct xenbus_device *);
+static void xenkbd_remove(struct xenbus_device *);
static int xenkbd_connect_backend(struct xenbus_device *, struct xenkbd_info *);
static void xenkbd_disconnect_backend(struct xenkbd_info *);
@@ -404,7 +404,7 @@ static int xenkbd_resume(struct xenbus_d
return xenkbd_connect_backend(dev, info);
}
-static int xenkbd_remove(struct xenbus_device *dev)
+static void xenkbd_remove(struct xenbus_device *dev)
{
struct xenkbd_info *info = dev_get_drvdata(&dev->dev);
@@ -417,7 +417,6 @@ static int xenkbd_remove(struct xenbus_d
input_unregister_device(info->mtouch);
free_page((unsigned long)info->page);
kfree(info);
- return 0;
}
static int xenkbd_connect_backend(struct xenbus_device *dev,
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -977,7 +977,7 @@ static int read_xenbus_vif_flags(struct
return 0;
}
-static int netback_remove(struct xenbus_device *dev)
+static void netback_remove(struct xenbus_device *dev)
{
struct backend_info *be = dev_get_drvdata(&dev->dev);
@@ -992,7 +992,6 @@ static int netback_remove(struct xenbus_
kfree(be->hotplug_script);
kfree(be);
dev_set_drvdata(&dev->dev, NULL);
- return 0;
}
/*
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -2652,7 +2652,7 @@ static void xennet_bus_close(struct xenb
} while (!ret);
}
-static int xennet_remove(struct xenbus_device *dev)
+static void xennet_remove(struct xenbus_device *dev)
{
struct netfront_info *info = dev_get_drvdata(&dev->dev);
@@ -2668,8 +2668,6 @@ static int xennet_remove(struct xenbus_d
rtnl_unlock();
}
xennet_free_netdev(info->netdev);
-
- return 0;
}
static const struct xenbus_device_id netfront_ids[] = {
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -1055,14 +1055,12 @@ out:
return err;
}
-static int pcifront_xenbus_remove(struct xenbus_device *xdev)
+static void pcifront_xenbus_remove(struct xenbus_device *xdev)
{
struct pcifront_device *pdev = dev_get_drvdata(&xdev->dev);
if (pdev)
free_pdev(pdev);
-
- return 0;
}
static const struct xenbus_device_id xenpci_ids[] = {
--- a/drivers/scsi/xen-scsifront.c
+++ b/drivers/scsi/xen-scsifront.c
@@ -995,7 +995,7 @@ static int scsifront_suspend(struct xenb
return err;
}
-static int scsifront_remove(struct xenbus_device *dev)
+static void scsifront_remove(struct xenbus_device *dev)
{
struct vscsifrnt_info *info = dev_get_drvdata(&dev->dev);
@@ -1011,8 +1011,6 @@ static int scsifront_remove(struct xenbu
scsifront_free_ring(info);
scsi_host_put(info->host);
-
- return 0;
}
static void scsifront_disconnect(struct vscsifrnt_info *info)
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -420,9 +420,9 @@ static int xen_console_remove(struct xen
return 0;
}
-static int xencons_remove(struct xenbus_device *dev)
+static void xencons_remove(struct xenbus_device *dev)
{
- return xen_console_remove(dev_get_drvdata(&dev->dev));
+ xen_console_remove(dev_get_drvdata(&dev->dev));
}
static int xencons_connect_backend(struct xenbus_device *dev,
--- a/drivers/usb/host/xen-hcd.c
+++ b/drivers/usb/host/xen-hcd.c
@@ -1530,15 +1530,13 @@ static void xenhcd_backend_changed(struc
}
}
-static int xenhcd_remove(struct xenbus_device *dev)
+static void xenhcd_remove(struct xenbus_device *dev)
{
struct xenhcd_info *info = dev_get_drvdata(&dev->dev);
struct usb_hcd *hcd = xenhcd_info_to_hcd(info);
xenhcd_destroy_rings(info);
usb_put_hcd(hcd);
-
- return 0;
}
static int xenhcd_probe(struct xenbus_device *dev,
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -67,7 +67,7 @@ MODULE_PARM_DESC(video,
"Video memory size in MB, width, height in pixels (default 2,800,600)");
static void xenfb_make_preferred_console(void);
-static int xenfb_remove(struct xenbus_device *);
+static void xenfb_remove(struct xenbus_device *);
static void xenfb_init_shared_page(struct xenfb_info *, struct fb_info *);
static int xenfb_connect_backend(struct xenbus_device *, struct xenfb_info *);
static void xenfb_disconnect_backend(struct xenfb_info *);
@@ -527,7 +527,7 @@ static int xenfb_resume(struct xenbus_de
return xenfb_connect_backend(dev, info);
}
-static int xenfb_remove(struct xenbus_device *dev)
+static void xenfb_remove(struct xenbus_device *dev)
{
struct xenfb_info *info = dev_get_drvdata(&dev->dev);
@@ -542,8 +542,6 @@ static int xenfb_remove(struct xenbus_de
vfree(info->gfns);
vfree(info->fb);
kfree(info);
-
- return 0;
}
static unsigned long vmalloc_to_gfn(void *address)
--- a/drivers/xen/pvcalls-back.c
+++ b/drivers/xen/pvcalls-back.c
@@ -1180,9 +1180,8 @@ static void pvcalls_back_changed(struct
}
}
-static int pvcalls_back_remove(struct xenbus_device *dev)
+static void pvcalls_back_remove(struct xenbus_device *dev)
{
- return 0;
}
static int pvcalls_back_uevent(struct xenbus_device *xdev,
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -1087,7 +1087,7 @@ static const struct xenbus_device_id pvc
{ "" }
};
-static int pvcalls_front_remove(struct xenbus_device *dev)
+static void pvcalls_front_remove(struct xenbus_device *dev)
{
struct pvcalls_bedata *bedata;
struct sock_mapping *map = NULL, *n;
@@ -1123,7 +1123,6 @@ static int pvcalls_front_remove(struct x
kfree(bedata->ring.sring);
kfree(bedata);
xenbus_switch_state(dev, XenbusStateClosed);
- return 0;
}
static int pvcalls_front_probe(struct xenbus_device *dev,
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -716,14 +716,12 @@ out:
return err;
}
-static int xen_pcibk_xenbus_remove(struct xenbus_device *dev)
+static void xen_pcibk_xenbus_remove(struct xenbus_device *dev)
{
struct xen_pcibk_device *pdev = dev_get_drvdata(&dev->dev);
if (pdev != NULL)
free_pdev(pdev);
-
- return 0;
}
static const struct xenbus_device_id xen_pcibk_ids[] = {
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1249,7 +1249,7 @@ static void scsiback_release_translation
spin_unlock_irqrestore(&info->v2p_lock, flags);
}
-static int scsiback_remove(struct xenbus_device *dev)
+static void scsiback_remove(struct xenbus_device *dev)
{
struct vscsibk_info *info = dev_get_drvdata(&dev->dev);
@@ -1261,8 +1261,6 @@ static int scsiback_remove(struct xenbus
gnttab_page_cache_shrink(&info->free_pages, 0);
dev_set_drvdata(&dev->dev, NULL);
-
- return 0;
}
static int scsiback_probe(struct xenbus_device *dev,
--- a/include/xen/xenbus.h
+++ b/include/xen/xenbus.h
@@ -117,7 +117,7 @@ struct xenbus_driver {
const struct xenbus_device_id *id);
void (*otherend_changed)(struct xenbus_device *dev,
enum xenbus_state backend_state);
- int (*remove)(struct xenbus_device *dev);
+ void (*remove)(struct xenbus_device *dev);
int (*suspend)(struct xenbus_device *dev);
int (*resume)(struct xenbus_device *dev);
int (*uevent)(struct xenbus_device *, struct kobj_uevent_env *);
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -307,13 +307,12 @@ static void xen_9pfs_front_free(struct x
kfree(priv);
}
-static int xen_9pfs_front_remove(struct xenbus_device *dev)
+static void xen_9pfs_front_remove(struct xenbus_device *dev)
{
struct xen_9pfs_front_priv *priv = dev_get_drvdata(&dev->dev);
dev_set_drvdata(&dev->dev, NULL);
xen_9pfs_front_free(priv);
- return 0;
}
static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,
--- a/sound/xen/xen_snd_front.c
+++ b/sound/xen/xen_snd_front.c
@@ -311,7 +311,7 @@ static int xen_drv_probe(struct xenbus_d
return xenbus_switch_state(xb_dev, XenbusStateInitialising);
}
-static int xen_drv_remove(struct xenbus_device *dev)
+static void xen_drv_remove(struct xenbus_device *dev)
{
struct xen_snd_front_info *front_info = dev_get_drvdata(&dev->dev);
int to = 100;
@@ -345,7 +345,6 @@ static int xen_drv_remove(struct xenbus_
xen_snd_drv_fini(front_info);
xenbus_frontend_closed(dev);
- return 0;
}
static const struct xenbus_device_id xen_drv_ids[] = {
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 223/280] scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 222/280] xen: make remove callback of xen driver void returned Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 224/280] dmaengine: stm32: dmamux: fix OF node leak on route allocation failure Greg Kroah-Hartman
` (61 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Juergen Gross,
Martin K. Petersen, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
[ Upstream commit 901a5f309daba412e2a30364d7ec1492fa11c32c ]
Memory allocated for struct vscsiblk_info in scsiback_probe() is not
freed in scsiback_remove() leading to potential memory leaks on remove,
as well as in the scsiback_probe() error paths. Fix that by freeing it
in scsiback_remove().
Cc: stable@vger.kernel.org
Fixes: d9d660f6e562 ("xen-scsiback: Add Xen PV SCSI backend driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://patch.msgid.link/20251223063012.119035-1-nihaal@cse.iitm.ac.in
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xen-scsiback.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1261,6 +1261,7 @@ static void scsiback_remove(struct xenbu
gnttab_page_cache_shrink(&info->free_pages, 0);
dev_set_drvdata(&dev->dev, NULL);
+ kfree(info);
}
static int scsiback_probe(struct xenbus_device *dev,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 224/280] dmaengine: stm32: dmamux: fix OF node leak on route allocation failure
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 223/280] scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 225/280] mm/page_alloc: prevent pcp corruption with SMP=n Greg Kroah-Hartman
` (60 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre-Yves MORDRET, Johan Hovold,
Amelie Delaunay, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit b1b590a590af13ded598e70f0b72bc1e515787a1 ]
Make sure to drop the reference taken to the DMA master OF node also on
late route allocation failures.
Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver")
Cc: stable@vger.kernel.org # 4.15
Cc: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://patch.msgid.link/20251117161258.10679-12-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/stm32-dmamux.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/dma/stm32-dmamux.c
+++ b/drivers/dma/stm32-dmamux.c
@@ -140,7 +140,7 @@ static void *stm32_dmamux_route_allocate
ret = pm_runtime_resume_and_get(&pdev->dev);
if (ret < 0) {
spin_unlock_irqrestore(&dmamux->lock, flags);
- goto error;
+ goto err_put_dma_spec_np;
}
spin_unlock_irqrestore(&dmamux->lock, flags);
@@ -160,6 +160,8 @@ static void *stm32_dmamux_route_allocate
return mux;
+err_put_dma_spec_np:
+ of_node_put(dma_spec->np);
error:
clear_bit(mux->chan_id, dmamux->dma_inuse);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 225/280] mm/page_alloc: prevent pcp corruption with SMP=n
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 224/280] dmaengine: stm32: dmamux: fix OF node leak on route allocation failure Greg Kroah-Hartman
@ 2026-02-04 14:39 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 226/280] dmaengine: stm32: dmamux: fix device leak on route allocation Greg Kroah-Hartman
` (59 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:39 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlastimil Babka, kernel test robot,
Mel Gorman, Brendan Jackman, Johannes Weiner, Michal Hocko,
Sebastian Andrzej Siewior, Steven Rostedt, Suren Baghdasaryan,
Zi Yan, Andrew Morton, Sasha Levin, Matthew Wilcox
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit 038a102535eb49e10e93eafac54352fcc5d78847 ]
The kernel test robot has reported:
BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28
lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0
CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470
Call Trace:
<IRQ>
__dump_stack (lib/dump_stack.c:95)
dump_stack_lvl (lib/dump_stack.c:123)
dump_stack (lib/dump_stack.c:130)
spin_dump (kernel/locking/spinlock_debug.c:71)
do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?)
_raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138)
__free_frozen_pages (mm/page_alloc.c:2973)
___free_pages (mm/page_alloc.c:5295)
__free_pages (mm/page_alloc.c:5334)
tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290)
? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289)
? rcu_core (kernel/rcu/tree.c:?)
rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861)
rcu_core_si (kernel/rcu/tree.c:2879)
handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)
__irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725)
irq_exit_rcu (kernel/softirq.c:741)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052)
</IRQ>
<TASK>
RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)
free_pcppages_bulk (mm/page_alloc.c:1494)
drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632)
__drain_all_pages (mm/page_alloc.c:2731)
drain_all_pages (mm/page_alloc.c:2747)
kcompactd (mm/compaction.c:3115)
kthread (kernel/kthread.c:465)
? __cfi_kcompactd (mm/compaction.c:3166)
? __cfi_kthread (kernel/kthread.c:412)
ret_from_fork (arch/x86/kernel/process.c:164)
? __cfi_kthread (kernel/kthread.c:412)
ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
</TASK>
Matthew has analyzed the report and identified that in drain_page_zone()
we are in a section protected by spin_lock(&pcp->lock) and then get an
interrupt that attempts spin_trylock() on the same lock. The code is
designed to work this way without disabling IRQs and occasionally fail the
trylock with a fallback. However, the SMP=n spinlock implementation
assumes spin_trylock() will always succeed, and thus it's normally a
no-op. Here the enabled lock debugging catches the problem, but otherwise
it could cause a corruption of the pcp structure.
The problem has been introduced by commit 574907741599 ("mm/page_alloc:
leave IRQs enabled for per-cpu page allocations"). The pcp locking scheme
recognizes the need for disabling IRQs to prevent nesting spin_trylock()
sections on SMP=n, but the need to prevent the nesting in spin_lock() has
not been recognized. Fix it by introducing local wrappers that change the
spin_lock() to spin_lock_iqsave() with SMP=n and use them in all places
that do spin_lock(&pcp->lock).
[vbabka@suse.cz: add pcp_ prefix to the spin_lock_irqsave wrappers, per Steven]
Link: https://lkml.kernel.org/r/20260105-fix-pcp-up-v1-1-5579662d2071@suse.cz
Fixes: 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202512101320.e2f2dd6f-lkp@intel.com
Analyzed-by: Matthew Wilcox <willy@infradead.org>
Link: https://lore.kernel.org/all/aUW05pyc9nZkvY-1@casper.infradead.org/
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ drop changes to decay_pcp_high() and zone_pcp_update_cacheinfo() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 37 +++++++++++++++++++++++++++++++++----
1 file changed, 33 insertions(+), 4 deletions(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -198,6 +198,33 @@ static DEFINE_MUTEX(pcp_batch_high_lock)
#define pcp_spin_unlock(ptr) \
pcpu_spin_unlock(lock, ptr)
+/*
+ * With the UP spinlock implementation, when we spin_lock(&pcp->lock) (for i.e.
+ * a potentially remote cpu drain) and get interrupted by an operation that
+ * attempts pcp_spin_trylock(), we can't rely on the trylock failure due to UP
+ * spinlock assumptions making the trylock a no-op. So we have to turn that
+ * spin_lock() to a spin_lock_irqsave(). This works because on UP there are no
+ * remote cpu's so we can only be locking the only existing local one.
+ */
+#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT)
+static inline void __flags_noop(unsigned long *flags) { }
+#define pcp_spin_lock_maybe_irqsave(ptr, flags) \
+({ \
+ __flags_noop(&(flags)); \
+ spin_lock(&(ptr)->lock); \
+})
+#define pcp_spin_unlock_maybe_irqrestore(ptr, flags) \
+({ \
+ spin_unlock(&(ptr)->lock); \
+ __flags_noop(&(flags)); \
+})
+#else
+#define pcp_spin_lock_maybe_irqsave(ptr, flags) \
+ spin_lock_irqsave(&(ptr)->lock, flags)
+#define pcp_spin_unlock_maybe_irqrestore(ptr, flags) \
+ spin_unlock_irqrestore(&(ptr)->lock, flags)
+#endif
+
#ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID
DEFINE_PER_CPU(int, numa_node);
EXPORT_PER_CPU_SYMBOL(numa_node);
@@ -3174,14 +3201,15 @@ static int rmqueue_bulk(struct zone *zon
*/
void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp)
{
+ unsigned long UP_flags;
int to_drain, batch;
batch = READ_ONCE(pcp->batch);
to_drain = min(pcp->count, batch);
if (to_drain > 0) {
- spin_lock(&pcp->lock);
+ pcp_spin_lock_maybe_irqsave(pcp, UP_flags);
free_pcppages_bulk(zone, to_drain, pcp, 0);
- spin_unlock(&pcp->lock);
+ pcp_spin_unlock_maybe_irqrestore(pcp, UP_flags);
}
}
#endif
@@ -3192,10 +3220,11 @@ void drain_zone_pages(struct zone *zone,
static void drain_pages_zone(unsigned int cpu, struct zone *zone)
{
struct per_cpu_pages *pcp = per_cpu_ptr(zone->per_cpu_pageset, cpu);
+ unsigned long UP_flags;
int count;
do {
- spin_lock(&pcp->lock);
+ pcp_spin_lock_maybe_irqsave(pcp, UP_flags);
count = pcp->count;
if (count) {
int to_drain = min(count,
@@ -3204,7 +3233,7 @@ static void drain_pages_zone(unsigned in
free_pcppages_bulk(zone, to_drain, pcp, 0);
count -= to_drain;
}
- spin_unlock(&pcp->lock);
+ pcp_spin_unlock_maybe_irqrestore(pcp, UP_flags);
} while (count);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 226/280] dmaengine: stm32: dmamux: fix device leak on route allocation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-02-04 14:39 ` [PATCH 6.1 225/280] mm/page_alloc: prevent pcp corruption with SMP=n Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 227/280] mm: kmsan: fix poisoning of high-order non-compound pages Greg Kroah-Hartman
` (58 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pierre-Yves MORDRET, Johan Hovold,
Amelie Delaunay, Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit dd6e4943889fb354efa3f700e42739da9bddb6ef ]
Make sure to drop the reference taken when looking up the DMA mux
platform device during route allocation.
Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver")
Cc: stable@vger.kernel.org # 4.15
Cc: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/stm32-dmamux.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/dma/stm32-dmamux.c
+++ b/drivers/dma/stm32-dmamux.c
@@ -88,23 +88,25 @@ static void *stm32_dmamux_route_allocate
struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev);
struct stm32_dmamux *mux;
u32 i, min, max;
- int ret;
+ int ret = -EINVAL;
unsigned long flags;
if (dma_spec->args_count != 3) {
dev_err(&pdev->dev, "invalid number of dma mux args\n");
- return ERR_PTR(-EINVAL);
+ goto err_put_pdev;
}
if (dma_spec->args[0] > dmamux->dmamux_requests) {
dev_err(&pdev->dev, "invalid mux request number: %d\n",
dma_spec->args[0]);
- return ERR_PTR(-EINVAL);
+ goto err_put_pdev;
}
mux = kzalloc(sizeof(*mux), GFP_KERNEL);
- if (!mux)
- return ERR_PTR(-ENOMEM);
+ if (!mux) {
+ ret = -ENOMEM;
+ goto err_put_pdev;
+ }
spin_lock_irqsave(&dmamux->lock, flags);
mux->chan_id = find_first_zero_bit(dmamux->dma_inuse,
@@ -131,7 +133,6 @@ static void *stm32_dmamux_route_allocate
dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1);
if (!dma_spec->np) {
dev_err(&pdev->dev, "can't get dma master\n");
- ret = -EINVAL;
goto error;
}
@@ -158,6 +159,8 @@ static void *stm32_dmamux_route_allocate
dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n",
mux->request, mux->master, mux->chan_id);
+ put_device(&pdev->dev);
+
return mux;
err_put_dma_spec_np:
@@ -167,6 +170,9 @@ error:
error_chan_id:
kfree(mux);
+err_put_pdev:
+ put_device(&pdev->dev);
+
return ERR_PTR(ret);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 227/280] mm: kmsan: fix poisoning of high-order non-compound pages
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 226/280] dmaengine: stm32: dmamux: fix device leak on route allocation Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 228/280] xfs: set max_agbno to allow sparse alloc of last full inode chunk Greg Kroah-Hartman
` (57 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryan Roberts, Alexander Potapenko,
Dmitriy Vyukov, Marco Elver, Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Roberts <ryan.roberts@arm.com>
[ Upstream commit 4795d205d78690a46b60164f44b8bb7b3e800865 ]
kmsan_free_page() is called by the page allocator's free_pages_prepare()
during page freeing. Its job is to poison all the memory covered by the
page. It can be called with an order-0 page, a compound high-order page
or a non-compound high-order page. But page_size() only works for order-0
and compound pages. For a non-compound high-order page it will
incorrectly return PAGE_SIZE.
The implication is that the tail pages of a high-order non-compound page
do not get poisoned at free, so any invalid access while they are free
could go unnoticed. It looks like the pages will be poisoned again at
allocation time, so that would bookend the window.
Fix this by using the order parameter to calculate the size.
Link: https://lkml.kernel.org/r/20260104134348.3544298-1-ryan.roberts@arm.com
Fixes: b073d7f8aee4 ("mm: kmsan: maintain KMSAN metadata for page operations")
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Tested-by: Alexander Potapenko <glider@google.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kmsan/shadow.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/mm/kmsan/shadow.c
+++ b/mm/kmsan/shadow.c
@@ -209,8 +209,7 @@ void kmsan_free_page(struct page *page,
if (!kmsan_enabled || kmsan_in_runtime())
return;
kmsan_enter_runtime();
- kmsan_internal_poison_memory(page_address(page),
- PAGE_SIZE << compound_order(page),
+ kmsan_internal_poison_memory(page_address(page), PAGE_SIZE << order,
GFP_KERNEL,
KMSAN_POISON_CHECK | KMSAN_POISON_FREE);
kmsan_leave_runtime();
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 228/280] xfs: set max_agbno to allow sparse alloc of last full inode chunk
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 227/280] mm: kmsan: fix poisoning of high-order non-compound pages Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 229/280] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu Greg Kroah-Hartman
` (56 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Foster, Darrick J. Wong,
Carlos Maiolino, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <bfoster@redhat.com>
[ Upstream commit c360004c0160dbe345870f59f24595519008926f ]
Sparse inode cluster allocation sets min/max agbno values to avoid
allocating an inode cluster that might map to an invalid inode
chunk. For example, we can't have an inode record mapped to agbno 0
or that extends past the end of a runt AG of misaligned size.
The initial calculation of max_agbno is unnecessarily conservative,
however. This has triggered a corner case allocation failure where a
small runt AG (i.e. 2063 blocks) is mostly full save for an extent
to the EOFS boundary: [2050,13]. max_agbno is set to 2048 in this
case, which happens to be the offset of the last possible valid
inode chunk in the AG. In practice, we should be able to allocate
the 4-block cluster at agbno 2052 to map to the parent inode record
at agbno 2048, but the max_agbno value precludes it.
Note that this can result in filesystem shutdown via dirty trans
cancel on stable kernels prior to commit 9eb775968b68 ("xfs: walk
all AGs if TRYLOCK passed to xfs_alloc_vextent_iterate_ags") because
the tail AG selection by the allocator sets t_highest_agno on the
transaction. If the inode allocator spins around and finds an inode
chunk with free inodes in an earlier AG, the subsequent dir name
creation path may still fail to allocate due to the AG restriction
and cancel.
To avoid this problem, update the max_agbno calculation to the agbno
prior to the last chunk aligned agbno in the AG. This is not
necessarily the last valid allocation target for a sparse chunk, but
since inode chunks (i.e. records) are chunk aligned and sparse
allocs are cluster sized/aligned, this allows the sb_spino_align
alignment restriction to take over and round down the max effective
agbno to within the last valid inode chunk in the AG.
Note that even though the allocator improvements in the
aforementioned commit seem to avoid this particular dirty trans
cancel situation, the max_agbno logic improvement still applies as
we should be able to allocate from an AG that has been appropriately
selected. The more important target for this patch however are
older/stable kernels prior to this allocator rework/improvement.
Cc: stable@vger.kernel.org # v4.2
Fixes: 56d1115c9bc7 ("xfs: allocate sparse inode chunks on full chunk allocation failure")
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
[ xfs_ag_block_count(args.mp, pag_agno(pag)) => args.mp->m_sb.sb_agblocks ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_ialloc.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -772,14 +772,15 @@ sparse_alloc:
* invalid inode records, such as records that start at agbno 0
* or extend beyond the AG.
*
- * Set min agbno to the first aligned, non-zero agbno and max to
- * the last aligned agbno that is at least one full chunk from
- * the end of the AG.
+ * Set min agbno to the first chunk aligned, non-zero agbno and
+ * max to one less than the last chunk aligned agbno from the
+ * end of the AG. We subtract 1 from max so that the cluster
+ * allocation alignment takes over and allows allocation within
+ * the last full inode chunk in the AG.
*/
args.min_agbno = args.mp->m_sb.sb_inoalignmt;
args.max_agbno = round_down(args.mp->m_sb.sb_agblocks,
- args.mp->m_sb.sb_inoalignmt) -
- igeo->ialloc_blks;
+ args.mp->m_sb.sb_inoalignmt) - 1;
error = xfs_alloc_vextent(&args);
if (error)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 229/280] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 228/280] xfs: set max_agbno to allow sparse alloc of last full inode chunk Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 230/280] ksmbd: smbd: fix dma_unmap_sg() nents Greg Kroah-Hartman
` (55 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming Qian, Benjamin Gaignard,
Peng Fan, Frank Li, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <ming.qian@oss.nxp.com>
[ Upstream commit 3de49966499634454fd59e0e6fecd50baab7febd ]
For i.MX8MQ platform, the ADB in the VPUMIX domain has no separate reset
and clock enable bits, but is ungated and reset together with the VPUs.
So we can't reset G1 or G2 separately, it may led to the system hang.
Remove rst_mask and clk_mask of imx8mq_vpu_blk_ctl_domain_data.
Let imx8mq_vpu_power_notifier() do really vpu reset.
Fixes: 608d7c325e85 ("soc: imx: imx8m-blk-ctrl: add i.MX8MQ VPU blk-ctrl")
Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/imx/imx8m-blk-ctrl.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/soc/imx/imx8m-blk-ctrl.c
+++ b/drivers/soc/imx/imx8m-blk-ctrl.c
@@ -810,22 +810,25 @@ static int imx8mq_vpu_power_notifier(str
return NOTIFY_OK;
}
+/*
+ * For i.MX8MQ, the ADB in the VPUMIX domain has no separate reset and clock
+ * enable bits, but is ungated and reset together with the VPUs.
+ * Resetting G1 or G2 separately may led to system hang.
+ * Remove the rst_mask and clk_mask from the domain data of G1 and G2,
+ * Let imx8mq_vpu_power_notifier() do really vpu reset.
+ */
static const struct imx8m_blk_ctrl_domain_data imx8mq_vpu_blk_ctl_domain_data[] = {
[IMX8MQ_VPUBLK_PD_G1] = {
.name = "vpublk-g1",
.clk_names = (const char *[]){ "g1", },
.num_clks = 1,
.gpc_name = "g1",
- .rst_mask = BIT(1),
- .clk_mask = BIT(1),
},
[IMX8MQ_VPUBLK_PD_G2] = {
.name = "vpublk-g2",
.clk_names = (const char *[]){ "g2", },
.num_clks = 1,
.gpc_name = "g2",
- .rst_mask = BIT(0),
- .clk_mask = BIT(0),
},
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 230/280] ksmbd: smbd: fix dma_unmap_sg() nents
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 229/280] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 231/280] mei: trace: treat reg parameter as string Greg Kroah-Hartman
` (54 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Namjae Jeon,
Steve French, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
[ Upstream commit 98e3e2b561bc88f4dd218d1c05890672874692f6 ]
The dma_unmap_sg() functions should be called with the same nents as the
dma_map_sg(), not the value the map function returned.
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
[ Context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/transport_rdma.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -1103,14 +1103,12 @@ static int get_sg_list(void *buf, int si
static int get_mapped_sg_list(struct ib_device *device, void *buf, int size,
struct scatterlist *sg_list, int nentries,
- enum dma_data_direction dir)
+ enum dma_data_direction dir, int *npages)
{
- int npages;
-
- npages = get_sg_list(buf, size, sg_list, nentries);
- if (npages < 0)
+ *npages = get_sg_list(buf, size, sg_list, nentries);
+ if (*npages < 0)
return -EINVAL;
- return ib_dma_map_sg(device, sg_list, npages, dir);
+ return ib_dma_map_sg(device, sg_list, *npages, dir);
}
static int post_sendmsg(struct smb_direct_transport *t,
@@ -1179,12 +1177,13 @@ static int smb_direct_post_send_data(str
for (i = 0; i < niov; i++) {
struct ib_sge *sge;
int sg_cnt;
+ int npages;
sg_init_table(sg, SMB_DIRECT_MAX_SEND_SGES - 1);
sg_cnt = get_mapped_sg_list(t->cm_id->device,
iov[i].iov_base, iov[i].iov_len,
sg, SMB_DIRECT_MAX_SEND_SGES - 1,
- DMA_TO_DEVICE);
+ DMA_TO_DEVICE, &npages);
if (sg_cnt <= 0) {
pr_err("failed to map buffer\n");
ret = -ENOMEM;
@@ -1192,7 +1191,7 @@ static int smb_direct_post_send_data(str
} else if (sg_cnt + msg->num_sge > SMB_DIRECT_MAX_SEND_SGES) {
pr_err("buffer not fitted into sges\n");
ret = -E2BIG;
- ib_dma_unmap_sg(t->cm_id->device, sg, sg_cnt,
+ ib_dma_unmap_sg(t->cm_id->device, sg, npages,
DMA_TO_DEVICE);
goto err;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 231/280] mei: trace: treat reg parameter as string
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 230/280] ksmbd: smbd: fix dma_unmap_sg() nents Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 232/280] arm64/fpsimd: signal: Fix restoration of SVE context Greg Kroah-Hartman
` (53 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Usyskin, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <alexander.usyskin@intel.com>
[ Upstream commit 06d5a7afe1d0b47102936d8fba568572c2b4b941 ]
The commit
afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format")
forbids to emit event with a plain char* without a wrapper.
The reg parameter always passed as static string and wrapper
is not strictly required, contrary to dev parameter.
Use the string wrapper anyway to check sanity of the reg parameters,
store it value independently and prevent internal kernel data leaks.
Since some code refactoring has taken place, explicit backporting may
be needed for kernels older than 6.10.
Cc: stable@vger.kernel.org # v6.11+
Fixes: a0a927d06d79 ("mei: me: add io register tracing")
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://patch.msgid.link/20260111145125.1754912-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ adapted __assign_str() calls to use two arguments ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/mei/mei-trace.h | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/misc/mei/mei-trace.h
+++ b/drivers/misc/mei/mei-trace.h
@@ -21,18 +21,18 @@ TRACE_EVENT(mei_reg_read,
TP_ARGS(dev, reg, offs, val),
TP_STRUCT__entry(
__string(dev, dev_name(dev))
- __field(const char *, reg)
+ __string(reg, reg)
__field(u32, offs)
__field(u32, val)
),
TP_fast_assign(
__assign_str(dev, dev_name(dev));
- __entry->reg = reg;
+ __assign_str(reg, reg);
__entry->offs = offs;
__entry->val = val;
),
TP_printk("[%s] read %s:[%#x] = %#x",
- __get_str(dev), __entry->reg, __entry->offs, __entry->val)
+ __get_str(dev), __get_str(reg), __entry->offs, __entry->val)
);
TRACE_EVENT(mei_reg_write,
@@ -40,18 +40,18 @@ TRACE_EVENT(mei_reg_write,
TP_ARGS(dev, reg, offs, val),
TP_STRUCT__entry(
__string(dev, dev_name(dev))
- __field(const char *, reg)
+ __string(reg, reg)
__field(u32, offs)
__field(u32, val)
),
TP_fast_assign(
__assign_str(dev, dev_name(dev));
- __entry->reg = reg;
+ __assign_str(reg, reg);
__entry->offs = offs;
__entry->val = val;
),
TP_printk("[%s] write %s[%#x] = %#x",
- __get_str(dev), __entry->reg, __entry->offs, __entry->val)
+ __get_str(dev), __get_str(reg), __entry->offs, __entry->val)
);
TRACE_EVENT(mei_pci_cfg_read,
@@ -59,18 +59,18 @@ TRACE_EVENT(mei_pci_cfg_read,
TP_ARGS(dev, reg, offs, val),
TP_STRUCT__entry(
__string(dev, dev_name(dev))
- __field(const char *, reg)
+ __string(reg, reg)
__field(u32, offs)
__field(u32, val)
),
TP_fast_assign(
__assign_str(dev, dev_name(dev));
- __entry->reg = reg;
+ __assign_str(reg, reg);
__entry->offs = offs;
__entry->val = val;
),
TP_printk("[%s] pci cfg read %s:[%#x] = %#x",
- __get_str(dev), __entry->reg, __entry->offs, __entry->val)
+ __get_str(dev), __get_str(reg), __entry->offs, __entry->val)
);
#endif /* _MEI_TRACE_H_ */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 232/280] arm64/fpsimd: signal: Fix restoration of SVE context
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 231/280] mei: trace: treat reg parameter as string Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 233/280] mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform Greg Kroah-Hartman
` (52 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Mark Brown,
Will Deacon, Catalin Marinas, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit d2907cbe9ea0a54cbe078076f9d089240ee1e2d9 ]
When SME is supported, Restoring SVE signal context can go wrong in a
few ways, including placing the task into an invalid state where the
kernel may read from out-of-bounds memory (and may potentially take a
fatal fault) and/or may kill the task with a SIGKILL.
(1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into
an invalid state where SVCR.SM is set (and sve_state is non-NULL)
but TIF_SME is clear, consequently resuting in out-of-bounds memory
reads and/or killing the task with SIGKILL.
This can only occur in unusual (but legitimate) cases where the SVE
signal context has either been modified by userspace or was saved in
the context of another task (e.g. as with CRIU), as otherwise the
presence of an SVE signal context with SVE_SIG_FLAG_SM implies that
TIF_SME is already set.
While in this state, task_fpsimd_load() will NOT configure SMCR_ELx
(leaving some arbitrary value configured in hardware) before
restoring SVCR and attempting to restore the streaming mode SVE
registers from memory via sve_load_state(). As the value of
SMCR_ELx.LEN may be larger than the task's streaming SVE vector
length, this may read memory outside of the task's allocated
sve_state, reading unrelated data and/or triggering a fault.
While this can result in secrets being loaded into streaming SVE
registers, these values are never exposed. As TIF_SME is clear,
fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0
accesses to streaming mode SVE registers, so these cannot be
accessed directly at EL0. As fpsimd_save_user_state() verifies the
live vector length before saving (S)SVE state to memory, no secret
values can be saved back to memory (and hence cannot be observed via
ptrace, signals, etc).
When the live vector length doesn't match the expected vector length
for the task, fpsimd_save_user_state() will send a fatal SIGKILL
signal to the task. Hence the task may be killed after executing
userspace for some period of time.
(2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the
task's SVCR.SM. If SVCR.SM was set prior to restoring the context,
then the task will be left in streaming mode unexpectedly, and some
register state will be combined inconsistently, though the task will
be left in legitimate state from the kernel's PoV.
This can only occur in unusual (but legitimate) cases where ptrace
has been used to set SVCR.SM after entry to the sigreturn syscall,
as syscall entry clears SVCR.SM.
In these cases, the the provided SVE register data will be loaded
into the task's sve_state using the non-streaming SVE vector length
and the FPSIMD registers will be merged into this using the
streaming SVE vector length.
Fix (1) by setting TIF_SME when setting SVCR.SM. This also requires
ensuring that the task's sme_state has been allocated, but as this could
contain live ZA state, it should not be zeroed. Fix (2) by clearing
SVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear.
For consistency, I've pulled the manipulation of SVCR, TIF_SVE, TIF_SME,
and fp_type earlier, immediately after the allocation of
sve_state/sme_state, before the restore of the actual register state.
This makes it easier to ensure that these are always modified
consistently, even if a fault is taken while reading the register data
from the signal context. I do not expect any software to depend on the
exact state restored when a fault is taken while reading the context.
Fixes: 85ed24dad290 ("arm64/sme: Implement streaming SVE signal handling")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ adapted sme_state to za_state ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/signal.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -317,12 +317,28 @@ static int restore_sve_fpsimd_context(st
fpsimd_flush_task_state(current);
/* From now, fpsimd_thread_switch() won't touch thread.sve_state */
+ if (sve.flags & SVE_SIG_FLAG_SM) {
+ sme_alloc(current, false);
+ if (!current->thread.za_state)
+ return -ENOMEM;
+ }
+
sve_alloc(current, true);
if (!current->thread.sve_state) {
clear_thread_flag(TIF_SVE);
return -ENOMEM;
}
+ if (sve.flags & SVE_SIG_FLAG_SM) {
+ current->thread.svcr |= SVCR_SM_MASK;
+ set_thread_flag(TIF_SME);
+ } else {
+ current->thread.svcr &= ~SVCR_SM_MASK;
+ set_thread_flag(TIF_SVE);
+ }
+
+ current->thread.fp_type = FP_STATE_SVE;
+
err = __copy_from_user(current->thread.sve_state,
(char __user const *)user->sve +
SVE_SIG_REGS_OFFSET,
@@ -330,12 +346,6 @@ static int restore_sve_fpsimd_context(st
if (err)
return -EFAULT;
- if (sve.flags & SVE_SIG_FLAG_SM)
- current->thread.svcr |= SVCR_SM_MASK;
- else
- set_thread_flag(TIF_SVE);
- current->thread.fp_type = FP_STATE_SVE;
-
fpsimd_only:
/* copy the FP and status/control registers */
/* restore_sigframe() already checked that user->fpsimd != NULL. */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 233/280] mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 232/280] arm64/fpsimd: signal: Fix restoration of SVE context Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 234/280] mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode Greg Kroah-Hartman
` (51 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shawn Lin, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit b75a52b0dda353aeefb4830a320589a363f49579 ]
For Rockchip platform, DLL bypass bit and start bit need to be set if
DLL is not locked. And adjust pre-change delay to 0x3 for better signal
test result.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Link: https://lore.kernel.org/r/1675298118-64243-2-git-send-email-shawn.lin@rock-chips.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Stable-dep-of: 3009738a855c ("mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-of-dwcmshc.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
+++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
@@ -48,6 +48,7 @@
#define DWCMSHC_EMMC_DLL_RXCLK_SRCSEL 29
#define DWCMSHC_EMMC_DLL_START_POINT 16
#define DWCMSHC_EMMC_DLL_INC 8
+#define DWCMSHC_EMMC_DLL_BYPASS BIT(24)
#define DWCMSHC_EMMC_DLL_DLYENA BIT(27)
#define DLL_TXCLK_TAPNUM_DEFAULT 0x10
#define DLL_TXCLK_TAPNUM_90_DEGREES 0xA
@@ -60,6 +61,7 @@
#define DLL_RXCLK_NO_INVERTER 1
#define DLL_RXCLK_INVERTER 0
#define DLL_CMDOUT_TAPNUM_90_DEGREES 0x8
+#define DLL_RXCLK_ORI_GATE BIT(31)
#define DLL_CMDOUT_TAPNUM_FROM_SW BIT(24)
#define DLL_CMDOUT_SRC_CLK_NEG BIT(28)
#define DLL_CMDOUT_EN_SRC_CLK_NEG BIT(29)
@@ -234,9 +236,12 @@ static void dwcmshc_rk3568_set_clock(str
sdhci_writel(host, extra, reg);
if (clock <= 52000000) {
- /* Disable DLL and reset both of sample and drive clock */
- sdhci_writel(host, 0, DWCMSHC_EMMC_DLL_CTRL);
- sdhci_writel(host, 0, DWCMSHC_EMMC_DLL_RXCLK);
+ /*
+ * Disable DLL and reset both of sample and drive clock.
+ * The bypass bit and start bit need to be set if DLL is not locked.
+ */
+ sdhci_writel(host, DWCMSHC_EMMC_DLL_BYPASS | DWCMSHC_EMMC_DLL_START, DWCMSHC_EMMC_DLL_CTRL);
+ sdhci_writel(host, DLL_RXCLK_ORI_GATE, DWCMSHC_EMMC_DLL_RXCLK);
sdhci_writel(host, 0, DWCMSHC_EMMC_DLL_TXCLK);
sdhci_writel(host, 0, DECMSHC_EMMC_DLL_CMDOUT);
/*
@@ -279,7 +284,7 @@ static void dwcmshc_rk3568_set_clock(str
}
extra = 0x1 << 16 | /* tune clock stop en */
- 0x2 << 17 | /* pre-change delay */
+ 0x3 << 17 | /* pre-change delay */
0x3 << 19; /* post-change delay */
sdhci_writel(host, extra, dwc_priv->vendor_specific_area1 + DWCMSHC_EMMC_ATCTRL);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 234/280] mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 233/280] mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 235/280] ALSA: scarlett2: Fix buffer overflow in config retrieval Greg Kroah-Hartman
` (50 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Yifeng Zhao,
Shawn Lin, Ulf Hansson, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit 3009738a855cf938bbfc9078bec725031ae623a4 ]
When operating in HS200 or HS400 timing modes, reducing the clock frequency
below 52MHz will lead to link broken as the Rockchip DWC MSHC controller
requires maintaining a minimum clock of 52MHz in these modes.
Add a check to prevent illegal clock reduction through debugfs:
root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock
root@debian:/# [ 30.090146] mmc0: running CQE recovery
mmc0: cqhci: Failed to halt
mmc0: cqhci: spurious TCN for tag 0
WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24
Modules linked in:
CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT
Hardware name: Rockchip RK3588 EVB1 V10 Board (DT)
Workqueue: kblockd blk_mq_run_work_fn
pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : cqhci_irq+0x254/0x818
lr : cqhci_irq+0x254/0x818
...
Fixes: c6f361cba51c ("mmc: sdhci-of-dwcmshc: add support for rk3588")
Cc: Sebastian Reichel <sebastian.reichel@collabora.com>
Cc: Yifeng Zhao <yifeng.zhao@rock-chips.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-of-dwcmshc.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
+++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
@@ -236,6 +236,13 @@ static void dwcmshc_rk3568_set_clock(str
sdhci_writel(host, extra, reg);
if (clock <= 52000000) {
+ if (host->mmc->ios.timing == MMC_TIMING_MMC_HS200 ||
+ host->mmc->ios.timing == MMC_TIMING_MMC_HS400) {
+ dev_err(mmc_dev(host->mmc),
+ "Can't reduce the clock below 52MHz in HS200/HS400 mode");
+ return;
+ }
+
/*
* Disable DLL and reset both of sample and drive clock.
* The bypass bit and start bit need to be set if DLL is not locked.
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 235/280] ALSA: scarlett2: Fix buffer overflow in config retrieval
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 234/280] mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 236/280] iio: adc: exynos_adc: fix OF populate on driver rebind Greg Kroah-Hartman
` (49 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samasth Norway Ananda, Takashi Iwai,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
[ Upstream commit 6f5c69f72e50d51be3a8c028ae7eda42c82902cb ]
The scarlett2_usb_get_config() function has a logic error in the
endianness conversion code that can cause buffer overflows when
count > 1.
The code checks `if (size == 2)` where `size` is the total buffer size in
bytes, then loops `count` times treating each element as u16 (2 bytes).
This causes the loop to access `count * 2` bytes when the buffer only
has `size` bytes allocated.
Fix by checking the element size (config_item->size) instead of the
total buffer size. This ensures the endianness conversion matches the
actual element type.
Fixes: ac34df733d2d ("ALSA: usb-audio: scarlett2: Update get_config to do endian conversion")
Cc: stable@vger.kernel.org
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Link: https://patch.msgid.link/20260117012706.1715574-1-samasth.norway.ananda@oracle.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ add 32-bit handling block ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_scarlett2.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/sound/usb/mixer_scarlett2.c
+++ b/sound/usb/mixer_scarlett2.c
@@ -1408,11 +1408,16 @@ static int scarlett2_usb_get_config(
err = scarlett2_usb_get(mixer, config_item->offset, buf, size);
if (err < 0)
return err;
- if (size == 2) {
+ if (config_item->size == 16) {
u16 *buf_16 = buf;
for (i = 0; i < count; i++, buf_16++)
*buf_16 = le16_to_cpu(*(__le16 *)buf_16);
+ } else if (config_item->size == 32) {
+ u32 *buf_32 = (u32 *)buf;
+
+ for (i = 0; i < count; i++, buf_32++)
+ *buf_32 = le32_to_cpu(*(__le32 *)buf_32);
}
return 0;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 236/280] iio: adc: exynos_adc: fix OF populate on driver rebind
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 235/280] ALSA: scarlett2: Fix buffer overflow in config retrieval Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 237/280] iio: chemical: scd4x: fix reported channel endianness Greg Kroah-Hartman
` (48 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Krzysztof Kozlowski,
Jonathan Cameron, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit ea6b4feba85e996e840e0b661bc42793df6eb701 ]
Since commit c6e126de43e7 ("of: Keep track of populated platform
devices") child devices will not be created by of_platform_populate()
if the devices had previously been deregistered individually so that the
OF_POPULATED flag is still set in the corresponding OF nodes.
Switch to using of_platform_depopulate() instead of open coding so that
the child devices are created if the driver is rebound.
Fixes: c6e126de43e7 ("of: Keep track of populated platform devices")
Cc: stable@vger.kernel.org # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/exynos_adc.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
--- a/drivers/iio/adc/exynos_adc.c
+++ b/drivers/iio/adc/exynos_adc.c
@@ -721,14 +721,7 @@ static const struct iio_chan_spec exynos
ADC_CHANNEL(9, "adc9"),
};
-static int exynos_adc_remove_devices(struct device *dev, void *c)
-{
- struct platform_device *pdev = to_platform_device(dev);
-
- platform_device_unregister(pdev);
- return 0;
-}
static int exynos_adc_ts_open(struct input_dev *dev)
{
@@ -929,8 +922,7 @@ static int exynos_adc_probe(struct platf
return 0;
err_of_populate:
- device_for_each_child(&indio_dev->dev, NULL,
- exynos_adc_remove_devices);
+ of_platform_depopulate(&indio_dev->dev);
if (has_ts) {
input_unregister_device(info->input);
free_irq(info->tsirq, info);
@@ -959,8 +951,7 @@ static int exynos_adc_remove(struct plat
free_irq(info->tsirq, info);
input_unregister_device(info->input);
}
- device_for_each_child(&indio_dev->dev, NULL,
- exynos_adc_remove_devices);
+ of_platform_depopulate(&indio_dev->dev);
iio_device_unregister(indio_dev);
free_irq(info->irq, info);
if (info->data->exit_hw)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 237/280] iio: chemical: scd4x: fix reported channel endianness
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 236/280] iio: adc: exynos_adc: fix OF populate on driver rebind Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 238/280] nvme-fc: rename free_ctrl callback to match name pattern Greg Kroah-Hartman
` (47 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fiona Klute, David Lechner,
Jonathan Cameron, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fiona Klute <fiona.klute@gmx.de>
[ Upstream commit 81d5a5366d3c20203fb9d7345e1aa46d668445a2 ]
The driver converts values read from the sensor from BE to CPU
endianness in scd4x_read_meas(). The result is then pushed into the
buffer in scd4x_trigger_handler(), so on LE architectures parsing the
buffer using the reported BE type gave wrong results.
scd4x_read_raw() which provides sysfs *_raw values is not affected, it
used the values returned by scd4x_read_meas() without further
conversion.
Fixes: 49d22b695cbb6 ("drivers: iio: chemical: Add support for Sensirion SCD4x CO2 sensor")
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/scd4x.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/iio/chemical/scd4x.c
+++ b/drivers/iio/chemical/scd4x.c
@@ -518,7 +518,7 @@ static const struct iio_chan_spec scd4x_
.sign = 'u',
.realbits = 16,
.storagebits = 16,
- .endianness = IIO_BE,
+ .endianness = IIO_CPU,
},
},
{
@@ -533,7 +533,7 @@ static const struct iio_chan_spec scd4x_
.sign = 'u',
.realbits = 16,
.storagebits = 16,
- .endianness = IIO_BE,
+ .endianness = IIO_CPU,
},
},
{
@@ -546,7 +546,7 @@ static const struct iio_chan_spec scd4x_
.sign = 'u',
.realbits = 16,
.storagebits = 16,
- .endianness = IIO_BE,
+ .endianness = IIO_CPU,
},
},
};
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 238/280] nvme-fc: rename free_ctrl callback to match name pattern
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 237/280] iio: chemical: scd4x: fix reported channel endianness Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 239/280] nvme-pci: do not directly handle subsys reset fallout Greg Kroah-Hartman
` (46 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Sagi Grimberg,
Hannes Reinecke, Daniel Wagner, Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
[ Upstream commit 205fb5fa6fde1b5b426015eb1ff69f2ff25ef5bb ]
Rename nvme_fc_nvme_ctrl_freed to nvme_fc_free_ctrl to match the name
pattern for the callback.
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 0edb475ac0a7 ("nvme: fix PCIe subsystem reset controller state transition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2417,7 +2417,7 @@ nvme_fc_ctrl_get(struct nvme_fc_ctrl *ct
* controller. Called after last nvme_put_ctrl() call
*/
static void
-nvme_fc_nvme_ctrl_freed(struct nvme_ctrl *nctrl)
+nvme_fc_free_ctrl(struct nvme_ctrl *nctrl)
{
struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
@@ -3362,7 +3362,7 @@ static const struct nvme_ctrl_ops nvme_f
.reg_read32 = nvmf_reg_read32,
.reg_read64 = nvmf_reg_read64,
.reg_write32 = nvmf_reg_write32,
- .free_ctrl = nvme_fc_nvme_ctrl_freed,
+ .free_ctrl = nvme_fc_free_ctrl,
.submit_async_event = nvme_fc_submit_async_event,
.delete_ctrl = nvme_fc_delete_ctrl,
.get_address = nvmf_get_address,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 239/280] nvme-pci: do not directly handle subsys reset fallout
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 238/280] nvme-fc: rename free_ctrl callback to match name pattern Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 240/280] nvme: fix PCIe subsystem reset controller state transition Greg Kroah-Hartman
` (45 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilay Shroff, Christoph Hellwig,
Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 210b1f6576e8b367907e7ff51ef425062e1468e4 ]
Scheduling reset_work after a nvme subsystem reset is expected to fail
on pcie, but this also prevents potential handling the platform's pcie
services may provide that might successfully recovering the link without
re-enumeration. Such examples include AER, DPC, and power's EEH.
Provide a pci specific operation that safely initiates a subsystem
reset, and instead of scheduling reset work, read back the status
register to trigger a pcie read error.
Since this only affects pci, the other fabrics drivers subscribe to a
generic nvmf subsystem reset that is exactly the same as before. The
loop fabric doesn't use it because nvmet doesn't support setting that
property anyway.
And since we're using the magic NSSR value in two places now, provide a
symbolic define for it.
Reported-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Stable-dep-of: 0edb475ac0a7 ("nvme: fix PCIe subsystem reset controller state transition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fabrics.c | 15 +++++++++++++++
drivers/nvme/host/fabrics.h | 1 +
drivers/nvme/host/fc.c | 1 +
drivers/nvme/host/nvme.h | 14 +++-----------
drivers/nvme/host/pci.c | 36 ++++++++++++++++++++++++++++++++++++
drivers/nvme/host/rdma.c | 1 +
drivers/nvme/host/tcp.c | 1 +
include/linux/nvme.h | 3 +++
8 files changed, 61 insertions(+), 11 deletions(-)
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -253,6 +253,21 @@ int nvmf_reg_write32(struct nvme_ctrl *c
}
EXPORT_SYMBOL_GPL(nvmf_reg_write32);
+int nvmf_subsystem_reset(struct nvme_ctrl *ctrl)
+{
+ int ret;
+
+ if (!nvme_wait_reset(ctrl))
+ return -EBUSY;
+
+ ret = ctrl->ops->reg_write32(ctrl, NVME_REG_NSSR, NVME_SUBSYS_RESET);
+ if (ret)
+ return ret;
+
+ return nvme_try_sched_reset(ctrl);
+}
+EXPORT_SYMBOL_GPL(nvmf_subsystem_reset);
+
/**
* nvmf_log_connect_error() - Error-parsing-diagnostic print out function for
* connect() errors.
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -199,6 +199,7 @@ static inline void nvmf_complete_timed_o
int nvmf_reg_read32(struct nvme_ctrl *ctrl, u32 off, u32 *val);
int nvmf_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val);
int nvmf_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val);
+int nvmf_subsystem_reset(struct nvme_ctrl *ctrl);
int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl);
int nvmf_connect_io_queue(struct nvme_ctrl *ctrl, u16 qid);
int nvmf_register_transport(struct nvmf_transport_ops *ops);
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3362,6 +3362,7 @@ static const struct nvme_ctrl_ops nvme_f
.reg_read32 = nvmf_reg_read32,
.reg_read64 = nvmf_reg_read64,
.reg_write32 = nvmf_reg_write32,
+ .subsystem_reset = nvmf_subsystem_reset,
.free_ctrl = nvme_fc_free_ctrl,
.submit_async_event = nvme_fc_submit_async_event,
.delete_ctrl = nvme_fc_delete_ctrl,
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -538,6 +538,7 @@ struct nvme_ctrl_ops {
int (*reg_read64)(struct nvme_ctrl *ctrl, u32 off, u64 *val);
void (*free_ctrl)(struct nvme_ctrl *ctrl);
void (*submit_async_event)(struct nvme_ctrl *ctrl);
+ int (*subsystem_reset)(struct nvme_ctrl *ctrl);
void (*delete_ctrl)(struct nvme_ctrl *ctrl);
void (*stop_ctrl)(struct nvme_ctrl *ctrl);
int (*get_address)(struct nvme_ctrl *ctrl, char *buf, int size);
@@ -636,18 +637,9 @@ int nvme_try_sched_reset(struct nvme_ctr
static inline int nvme_reset_subsystem(struct nvme_ctrl *ctrl)
{
- int ret;
-
- if (!ctrl->subsystem)
+ if (!ctrl->subsystem || !ctrl->ops->subsystem_reset)
return -ENOTTY;
- if (!nvme_wait_reset(ctrl))
- return -EBUSY;
-
- ret = ctrl->ops->reg_write32(ctrl, NVME_REG_NSSR, 0x4E564D65);
- if (ret)
- return ret;
-
- return nvme_try_sched_reset(ctrl);
+ return ctrl->ops->subsystem_reset(ctrl);
}
/*
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1190,6 +1190,41 @@ static void nvme_pci_submit_async_event(
spin_unlock(&nvmeq->sq_lock);
}
+static int nvme_pci_subsystem_reset(struct nvme_ctrl *ctrl)
+{
+ struct nvme_dev *dev = to_nvme_dev(ctrl);
+ int ret = 0;
+
+ /*
+ * Taking the shutdown_lock ensures the BAR mapping is not being
+ * altered by reset_work. Holding this lock before the RESETTING state
+ * change, if successful, also ensures nvme_remove won't be able to
+ * proceed to iounmap until we're done.
+ */
+ mutex_lock(&dev->shutdown_lock);
+ if (!dev->bar_mapped_size) {
+ ret = -ENODEV;
+ goto unlock;
+ }
+
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING)) {
+ ret = -EBUSY;
+ goto unlock;
+ }
+
+ writel(NVME_SUBSYS_RESET, dev->bar + NVME_REG_NSSR);
+ nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE);
+
+ /*
+ * Read controller status to flush the previous write and trigger a
+ * pcie read error.
+ */
+ readl(dev->bar + NVME_REG_CSTS);
+unlock:
+ mutex_unlock(&dev->shutdown_lock);
+ return ret;
+}
+
static int adapter_delete_queue(struct nvme_dev *dev, u8 opcode, u16 id)
{
struct nvme_command c = { };
@@ -3033,6 +3068,7 @@ static const struct nvme_ctrl_ops nvme_p
.reg_read64 = nvme_pci_reg_read64,
.free_ctrl = nvme_pci_free_ctrl,
.submit_async_event = nvme_pci_submit_async_event,
+ .subsystem_reset = nvme_pci_subsystem_reset,
.get_address = nvme_pci_get_address,
.print_device_info = nvme_pci_print_device_info,
.supports_pci_p2pdma = nvme_pci_supports_pci_p2pdma,
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -2256,6 +2256,7 @@ static const struct nvme_ctrl_ops nvme_r
.reg_read32 = nvmf_reg_read32,
.reg_read64 = nvmf_reg_read64,
.reg_write32 = nvmf_reg_write32,
+ .subsystem_reset = nvmf_subsystem_reset,
.free_ctrl = nvme_rdma_free_ctrl,
.submit_async_event = nvme_rdma_submit_async_event,
.delete_ctrl = nvme_rdma_delete_ctrl,
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2612,6 +2612,7 @@ static const struct nvme_ctrl_ops nvme_t
.reg_read32 = nvmf_reg_read32,
.reg_read64 = nvmf_reg_read64,
.reg_write32 = nvmf_reg_write32,
+ .subsystem_reset = nvmf_subsystem_reset,
.free_ctrl = nvme_tcp_free_ctrl,
.submit_async_event = nvme_tcp_submit_async_event,
.delete_ctrl = nvme_tcp_delete_ctrl,
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -28,6 +28,9 @@
#define NVME_NSID_ALL 0xffffffff
+/* Special NSSR value, 'NVMe' */
+#define NVME_SUBSYS_RESET 0x4E564D65
+
enum nvme_subsys_type {
/* Referral to another discovery type target subsystem */
NVME_NQN_DISC = 1,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 240/280] nvme: fix PCIe subsystem reset controller state transition
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 239/280] nvme-pci: do not directly handle subsys reset fallout Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 241/280] phy: phy-rockchip-inno-usb2: simplify phy clock handling Greg Kroah-Hartman
` (44 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Wagner, Nilay Shroff,
Keith Busch, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <nilay@linux.ibm.com>
[ Upstream commit 0edb475ac0a7d153318a24d4dca175a270a5cc4f ]
The commit d2fe192348f9 (“nvme: only allow entering LIVE from CONNECTING
state”) disallows controller state transitions directly from RESETTING
to LIVE. However, the NVMe PCIe subsystem reset path relies on this
transition to recover the controller on PowerPC (PPC) systems.
On PPC systems, issuing a subsystem reset causes a temporary loss of
communication with the NVMe adapter. A subsequent PCIe MMIO read then
triggers EEH recovery, which restores the PCIe link and brings the
controller back online. For EEH recovery to proceed correctly, the
controller must transition back to the LIVE state.
Due to the changes introduced by commit d2fe192348f9 (“nvme: only allow
entering LIVE from CONNECTING state”), the controller can no longer
transition directly from RESETTING to LIVE. As a result, EEH recovery
exits prematurely, leaving the controller stuck in the RESETTING state.
Fix this by explicitly transitioning the controller state from RESETTING
to CONNECTING and then to LIVE. This satisfies the updated state
transition rules and allows the controller to be successfully recovered
on PPC systems following a PCIe subsystem reset.
Cc: stable@vger.kernel.org
Fixes: d2fe192348f9 ("nvme: only allow entering LIVE from CONNECTING state")
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1213,7 +1213,10 @@ static int nvme_pci_subsystem_reset(stru
}
writel(NVME_SUBSYS_RESET, dev->bar + NVME_REG_NSSR);
- nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE);
+
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING) ||
+ !nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE))
+ goto unlock;
/*
* Read controller status to flush the previous write and trigger a
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 241/280] phy: phy-rockchip-inno-usb2: simplify phy clock handling
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 240/280] nvme: fix PCIe subsystem reset controller state transition Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 242/280] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path Greg Kroah-Hartman
` (43 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Vinod Koul,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <sebastian.reichel@collabora.com>
[ Upstream commit b43511233c6e34b9c0d9a55e41b078d10e7d9ea6 ]
Simplify phyclk handling by using devm_clk_get_optional_enabled to
acquire and enable the optional clock. This also fixes a resource
leak in driver remove path and adds proper error handling.
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20230522170324.61349-6-sebastian.reichel@collabora.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Stable-dep-of: e07dea3de508 ("phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 17 +++++------------
1 file changed, 5 insertions(+), 12 deletions(-)
--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
@@ -1273,18 +1273,16 @@ static int rockchip_usb2phy_probe(struct
return -EINVAL;
}
- rphy->clk = of_clk_get_by_name(np, "phyclk");
- if (!IS_ERR(rphy->clk)) {
- clk_prepare_enable(rphy->clk);
- } else {
- dev_info(&pdev->dev, "no phyclk specified\n");
- rphy->clk = NULL;
+ rphy->clk = devm_clk_get_optional_enabled(dev, "phyclk");
+ if (IS_ERR(rphy->clk)) {
+ return dev_err_probe(&pdev->dev, PTR_ERR(rphy->clk),
+ "failed to get phyclk\n");
}
ret = rockchip_usb2phy_clk480m_register(rphy);
if (ret) {
dev_err(dev, "failed to register 480m output clock\n");
- goto disable_clks;
+ return ret;
}
index = 0;
@@ -1347,11 +1345,6 @@ next_child:
put_child:
of_node_put(child_np);
-disable_clks:
- if (rphy->clk) {
- clk_disable_unprepare(rphy->clk);
- clk_put(rphy->clk);
- }
return ret;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 242/280] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 241/280] phy: phy-rockchip-inno-usb2: simplify phy clock handling Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 243/280] phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() Greg Kroah-Hartman
` (42 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragan Simic, Heiko Stuebner,
Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <dsimic@manjaro.org>
[ Upstream commit 40452520850683f6771094ca218ff206d1fcb022 ]
Improve error handling in the probe path by using function dev_err_probe()
instead of function dev_err(), where appropriate.
Signed-off-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://lore.kernel.org/r/d4ccd9fc278fb46ea868406bf77811ee507f0e4e.1725524803.git.dsimic@manjaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Stable-dep-of: e07dea3de508 ("phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 27 +++++++++-----------------
1 file changed, 10 insertions(+), 17 deletions(-)
--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
@@ -380,11 +380,9 @@ static int rockchip_usb2phy_extcon_regis
if (of_property_read_bool(node, "extcon")) {
edev = extcon_get_edev_by_phandle(rphy->dev, 0);
- if (IS_ERR(edev)) {
- if (PTR_ERR(edev) != -EPROBE_DEFER)
- dev_err(rphy->dev, "Invalid or missing extcon\n");
- return PTR_ERR(edev);
- }
+ if (IS_ERR(edev))
+ return dev_err_probe(rphy->dev, PTR_ERR(edev),
+ "invalid or missing extcon\n");
} else {
/* Initialize extcon device */
edev = devm_extcon_dev_allocate(rphy->dev,
@@ -394,10 +392,9 @@ static int rockchip_usb2phy_extcon_regis
return -ENOMEM;
ret = devm_extcon_dev_register(rphy->dev, edev);
- if (ret) {
- dev_err(rphy->dev, "failed to register extcon device\n");
- return ret;
- }
+ if (ret)
+ return dev_err_probe(rphy->dev, ret,
+ "failed to register extcon device\n");
}
rphy->edev = edev;
@@ -1280,10 +1277,8 @@ static int rockchip_usb2phy_probe(struct
}
ret = rockchip_usb2phy_clk480m_register(rphy);
- if (ret) {
- dev_err(dev, "failed to register 480m output clock\n");
- return ret;
- }
+ if (ret)
+ return dev_err_probe(dev, ret, "failed to register 480m output clock\n");
index = 0;
for_each_available_child_of_node(np, child_np) {
@@ -1297,8 +1292,7 @@ static int rockchip_usb2phy_probe(struct
phy = devm_phy_create(dev, child_np, &rockchip_usb2phy_ops);
if (IS_ERR(phy)) {
- dev_err_probe(dev, PTR_ERR(phy), "failed to create phy\n");
- ret = PTR_ERR(phy);
+ ret = dev_err_probe(dev, PTR_ERR(phy), "failed to create phy\n");
goto put_child;
}
@@ -1335,8 +1329,7 @@ next_child:
"rockchip_usb2phy",
rphy);
if (ret) {
- dev_err(rphy->dev,
- "failed to request usb2phy irq handle\n");
+ dev_err_probe(rphy->dev, ret, "failed to request usb2phy irq handle\n");
goto put_child;
}
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 243/280] phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 242/280] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 244/280] ASoC: codecs: wsa881x: Simplify &pdev->dev in probe Greg Kroah-Hartman
` (41 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Neil Armstrong,
Vinod Koul, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
[ Upstream commit e07dea3de508cd6950c937cec42de7603190e1ca ]
The for_each_available_child_of_node() calls of_node_put() to
release child_np in each success loop. After breaking from the
loop with the child_np has been released, the code will jump to
the put_child label and will call the of_node_put() again if the
devm_request_threaded_irq() fails. These cause a double free bug.
Fix by returning directly to avoid the duplicate of_node_put().
Fixes: ed2b5a8e6b98 ("phy: phy-rockchip-inno-usb2: support muxed interrupts")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260109154626.2452034-1-vulab@iscas.ac.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
@@ -1330,7 +1330,7 @@ next_child:
rphy);
if (ret) {
dev_err_probe(rphy->dev, ret, "failed to request usb2phy irq handle\n");
- goto put_child;
+ return ret;
}
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 244/280] ASoC: codecs: wsa881x: Simplify &pdev->dev in probe
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 243/280] phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 245/280] ASoC: codecs: wsa881x: Use proper shutdown GPIO polarity Greg Kroah-Hartman
` (40 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit c617c9e7024d152426acf9f1aaf01070b6852f13 ]
The probe already stores pointer to &pdev->dev, so use it to make the
code a bit easier to read.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230102114152.297305-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 29d71b8a5a40 ("ASoC: codecs: wsa881x: fix unnecessary initialisation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wsa881x.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/sound/soc/codecs/wsa881x.c
+++ b/sound/soc/codecs/wsa881x.c
@@ -1112,20 +1112,20 @@ static int wsa881x_probe(struct sdw_slav
struct wsa881x_priv *wsa881x;
struct device *dev = &pdev->dev;
- wsa881x = devm_kzalloc(&pdev->dev, sizeof(*wsa881x), GFP_KERNEL);
+ wsa881x = devm_kzalloc(dev, sizeof(*wsa881x), GFP_KERNEL);
if (!wsa881x)
return -ENOMEM;
- wsa881x->sd_n = devm_gpiod_get_optional(&pdev->dev, "powerdown",
+ wsa881x->sd_n = devm_gpiod_get_optional(dev, "powerdown",
GPIOD_FLAGS_BIT_NONEXCLUSIVE);
if (IS_ERR(wsa881x->sd_n)) {
dev_err(&pdev->dev, "Shutdown Control GPIO not found\n");
return PTR_ERR(wsa881x->sd_n);
}
- dev_set_drvdata(&pdev->dev, wsa881x);
+ dev_set_drvdata(dev, wsa881x);
wsa881x->slave = pdev;
- wsa881x->dev = &pdev->dev;
+ wsa881x->dev = dev;
wsa881x->sconfig.ch_count = 1;
wsa881x->sconfig.bps = 1;
wsa881x->sconfig.frame_rate = 48000;
@@ -1148,7 +1148,7 @@ static int wsa881x_probe(struct sdw_slav
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
- return devm_snd_soc_register_component(&pdev->dev,
+ return devm_snd_soc_register_component(dev,
&wsa881x_component_drv,
wsa881x_dais,
ARRAY_SIZE(wsa881x_dais));
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 245/280] ASoC: codecs: wsa881x: Use proper shutdown GPIO polarity
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 244/280] ASoC: codecs: wsa881x: Simplify &pdev->dev in probe Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 246/280] ASoC: codecs: wsa881x: Drop unused version readout Greg Kroah-Hartman
` (39 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 738455858a2d21b769f673892546cf8300c9fd78 ]
The shutdown GPIO is active low (SD_N), but this depends on actual board
layout. Linux drivers should only care about logical state, where high
(1) means shutdown and low (0) means do not shutdown.
Invert the GPIO to match logical value while preserving backwards DTB
compatibility. It is not possible to detect whether ACTIVE_HIGH flag in
DTB is because it is an old DTB (using incorrect flag) or it is a new
DTB with a correct hardware pin polarity description. Therefore the
solution prioritizes backwards compatibility while relying on relevant
DTS being upstreamed.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230102114152.297305-4-krzysztof.kozlowski@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 29d71b8a5a40 ("ASoC: codecs: wsa881x: fix unnecessary initialisation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wsa881x.c | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
--- a/sound/soc/codecs/wsa881x.c
+++ b/sound/soc/codecs/wsa881x.c
@@ -678,6 +678,11 @@ struct wsa881x_priv {
struct sdw_stream_runtime *sruntime;
struct sdw_port_config port_config[WSA881X_MAX_SWR_PORTS];
struct gpio_desc *sd_n;
+ /*
+ * Logical state for SD_N GPIO: high for shutdown, low for enable.
+ * For backwards compatibility.
+ */
+ unsigned int sd_n_val;
int version;
int active_ports;
bool port_prepared[WSA881X_MAX_SWR_PORTS];
@@ -1123,6 +1128,26 @@ static int wsa881x_probe(struct sdw_slav
return PTR_ERR(wsa881x->sd_n);
}
+ /*
+ * Backwards compatibility work-around.
+ *
+ * The SD_N GPIO is active low, however upstream DTS used always active
+ * high. Changing the flag in driver and DTS will break backwards
+ * compatibility, so add a simple value inversion to work with both old
+ * and new DTS.
+ *
+ * This won't work properly with DTS using the flags properly in cases:
+ * 1. Old DTS with proper ACTIVE_LOW, however such case was broken
+ * before as the driver required the active high.
+ * 2. New DTS with proper ACTIVE_HIGH (intended), which is rare case
+ * (not existing upstream) but possible. This is the price of
+ * backwards compatibility, therefore this hack should be removed at
+ * some point.
+ */
+ wsa881x->sd_n_val = gpiod_is_active_low(wsa881x->sd_n);
+ if (!wsa881x->sd_n_val)
+ dev_warn(dev, "Using ACTIVE_HIGH for shutdown GPIO. Your DTB might be outdated or you use unsupported configuration for the GPIO.");
+
dev_set_drvdata(dev, wsa881x);
wsa881x->slave = pdev;
wsa881x->dev = dev;
@@ -1134,7 +1159,7 @@ static int wsa881x_probe(struct sdw_slav
pdev->prop.sink_ports = GENMASK(WSA881X_MAX_SWR_PORTS - 1, 0);
pdev->prop.sink_dpn_prop = wsa_sink_dpn_prop;
pdev->prop.scp_int1_mask = SDW_SCP_INT1_BUS_CLASH | SDW_SCP_INT1_PARITY;
- gpiod_direction_output(wsa881x->sd_n, 1);
+ gpiod_direction_output(wsa881x->sd_n, !wsa881x->sd_n_val);
wsa881x->regmap = devm_regmap_init_sdw(pdev, &wsa881x_regmap_config);
if (IS_ERR(wsa881x->regmap)) {
@@ -1159,7 +1184,7 @@ static int __maybe_unused wsa881x_runtim
struct regmap *regmap = dev_get_regmap(dev, NULL);
struct wsa881x_priv *wsa881x = dev_get_drvdata(dev);
- gpiod_direction_output(wsa881x->sd_n, 0);
+ gpiod_direction_output(wsa881x->sd_n, wsa881x->sd_n_val);
regcache_cache_only(regmap, true);
regcache_mark_dirty(regmap);
@@ -1174,13 +1199,13 @@ static int __maybe_unused wsa881x_runtim
struct wsa881x_priv *wsa881x = dev_get_drvdata(dev);
unsigned long time;
- gpiod_direction_output(wsa881x->sd_n, 1);
+ gpiod_direction_output(wsa881x->sd_n, !wsa881x->sd_n_val);
time = wait_for_completion_timeout(&slave->initialization_complete,
msecs_to_jiffies(WSA881X_PROBE_TIMEOUT));
if (!time) {
dev_err(dev, "Initialization not complete, timed out\n");
- gpiod_direction_output(wsa881x->sd_n, 0);
+ gpiod_direction_output(wsa881x->sd_n, wsa881x->sd_n_val);
return -ETIMEDOUT;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 246/280] ASoC: codecs: wsa881x: Drop unused version readout
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 245/280] ASoC: codecs: wsa881x: Use proper shutdown GPIO polarity Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 247/280] ASoC: codecs: wsa881x: fix unnecessary initialisation Greg Kroah-Hartman
` (38 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Mark Brown,
Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 3d2a69eb503d15171a7ba51cf0b562728ac396b7 ]
Driver does not use the device version after reading it from the
registers, so simplify by dropping unneeded code.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20240710-asoc-wsa88xx-version-v1-1-f1c54966ccde@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 29d71b8a5a40 ("ASoC: codecs: wsa881x: fix unnecessary initialisation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wsa881x.c | 2 --
1 file changed, 2 deletions(-)
--- a/sound/soc/codecs/wsa881x.c
+++ b/sound/soc/codecs/wsa881x.c
@@ -683,7 +683,6 @@ struct wsa881x_priv {
* For backwards compatibility.
*/
unsigned int sd_n_val;
- int version;
int active_ports;
bool port_prepared[WSA881X_MAX_SWR_PORTS];
bool port_enable[WSA881X_MAX_SWR_PORTS];
@@ -694,7 +693,6 @@ static void wsa881x_init(struct wsa881x_
struct regmap *rm = wsa881x->regmap;
unsigned int val = 0;
- regmap_read(rm, WSA881X_CHIP_ID1, &wsa881x->version);
regmap_register_patch(wsa881x->regmap, wsa881x_rev_2_0,
ARRAY_SIZE(wsa881x_rev_2_0));
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 247/280] ASoC: codecs: wsa881x: fix unnecessary initialisation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 246/280] ASoC: codecs: wsa881x: Drop unused version readout Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 248/280] ASoC: codecs: wsa883x: " Greg Kroah-Hartman
` (37 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Johan Hovold,
Krzysztof Kozlowski, Srinivas Kandagatla, Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 29d71b8a5a40708b3eed9ba4953bfc2312c9c776 ]
The soundwire update_status() callback may be called multiple times with
the same ATTACHED status but initialisation should only be done when
transitioning from UNATTACHED to ATTACHED.
Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support")
Cc: stable@vger.kernel.org # 5.6
Cc: Srinivas Kandagatla <srini@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260102111413.9605-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wsa881x.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/soc/codecs/wsa881x.c
+++ b/sound/soc/codecs/wsa881x.c
@@ -684,6 +684,7 @@ struct wsa881x_priv {
*/
unsigned int sd_n_val;
int active_ports;
+ bool hw_init;
bool port_prepared[WSA881X_MAX_SWR_PORTS];
bool port_enable[WSA881X_MAX_SWR_PORTS];
};
@@ -693,6 +694,9 @@ static void wsa881x_init(struct wsa881x_
struct regmap *rm = wsa881x->regmap;
unsigned int val = 0;
+ if (wsa881x->hw_init)
+ return;
+
regmap_register_patch(wsa881x->regmap, wsa881x_rev_2_0,
ARRAY_SIZE(wsa881x_rev_2_0));
@@ -730,6 +734,8 @@ static void wsa881x_init(struct wsa881x_
regmap_update_bits(rm, WSA881X_OTP_REG_28, 0x3F, 0x3A);
regmap_update_bits(rm, WSA881X_BONGO_RESRV_REG1, 0xFF, 0xB2);
regmap_update_bits(rm, WSA881X_BONGO_RESRV_REG2, 0xFF, 0x05);
+
+ wsa881x->hw_init = true;
}
static int wsa881x_component_probe(struct snd_soc_component *comp)
@@ -1074,6 +1080,9 @@ static int wsa881x_update_status(struct
{
struct wsa881x_priv *wsa881x = dev_get_drvdata(&slave->dev);
+ if (status == SDW_SLAVE_UNATTACHED)
+ wsa881x->hw_init = false;
+
if (status == SDW_SLAVE_ATTACHED && slave->dev_num > 0)
wsa881x_init(wsa881x);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 248/280] ASoC: codecs: wsa883x: fix unnecessary initialisation
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 247/280] ASoC: codecs: wsa881x: fix unnecessary initialisation Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 249/280] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 Greg Kroah-Hartman
` (36 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Johan Hovold,
Krzysztof Kozlowski, Srinivas Kandagatla, Mark Brown, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 49aadf830eb048134d33ad7329d92ecff45d8dbb ]
The soundwire update_status() callback may be called multiple times with
the same ATTACHED status but initialisation should only be done when
transitioning from UNATTACHED to ATTACHED.
This avoids repeated initialisation of the codecs during boot of
machines like the Lenovo ThinkPad X13s:
[ 11.614523] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2
[ 11.618022] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2
[ 11.621377] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2
[ 11.624065] wsa883x-codec sdw:1:0:0217:0202:00:1: WSA883X Version 1_1, Variant: WSA8835_V2
[ 11.631382] wsa883x-codec sdw:1:0:0217:0202:00:2: WSA883X Version 1_1, Variant: WSA8835_V2
[ 11.634424] wsa883x-codec sdw:1:0:0217:0202:00:2: WSA883X Version 1_1, Variant: WSA8835_V2
Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support")
Cc: stable@vger.kernel.org # 6.0
Cc: Srinivas Kandagatla <srini@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260102111413.9605-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/wsa883x.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/sound/soc/codecs/wsa883x.c
+++ b/sound/soc/codecs/wsa883x.c
@@ -448,6 +448,7 @@ struct wsa883x_priv {
int active_ports;
int dev_mode;
int comp_offset;
+ bool hw_init;
};
enum {
@@ -1007,6 +1008,9 @@ static int wsa883x_init(struct wsa883x_p
struct regmap *regmap = wsa883x->regmap;
int variant, version, ret;
+ if (wsa883x->hw_init)
+ return 0;
+
ret = regmap_read(regmap, WSA883X_OTP_REG_0, &variant);
if (ret)
return ret;
@@ -1050,6 +1054,8 @@ static int wsa883x_init(struct wsa883x_p
wsa883x->comp_offset);
}
+ wsa883x->hw_init = true;
+
return 0;
}
@@ -1058,6 +1064,9 @@ static int wsa883x_update_status(struct
{
struct wsa883x_priv *wsa883x = dev_get_drvdata(&slave->dev);
+ if (status == SDW_SLAVE_UNATTACHED)
+ wsa883x->hw_init = false;
+
if (status == SDW_SLAVE_ATTACHED && slave->dev_num > 0)
return wsa883x_init(wsa883x);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 249/280] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 248/280] ASoC: codecs: wsa883x: " Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 250/280] team: Move team device type change at the end of team_port_add Greg Kroah-Hartman
` (35 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Bonzini, Sean Christopherson,
Binbin Wu, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit b45f721775947a84996deb5c661602254ce25ce6 ]
When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in
response to a guest WRMSR, clear XFD-disabled features in the saved (or to
be restored) XSTATE_BV to ensure KVM doesn't attempt to load state for
features that are disabled via the guest's XFD. Because the kernel
executes XRSTOR with the guest's XFD, saving XSTATE_BV[i]=1 with XFD[i]=1
will cause XRSTOR to #NM and panic the kernel.
E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:
------------[ cut here ]------------
WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848
Modules linked in: kvm_intel kvm irqbypass
CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:exc_device_not_available+0x101/0x110
Call Trace:
<TASK>
asm_exc_device_not_available+0x1a/0x20
RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90
switch_fpu_return+0x4a/0xb0
kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]
kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]
__x64_sys_ioctl+0x8f/0xd0
do_syscall_64+0x62/0x940
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
---[ end trace 0000000000000000 ]---
This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,
and a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler's
call to fpu_update_guest_xfd().
and if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:
------------[ cut here ]------------
WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867
Modules linked in: kvm_intel kvm irqbypass
CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:exc_device_not_available+0x101/0x110
Call Trace:
<TASK>
asm_exc_device_not_available+0x1a/0x20
RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90
fpu_swap_kvm_fpstate+0x6b/0x120
kvm_load_guest_fpu+0x30/0x80 [kvm]
kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]
kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]
__x64_sys_ioctl+0x8f/0xd0
do_syscall_64+0x62/0x940
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
---[ end trace 0000000000000000 ]---
The new behavior is consistent with the AMX architecture. Per Intel's SDM,
XSAVE saves XSTATE_BV as '0' for components that are disabled via XFD
(and non-compacted XSAVE saves the initial configuration of the state
component):
If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,
the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;
instead, it operates as if XINUSE[i] = 0 (and the state component was
in its initial state): it saves bit i of XSTATE_BV field of the XSAVE
header as 0; in addition, XSAVE saves the initial configuration of the
state component (the other instructions do not save state component i).
Alternatively, KVM could always do XRSTOR with XFD=0, e.g. by using
a constant XFD based on the set of enabled features when XSAVEing for
a struct fpu_guest. However, having XSTATE_BV[i]=1 for XFD-disabled
features can only happen in the above interrupt case, or in similar
scenarios involving preemption on preemptible kernels, because
fpu_swap_kvm_fpstate()'s call to save_fpregs_to_fpstate() saves the
outgoing FPU state with the current XFD; and that is (on all but the
first WRMSR to XFD) the guest XFD.
Therefore, XFD can only go out of sync with XSTATE_BV in the above
interrupt case, or in similar scenarios involving preemption on
preemptible kernels, and it we can consider it (de facto) part of KVM
ABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 820a6ee944e7 ("kvm: x86: Add emulation for IA32_XFD", 2022-01-14)
Signed-off-by: Sean Christopherson <seanjc@google.com>
[Move clearing of XSTATE_BV from fpu_copy_uabi_to_guest_fpstate
to kvm_vcpu_ioctl_x86_set_xsave. - Paolo]
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/fpu/core.c | 32 +++++++++++++++++++++++++++++---
arch/x86/kvm/x86.c | 9 +++++++++
2 files changed, 38 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -294,10 +294,29 @@ EXPORT_SYMBOL_GPL(fpu_enable_guest_xfd_f
#ifdef CONFIG_X86_64
void fpu_update_guest_xfd(struct fpu_guest *guest_fpu, u64 xfd)
{
+ struct fpstate *fpstate = guest_fpu->fpstate;
+
fpregs_lock();
- guest_fpu->fpstate->xfd = xfd;
- if (guest_fpu->fpstate->in_use)
- xfd_update_state(guest_fpu->fpstate);
+
+ /*
+ * KVM's guest ABI is that setting XFD[i]=1 *can* immediately revert the
+ * save state to its initial configuration. Likewise, KVM_GET_XSAVE does
+ * the same as XSAVE and returns XSTATE_BV[i]=0 whenever XFD[i]=1.
+ *
+ * If the guest's FPU state is in hardware, just update XFD: the XSAVE
+ * in fpu_swap_kvm_fpstate will clear XSTATE_BV[i] whenever XFD[i]=1.
+ *
+ * If however the guest's FPU state is NOT resident in hardware, clear
+ * disabled components in XSTATE_BV now, or a subsequent XRSTOR will
+ * attempt to load disabled components and generate #NM _in the host_.
+ */
+ if (xfd && test_thread_flag(TIF_NEED_FPU_LOAD))
+ fpstate->regs.xsave.header.xfeatures &= ~xfd;
+
+ fpstate->xfd = xfd;
+ if (fpstate->in_use)
+ xfd_update_state(fpstate);
+
fpregs_unlock();
}
EXPORT_SYMBOL_GPL(fpu_update_guest_xfd);
@@ -406,6 +425,13 @@ int fpu_copy_uabi_to_guest_fpstate(struc
return -EINVAL;
/*
+ * Disabled features must be in their initial state, otherwise XRSTOR
+ * causes an exception.
+ */
+ if (WARN_ON_ONCE(ustate->xsave.header.xfeatures & kstate->xfd))
+ return -EINVAL;
+
+ /*
* Nullify @vpkru to preserve its current value if PKRU's bit isn't set
* in the header. KVM's odd ABI is to leave PKRU untouched in this
* case (all other components are eventually re-initialized).
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5341,9 +5341,18 @@ static void kvm_vcpu_ioctl_x86_get_xsave
static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
struct kvm_xsave *guest_xsave)
{
+ union fpregs_state *xstate = (union fpregs_state *)guest_xsave->region;
+
if (fpstate_is_confidential(&vcpu->arch.guest_fpu))
return 0;
+ /*
+ * For backwards compatibility, do not expect disabled features to be in
+ * their initial state. XSTATE_BV[i] must still be cleared whenever
+ * XFD[i]=1, or XRSTOR would cause a #NM.
+ */
+ xstate->xsave.header.xfeatures &= ~vcpu->arch.guest_fpu.fpstate->xfd;
+
return fpu_copy_uabi_to_guest_fpstate(&vcpu->arch.guest_fpu,
guest_xsave->region,
kvm_caps.supported_xcr0,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 250/280] team: Move team device type change at the end of team_port_add
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 249/280] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 251/280] wifi: mac80211: use wiphy work for sdata->work Greg Kroah-Hartman
` (34 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a2a3b519de727b0f7903,
Nikola Z. Ivanov, Jiri Pirko, Jakub Kicinski, Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Nikola Z. Ivanov" <zlatistiv@gmail.com>
[ Upstream commit 0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef ]
Attempting to add a port device that is already up will expectedly fail,
but not before modifying the team device header_ops.
In the case of the syzbot reproducer the gre0 device is
already in state UP when it attempts to add it as a
port device of team0, this fails but before that
header_ops->create of team0 is changed from eth_header to ipgre_header
in the call to team_dev_type_check_change.
Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense
as the private data of the device still holds a struct team.
Example sequence of iproute2 commands to reproduce the hang/BUG():
ip link add dev team0 type team
ip link add dev gre0 type gre
ip link set dev gre0 up
ip link set dev gre0 master team0
ip link set dev team0 up
ping -I team0 1.1.1.1
Move team_dev_type_check_change down where all other checks have passed
as it changes the dev type with no way to restore it in case
one of the checks that follow it fail.
Also make sure to preserve the origial mtu assignment:
- If port_dev is not the same type as dev, dev takes mtu from port_dev
- If port_dev is the same type as dev, port_dev takes mtu from dev
This is done by adding a conditional before the call to dev_set_mtu
to prevent it from assigning port_dev->mtu = dev->mtu and instead
letting team_dev_type_check_change assign dev->mtu = port_dev->mtu.
The conditional is needed because the patch moves the call to
team_dev_type_check_change past dev_set_mtu.
Testing:
- team device driver in-tree selftests
- Add/remove various devices as slaves of team device
- syzbot
Reported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a2a3b519de727b0f7903
Fixes: 1d76efe1577b ("team: add support for non-ethernet devices")
Signed-off-by: Nikola Z. Ivanov <zlatistiv@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20251122002027.695151-1-zlatistiv@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/team/team.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1186,10 +1186,6 @@ static int team_port_add(struct team *te
return -EPERM;
}
- err = team_dev_type_check_change(dev, port_dev);
- if (err)
- return err;
-
if (port_dev->flags & IFF_UP) {
NL_SET_ERR_MSG(extack, "Device is up. Set it down before adding it as a team port");
netdev_err(dev, "Device %s is up. Set it down before adding it as a team port\n",
@@ -1207,10 +1203,16 @@ static int team_port_add(struct team *te
INIT_LIST_HEAD(&port->qom_list);
port->orig.mtu = port_dev->mtu;
- err = dev_set_mtu(port_dev, dev->mtu);
- if (err) {
- netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err);
- goto err_set_mtu;
+ /*
+ * MTU assignment will be handled in team_dev_type_check_change
+ * if dev and port_dev are of different types
+ */
+ if (dev->type == port_dev->type) {
+ err = dev_set_mtu(port_dev, dev->mtu);
+ if (err) {
+ netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err);
+ goto err_set_mtu;
+ }
}
memcpy(port->orig.dev_addr, port_dev->dev_addr, port_dev->addr_len);
@@ -1285,6 +1287,10 @@ static int team_port_add(struct team *te
}
}
+ err = team_dev_type_check_change(dev, port_dev);
+ if (err)
+ goto err_set_dev_type;
+
if (dev->flags & IFF_UP) {
netif_addr_lock_bh(dev);
dev_uc_sync_multiple(port_dev, dev);
@@ -1303,6 +1309,7 @@ static int team_port_add(struct team *te
return 0;
+err_set_dev_type:
err_set_slave_promisc:
__team_option_inst_del_port(team, port);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 251/280] wifi: mac80211: use wiphy work for sdata->work
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 250/280] team: Move team device type change at the end of team_port_add Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 252/280] wifi: mac80211: move TDLS work to wiphy work Greg Kroah-Hartman
` (33 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg,
Hanne-Lotta Mäenpää
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 16114496d684a3df4ce09f7c6b7557a8b2922795 ]
We'll need this later to convert other works that might
be cancelled from here, so convert this one first.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 16114496d684a3df4ce09f7c6b7557a8b2922795)
Signed-off-by: Hanne-Lotta Mäenpää <hannelotta@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/ibss.c | 8 ++++----
net/mac80211/ieee80211_i.h | 2 +-
net/mac80211/iface.c | 10 +++++-----
net/mac80211/mesh.c | 10 +++++-----
net/mac80211/mesh_hwmp.c | 6 +++---
net/mac80211/mlme.c | 6 +++---
net/mac80211/ocb.c | 6 +++---
net/mac80211/rx.c | 2 +-
net/mac80211/scan.c | 2 +-
net/mac80211/status.c | 6 +++---
net/mac80211/util.c | 2 +-
11 files changed, 30 insertions(+), 30 deletions(-)
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -741,7 +741,7 @@ static void ieee80211_csa_connection_dro
skb_queue_purge(&sdata->skb_queue);
/* trigger a scan to find another IBSS network to join */
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
sdata_unlock(sdata);
}
@@ -1242,7 +1242,7 @@ void ieee80211_ibss_rx_no_sta(struct iee
spin_lock(&ifibss->incomplete_lock);
list_add(&sta->list, &ifibss->incomplete_stations);
spin_unlock(&ifibss->incomplete_lock);
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
}
static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
@@ -1721,7 +1721,7 @@ static void ieee80211_ibss_timer(struct
struct ieee80211_sub_if_data *sdata =
from_timer(sdata, t, u.ibss.timer);
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
@@ -1856,7 +1856,7 @@ int ieee80211_ibss_join(struct ieee80211
sdata->deflink.needed_rx_chains = local->rx_chains;
sdata->control_port_over_nl80211 = params->control_port_over_nl80211;
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
return 0;
}
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1046,7 +1046,7 @@ struct ieee80211_sub_if_data {
/* used to reconfigure hardware SM PS */
struct work_struct recalc_smps;
- struct work_struct work;
+ struct wiphy_work work;
struct sk_buff_head skb_queue;
struct sk_buff_head status_queue;
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -43,7 +43,7 @@
* by either the RTNL, the iflist_mtx or RCU.
*/
-static void ieee80211_iface_work(struct work_struct *work);
+static void ieee80211_iface_work(struct wiphy *wiphy, struct wiphy_work *work);
bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
{
@@ -650,7 +650,7 @@ static void ieee80211_do_stop(struct iee
RCU_INIT_POINTER(local->p2p_sdata, NULL);
fallthrough;
default:
- cancel_work_sync(&sdata->work);
+ wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->work);
/*
* When we get here, the interface is marked down.
* Free the remaining keys, if there are any
@@ -1224,7 +1224,7 @@ int ieee80211_add_virtual_monitor(struct
skb_queue_head_init(&sdata->skb_queue);
skb_queue_head_init(&sdata->status_queue);
- INIT_WORK(&sdata->work, ieee80211_iface_work);
+ wiphy_work_init(&sdata->work, ieee80211_iface_work);
return 0;
}
@@ -1707,7 +1707,7 @@ static void ieee80211_iface_process_stat
}
}
-static void ieee80211_iface_work(struct work_struct *work)
+static void ieee80211_iface_work(struct wiphy *wiphy, struct wiphy_work *work)
{
struct ieee80211_sub_if_data *sdata =
container_of(work, struct ieee80211_sub_if_data, work);
@@ -1819,7 +1819,7 @@ static void ieee80211_setup_sdata(struct
skb_queue_head_init(&sdata->skb_queue);
skb_queue_head_init(&sdata->status_queue);
- INIT_WORK(&sdata->work, ieee80211_iface_work);
+ wiphy_work_init(&sdata->work, ieee80211_iface_work);
INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
INIT_WORK(&sdata->activate_links_work, ieee80211_activate_links_work);
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -44,7 +44,7 @@ static void ieee80211_mesh_housekeeping_
set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
}
/**
@@ -643,7 +643,7 @@ static void ieee80211_mesh_path_timer(st
struct ieee80211_sub_if_data *sdata =
from_timer(sdata, t, u.mesh.mesh_path_timer);
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
static void ieee80211_mesh_path_root_timer(struct timer_list *t)
@@ -654,7 +654,7 @@ static void ieee80211_mesh_path_root_tim
set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
@@ -1018,7 +1018,7 @@ void ieee80211_mbss_info_change_notify(s
for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE)
set_bit(bit, &ifmsh->mbss_changed);
set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags);
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
@@ -1043,7 +1043,7 @@ int ieee80211_start_mesh(struct ieee8021
ifmsh->sync_offset_clockdrift_max = 0;
set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
ieee80211_mesh_root_setup(ifmsh);
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
sdata->vif.bss_conf.ht_operation_mode =
ifmsh->mshcfg.ht_opmode;
sdata->vif.bss_conf.enable_beacon = true;
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
- * Copyright (C) 2019, 2021-2022 Intel Corporation
+ * Copyright (C) 2019, 2021-2023 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com>
*/
@@ -1025,14 +1025,14 @@ static void mesh_queue_preq(struct mesh_
spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
else if (time_before(jiffies, ifmsh->last_preq)) {
/* avoid long wait if did not send preqs for a long time
* and jiffies wrapped around
*/
ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
} else
mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
min_preq_int_jiff(sdata));
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3168,7 +3168,7 @@ void ieee80211_sta_tx_notify(struct ieee
sdata->u.mgd.probe_send_count = 0;
else
sdata->u.mgd.nullfunc_failed = true;
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
static void ieee80211_mlme_send_probe_req(struct ieee80211_sub_if_data *sdata,
@@ -6031,7 +6031,7 @@ static void ieee80211_sta_timer(struct t
struct ieee80211_sub_if_data *sdata =
from_timer(sdata, t, u.mgd.timer);
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
@@ -6175,7 +6175,7 @@ void ieee80211_mgd_conn_tx_status(struct
sdata->u.mgd.status_acked = acked;
sdata->u.mgd.status_received = true;
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
}
void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
--- a/net/mac80211/ocb.c
+++ b/net/mac80211/ocb.c
@@ -81,7 +81,7 @@ void ieee80211_ocb_rx_no_sta(struct ieee
spin_lock(&ifocb->incomplete_lock);
list_add(&sta->list, &ifocb->incomplete_stations);
spin_unlock(&ifocb->incomplete_lock);
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
}
static struct sta_info *ieee80211_ocb_finish_sta(struct sta_info *sta)
@@ -157,7 +157,7 @@ static void ieee80211_ocb_housekeeping_t
set_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags);
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
}
void ieee80211_ocb_setup_sdata(struct ieee80211_sub_if_data *sdata)
@@ -197,7 +197,7 @@ int ieee80211_ocb_join(struct ieee80211_
ifocb->joined = true;
set_bit(OCB_WORK_HOUSEKEEPING, &ifocb->wrkq_flags);
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
netif_carrier_on(sdata->dev);
return 0;
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -229,7 +229,7 @@ static void __ieee80211_queue_skb_to_ifa
}
skb_queue_tail(&sdata->skb_queue, skb);
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
if (sta)
sta->deflink.rx_stats.packets++;
}
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -503,7 +503,7 @@ static void __ieee80211_scan_completed(s
*/
list_for_each_entry_rcu(sdata, &local->interfaces, list) {
if (ieee80211_sdata_running(sdata))
- ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+ wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
}
if (was_scanning)
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -5,7 +5,7 @@
* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
* Copyright 2008-2010 Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
- * Copyright 2021-2022 Intel Corporation
+ * Copyright 2021-2023 Intel Corporation
*/
#include <linux/export.h>
@@ -747,8 +747,8 @@ static void ieee80211_report_used_skb(st
if (qskb) {
skb_queue_tail(&sdata->status_queue,
qskb);
- ieee80211_queue_work(&local->hw,
- &sdata->work);
+ wiphy_work_queue(local->hw.wiphy,
+ &sdata->work);
}
}
} else {
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2751,7 +2751,7 @@ int ieee80211_reconfig(struct ieee80211_
/* Requeue all works */
list_for_each_entry(sdata, &local->interfaces, list)
- ieee80211_queue_work(&local->hw, &sdata->work);
+ wiphy_work_queue(local->hw.wiphy, &sdata->work);
}
ieee80211_wake_queues_by_reason(hw, IEEE80211_MAX_QUEUE_MAP,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 252/280] wifi: mac80211: move TDLS work to wiphy work
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 251/280] wifi: mac80211: use wiphy work for sdata->work Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 253/280] genirq/irq_sim: Initialize work context pointers properly Greg Kroah-Hartman
` (32 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emmanuel Grumbach, Johannes Berg,
Hanne-Lotta Mäenpää
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 777b26002b73127e81643d9286fadf3d41e0e477 ]
Again, to have the wiphy locked for it.
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ Summary of conflict resolutions:
- In mlme.c, move only tdls_peer_del_work
to wiphy work, and none the other works ]
Signed-off-by: Hanne-Lotta Mäenpää <hannelotta@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/ieee80211_i.h | 4 ++--
net/mac80211/mlme.c | 7 ++++---
net/mac80211/tdls.c | 11 ++++++-----
3 files changed, 12 insertions(+), 10 deletions(-)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -531,7 +531,7 @@ struct ieee80211_if_managed {
/* TDLS support */
u8 tdls_peer[ETH_ALEN] __aligned(2);
- struct delayed_work tdls_peer_del_work;
+ struct wiphy_delayed_work tdls_peer_del_work;
struct sk_buff *orig_teardown_skb; /* The original teardown skb */
struct sk_buff *teardown_skb; /* A copy to send through the AP */
spinlock_t teardown_lock; /* To lock changing teardown_skb */
@@ -2525,7 +2525,7 @@ int ieee80211_tdls_mgmt(struct wiphy *wi
size_t extra_ies_len);
int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
const u8 *peer, enum nl80211_tdls_operation oper);
-void ieee80211_tdls_peer_del_work(struct work_struct *wk);
+void ieee80211_tdls_peer_del_work(struct wiphy *wiphy, struct wiphy_work *wk);
int ieee80211_tdls_channel_switch(struct wiphy *wiphy, struct net_device *dev,
const u8 *addr, u8 oper_class,
struct cfg80211_chan_def *chandef);
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -6517,8 +6517,8 @@ void ieee80211_sta_setup_sdata(struct ie
ieee80211_beacon_connection_loss_work);
INIT_WORK(&ifmgd->csa_connection_drop_work,
ieee80211_csa_connection_drop_work);
- INIT_DELAYED_WORK(&ifmgd->tdls_peer_del_work,
- ieee80211_tdls_peer_del_work);
+ wiphy_delayed_work_init(&ifmgd->tdls_peer_del_work,
+ ieee80211_tdls_peer_del_work);
timer_setup(&ifmgd->timer, ieee80211_sta_timer, 0);
timer_setup(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer, 0);
timer_setup(&ifmgd->conn_mon_timer, ieee80211_sta_conn_mon_timer, 0);
@@ -7524,7 +7524,8 @@ void ieee80211_mgd_stop(struct ieee80211
cancel_work_sync(&ifmgd->monitor_work);
cancel_work_sync(&ifmgd->beacon_connection_loss_work);
cancel_work_sync(&ifmgd->csa_connection_drop_work);
- cancel_delayed_work_sync(&ifmgd->tdls_peer_del_work);
+ wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
+ &ifmgd->tdls_peer_del_work);
sdata_lock(sdata);
if (ifmgd->assoc_data)
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -21,7 +21,7 @@
/* give usermode some time for retries in setting up the TDLS session */
#define TDLS_PEER_SETUP_TIMEOUT (15 * HZ)
-void ieee80211_tdls_peer_del_work(struct work_struct *wk)
+void ieee80211_tdls_peer_del_work(struct wiphy *wiphy, struct wiphy_work *wk)
{
struct ieee80211_sub_if_data *sdata;
struct ieee80211_local *local;
@@ -1128,9 +1128,9 @@ ieee80211_tdls_mgmt_setup(struct wiphy *
return ret;
}
- ieee80211_queue_delayed_work(&sdata->local->hw,
- &sdata->u.mgd.tdls_peer_del_work,
- TDLS_PEER_SETUP_TIMEOUT);
+ wiphy_delayed_work_queue(sdata->local->hw.wiphy,
+ &sdata->u.mgd.tdls_peer_del_work,
+ TDLS_PEER_SETUP_TIMEOUT);
return 0;
out_unlock:
@@ -1427,7 +1427,8 @@ int ieee80211_tdls_oper(struct wiphy *wi
}
if (ret == 0 && ether_addr_equal(sdata->u.mgd.tdls_peer, peer)) {
- cancel_delayed_work(&sdata->u.mgd.tdls_peer_del_work);
+ wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
+ &sdata->u.mgd.tdls_peer_del_work);
eth_zero_addr(sdata->u.mgd.tdls_peer);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 253/280] genirq/irq_sim: Initialize work context pointers properly
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 252/280] wifi: mac80211: move TDLS work to wiphy work Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 254/280] drm/amdkfd: fix a memory leak in device_queue_manager_init() Greg Kroah-Hartman
` (31 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gyeyoung Baek, Thomas Gleixner,
Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gyeyoung Baek <gye976@gmail.com>
[ Upstream commit 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819 ]
Initialize `ops` member's pointers properly by using kzalloc() instead of
kmalloc() when allocating the simulation work context. Otherwise the
pointers contain random content leading to invalid dereferencing.
Signed-off-by: Gyeyoung Baek <gye976@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/20250612124827.63259-1-gye976@gmail.com
[ The context change is due to the commit 011f583781fa
("genirq/irq_sim: add an extended irq_sim initializer")
which is irrelevant to the logic of this patch. ]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/irq_sim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/irq/irq_sim.c
+++ b/kernel/irq/irq_sim.c
@@ -166,7 +166,7 @@ struct irq_domain *irq_domain_create_sim
{
struct irq_sim_work_ctx *work_ctx;
- work_ctx = kmalloc(sizeof(*work_ctx), GFP_KERNEL);
+ work_ctx = kzalloc(sizeof(*work_ctx), GFP_KERNEL);
if (!work_ctx)
goto err_out;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 254/280] drm/amdkfd: fix a memory leak in device_queue_manager_init()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 253/280] genirq/irq_sim: Initialize work context pointers properly Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 255/280] can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
` (30 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Felix Kuehling,
Oak Zeng, Alex Deucher
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit 80614c509810fc051312d1a7ccac8d0012d6b8d0 upstream.
If dqm->ops.initialize() fails, add deallocate_hiq_sdma_mqd()
to release the memory allocated by allocate_hiq_sdma_mqd().
Move deallocate_hiq_sdma_mqd() up to ensure proper function
visibility at the point of use.
Fixes: 11614c36bc8f ("drm/amdkfd: Allocate MQD trunk for HIQ and SDMA")
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Oak Zeng <Oak.Zeng@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b7cccc8286bb9919a0952c812872da1dcfe9d390)
Cc: stable@vger.kernel.org
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -2257,6 +2257,14 @@ static int allocate_hiq_sdma_mqd(struct
return retval;
}
+static void deallocate_hiq_sdma_mqd(struct kfd_dev *dev,
+ struct kfd_mem_obj *mqd)
+{
+ WARN(!mqd, "No hiq sdma mqd trunk to free");
+
+ amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
+}
+
struct device_queue_manager *device_queue_manager_init(struct kfd_dev *dev)
{
struct device_queue_manager *dqm;
@@ -2382,19 +2390,13 @@ struct device_queue_manager *device_queu
if (!dqm->ops.initialize(dqm))
return dqm;
+ deallocate_hiq_sdma_mqd(dev, &dqm->hiq_sdma_mqd);
+
out_free:
kfree(dqm);
return NULL;
}
-static void deallocate_hiq_sdma_mqd(struct kfd_dev *dev,
- struct kfd_mem_obj *mqd)
-{
- WARN(!mqd, "No hiq sdma mqd trunk to free");
-
- amdgpu_amdkfd_free_gtt_mem(dev->adev, &mqd->gtt_mem);
-}
-
void device_queue_manager_uninit(struct device_queue_manager *dqm)
{
dqm->ops.uninitialize(dqm);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 255/280] can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 254/280] drm/amdkfd: fix a memory leak in device_queue_manager_init() Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 256/280] Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()" Greg Kroah-Hartman
` (29 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 5a4391bdc6c8357242f62f22069c865b792406b3 upstream.
Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").
In esd_usb_open(), the URBs for USB-in transfers are allocated, added to
the dev->rx_submitted anchor and submitted. In the complete callback
esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In
esd_usb_close() the URBs are freed by calling
usb_kill_anchored_urbs(&dev->rx_submitted).
However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in esd_usb_close().
Fix the memory leak by anchoring the URB in the
esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.
Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260116-can_usb-fix-memory-leak-v2-2-4b8cb2915571@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/esd_usb.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/net/can/usb/esd_usb.c
+++ b/drivers/net/can/usb/esd_usb.c
@@ -447,13 +447,20 @@ resubmit_urb:
urb->transfer_buffer, RX_BUFFER_SIZE,
esd_usb_read_bulk_callback, dev);
+ usb_anchor_urb(urb, &dev->rx_submitted);
+
retval = usb_submit_urb(urb, GFP_ATOMIC);
+ if (!retval)
+ return;
+
+ usb_unanchor_urb(urb);
+
if (retval == -ENODEV) {
for (i = 0; i < dev->net_count; i++) {
if (dev->nets[i])
netif_device_detach(dev->nets[i]->netdev);
}
- } else if (retval) {
+ } else {
dev_err(dev->udev->dev.parent,
"failed resubmitting read bulk urb: %d\n", retval);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 256/280] Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()"
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 255/280] can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 257/280] drm/amd/display: Check dce_hwseq before dereferencing it Greg Kroah-Hartman
` (28 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
Liam.Howlett@oracle.com, akpm@linux-foundation.org, david@kernel.org, hughd@google.com, jannh@google.com, linux-mm@kvack.org, lorenzo.stoakes@oracle.com, pfalcato@suse.de, vbabka@suse.cz, Harry Yoo,
Harry Yoo
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harry Yoo <harry.yoo@oracle.com>
This reverts commit 91750c8a4be42d73b6810a1c35d73c8a3cd0b481 which is
commit 670ddd8cdcbd1d07a4571266ae3517f821728c3a upstream.
While the commit fixes a race condition between NUMA balancing and THP
migration, it causes a NULL-pointer-deref when the pmd temporarily
transitions from pmd_trans_huge() to pmd_none(). Verifying whether the
pmd value has changed under page table lock does not prevent the crash,
as it occurs when acquiring the lock.
Since the original issue addressed by the commit is quite rare and
non-fatal, revert the commit. A better backport solution that more
closely matches the upstream semantics will be provided as a follow-up.
Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mprotect.c | 101 +++++++++++++++++++++++++++++++++-------------------------
1 file changed, 58 insertions(+), 43 deletions(-)
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -73,12 +73,10 @@ static inline bool can_change_pte_writab
}
static long change_pte_range(struct mmu_gather *tlb,
- struct vm_area_struct *vma, pmd_t *pmd, pmd_t pmd_old,
- unsigned long addr, unsigned long end, pgprot_t newprot,
- unsigned long cp_flags)
+ struct vm_area_struct *vma, pmd_t *pmd, unsigned long addr,
+ unsigned long end, pgprot_t newprot, unsigned long cp_flags)
{
pte_t *pte, oldpte;
- pmd_t _pmd;
spinlock_t *ptl;
long pages = 0;
int target_node = NUMA_NO_NODE;
@@ -88,15 +86,21 @@ static long change_pte_range(struct mmu_
tlb_change_page_size(tlb, PAGE_SIZE);
+ /*
+ * Can be called with only the mmap_lock for reading by
+ * prot_numa so we must check the pmd isn't constantly
+ * changing from under us from pmd_none to pmd_trans_huge
+ * and/or the other way around.
+ */
+ if (pmd_trans_unstable(pmd))
+ return 0;
+
+ /*
+ * The pmd points to a regular pte so the pmd can't change
+ * from under us even if the mmap_lock is only hold for
+ * reading.
+ */
pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
- /* Make sure pmd didn't change after acquiring ptl */
- _pmd = pmd_read_atomic(pmd);
- /* See pmd_none_or_trans_huge_or_clear_bad for info on barrier */
- barrier();
- if (!pmd_same(pmd_old, _pmd)) {
- pte_unmap_unlock(pte, ptl);
- return -EAGAIN;
- }
/* Get target node for single threaded private VMAs */
if (prot_numa && !(vma->vm_flags & VM_SHARED) &&
@@ -284,6 +288,31 @@ static long change_pte_range(struct mmu_
return pages;
}
+/*
+ * Used when setting automatic NUMA hinting protection where it is
+ * critical that a numa hinting PMD is not confused with a bad PMD.
+ */
+static inline int pmd_none_or_clear_bad_unless_trans_huge(pmd_t *pmd)
+{
+ pmd_t pmdval = pmd_read_atomic(pmd);
+
+ /* See pmd_none_or_trans_huge_or_clear_bad for info on barrier */
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ barrier();
+#endif
+
+ if (pmd_none(pmdval))
+ return 1;
+ if (pmd_trans_huge(pmdval))
+ return 0;
+ if (unlikely(pmd_bad(pmdval))) {
+ pmd_clear_bad(pmd);
+ return 1;
+ }
+
+ return 0;
+}
+
/* Return true if we're uffd wr-protecting file-backed memory, or false */
static inline bool
uffd_wp_protect_file(struct vm_area_struct *vma, unsigned long cp_flags)
@@ -331,34 +360,22 @@ static inline long change_pmd_range(stru
pmd = pmd_offset(pud, addr);
do {
- long ret;
- pmd_t _pmd;
-again:
+ long this_pages;
+
next = pmd_addr_end(addr, end);
- _pmd = pmd_read_atomic(pmd);
- /* See pmd_none_or_trans_huge_or_clear_bad for info on barrier */
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
- barrier();
-#endif
change_pmd_prepare(vma, pmd, cp_flags);
/*
* Automatic NUMA balancing walks the tables with mmap_lock
* held for read. It's possible a parallel update to occur
- * between pmd_trans_huge(), is_swap_pmd(), and
- * a pmd_none_or_clear_bad() check leading to a false positive
- * and clearing. Hence, it's necessary to atomically read
- * the PMD value for all the checks.
+ * between pmd_trans_huge() and a pmd_none_or_clear_bad()
+ * check leading to a false positive and clearing.
+ * Hence, it's necessary to atomically read the PMD value
+ * for all the checks.
*/
- if (!is_swap_pmd(_pmd) && !pmd_devmap(_pmd) && !pmd_trans_huge(_pmd)) {
- if (pmd_none(_pmd))
- goto next;
-
- if (pmd_bad(_pmd)) {
- pmd_clear_bad(pmd);
- goto next;
- }
- }
+ if (!is_swap_pmd(*pmd) && !pmd_devmap(*pmd) &&
+ pmd_none_or_clear_bad_unless_trans_huge(pmd))
+ goto next;
/* invoke the mmu notifier if the pmd is populated */
if (!range.start) {
@@ -368,7 +385,7 @@ again:
mmu_notifier_invalidate_range_start(&range);
}
- if (is_swap_pmd(_pmd) || pmd_trans_huge(_pmd) || pmd_devmap(_pmd)) {
+ if (is_swap_pmd(*pmd) || pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) {
if ((next - addr != HPAGE_PMD_SIZE) ||
uffd_wp_protect_file(vma, cp_flags)) {
__split_huge_pmd(vma, pmd, addr, false, NULL);
@@ -383,11 +400,11 @@ again:
* change_huge_pmd() does not defer TLB flushes,
* so no need to propagate the tlb argument.
*/
- ret = change_huge_pmd(tlb, vma, pmd,
- addr, newprot, cp_flags);
+ int nr_ptes = change_huge_pmd(tlb, vma, pmd,
+ addr, newprot, cp_flags);
- if (ret) {
- if (ret == HPAGE_PMD_NR) {
+ if (nr_ptes) {
+ if (nr_ptes == HPAGE_PMD_NR) {
pages += HPAGE_PMD_NR;
nr_huge_updates++;
}
@@ -398,11 +415,9 @@ again:
}
/* fall through, the trans huge pmd just split */
}
- ret = change_pte_range(tlb, vma, pmd, _pmd, addr, next,
- newprot, cp_flags);
- if (ret < 0)
- goto again;
- pages += ret;
+ this_pages = change_pte_range(tlb, vma, pmd, addr, next,
+ newprot, cp_flags);
+ pages += this_pages;
next:
cond_resched();
} while (pmd++, addr = next, addr != end);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 257/280] drm/amd/display: Check dce_hwseq before dereferencing it
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 256/280] Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()" Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 258/280] crypto: qat - flush misc workqueue during device shutdown Greg Kroah-Hartman
` (27 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Aurabindo Pillai, Alex Hung, Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <alex.hung@amd.com>
[ Upstream commit b669507b637eb6b1aaecf347f193efccc65d756e ]
[WHAT]
hws was checked for null earlier in dce110_blank_stream, indicating hws
can be null, and should be checked whenever it is used.
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad)
Cc: stable@vger.kernel.org
[ The context change is due to the commit 8e7b3f5435b3
("drm/amd/display: Add control flag to dc_stream_state to skip eDP BL off/link off")
and the commit a8728dbb4ba2 ("drm/amd/display: Refactor edp power
control") and the proper adoption is done. ]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1233,7 +1233,8 @@ void dce110_blank_stream(struct pipe_ctx
struct dce_hwseq *hws = link->dc->hwseq;
if (link->local_sink && link->local_sink->sink_signal == SIGNAL_TYPE_EDP) {
- hws->funcs.edp_backlight_control(link, false);
+ if (hws)
+ hws->funcs.edp_backlight_control(link, false);
link->dc->hwss.set_abm_immediate_disable(pipe_ctx);
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 258/280] crypto: qat - flush misc workqueue during device shutdown
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 257/280] drm/amd/display: Check dce_hwseq before dereferencing it Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 259/280] iomap: Fix possible overflow condition in iomap_write_delalloc_scan Greg Kroah-Hartman
` (26 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Cabiddu, Ahsan Atta,
Herbert Xu, Wenshan Lan
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a ]
Repeated loading and unloading of a device specific QAT driver, for
example qat_4xxx, in a tight loop can lead to a crash due to a
use-after-free scenario. This occurs when a power management (PM)
interrupt triggers just before the device-specific driver (e.g.,
qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains
loaded.
Since the driver uses a shared workqueue (`qat_misc_wq`) across all
devices and owned by intel_qat.ko, a deferred routine from the
device-specific driver may still be pending in the queue. If this
routine executes after the driver is unloaded, it can dereference freed
memory, resulting in a page fault and kernel crash like the following:
BUG: unable to handle page fault for address: ffa000002e50a01c
#PF: supervisor read access in kernel mode
RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]
Call Trace:
pm_bh_handler+0x1d2/0x250 [intel_qat]
process_one_work+0x171/0x340
worker_thread+0x277/0x3a0
kthread+0xf0/0x120
ret_from_fork+0x2d/0x50
To prevent this, flush the misc workqueue during device shutdown to
ensure that all pending work items are completed before the driver is
unloaded.
Note: This approach may slightly increase shutdown latency if the
workqueue contains jobs from other devices, but it ensures correctness
and stability.
Fixes: e5745f34113b ("crypto: qat - enable power management for QAT GEN4")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[ Intel crypto drivers was moved by
a4b16dad4657 ("crypto: qat - Move driver to drivers/crypto/intel/qat")
so apply the patch to files under drivers/crypto/qat/qat_common in
6.1.y. ]
Signed-off-by: Wenshan Lan <jetlan9@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qat/qat_common/adf_common_drv.h | 1 +
drivers/crypto/qat/qat_common/adf_init.c | 1 +
drivers/crypto/qat/qat_common/adf_isr.c | 5 +++++
3 files changed, 7 insertions(+)
--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
@@ -194,6 +194,7 @@ int qat_uclo_set_cfg_ae_mask(struct icp_
int adf_init_misc_wq(void);
void adf_exit_misc_wq(void);
bool adf_misc_wq_queue_work(struct work_struct *work);
+void adf_misc_wq_flush(void);
#if defined(CONFIG_PCI_IOV)
int adf_sriov_configure(struct pci_dev *pdev, int numvfs);
void adf_disable_sriov(struct adf_accel_dev *accel_dev);
--- a/drivers/crypto/qat/qat_common/adf_init.c
+++ b/drivers/crypto/qat/qat_common/adf_init.c
@@ -337,6 +337,7 @@ void adf_dev_shutdown(struct adf_accel_d
hw_data->exit_admin_comms(accel_dev);
adf_cleanup_etr_data(accel_dev);
+ adf_misc_wq_flush();
adf_dev_restore(accel_dev);
}
EXPORT_SYMBOL_GPL(adf_dev_shutdown);
--- a/drivers/crypto/qat/qat_common/adf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_isr.c
@@ -380,3 +380,8 @@ bool adf_misc_wq_queue_work(struct work_
{
return queue_work(adf_misc_wq, work);
}
+
+void adf_misc_wq_flush(void)
+{
+ flush_workqueue(adf_misc_wq);
+}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 259/280] iomap: Fix possible overflow condition in iomap_write_delalloc_scan
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 258/280] crypto: qat - flush misc workqueue during device shutdown Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 260/280] fs/ntfs3: Initialize allocated memory before use Greg Kroah-Hartman
` (25 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Wilcox, Ritesh Harjani (IBM),
Darrick J. Wong, Rajani Kantha
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
[ Upstream commit eee2d2e6ea5550118170dbd5bb1316ceb38455fb ]
folio_next_index() returns an unsigned long value which left shifted
by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead
use folio_pos(folio) + folio_size(folio), which does this correctly.
Suggested-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Rajani Kantha <681739313@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/iomap/buffered-io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -903,7 +903,7 @@ static int iomap_write_delalloc_scan(str
* the end of this data range, not the end of the folio.
*/
*punch_start_byte = min_t(loff_t, end_byte,
- folio_next_index(folio) << PAGE_SHIFT);
+ folio_pos(folio) + folio_size(folio));
}
/* move offset to start of next folio in range */
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 260/280] fs/ntfs3: Initialize allocated memory before use
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 259/280] iomap: Fix possible overflow condition in iomap_write_delalloc_scan Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 261/280] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Greg Kroah-Hartman
` (24 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+332bd4e9d148f11a87dc,
syzbot+0399100e525dd9696764, Khalid Aziz, Bartlomiej Kubik,
Konstantin Komarov, Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
[ Upstream commit a8a3ca23bbd9d849308a7921a049330dc6c91398 ]
KMSAN reports: Multiple uninitialized values detected:
- KMSAN: uninit-value in ntfs_read_hdr (3)
- KMSAN: uninit-value in bcmp (3)
Memory is allocated by __getname(), which is a wrapper for
kmem_cache_alloc(). This memory is used before being properly
cleared. Change kmem_cache_alloc() to kmem_cache_zalloc() to
properly allocate and clear memory before use.
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations")
Tested-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com
Reported-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=332bd4e9d148f11a87dc
Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations")
Tested-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com
Reported-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0399100e525dd9696764
Reviewed-by: Khalid Aziz <khalid@kernel.org>
Signed-off-by: Bartlomiej Kubik <kubik.bartlomiej@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/inode.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -1294,7 +1294,7 @@ struct inode *ntfs_create_inode(struct u
fa |= FILE_ATTRIBUTE_READONLY;
/* Allocate PATH_MAX bytes. */
- new_de = __getname();
+ new_de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
if (!new_de) {
err = -ENOMEM;
goto out1;
@@ -1698,10 +1698,9 @@ int ntfs_link_inode(struct inode *inode,
struct NTFS_DE *de;
/* Allocate PATH_MAX bytes. */
- de = __getname();
+ de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
if (!de)
return -ENOMEM;
- memset(de, 0, PATH_MAX);
/* Mark rw ntfs as dirty. It will be cleared at umount. */
ntfs_set_state(sbi, NTFS_DIRTY_DIRTY);
@@ -1737,7 +1736,7 @@ int ntfs_unlink_inode(struct inode *dir,
return -EINVAL;
/* Allocate PATH_MAX bytes. */
- de = __getname();
+ de = kmem_cache_zalloc(names_cachep, GFP_KERNEL);
if (!de)
return -ENOMEM;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 261/280] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 260/280] fs/ntfs3: Initialize allocated memory before use Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 262/280] Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" Greg Kroah-Hartman
` (23 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Waiman Long, Ming Lei, Tejun Heo,
Jens Axboe, Alva Lan
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
[ Upstream commit 3d2af77e31ade05ff7ccc3658c3635ec1bea0979 ]
When blkg_alloc() is called to allocate a blkcg_gq structure
with the associated blkg_iostat_set's, there are 2 fields within
blkg_iostat_set that requires proper initialization - blkg & sync.
The former field was introduced by commit 3b8cc6298724 ("blk-cgroup:
Optimize blkcg_rstat_flush()") while the later one was introduced by
commit f73316482977 ("blk-cgroup: reimplement basic IO stats using
cgroup rstat").
Unfortunately those fields in the blkg_iostat_set's are not properly
re-initialized when they are cleared in v1's blkcg_reset_stats(). This
can lead to a kernel panic due to NULL pointer access of the blkg
pointer. The missing initialization of sync is less problematic and
can be a problem in a debug kernel due to missing lockdep initialization.
Fix these problems by re-initializing them after memory clearing.
Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
Fixes: f73316482977 ("blk-cgroup: reimplement basic IO stats using cgroup rstat")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20230606180724.2455066-1-longman@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ Remove this line: bis -> blkg = blkg for blkg was introduced by commit
3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") since v6.2. ]
Signed-off-by: Alva Lan <alvalan9@foxmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -531,8 +531,12 @@ static int blkcg_reset_stats(struct cgro
struct blkg_iostat_set *bis =
per_cpu_ptr(blkg->iostat_cpu, cpu);
memset(bis, 0, sizeof(*bis));
+
+ /* Re-initialize the cleared blkg_iostat_set */
+ u64_stats_init(&bis->sync);
}
memset(&blkg->iostat, 0, sizeof(blkg->iostat));
+ u64_stats_init(&blkg->iostat.sync);
for (i = 0; i < BLKCG_MAX_POLS; i++) {
struct blkcg_policy *pol = blkcg_policy[i];
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 262/280] Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 261/280] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 263/280] gfs2: Fix NULL pointer dereference in gfs2_log_flush Greg Kroah-Hartman
` (22 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gavin Li, Jiri Pirko, Saeed Mahameed,
Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Li <gavinl@nvidia.com>
[ Upstream commit 8deeefb24786ea7950b37bde4516b286c877db00 ]
This reverts commit 662404b24a4c4d839839ed25e3097571f5938b9b.
The revert is required due to the suspicion it is not good for anything
and cause crash.
Fixes: 662404b24a4c ("net/mlx5e: Block entering switchdev mode with ns inconsistency")
Signed-off-by: Gavin Li <gavinl@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
[ The context change is due to the commit e25373416678
("net/mlx5e: Rewrite IPsec vs. TC block interface") in v6.6
which is irrelevant to the logic of this patch. ]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 19 -------------
1 file changed, 19 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -3493,18 +3493,6 @@ static int esw_inline_mode_to_devlink(u8
return 0;
}
-static bool esw_offloads_devlink_ns_eq_netdev_ns(struct devlink *devlink)
-{
- struct net *devl_net, *netdev_net;
- struct mlx5_eswitch *esw;
-
- esw = mlx5_devlink_eswitch_get(devlink);
- netdev_net = dev_net(esw->dev->mlx5e_res.uplink_netdev);
- devl_net = devlink_net(devlink);
-
- return net_eq(devl_net, netdev_net);
-}
-
int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode,
struct netlink_ext_ack *extack)
{
@@ -3519,13 +3507,6 @@ int mlx5_devlink_eswitch_mode_set(struct
if (esw_mode_from_devlink(mode, &mlx5_mode))
return -EINVAL;
- if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV &&
- !esw_offloads_devlink_ns_eq_netdev_ns(devlink)) {
- NL_SET_ERR_MSG_MOD(extack,
- "Can't change E-Switch mode to switchdev when netdev net namespace has diverged from the devlink's.");
- return -EPERM;
- }
-
mlx5_lag_disable_change(esw->dev);
err = mlx5_esw_try_lock(esw);
if (err < 0) {
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 263/280] gfs2: Fix NULL pointer dereference in gfs2_log_flush
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 262/280] Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 264/280] NFSD: fix race between nfsd registration and exports_proc Greg Kroah-Hartman
` (21 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andreas Gruenbacher, Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <agruenba@redhat.com>
[ Upstream commit 35264909e9d1973ab9aaa2a1b07cda70f12bb828 ]
In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush
lock to provide exclusion against gfs2_log_flush().
In gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before
dereferencing it. Otherwise, we could run into a NULL pointer
dereference when outstanding glock work races with an unmount
(glock_work_func -> run_queue -> do_xmote -> inode_go_sync ->
gfs2_log_flush).
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
[ The context change is due to the commit 4d927b03a688
("gfs2: Rename gfs2_withdrawn to gfs2_withdrawing_or_withdrawn") in v6.8
which is irrelevant to the logic of this patch. ]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/gfs2/log.c | 3 ++-
fs/gfs2/super.c | 4 ++++
2 files changed, 6 insertions(+), 1 deletion(-)
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -1102,7 +1102,8 @@ repeat:
lops_before_commit(sdp, tr);
if (gfs2_withdrawn(sdp))
goto out_withdraw;
- gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
+ if (sdp->sd_jdesc)
+ gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
if (gfs2_withdrawn(sdp))
goto out_withdraw;
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -67,9 +67,13 @@ void gfs2_jindex_free(struct gfs2_sbd *s
sdp->sd_journals = 0;
spin_unlock(&sdp->sd_jindex_spin);
+ down_write(&sdp->sd_log_flush_lock);
sdp->sd_jdesc = NULL;
+ up_write(&sdp->sd_log_flush_lock);
+
while (!list_empty(&list)) {
jd = list_first_entry(&list, struct gfs2_jdesc, jd_list);
+ BUG_ON(jd->jd_log_bio);
gfs2_free_journal_extents(jd);
list_del(&jd->jd_list);
iput(jd->jd_inode);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 264/280] NFSD: fix race between nfsd registration and exports_proc
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 263/280] gfs2: Fix NULL pointer dereference in gfs2_log_flush Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 265/280] usbnet: Fix using smp_processor_id() in preemptible code warnings Greg Kroah-Hartman
` (20 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shubham Rana, Maninder Singh,
Jeff Layton, Chuck Lever, Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maninder Singh <maninder1.s@samsung.com>
[ Upstream commit f7fb730cac9aafda8b9813b55d04e28a9664d17c ]
As of now nfsd calls create_proc_exports_entry() at start of init_nfsd
and cleanup by remove_proc_entry() at last of exit_nfsd.
Which causes kernel OOPs if there is race between below 2 operations:
(i) exportfs -r
(ii) mount -t nfsd none /proc/fs/nfsd
for 5.4 kernel ARM64:
CPU 1:
el1_irq+0xbc/0x180
arch_counter_get_cntvct+0x14/0x18
running_clock+0xc/0x18
preempt_count_add+0x88/0x110
prep_new_page+0xb0/0x220
get_page_from_freelist+0x2d8/0x1778
__alloc_pages_nodemask+0x15c/0xef0
__vmalloc_node_range+0x28c/0x478
__vmalloc_node_flags_caller+0x8c/0xb0
kvmalloc_node+0x88/0xe0
nfsd_init_net+0x6c/0x108 [nfsd]
ops_init+0x44/0x170
register_pernet_operations+0x114/0x270
register_pernet_subsys+0x34/0x50
init_nfsd+0xa8/0x718 [nfsd]
do_one_initcall+0x54/0x2e0
CPU 2 :
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
PC is at : exports_net_open+0x50/0x68 [nfsd]
Call trace:
exports_net_open+0x50/0x68 [nfsd]
exports_proc_open+0x2c/0x38 [nfsd]
proc_reg_open+0xb8/0x198
do_dentry_open+0x1c4/0x418
vfs_open+0x38/0x48
path_openat+0x28c/0xf18
do_filp_open+0x70/0xe8
do_sys_open+0x154/0x248
Sometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().
and same is happening on latest 6.14 kernel as well:
[ 0.000000] Linux version 6.14.0-rc5-next-20250304-dirty
...
[ 285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48
...
[ 285.464902] pc : cache_seq_next_rcu+0x78/0xa4
...
[ 285.469695] Call trace:
[ 285.470083] cache_seq_next_rcu+0x78/0xa4 (P)
[ 285.470488] seq_read+0xe0/0x11c
[ 285.470675] proc_reg_read+0x9c/0xf0
[ 285.470874] vfs_read+0xc4/0x2fc
[ 285.471057] ksys_read+0x6c/0xf4
[ 285.471231] __arm64_sys_read+0x1c/0x28
[ 285.471428] invoke_syscall+0x44/0x100
[ 285.471633] el0_svc_common.constprop.0+0x40/0xe0
[ 285.471870] do_el0_svc_compat+0x1c/0x34
[ 285.472073] el0_svc_compat+0x2c/0x80
[ 285.472265] el0t_32_sync_handler+0x90/0x140
[ 285.472473] el0t_32_sync+0x19c/0x1a0
[ 285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)
[ 285.473422] ---[ end trace 0000000000000000 ]---
It reproduced simply with below script:
while [ 1 ]
do
/exportfs -r
done &
while [ 1 ]
do
insmod /nfsd.ko
mount -t nfsd none /proc/fs/nfsd
umount /proc/fs/nfsd
rmmod nfsd
done &
So exporting interfaces to user space shall be done at last and
cleanup at first place.
With change there is no Kernel OOPs.
Co-developed-by: Shubham Rana <s9.rana@samsung.com>
Signed-off-by: Shubham Rana <s9.rana@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ The context change is due to the commit bd9d6a3efa97
("NFSD: add rpc_status netlink support") in v6.7
and the proper adoption is done. ]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1511,12 +1511,9 @@ static int __init init_nfsd(void)
if (retval)
goto out_free_pnfs;
nfsd_lockd_init(); /* lockd->nfsd callbacks */
- retval = create_proc_exports_entry();
- if (retval)
- goto out_free_lockd;
retval = register_pernet_subsys(&nfsd_net_ops);
if (retval < 0)
- goto out_free_exports;
+ goto out_free_lockd;
retval = register_cld_notifier();
if (retval)
goto out_free_subsys;
@@ -1525,17 +1522,19 @@ static int __init init_nfsd(void)
goto out_free_cld;
retval = register_filesystem(&nfsd_fs_type);
if (retval)
+ goto out_free_nfsd4;
+ retval = create_proc_exports_entry();
+ if (retval)
goto out_free_all;
return 0;
out_free_all:
+ unregister_filesystem(&nfsd_fs_type);
+out_free_nfsd4:
nfsd4_destroy_laundry_wq();
out_free_cld:
unregister_cld_notifier();
out_free_subsys:
unregister_pernet_subsys(&nfsd_net_ops);
-out_free_exports:
- remove_proc_entry("fs/nfs/exports", NULL);
- remove_proc_entry("fs/nfs", NULL);
out_free_lockd:
nfsd_lockd_shutdown();
nfsd_drc_slab_free();
@@ -1548,13 +1547,13 @@ out_free_slabs:
static void __exit exit_nfsd(void)
{
+ remove_proc_entry("fs/nfs/exports", NULL);
+ remove_proc_entry("fs/nfs", NULL);
unregister_filesystem(&nfsd_fs_type);
nfsd4_destroy_laundry_wq();
unregister_cld_notifier();
unregister_pernet_subsys(&nfsd_net_ops);
nfsd_drc_slab_free();
- remove_proc_entry("fs/nfs/exports", NULL);
- remove_proc_entry("fs/nfs", NULL);
nfsd_lockd_shutdown();
nfsd4_free_slabs();
nfsd4_exit_pnfs();
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 265/280] usbnet: Fix using smp_processor_id() in preemptible code warnings
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 264/280] NFSD: fix race between nfsd registration and exports_proc Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 266/280] drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV Greg Kroah-Hartman
` (19 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Zqiang, Paolo Abeni,
Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <qiang.zhang@linux.dev>
[ Upstream commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 ]
Syzbot reported the following warning:
BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879
caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331
CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49
usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331
usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708
usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417
__dev_set_mtu net/core/dev.c:9443 [inline]
netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496
netif_set_mtu+0xb0/0x160 net/core/dev.c:9520
dev_set_mtu+0xae/0x170 net/core/dev_api.c:247
dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572
dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821
sock_do_ioctl+0x19d/0x280 net/socket.c:1204
sock_ioctl+0x42f/0x6a0 net/socket.c:1311
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
For historical and portability reasons, the netif_rx() is usually
run in the softirq or interrupt context, this commit therefore add
local_bh_disable/enable() protection in the usbnet_resume_rx().
Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
Link: https://syzkaller.appspot.com/bug?id=81f55dfa587ee544baaaa5a359a060512228c1e1
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Zqiang <qiang.zhang@linux.dev>
Link: https://patch.msgid.link/20251011070518.7095-1-qiang.zhang@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ The context change is due to the commit 2c04d279e857
("net: usb: Convert tasklet API to new bottom half workqueue mechanism")
in v6.17 which is irrelevant to the logic of this patch.]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/usbnet.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -704,6 +704,7 @@ void usbnet_resume_rx(struct usbnet *dev
struct sk_buff *skb;
int num = 0;
+ local_bh_disable();
clear_bit(EVENT_RX_PAUSED, &dev->flags);
while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) {
@@ -712,6 +713,7 @@ void usbnet_resume_rx(struct usbnet *dev
}
tasklet_schedule(&dev->bh);
+ local_bh_enable();
netif_dbg(dev, rx_status, dev->net,
"paused rx queue disabled, %d skbs requeued\n", num);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 266/280] drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 265/280] usbnet: Fix using smp_processor_id() in preemptible code warnings Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 267/280] net: stmmac: make sure that ptp_rate is not 0 before configuring EST Greg Kroah-Hartman
` (18 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, lin cao, Jingwen Chen,
Victor Skvortsov, Zhigang Luo, Christian König, Alex Deucher,
Srinivasan Shanmugam, Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit dc0297f3198bd60108ccbd167ee5d9fa4af31ed0 ]
RLCG Register Access is a way for virtual functions to safely access GPU
registers in a virtualized environment., including TLB flushes and
register reads. When multiple threads or VFs try to access the same
registers simultaneously, it can lead to race conditions. By using the
RLCG interface, the driver can serialize access to the registers. This
means that only one thread can access the registers at a time,
preventing conflicts and ensuring that operations are performed
correctly. Additionally, when a low-priority task holds a mutex that a
high-priority task needs, ie., If a thread holding a spinlock tries to
acquire a mutex, it can lead to priority inversion. register access in
amdgpu_virt_rlcg_reg_rw especially in a fast code path is critical.
The call stack shows that the function amdgpu_virt_rlcg_reg_rw is being
called, which attempts to acquire the mutex. This function is invoked
from amdgpu_sriov_wreg, which in turn is called from
gmc_v11_0_flush_gpu_tlb.
The [ BUG: Invalid wait context ] indicates that a thread is trying to
acquire a mutex while it is in a context that does not allow it to sleep
(like holding a spinlock).
Fixes the below:
[ 253.013423] =============================
[ 253.013434] [ BUG: Invalid wait context ]
[ 253.013446] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G U OE
[ 253.013464] -----------------------------
[ 253.013475] kworker/0:1/10 is trying to lock:
[ 253.013487] ffff9f30542e3cf8 (&adev->virt.rlcg_reg_lock){+.+.}-{3:3}, at: amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.013815] other info that might help us debug this:
[ 253.013827] context-{4:4}
[ 253.013835] 3 locks held by kworker/0:1/10:
[ 253.013847] #0: ffff9f3040050f58 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x3f5/0x680
[ 253.013877] #1: ffffb789c008be40 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: process_one_work+0x1d6/0x680
[ 253.013905] #2: ffff9f3054281838 (&adev->gmc.invalidate_lock){+.+.}-{2:2}, at: gmc_v11_0_flush_gpu_tlb+0x198/0x4f0 [amdgpu]
[ 253.014154] stack backtrace:
[ 253.014164] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Tainted: G U OE 6.12.0-amdstaging-drm-next-lol-050225 #14
[ 253.014189] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 253.014203] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/18/2024
[ 253.014224] Workqueue: events work_for_cpu_fn
[ 253.014241] Call Trace:
[ 253.014250] <TASK>
[ 253.014260] dump_stack_lvl+0x9b/0xf0
[ 253.014275] dump_stack+0x10/0x20
[ 253.014287] __lock_acquire+0xa47/0x2810
[ 253.014303] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.014321] lock_acquire+0xd1/0x300
[ 253.014333] ? amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.014562] ? __lock_acquire+0xa6b/0x2810
[ 253.014578] __mutex_lock+0x85/0xe20
[ 253.014591] ? amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.014782] ? sched_clock_noinstr+0x9/0x10
[ 253.014795] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.014808] ? local_clock_noinstr+0xe/0xc0
[ 253.014822] ? amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.015012] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.015029] mutex_lock_nested+0x1b/0x30
[ 253.015044] ? mutex_lock_nested+0x1b/0x30
[ 253.015057] amdgpu_virt_rlcg_reg_rw+0xf6/0x330 [amdgpu]
[ 253.015249] amdgpu_sriov_wreg+0xc5/0xd0 [amdgpu]
[ 253.015435] gmc_v11_0_flush_gpu_tlb+0x44b/0x4f0 [amdgpu]
[ 253.015667] gfx_v11_0_hw_init+0x499/0x29c0 [amdgpu]
[ 253.015901] ? __pfx_smu_v13_0_update_pcie_parameters+0x10/0x10 [amdgpu]
[ 253.016159] ? srso_alias_return_thunk+0x5/0xfbef5
[ 253.016173] ? smu_hw_init+0x18d/0x300 [amdgpu]
[ 253.016403] amdgpu_device_init+0x29ad/0x36a0 [amdgpu]
[ 253.016614] amdgpu_driver_load_kms+0x1a/0xc0 [amdgpu]
[ 253.017057] amdgpu_pci_probe+0x1c2/0x660 [amdgpu]
[ 253.017493] local_pci_probe+0x4b/0xb0
[ 253.017746] work_for_cpu_fn+0x1a/0x30
[ 253.017995] process_one_work+0x21e/0x680
[ 253.018248] worker_thread+0x190/0x330
[ 253.018500] ? __pfx_worker_thread+0x10/0x10
[ 253.018746] kthread+0xe7/0x120
[ 253.018988] ? __pfx_kthread+0x10/0x10
[ 253.019231] ret_from_fork+0x3c/0x60
[ 253.019468] ? __pfx_kthread+0x10/0x10
[ 253.019701] ret_from_fork_asm+0x1a/0x30
[ 253.019939] </TASK>
v2: s/spin_trylock/spin_lock_irqsave to be safe (Christian).
Fixes: e864180ee49b ("drm/amdgpu: Add lock around VF RLCG interface")
Cc: lin cao <lin.cao@amd.com>
Cc: Jingwen Chen <Jingwen.Chen2@amd.com>
Cc: Victor Skvortsov <victor.skvortsov@amd.com>
Cc: Zhigang Luo <zhigang.luo@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ Minor conflict resolved. ]
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 5 +++--
drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 3 ++-
3 files changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3652,7 +3652,6 @@ int amdgpu_device_init(struct amdgpu_dev
mutex_init(&adev->grbm_idx_mutex);
mutex_init(&adev->mn_lock);
mutex_init(&adev->virt.vf_errors.lock);
- mutex_init(&adev->virt.rlcg_reg_lock);
hash_init(adev->mn_hash);
mutex_init(&adev->psp.mutex);
mutex_init(&adev->notifier_lock);
@@ -3674,6 +3673,7 @@ int amdgpu_device_init(struct amdgpu_dev
spin_lock_init(&adev->se_cac_idx_lock);
spin_lock_init(&adev->audio_endpt_idx_lock);
spin_lock_init(&adev->mm_stats.lock);
+ spin_lock_init(&adev->virt.rlcg_reg_lock);
INIT_LIST_HEAD(&adev->shadow_list);
mutex_init(&adev->shadow_list_lock);
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
@@ -965,6 +965,7 @@ static u32 amdgpu_virt_rlcg_reg_rw(struc
void *scratch_reg2;
void *scratch_reg3;
void *spare_int;
+ unsigned long flags;
if (!adev->gfx.rlc.rlcg_reg_access_supported) {
dev_err(adev->dev,
@@ -978,7 +979,7 @@ static u32 amdgpu_virt_rlcg_reg_rw(struc
scratch_reg2 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg2;
scratch_reg3 = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->scratch_reg3;
- mutex_lock(&adev->virt.rlcg_reg_lock);
+ spin_lock_irqsave(&adev->virt.rlcg_reg_lock, flags);
if (reg_access_ctrl->spare_int)
spare_int = (void __iomem *)adev->rmmio + 4 * reg_access_ctrl->spare_int;
@@ -1034,7 +1035,7 @@ static u32 amdgpu_virt_rlcg_reg_rw(struc
ret = readl(scratch_reg0);
- mutex_unlock(&adev->virt.rlcg_reg_lock);
+ spin_unlock_irqrestore(&adev->virt.rlcg_reg_lock, flags);
return ret;
}
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
@@ -264,7 +264,8 @@ struct amdgpu_virt {
/* the ucode id to signal the autoload */
uint32_t autoload_ucode_id;
- struct mutex rlcg_reg_lock;
+ /* Spinlock to protect access to the RLCG register interface */
+ spinlock_t rlcg_reg_lock;
};
struct amdgpu_video_codec_info;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 267/280] net: stmmac: make sure that ptp_rate is not 0 before configuring EST
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 266/280] drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 268/280] sctp: linearize cloned gso packets in sctp_rcv Greg Kroah-Hartman
` (17 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Chevallier,
Alexis Lothoré, Jakub Kicinski, Rahul Sharma
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexis Lothoré <alexis.lothore@bootlin.com>
[ Upstream commit cbefe2ffa7784525ec5d008ba87c7add19ec631a ]
If the ptp_rate recorded earlier in the driver happens to be 0, this
bogus value will propagate up to EST configuration, where it will
trigger a division by 0.
Prevent this division by 0 by adding the corresponding check and error
code.
Suggested-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Fixes: 8572aec3d0dc ("net: stmmac: Add basic EST support for XGMAC")
Link: https://patch.msgid.link/20250529-stmmac_tstamp_div-v4-2-d73340a794d5@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ The context change is due to the commit c3f3b97238f6
("net: stmmac: Refactor EST implementation")
and the proper adoption is done. ]
Signed-off-by: Rahul Sharma <black.hawk@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 5 +++++
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 5 +++++
2 files changed, 10 insertions(+)
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
@@ -597,6 +597,11 @@ int dwmac5_est_configure(void __iomem *i
int i, ret = 0x0;
u32 ctrl;
+ if (!ptp_rate) {
+ pr_warn("Dwmac5: Invalid PTP rate");
+ return -EINVAL;
+ }
+
ret |= dwmac5_est_write(ioaddr, BTR_LOW, cfg->btr[0], false);
ret |= dwmac5_est_write(ioaddr, BTR_HIGH, cfg->btr[1], false);
ret |= dwmac5_est_write(ioaddr, TER, cfg->ter, false);
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
@@ -1497,6 +1497,11 @@ static int dwxgmac3_est_configure(void _
int i, ret = 0x0;
u32 ctrl;
+ if (!ptp_rate) {
+ pr_warn("Dwxgmac2: Invalid PTP rate");
+ return -EINVAL;
+ }
+
ret |= dwxgmac3_est_write(ioaddr, XGMAC_BTR_LOW, cfg->btr[0], false);
ret |= dwxgmac3_est_write(ioaddr, XGMAC_BTR_HIGH, cfg->btr[1], false);
ret |= dwxgmac3_est_write(ioaddr, XGMAC_TER, cfg->ter, false);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 268/280] sctp: linearize cloned gso packets in sctp_rcv
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 267/280] net: stmmac: make sure that ptp_rate is not 0 before configuring EST Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 269/280] ksmbd: fix use-after-free in ksmbd_session_rpc_open Greg Kroah-Hartman
` (16 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+773e51afe420baaf0e2b,
syzbot+70a42f45e76bede082be, Xin Long, Marcelo Ricardo Leitner,
Jakub Kicinski, Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit fd60d8a086191fe33c2d719732d2482052fa6805 ]
A cloned head skb still shares these frag skbs in fraglist with the
original head skb. It's not safe to access these frag skbs.
syzbot reported two use-of-uninitialized-memory bugs caused by this:
BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211
sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211
sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998
sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88
sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331
sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122
__release_sock+0x1da/0x330 net/core/sock.c:3106
release_sock+0x6b/0x250 net/core/sock.c:3660
sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360
sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885
sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031
inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:718 [inline]
and
BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987
sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987
sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88
sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331
sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148
__release_sock+0x1d3/0x330 net/core/sock.c:3213
release_sock+0x6b/0x270 net/core/sock.c:3767
sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367
sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886
sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032
inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:712 [inline]
This patch fixes it by linearizing cloned gso packets in sctp_rcv().
Fixes: 90017accff61 ("sctp: Add GSO support")
Reported-by: syzbot+773e51afe420baaf0e2b@syzkaller.appspotmail.com
Reported-by: syzbot+70a42f45e76bede082be@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/dd7dc337b99876d4132d0961f776913719f7d225.1754595611.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
This patch is lost/missing, as it has already been added
into stable branches less than and greater than 6.1. Previous patch in
https://lore.kernel.org/stable/20251022075549.195012-1-kovalev@altlinux.org/ is still not added.
So I resent it again.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -114,7 +114,7 @@ int sctp_rcv(struct sk_buff *skb)
* it's better to just linearize it otherwise crc computing
* takes longer.
*/
- if ((!is_gso && skb_linearize(skb)) ||
+ if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb)) ||
!pskb_may_pull(skb, sizeof(struct sctphdr)))
goto discard_it;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 269/280] ksmbd: fix use-after-free in ksmbd_session_rpc_open
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 268/280] sctp: linearize cloned gso packets in sctp_rcv Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 270/280] ksmbd: Fix race condition in RPC handle list access Greg Kroah-Hartman
` (15 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Norbert Szetei, Namjae Jeon,
Steve French, Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit a1f46c99d9ea411f9bf30025b912d881d36fc709 ]
A UAF issue can occur due to a race condition between
ksmbd_session_rpc_open() and __session_rpc_close().
Add rpc_lock to the session to protect it.
Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
[ KSMBD_DEFAULT_GFP is introduced by commit 0066f623bce8 ("ksmbd: use __GFP_RETRY_MAYFAIL")
after linux-6.13. Here we still use GFP_KERNEL. ]
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 20 ++++++++++++++------
fs/smb/server/mgmt/user_session.h | 1 +
2 files changed, 15 insertions(+), 6 deletions(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -59,10 +59,12 @@ static void ksmbd_session_rpc_clear_list
struct ksmbd_session_rpc *entry;
long index;
+ down_write(&sess->rpc_lock);
xa_for_each(&sess->rpc_handle_list, index, entry) {
xa_erase(&sess->rpc_handle_list, index);
__session_rpc_close(sess, entry);
}
+ up_write(&sess->rpc_lock);
xa_destroy(&sess->rpc_handle_list);
}
@@ -92,7 +94,7 @@ int ksmbd_session_rpc_open(struct ksmbd_
{
struct ksmbd_session_rpc *entry, *old;
struct ksmbd_rpc_command *resp;
- int method;
+ int method, id;
method = __rpc_method(rpc_name);
if (!method)
@@ -102,26 +104,29 @@ int ksmbd_session_rpc_open(struct ksmbd_
if (!entry)
return -ENOMEM;
+ down_read(&sess->rpc_lock);
entry->method = method;
- entry->id = ksmbd_ipc_id_alloc();
- if (entry->id < 0)
+ entry->id = id = ksmbd_ipc_id_alloc();
+ if (id < 0)
goto free_entry;
- old = xa_store(&sess->rpc_handle_list, entry->id, entry, GFP_KERNEL);
+ old = xa_store(&sess->rpc_handle_list, id, entry, GFP_KERNEL);
if (xa_is_err(old))
goto free_id;
- resp = ksmbd_rpc_open(sess, entry->id);
+ resp = ksmbd_rpc_open(sess, id);
if (!resp)
goto erase_xa;
+ up_read(&sess->rpc_lock);
kvfree(resp);
- return entry->id;
+ return id;
erase_xa:
xa_erase(&sess->rpc_handle_list, entry->id);
free_id:
ksmbd_rpc_id_free(entry->id);
free_entry:
kfree(entry);
+ up_read(&sess->rpc_lock);
return -EINVAL;
}
@@ -129,9 +134,11 @@ void ksmbd_session_rpc_close(struct ksmb
{
struct ksmbd_session_rpc *entry;
+ down_write(&sess->rpc_lock);
entry = xa_erase(&sess->rpc_handle_list, id);
if (entry)
__session_rpc_close(sess, entry);
+ up_write(&sess->rpc_lock);
}
int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
@@ -404,6 +411,7 @@ static struct ksmbd_session *__session_c
sess->sequence_number = 1;
rwlock_init(&sess->tree_conns_lock);
atomic_set(&sess->refcnt, 2);
+ init_rwsem(&sess->rpc_lock);
ret = __init_smb2_session(sess);
if (ret)
--- a/fs/smb/server/mgmt/user_session.h
+++ b/fs/smb/server/mgmt/user_session.h
@@ -63,6 +63,7 @@ struct ksmbd_session {
rwlock_t tree_conns_lock;
atomic_t refcnt;
+ struct rw_semaphore rpc_lock;
};
static inline int test_session_flag(struct ksmbd_session *sess, int bit)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 270/280] ksmbd: Fix race condition in RPC handle list access
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 269/280] ksmbd: fix use-after-free in ksmbd_session_rpc_open Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 271/280] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint Greg Kroah-Hartman
` (14 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunseong Kim, Namjae Jeon,
Steve French, Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunseong Kim <ysk@kzalloc.com>
[ Upstream commit 305853cce379407090a73b38c5de5ba748893aee ]
The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd
session. Access to this list is intended to be protected by
'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was
flawed, leading to potential race conditions.
In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock
before calling xa_store() and xa_erase(). Since these operations modify
the XArray structure, a write lock is required to ensure exclusive access
and prevent data corruption from concurrent modifications.
Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load()
without holding any lock at all. This could lead to reading inconsistent
data or a potential use-after-free if an entry is concurrently removed and
the pointer is dereferenced.
Fix these issues by:
1. Using down_write() and up_write() in ksmbd_session_rpc_open()
to ensure exclusive access during XArray modification, and ensuring
the lock is correctly released on error paths.
2. Adding down_read() and up_read() in ksmbd_session_rpc_method()
to safely protect the lookup.
Fixes: a1f46c99d9ea ("ksmbd: fix use-after-free in ksmbd_session_rpc_open")
Fixes: b685757c7b08 ("ksmbd: Implements sess->rpc_handle_list as xarray")
Cc: stable@vger.kernel.org
Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
[ Minor conflict resolved. ]
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -104,29 +104,32 @@ int ksmbd_session_rpc_open(struct ksmbd_
if (!entry)
return -ENOMEM;
- down_read(&sess->rpc_lock);
entry->method = method;
entry->id = id = ksmbd_ipc_id_alloc();
if (id < 0)
goto free_entry;
+
+ down_write(&sess->rpc_lock);
old = xa_store(&sess->rpc_handle_list, id, entry, GFP_KERNEL);
- if (xa_is_err(old))
+ if (xa_is_err(old)) {
+ up_write(&sess->rpc_lock);
goto free_id;
+ }
resp = ksmbd_rpc_open(sess, id);
- if (!resp)
- goto erase_xa;
+ if (!resp) {
+ xa_erase(&sess->rpc_handle_list, entry->id);
+ up_write(&sess->rpc_lock);
+ goto free_id;
+ }
- up_read(&sess->rpc_lock);
+ up_write(&sess->rpc_lock);
kvfree(resp);
return id;
-erase_xa:
- xa_erase(&sess->rpc_handle_list, entry->id);
free_id:
ksmbd_rpc_id_free(entry->id);
free_entry:
kfree(entry);
- up_read(&sess->rpc_lock);
return -EINVAL;
}
@@ -144,9 +147,14 @@ void ksmbd_session_rpc_close(struct ksmb
int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
{
struct ksmbd_session_rpc *entry;
+ int method;
+ down_read(&sess->rpc_lock);
entry = xa_load(&sess->rpc_handle_list, id);
- return entry ? entry->method : 0;
+ method = entry ? entry->method : 0;
+ up_read(&sess->rpc_lock);
+
+ return method;
}
void ksmbd_session_destroy(struct ksmbd_session *sess)
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 271/280] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 270/280] ksmbd: Fix race condition in RPC handle list access Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 272/280] drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Greg Kroah-Hartman
` (13 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoran Zhang, Mike Christie,
Stefan Hajnoczi, Michael S. Tsirkin, Stefano Garzarella,
Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <michael.christie@oracle.com>
[ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ]
If vhost_scsi_set_endpoint is called multiple times without a
vhost_scsi_clear_endpoint between them, we can hit multiple bugs
found by Haoran Zhang:
1. Use-after-free when no tpgs are found:
This fixes a use after free that occurs when vhost_scsi_set_endpoint is
called more than once and calls after the first call do not find any
tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds
tpgs to add to the vs_tpg array match=true, so we will do:
vhost_vq_set_backend(vq, vs_tpg);
...
kfree(vs->vs_tpg);
vs->vs_tpg = vs_tpg;
If vhost_scsi_set_endpoint is called again and no tpgs are found
match=false so we skip the vhost_vq_set_backend call leaving the
pointer to the vs_tpg we then free via:
kfree(vs->vs_tpg);
vs->vs_tpg = vs_tpg;
If a scsi request is then sent we do:
vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend
which sees the vs_tpg we just did a kfree on.
2. Tpg dir removal hang:
This patch fixes an issue where we cannot remove a LIO/target layer
tpg (and structs above it like the target) dir due to the refcount
dropping to -1.
The problem is that if vhost_scsi_set_endpoint detects a tpg is already
in the vs->vs_tpg array or if the tpg has been removed so
target_depend_item fails, the undepend goto handler will do
target_undepend_item on all tpgs in the vs_tpg array dropping their
refcount to 0. At this time vs_tpg contains both the tpgs we have added
in the current vhost_scsi_set_endpoint call as well as tpgs we added in
previous calls which are also in vs->vs_tpg.
Later, when vhost_scsi_clear_endpoint runs it will do
target_undepend_item on all the tpgs in the vs->vs_tpg which will drop
their refcount to -1. Userspace will then not be able to remove the tpg
and will hang when it tries to do rmdir on the tpg dir.
3. Tpg leak:
This fixes a bug where we can leak tpgs and cause them to be
un-removable because the target name is overwritten when
vhost_scsi_set_endpoint is called multiple times but with different
target names.
The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup
a vhost-scsi device to target/tpg mapping, then calls
VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we
haven't seen before (target1 has tpg1 but target2 has tpg2). When this
happens we don't teardown the old target tpg mapping and just overwrite
the target name and the vs->vs_tpg array. Later when we do
vhost_scsi_clear_endpoint, we are passed in either target1 or target2's
name and we will only match that target's tpgs when we loop over the
vs->vs_tpg. We will then return from the function without doing
target_undepend_item on the tpgs.
Because of all these bugs, it looks like being able to call
vhost_scsi_set_endpoint multiple times was never supported. The major
user, QEMU, already has checks to prevent this use case. So to fix the
issues, this patch prevents vhost_scsi_set_endpoint from being called
if it's already successfully added tpgs. To add, remove or change the
tpg config or target name, you must do a vhost_scsi_clear_endpoint
first.
Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session")
Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup")
Reported-by: Haoran Zhang <wh1sper@zju.edu.cn>
Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e@oracle.com/T/#me6c0041ce376677419b9b2563494172a01487ecb
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20250129210922.121533-1-michael.christie@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
[ Minor conflict resolved. ]
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/scsi.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1572,14 +1572,19 @@ vhost_scsi_set_endpoint(struct vhost_scs
}
}
+ if (vs->vs_tpg) {
+ pr_err("vhost-scsi endpoint already set for %s.\n",
+ vs->vs_vhost_wwpn);
+ ret = -EEXIST;
+ goto out;
+ }
+
len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET;
vs_tpg = kzalloc(len, GFP_KERNEL);
if (!vs_tpg) {
ret = -ENOMEM;
goto out;
}
- if (vs->vs_tpg)
- memcpy(vs_tpg, vs->vs_tpg, len);
list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) {
mutex_lock(&tpg->tv_tpg_mutex);
@@ -1594,11 +1599,6 @@ vhost_scsi_set_endpoint(struct vhost_scs
tv_tport = tpg->tport;
if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
- if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) {
- mutex_unlock(&tpg->tv_tpg_mutex);
- ret = -EEXIST;
- goto undepend;
- }
/*
* In order to ensure individual vhost-scsi configfs
* groups cannot be removed while in use by vhost ioctl,
@@ -1643,15 +1643,15 @@ vhost_scsi_set_endpoint(struct vhost_scs
}
ret = 0;
} else {
- ret = -EEXIST;
+ ret = -ENODEV;
+ goto free_tpg;
}
/*
- * Act as synchronize_rcu to make sure access to
- * old vs->vs_tpg is finished.
+ * Act as synchronize_rcu to make sure requests after this point
+ * see a fully setup device.
*/
vhost_scsi_flush(vs);
- kfree(vs->vs_tpg);
vs->vs_tpg = vs_tpg;
goto out;
@@ -1668,6 +1668,7 @@ undepend:
target_undepend_item(&tpg->se_tpg.tpg_group.cg_item);
}
}
+free_tpg:
kfree(vs_tpg);
out:
mutex_unlock(&vs->dev.mutex);
@@ -1757,6 +1758,7 @@ vhost_scsi_clear_endpoint(struct vhost_s
vhost_scsi_flush(vs);
kfree(vs->vs_tpg);
vs->vs_tpg = NULL;
+ memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn));
WARN_ON(vs->vs_events_nr);
mutex_unlock(&vs->dev.mutex);
mutex_unlock(&vhost_scsi_mutex);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 272/280] drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 271/280] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 273/280] btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() Greg Kroah-Hartman
` (12 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Robert McClinton,
Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert McClinton <rbmccav@gmail.com>
[ Upstream commit 9eb00b5f5697bd56baa3222c7a1426fa15bacfb5 ]
Delete the attempt to progress the queue when checking if fence is
signaled. This avoids deadlock.
dma-fence_ops::signaled can be called with the fence lock in unknown
state. For radeon, the fence lock is also the wait queue lock. This can
cause a self deadlock when signaled() tries to make forward progress on
the wait queue. But advancing the queue is unneeded because incorrectly
returning false from signaled() is perfectly acceptable.
Link: https://github.com/brave/brave-browser/issues/49182
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4641
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Robert McClinton <rbmccav@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 527ba26e50ec2ca2be9c7c82f3ad42998a75d0db)
Cc: stable@vger.kernel.org
[ Minor conflict resolved. ]
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_fence.c | 8 --------
1 file changed, 8 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -362,14 +362,6 @@ static bool radeon_fence_is_signaled(str
return true;
}
- if (down_read_trylock(&rdev->exclusive_lock)) {
- radeon_fence_process(rdev, ring);
- up_read(&rdev->exclusive_lock);
-
- if (atomic64_read(&rdev->fence_drv[ring].last_seq) >= seq) {
- return true;
- }
- }
return false;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 273/280] btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate()
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 272/280] drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 274/280] net/sched: act_ife: convert comma to semicolon Greg Kroah-Hartman
` (11 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, JP Kobryn
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Kobryn <inwardvessel@gmail.com>
This is a stable-only patch. The issue was inadvertently fixed in 6.17 [0]
as part of a refactoring, but this patch serves as a minimal targeted fix
for prior kernels.
Users of find_lock_page() need to guard against the situation where
releasepage() has been invoked during reclaim but the page was ultimately
not removed from the page cache. This patch covers one location that was
overlooked.
After acquiring the page, use set_page_extent_mapped() to ensure the page
private state is valid. This is especially important in the subpage case,
where the private field is an allocated struct containing bitmap and lock
data.
Without this protection, the race below is possible:
[mm] page cache reclaim path [fs] relocation in subpage mode
shrink_page_list()
trylock_page() /* lock acquired */
try_to_release_page()
mapping->a_ops->releasepage()
btrfs_releasepage()
__btrfs_releasepage()
clear_page_extent_mapped()
btrfs_detach_subpage()
subpage = detach_page_private(page)
btrfs_free_subpage(subpage)
kfree(subpage) /* point A */
prealloc_file_extent_cluster()
find_lock_page()
page_cache_get_speculative()
lock_page() /* wait for lock */
if (...)
...
else if (!mapping || !__remove_mapping(..))
/*
* __remove_mapping() returns zero when
* page_ref_freeze(page, refcount) fails /* point B */
*/
goto keep_locked /* page remains in cache */
keep_locked:
unlock_page(page) /* lock released */
/* lock acquired */
btrfs_subpage_clear_uptodate()
/* use-after-free */
subpage = page->private
[0] 4e346baee95f ("btrfs: reloc: unconditionally invalidate the page cache for each cluster")
Fixes: 9d9ea1e68a05 ("btrfs: subpage: fix relocation potentially overwriting last page data")
Cc: stable@vger.kernel.org # 5.15 - 6.9
Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/relocation.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2897,6 +2897,19 @@ static noinline_for_stack int prealloc_f
* will re-read the whole page anyway.
*/
if (page) {
+ /*
+ * releasepage() could have cleared the page private data while
+ * we were not holding the lock. Reset the mapping if needed so
+ * subpage operations can access a valid private page state.
+ */
+ ret = set_page_extent_mapped(page);
+ if (ret) {
+ unlock_page(page);
+ put_page(page);
+
+ return ret;
+ }
+
btrfs_subpage_clear_uptodate(fs_info, page, i_size,
round_up(i_size, PAGE_SIZE) - i_size);
unlock_page(page);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 274/280] net/sched: act_ife: convert comma to semicolon
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 273/280] btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 275/280] mptcp: avoid dup SUB_CLOSED events after disconnect Greg Kroah-Hartman
` (10 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Ni, Jamal Hadi Salim,
Jakub Kicinski, Ben Hutchings
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <nichen@iscas.ac.cn>
commit 205305c028ad986d0649b8b100bab6032dcd1bb5 upstream.
Replace comma between expressions with semicolons.
Using a ',' in place of a ';' can have unintended side effects.
Although that is not the case here, it is seems best to use ';'
unless ',' is intended.
Found by inspection.
No functional change intended.
Compile tested only.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112072709.73755-1-nichen@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/act_ife.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -648,9 +648,9 @@ static int tcf_ife_dump(struct sk_buff *
memset(&opt, 0, sizeof(opt));
- opt.index = ife->tcf_index,
- opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref,
- opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind,
+ opt.index = ife->tcf_index;
+ opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref;
+ opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind;
spin_lock_bh(&ife->tcf_lock);
opt.action = ife->tcf_action;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 275/280] mptcp: avoid dup SUB_CLOSED events after disconnect
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 274/280] net/sched: act_ife: convert comma to semicolon Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 276/280] mm/kfence: randomize the freelist on initialization Greg Kroah-Hartman
` (9 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Angaroni, Geliang Tang,
Matthieu Baerts (NGI0), Jakub Kicinski, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
[ Upstream commit 280d654324e33f8e6e3641f76764694c7b64c5db ]
In case of subflow disconnect(), which can also happen with the first
subflow in case of errors like timeout or reset, mptcp_subflow_ctx_reset
will reset most fields from the mptcp_subflow_context structure,
including close_event_done. Then, when another subflow is closed, yet
another SUB_CLOSED event for the disconnected initial subflow is sent.
Because of the previous reset, there are no source address and
destination port.
A solution is then to also check the subflow's local id: it shouldn't be
negative anyway.
Another solution would be not to reset subflow->close_event_done at
disconnect time, but when reused. But then, probably the whole reset
could be done when being reused. Let's not change this logic, similar
to TCP with tcp_disconnect().
Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
Cc: stable@vger.kernel.org
Reported-by: Marco Angaroni <marco.angaroni@italtel.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/603
Reviewed-by: Geliang Tang <geliang@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-1-7f71e1bc4feb@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2569,8 +2569,8 @@ out:
void mptcp_close_ssk(struct sock *sk, struct sock *ssk,
struct mptcp_subflow_context *subflow)
{
- /* The first subflow can already be closed and still in the list */
- if (subflow->close_event_done)
+ /* The first subflow can already be closed or disconnected */
+ if (subflow->close_event_done || READ_ONCE(subflow->local_id) < 0)
return;
subflow->close_event_done = true;
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 276/280] mm/kfence: randomize the freelist on initialization
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 275/280] mptcp: avoid dup SUB_CLOSED events after disconnect Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 277/280] writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 Greg Kroah-Hartman
` (8 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pimyn Girgis, Alexander Potapenko,
Dmitry Vyukov, Marco Elver, Ernesto Martnez Garca, Kees Cook,
Andrew Morton, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pimyn Girgis <pimyn@google.com>
[ Upstream commit 870ff19251bf3910dda7a7245da826924045fedd ]
Randomize the KFENCE freelist during pool initialization to make
allocation patterns less predictable. This is achieved by shuffling the
order in which metadata objects are added to the freelist using
get_random_u32_below().
Additionally, ensure the error path correctly calculates the address range
to be reset if initialization fails, as the address increment logic has
been moved to a separate loop.
Link: https://lkml.kernel.org/r/20260120161510.3289089-1-pimyn@google.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: Pimyn Girgis <pimyn@google.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Ernesto Martnez Garca <ernesto.martinezgarcia@tugraz.at>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ replaced kfence_metadata_init with kfence_metadata ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kfence/core.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
--- a/mm/kfence/core.c
+++ b/mm/kfence/core.c
@@ -542,7 +542,7 @@ static unsigned long kfence_init_pool(vo
{
unsigned long addr = (unsigned long)__kfence_pool;
struct page *pages;
- int i;
+ int i, rand;
if (!arch_kfence_init_pool())
return addr;
@@ -590,19 +590,34 @@ static unsigned long kfence_init_pool(vo
INIT_LIST_HEAD(&meta->list);
raw_spin_lock_init(&meta->lock);
meta->state = KFENCE_OBJECT_UNUSED;
- meta->addr = addr; /* Initialize for validation in metadata_to_pageaddr(). */
- list_add_tail(&meta->list, &kfence_freelist);
+ /* Use addr to randomize the freelist. */
+ meta->addr = i;
/* Protect the right redzone. */
- if (unlikely(!kfence_protect(addr + PAGE_SIZE)))
+ if (unlikely(!kfence_protect(addr + 2 * i * PAGE_SIZE + PAGE_SIZE)))
goto reset_slab;
+ }
+
+ for (i = CONFIG_KFENCE_NUM_OBJECTS; i > 0; i--) {
+ rand = get_random_u32_below(i);
+ swap(kfence_metadata[i - 1].addr, kfence_metadata[rand].addr);
+ }
+ for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+ struct kfence_metadata *meta_1 = &kfence_metadata[i];
+ struct kfence_metadata *meta_2 = &kfence_metadata[meta_1->addr];
+
+ list_add_tail(&meta_2->list, &kfence_freelist);
+ }
+ for (i = 0; i < CONFIG_KFENCE_NUM_OBJECTS; i++) {
+ kfence_metadata[i].addr = addr;
addr += 2 * PAGE_SIZE;
}
return 0;
reset_slab:
+ addr += 2 * i * PAGE_SIZE;
for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
struct slab *slab = page_slab(nth_page(pages, i));
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 277/280] writeback: fix 100% CPU usage when dirtytime_expire_interval is 0
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 276/280] mm/kfence: randomize the freelist on initialization Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 278/280] drm/imx/tve: fix probe device leak Greg Kroah-Hartman
` (7 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laveesh Bansal, Jan Kara,
Christian Brauner, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laveesh Bansal <laveeshb@laveeshbansal.com>
[ Upstream commit 543467d6fe97e27e22a26e367fda972dbefebbff ]
When vm.dirtytime_expire_seconds is set to 0, wakeup_dirtytime_writeback()
schedules delayed work with a delay of 0, causing immediate execution.
The function then reschedules itself with 0 delay again, creating an
infinite busy loop that causes 100% kworker CPU usage.
Fix by:
- Only scheduling delayed work in wakeup_dirtytime_writeback() when
dirtytime_expire_interval is non-zero
- Cancelling the delayed work in dirtytime_interval_handler() when
the interval is set to 0
- Adding a guard in start_dirtytime_writeback() for defensive coding
Tested by booting kernel in QEMU with virtme-ng:
- Before fix: kworker CPU spikes to ~73%
- After fix: CPU remains at normal levels
- Setting interval back to non-zero correctly resumes writeback
Fixes: a2f4870697a5 ("fs: make sure the timestamps for lazytime inodes eventually get written")
Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220227
Signed-off-by: Laveesh Bansal <laveeshb@laveeshbansal.com>
Link: https://patch.msgid.link/20260106145059.543282-2-laveeshb@laveeshbansal.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
[ adapted system_percpu_wq to system_wq for the workqueue used in dirtytime_interval_handler() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2360,12 +2360,14 @@ static void wakeup_dirtytime_writeback(s
wb_wakeup(wb);
}
rcu_read_unlock();
- schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
+ if (dirtytime_expire_interval)
+ schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
}
static int __init start_dirtytime_writeback(void)
{
- schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
+ if (dirtytime_expire_interval)
+ schedule_delayed_work(&dirtytime_work, dirtytime_expire_interval * HZ);
return 0;
}
__initcall(start_dirtytime_writeback);
@@ -2376,8 +2378,12 @@ int dirtytime_interval_handler(struct ct
int ret;
ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
- if (ret == 0 && write)
- mod_delayed_work(system_wq, &dirtytime_work, 0);
+ if (ret == 0 && write) {
+ if (dirtytime_expire_interval)
+ mod_delayed_work(system_wq, &dirtytime_work, 0);
+ else
+ cancel_delayed_work_sync(&dirtytime_work);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 278/280] drm/imx/tve: fix probe device leak
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 277/280] writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 279/280] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver Greg Kroah-Hartman
` (6 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philipp Zabel, Frank Li,
Johan Hovold, Maxime Ripard, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit e535c23513c63f02f67e3e09e0787907029efeaf ]
Make sure to drop the reference taken to the DDC device during probe on
probe failure (e.g. probe deferral) and on driver unbind.
Fixes: fcbc51e54d2a ("staging: drm/imx: Add support for Television Encoder (TVEv2)")
Cc: stable@vger.kernel.org # 3.10
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251030163456.15807-1-johan@kernel.org
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/imx/imx-tve.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/gpu/drm/imx/imx-tve.c
+++ b/drivers/gpu/drm/imx/imx-tve.c
@@ -522,6 +522,13 @@ static const struct component_ops imx_tv
.bind = imx_tve_bind,
};
+static void imx_tve_put_device(void *_dev)
+{
+ struct device *dev = _dev;
+
+ put_device(dev);
+}
+
static int imx_tve_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -543,6 +550,12 @@ static int imx_tve_probe(struct platform
if (ddc_node) {
tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
of_node_put(ddc_node);
+ if (tve->ddc) {
+ ret = devm_add_action_or_reset(dev, imx_tve_put_device,
+ &tve->ddc->dev);
+ if (ret)
+ return ret;
+ }
}
tve->mode = of_get_tve_mode(np);
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 279/280] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 278/280] drm/imx/tve: fix probe device leak Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 280/280] ksmbd: fix recursive locking in RPC handle list access Greg Kroah-Hartman
` (5 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Bartosz Golaszewski,
Konrad Dybcio, Abel Vesa, Linus Walleij, Sasha Levin
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
[ Upstream commit 4f0d22ec60cee420125f4055af76caa0f373a3fe ]
GPIO controller driver should typically implement the .get_direction()
callback as GPIOLIB internals may try to use it to determine the state
of a pin. Add it for the LPASS LPI driver.
Reported-by: Abel Vesa <abelvesa@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # X1E CRD
Tested-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
[ PIN_CONFIG_LEVEL => PIN_CONFIG_OUTPUT ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
@@ -248,6 +248,22 @@ static const struct pinconf_ops lpi_gpio
.pin_config_group_set = lpi_config_set,
};
+static int lpi_gpio_get_direction(struct gpio_chip *chip, unsigned int pin)
+{
+ unsigned long config = pinconf_to_config_packed(PIN_CONFIG_OUTPUT, 0);
+ struct lpi_pinctrl *state = gpiochip_get_data(chip);
+ unsigned long arg;
+ int ret;
+
+ ret = lpi_config_get(state->ctrl, pin, &config);
+ if (ret)
+ return ret;
+
+ arg = pinconf_to_config_argument(config);
+
+ return arg ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN;
+}
+
static int lpi_gpio_direction_input(struct gpio_chip *chip, unsigned int pin)
{
struct lpi_pinctrl *state = gpiochip_get_data(chip);
@@ -346,6 +362,7 @@ static void lpi_gpio_dbg_show(struct seq
#endif
static const struct gpio_chip lpi_gpio_template = {
+ .get_direction = lpi_gpio_get_direction,
.direction_input = lpi_gpio_direction_input,
.direction_output = lpi_gpio_direction_output,
.get = lpi_gpio_get,
^ permalink raw reply [flat|nested] 295+ messages in thread
* [PATCH 6.1 280/280] ksmbd: fix recursive locking in RPC handle list access
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 279/280] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver Greg Kroah-Hartman
@ 2026-02-04 14:40 ` Greg Kroah-Hartman
2026-02-04 19:52 ` [PATCH 6.1 000/280] 6.1.162-rc1 review Brett A C Sheffield
` (4 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-04 14:40 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marios Makassikis, Namjae Jeon,
Steve French, Li hongliang
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marios Makassikis <mmakassikis@freebox.fr>
[ Upstream commit 88f170814fea74911ceab798a43cbd7c5599bed4 ]
Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list
access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
This causes hung connections / tasks when a client attempts to open
a named pipe. Using Samba's rpcclient tool:
$ rpcclient //192.168.1.254 -U user%password
$ rpcclient $> srvinfo
<connection hung here>
Kernel side:
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000
Workqueue: ksmbd-io handle_ksmbd_work
Call trace:
__schedule from schedule+0x3c/0x58
schedule from schedule_preempt_disabled+0xc/0x10
schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8
rwsem_down_read_slowpath from down_read+0x28/0x30
down_read from ksmbd_session_rpc_method+0x18/0x3c
ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68
ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228
ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8
create_smb2_pipe from smb2_open+0x10c/0x27ac
smb2_open from handle_ksmbd_work+0x238/0x3dc
handle_ksmbd_work from process_scheduled_works+0x160/0x25c
process_scheduled_works from worker_thread+0x16c/0x1e8
worker_thread from kthread+0xa8/0xb8
kthread from ret_from_fork+0x14/0x38
Exception stack(0x8529ffb0 to 0x8529fff8)
The task deadlocks because the lock is already held:
ksmbd_session_rpc_open
down_write(&sess->rpc_lock)
ksmbd_rpc_open
ksmbd_session_rpc_method
down_read(&sess->rpc_lock) <-- deadlock
Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
Fixes: 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access")
Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Li hongliang <1468888505@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/mgmt/user_session.c | 7 ++-----
fs/smb/server/smb2pdu.c | 9 ++++++++-
fs/smb/server/transport_ipc.c | 12 ++++++++++++
3 files changed, 22 insertions(+), 6 deletions(-)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -147,14 +147,11 @@ void ksmbd_session_rpc_close(struct ksmb
int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
{
struct ksmbd_session_rpc *entry;
- int method;
- down_read(&sess->rpc_lock);
+ lockdep_assert_held(&sess->rpc_lock);
entry = xa_load(&sess->rpc_handle_list, id);
- method = entry ? entry->method : 0;
- up_read(&sess->rpc_lock);
- return method;
+ return entry ? entry->method : 0;
}
void ksmbd_session_destroy(struct ksmbd_session *sess)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4308,8 +4308,15 @@ static int smb2_get_info_file_pipe(struc
* pipe without opening it, checking error condition here
*/
id = req->VolatileFileId;
- if (!ksmbd_session_rpc_method(sess, id))
+
+ lockdep_assert_not_held(&sess->rpc_lock);
+
+ down_read(&sess->rpc_lock);
+ if (!ksmbd_session_rpc_method(sess, id)) {
+ up_read(&sess->rpc_lock);
return -ENOENT;
+ }
+ up_read(&sess->rpc_lock);
ksmbd_debug(SMB, "FileInfoClass %u, FileId 0x%llx\n",
req->FileInfoClass, req->VolatileFileId);
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -775,6 +775,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_writ
if (!msg)
return NULL;
+ lockdep_assert_not_held(&sess->rpc_lock);
+
+ down_read(&sess->rpc_lock);
msg->type = KSMBD_EVENT_RPC_REQUEST;
req = (struct ksmbd_rpc_command *)msg->payload;
req->handle = handle;
@@ -783,6 +786,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_writ
req->flags |= KSMBD_RPC_WRITE_METHOD;
req->payload_sz = payload_sz;
memcpy(req->payload, payload, payload_sz);
+ up_read(&sess->rpc_lock);
resp = ipc_msg_send_request(msg, req->handle);
ipc_msg_free(msg);
@@ -799,6 +803,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_read
if (!msg)
return NULL;
+ lockdep_assert_not_held(&sess->rpc_lock);
+
+ down_read(&sess->rpc_lock);
msg->type = KSMBD_EVENT_RPC_REQUEST;
req = (struct ksmbd_rpc_command *)msg->payload;
req->handle = handle;
@@ -806,6 +813,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_read
req->flags |= rpc_context_flags(sess);
req->flags |= KSMBD_RPC_READ_METHOD;
req->payload_sz = 0;
+ up_read(&sess->rpc_lock);
resp = ipc_msg_send_request(msg, req->handle);
ipc_msg_free(msg);
@@ -826,6 +834,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioct
if (!msg)
return NULL;
+ lockdep_assert_not_held(&sess->rpc_lock);
+
+ down_read(&sess->rpc_lock);
msg->type = KSMBD_EVENT_RPC_REQUEST;
req = (struct ksmbd_rpc_command *)msg->payload;
req->handle = handle;
@@ -834,6 +845,7 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioct
req->flags |= KSMBD_RPC_IOCTL_METHOD;
req->payload_sz = payload_sz;
memcpy(req->payload, payload, payload_sz);
+ up_read(&sess->rpc_lock);
resp = ipc_msg_send_request(msg, req->handle);
ipc_msg_free(msg);
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect
2026-02-04 14:37 ` [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect Greg Kroah-Hartman
@ 2026-02-04 15:31 ` Mario Limonciello
2026-02-05 14:10 ` Greg Kroah-Hartman
0 siblings, 1 reply; 295+ messages in thread
From: Mario Limonciello @ 2026-02-04 15:31 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, kent.russell, Alex Deucher
On 2/4/26 8:37 AM, Greg Kroah-Hartman wrote:
> 6.1-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Mario Limonciello (AMD) <superm1@kernel.org>
>
> commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
>
> When an eGPU is unplugged the KFD topology should also be destroyed
> for that GPU. This never happens because the fini_sw callbacks never
> get to run. Run them manually before calling amdgpu_device_ip_fini_early()
> when a device has already been disconnected.
>
> This location is intentionally chosen to make sure that the kfd locking
> refcount doesn't get incremented unintentionally.
>
> Cc: kent.russell@amd.com
> Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
> Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
> Reviewed-by: Kent Russell <kent.russell@amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> (cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab)
> Cc: stable@vger.kernel.org
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> @@ -4102,6 +4102,14 @@ void amdgpu_device_fini_hw(struct amdgpu
> /* disable ras feature must before hw fini */
> amdgpu_ras_pre_fini(adev);
>
> + /*
> + * device went through surprise hotplug; we need to destroy topology
> + * before ip_fini_early to prevent kfd locking refcount issues by calling
> + * amdgpu_amdkfd_suspend()
> + */
> + if (drm_dev_is_unplugged(adev_to_drm(adev)))
> + amdgpu_amdkfd_device_fini_sw(adev);
> +
> amdgpu_device_ip_fini_early(adev);
>
> amdgpu_irq_fini_hw(adev);
>
>
There was a regression [1] reported on this patch yesterday.
I haven't had time to dig into it; but I think we should hold off
letting it go to any more stable kernels until it's understood.
https://lore.kernel.org/all/b0c22deb-c0fa-3343-33cf-fd9a77d7db99@absolutedigital.net/
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-02-04 14:40 ` [PATCH 6.1 280/280] ksmbd: fix recursive locking in RPC handle list access Greg Kroah-Hartman
@ 2026-02-04 19:52 ` Brett A C Sheffield
2026-02-04 19:52 ` Florian Fainelli
` (3 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Brett A C Sheffield @ 2026-02-04 19:52 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.1.162-rc1-00281-g5a68cae0b7bf #1 SMP PREEMPT_DYNAMIC Wed Feb 4 18:36:06 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-02-04 19:52 ` [PATCH 6.1 000/280] 6.1.162-rc1 review Brett A C Sheffield
@ 2026-02-04 19:52 ` Florian Fainelli
2026-02-04 22:17 ` Peter Schneider
` (2 subsequent siblings)
284 siblings, 0 replies; 295+ messages in thread
From: Florian Fainelli @ 2026-02-04 19:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 2/4/26 06:36, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.162 release.
> There are 280 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.162-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-02-04 19:52 ` Florian Fainelli
@ 2026-02-04 22:17 ` Peter Schneider
2026-02-05 8:31 ` Greg Kroah-Hartman
2026-02-05 7:52 ` Ron Economos
2026-02-05 8:24 ` Francesco Dolcini
284 siblings, 1 reply; 295+ messages in thread
From: Peter Schneider @ 2026-02-04 22:17 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Hi Greg,
Am 04.02.2026 um 15:36 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.1.162 release.
> There are 280 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
> Anything received after that time might be too late.
It seems that this time, I cannot even build this RC. When I run "make menuconfig" I get a big serious of warning and
error messages; something seems to be really messed up here...
root@linus:/usr/src/linux-stable-rc# vim .config
root@linus:/usr/src/linux-stable-rc# make menuconfig
scripts/kconfig/Makefile:215: Warnung: Das Musterrezept hat das Peer-Ziel „scripts/kconfig/mconf-bin“ nicht aktualisiert.
HOSTCC scripts/kconfig/mconf.o
HOSTCC scripts/kconfig/lxdialog/checklist.o
HOSTCC scripts/kconfig/lxdialog/inputbox.o
HOSTCC scripts/kconfig/lxdialog/menubox.o
HOSTCC scripts/kconfig/lxdialog/textbox.o
HOSTCC scripts/kconfig/lxdialog/util.o
HOSTCC scripts/kconfig/lxdialog/yesno.o
HOSTLD scripts/kconfig/mconf
/usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: warning: relocation against `acs_map' in read-only section `.text'
/usr/bin/ld: scripts/kconfig/mconf.o: in function `show_help':
mconf.c:(.text+0xa1b): undefined reference to `stdscr'
/usr/bin/ld: mconf.c:(.text+0xa20): undefined reference to `getmaxx'
/usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_arrows':
checklist.c:(.text+0x2c): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x43): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x49): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x51): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x65): undefined reference to `waddnstr'
/usr/bin/ld: checklist.c:(.text+0x75): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x97): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x9d): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0xa5): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0xab): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0xb3): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0xb9): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0xc1): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0xc7): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0xf2): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0xf8): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x100): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x13a): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x140): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x148): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x14e): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x156): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x15c): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x164): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x16a): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x172): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_item':
checklist.c:(.text+0x1de): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x1eb): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x20c): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x225): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x23c): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x25c): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x26d): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x284): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x296): undefined reference to `waddnstr'
/usr/bin/ld: checklist.c:(.text+0x2aa): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x2b2): undefined reference to `wrefresh'
/usr/bin/ld: checklist.c:(.text+0x2da): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x2f6): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x307): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x31a): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x32c): undefined reference to `waddnstr'
/usr/bin/ld: checklist.c:(.text+0x349): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x359): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x388): undefined reference to `wprintw'
/usr/bin/ld: checklist.c:(.text+0x3b8): undefined reference to `wprintw'
/usr/bin/ld: checklist.c:(.text+0x3d3): undefined reference to `wprintw'
/usr/bin/ld: checklist.c:(.text+0x3ee): undefined reference to `wprintw'
/usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_buttons':
checklist.c:(.text+0x46a): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `dialog_checklist':
checklist.c:(.text+0x565): undefined reference to `stdscr'
/usr/bin/ld: checklist.c:(.text+0x56a): undefined reference to `getmaxy'
/usr/bin/ld: checklist.c:(.text+0x57d): undefined reference to `stdscr'
/usr/bin/ld: checklist.c:(.text+0x582): undefined reference to `getmaxx'
/usr/bin/ld: checklist.c:(.text+0x5a7): undefined reference to `stdscr'
/usr/bin/ld: checklist.c:(.text+0x5ac): undefined reference to `getmaxx'
/usr/bin/ld: checklist.c:(.text+0x5b8): undefined reference to `stdscr'
/usr/bin/ld: checklist.c:(.text+0x5d0): undefined reference to `getmaxy'
/usr/bin/ld: checklist.c:(.text+0x5e1): undefined reference to `stdscr'
/usr/bin/ld: checklist.c:(.text+0x60a): undefined reference to `newwin'
/usr/bin/ld: checklist.c:(.text+0x61a): undefined reference to `keypad'
/usr/bin/ld: checklist.c:(.text+0x64b): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x658): undefined reference to `wmove'
/usr/bin/ld: checklist.c:(.text+0x666): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x66e): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x682): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x68e): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x6a1): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x6a7): undefined reference to `acs_map'
/usr/bin/ld: checklist.c:(.text+0x6af): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x6d2): undefined reference to `wattrset'
/usr/bin/ld: checklist.c:(.text+0x717): undefined reference to `subwin'
/usr/bin/ld: checklist.c:(.text+0x729): undefined reference to `keypad'
/usr/bin/ld: checklist.c:(.text+0x8b5): undefined reference to `wnoutrefresh'
/usr/bin/ld: checklist.c:(.text+0x8bf): undefined reference to `wnoutrefresh'
/usr/bin/ld: checklist.c:(.text+0x8c4): undefined reference to `doupdate'
/usr/bin/ld: checklist.c:(.text+0x8e4): undefined reference to `wgetch'
/usr/bin/ld: checklist.c:(.text+0x9f7): undefined reference to `wrefresh'
/usr/bin/ld: checklist.c:(.text+0xa40): undefined reference to `delwin'
/usr/bin/ld: checklist.c:(.text+0xa48): undefined reference to `delwin'
/usr/bin/ld: checklist.c:(.text+0xaa8): undefined reference to `scrollok'
/usr/bin/ld: checklist.c:(.text+0xab5): undefined reference to `wscrl'
/usr/bin/ld: checklist.c:(.text+0xabf): undefined reference to `scrollok'
/usr/bin/ld: checklist.c:(.text+0xb12): undefined reference to `wnoutrefresh'
/usr/bin/ld: checklist.c:(.text+0xb1a): undefined reference to `wrefresh'
/usr/bin/ld: checklist.c:(.text+0xb79): undefined reference to `wnoutrefresh'
/usr/bin/ld: checklist.c:(.text+0xb81): undefined reference to `wrefresh'
/usr/bin/ld: checklist.c:(.text+0xbe2): undefined reference to `scrollok'
/usr/bin/ld: checklist.c:(.text+0xbef): undefined reference to `wscrl'
/usr/bin/ld: checklist.c:(.text+0xbf9): undefined reference to `scrollok'
/usr/bin/ld: checklist.c:(.text+0xc56): undefined reference to `wnoutrefresh'
/usr/bin/ld: checklist.c:(.text+0xc5e): undefined reference to `wrefresh'
/usr/bin/ld: checklist.c:(.text+0xc68): undefined reference to `wgetch'
/usr/bin/ld: checklist.c:(.text+0xcdc): undefined reference to `doupdate'
/usr/bin/ld: checklist.c:(.text+0xcf1): undefined reference to `doupdate'
/usr/bin/ld: checklist.c:(.text+0xd16): undefined reference to `delwin'
/usr/bin/ld: checklist.c:(.text+0xd1e): undefined reference to `delwin'
/usr/bin/ld: checklist.c:(.text+0xdb8): undefined reference to `delwin'
/usr/bin/ld: checklist.c:(.text+0xdc0): undefined reference to `delwin'
/usr/bin/ld: checklist.c:(.text+0xe08): undefined reference to `doupdate'
/usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_arrows':
checklist.c:(.text+0xdd): undefined reference to `waddch'
/usr/bin/ld: checklist.c:(.text+0x122): undefined reference to `waddnstr'
/usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_buttons':
checklist.c:(.text+0x47c): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/inputbox.o: in function `print_buttons':
inputbox.c:(.text+0x63): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/inputbox.o: in function `dialog_inputbox':
inputbox.c:(.text+0xd6): undefined reference to `stdscr'
/usr/bin/ld: inputbox.c:(.text+0xdb): undefined reference to `getmaxy'
/usr/bin/ld: inputbox.c:(.text+0xee): undefined reference to `stdscr'
/usr/bin/ld: inputbox.c:(.text+0xf3): undefined reference to `getmaxx'
/usr/bin/ld: inputbox.c:(.text+0x106): undefined reference to `stdscr'
/usr/bin/ld: inputbox.c:(.text+0x10b): undefined reference to `getmaxx'
/usr/bin/ld: inputbox.c:(.text+0x112): undefined reference to `stdscr'
/usr/bin/ld: inputbox.c:(.text+0x124): undefined reference to `getmaxy'
/usr/bin/ld: inputbox.c:(.text+0x137): undefined reference to `stdscr'
/usr/bin/ld: inputbox.c:(.text+0x15a): undefined reference to `newwin'
/usr/bin/ld: inputbox.c:(.text+0x16a): undefined reference to `keypad'
/usr/bin/ld: inputbox.c:(.text+0x19c): undefined reference to `wattrset'
/usr/bin/ld: inputbox.c:(.text+0x1ab): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x1ba): undefined reference to `acs_map'
/usr/bin/ld: inputbox.c:(.text+0x1c2): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0x1d2): undefined reference to `acs_map'
/usr/bin/ld: inputbox.c:(.text+0x1dd): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0x1f3): undefined reference to `wattrset'
/usr/bin/ld: inputbox.c:(.text+0x1f9): undefined reference to `acs_map'
/usr/bin/ld: inputbox.c:(.text+0x201): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0x21f): undefined reference to `wattrset'
/usr/bin/ld: inputbox.c:(.text+0x246): undefined reference to `getcury'
/usr/bin/ld: inputbox.c:(.text+0x250): undefined reference to `getcurx'
/usr/bin/ld: inputbox.c:(.text+0x2a6): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x2b4): undefined reference to `wattrset'
/usr/bin/ld: inputbox.c:(.text+0x2e8): undefined reference to `waddnstr'
/usr/bin/ld: inputbox.c:(.text+0x307): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x30f): undefined reference to `wrefresh'
/usr/bin/ld: inputbox.c:(.text+0x31c): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x382): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x3ea): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x41f): undefined reference to `flash'
/usr/bin/ld: inputbox.c:(.text+0x434): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x487): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x4da): undefined reference to `delwin'
/usr/bin/ld: inputbox.c:(.text+0x55c): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0x5ab): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x5d5): undefined reference to `delwin'
/usr/bin/ld: inputbox.c:(.text+0x5f4): undefined reference to `delwin'
/usr/bin/ld: inputbox.c:(.text+0x635): undefined reference to `delwin'
/usr/bin/ld: inputbox.c:(.text+0x6c2): undefined reference to `delwin'
/usr/bin/ld: inputbox.c:(.text+0x75a): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x79f): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x7a7): undefined reference to `wrefresh'
/usr/bin/ld: inputbox.c:(.text+0x7af): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x7de): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x7fc): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x85e): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x879): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x890): undefined reference to `wattrset'
/usr/bin/ld: inputbox.c:(.text+0x8dd): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x918): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0x933): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0x946): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x94e): undefined reference to `wrefresh'
/usr/bin/ld: inputbox.c:(.text+0x956): undefined reference to `wgetch'
/usr/bin/ld: inputbox.c:(.text+0x9b7): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0x9ed): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0xa07): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0xa18): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0xa33): undefined reference to `wattrset'
/usr/bin/ld: inputbox.c:(.text+0xa8b): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0xac5): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0xae6): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0xaf9): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0xb01): undefined reference to `wrefresh'
/usr/bin/ld: inputbox.c:(.text+0xb59): undefined reference to `wmove'
/usr/bin/ld: inputbox.c:(.text+0xb93): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0xbad): undefined reference to `waddch'
/usr/bin/ld: inputbox.c:(.text+0xbc0): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/inputbox.o: in function `print_buttons':
inputbox.c:(.text+0x75): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `do_print_item':
menubox.c:(.text+0x6d): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x7a): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x82): undefined reference to `wclrtoeol'
/usr/bin/ld: menubox.c:(.text+0x9a): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0xab): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0xc0): undefined reference to `waddnstr'
/usr/bin/ld: menubox.c:(.text+0xd8): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0xeb): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x108): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x14a): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x15d): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x16f): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x181): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `print_buttons':
menubox.c:(.text+0x253): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `print_arrows.constprop.0':
menubox.c:(.text+0x28d): undefined reference to `getcury'
/usr/bin/ld: menubox.c:(.text+0x299): undefined reference to `getcurx'
/usr/bin/ld: menubox.c:(.text+0x2ac): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x2c2): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x2c8): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x2d0): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x2e4): undefined reference to `waddnstr'
/usr/bin/ld: menubox.c:(.text+0x2f4): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x2fc): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0x317): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x31d): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x325): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x32b): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x333): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x339): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x341): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x347): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x34f): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x35e): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x38a): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x390): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x398): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x3ac): undefined reference to `waddnstr'
/usr/bin/ld: menubox.c:(.text+0x3c2): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x3c8): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x3d0): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x3d6): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x3de): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x3e4): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x3ec): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x3f2): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x3fa): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `dialog_menu':
menubox.c:(.text+0x446): undefined reference to `stdscr'
/usr/bin/ld: menubox.c:(.text+0x44b): undefined reference to `getmaxy'
/usr/bin/ld: menubox.c:(.text+0x452): undefined reference to `stdscr'
/usr/bin/ld: menubox.c:(.text+0x459): undefined reference to `getmaxx'
/usr/bin/ld: menubox.c:(.text+0x49f): undefined reference to `stdscr'
/usr/bin/ld: menubox.c:(.text+0x4a4): undefined reference to `getmaxx'
/usr/bin/ld: menubox.c:(.text+0x4b0): undefined reference to `stdscr'
/usr/bin/ld: menubox.c:(.text+0x4ca): undefined reference to `getmaxy'
/usr/bin/ld: menubox.c:(.text+0x4d6): undefined reference to `stdscr'
/usr/bin/ld: menubox.c:(.text+0x50b): undefined reference to `newwin'
/usr/bin/ld: menubox.c:(.text+0x51b): undefined reference to `keypad'
/usr/bin/ld: menubox.c:(.text+0x54d): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x55a): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x568): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x570): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x582): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x58e): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x5a1): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x5b5): undefined reference to `wbkgdset'
/usr/bin/ld: menubox.c:(.text+0x5bb): undefined reference to `acs_map'
/usr/bin/ld: menubox.c:(.text+0x5c3): undefined reference to `waddch'
/usr/bin/ld: menubox.c:(.text+0x5e2): undefined reference to `wattrset'
/usr/bin/ld: menubox.c:(.text+0x621): undefined reference to `subwin'
/usr/bin/ld: menubox.c:(.text+0x631): undefined reference to `keypad'
/usr/bin/ld: menubox.c:(.text+0x7ac): undefined reference to `wnoutrefresh'
/usr/bin/ld: menubox.c:(.text+0x7f5): undefined reference to `wmove'
/usr/bin/ld: menubox.c:(.text+0x7fd): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0x805): undefined reference to `wgetch'
/usr/bin/ld: menubox.c:(.text+0x933): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0x93b): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0x97e): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0x986): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0xab9): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0xac6): undefined reference to `wscrl'
/usr/bin/ld: menubox.c:(.text+0xad0): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0xadd): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0xb81): undefined reference to `wnoutrefresh'
/usr/bin/ld: menubox.c:(.text+0xb89): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0xbe6): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0xcc3): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0xccb): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0xf96): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0xfca): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0xfd7): undefined reference to `wscrl'
/usr/bin/ld: menubox.c:(.text+0xfe1): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0xff3): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0x1066): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0x106e): undefined reference to `delwin'
/usr/bin/ld: menubox.c:(.text+0x111a): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0x112c): undefined reference to `wscrl'
/usr/bin/ld: menubox.c:(.text+0x1136): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0x113e): undefined reference to `wrefresh'
/usr/bin/ld: menubox.c:(.text+0x11f4): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0x1231): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0x123e): undefined reference to `wscrl'
/usr/bin/ld: menubox.c:(.text+0x1248): undefined reference to `scrollok'
/usr/bin/ld: menubox.c:(.text+0x1250): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `do_print_item':
menubox.c:(.text+0x126): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `print_buttons':
menubox.c:(.text+0x265): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/menubox.o: in function `print_arrows.constprop.0':
menubox.c:(.text+0x374): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/textbox.o: in function `refresh_text_box':
textbox.c:(.text+0x2da): undefined reference to `wmove'
/usr/bin/ld: textbox.c:(.text+0x2e7): undefined reference to `waddch'
/usr/bin/ld: textbox.c:(.text+0x304): undefined reference to `waddnstr'
/usr/bin/ld: textbox.c:(.text+0x30c): undefined reference to `wclrtoeol'
/usr/bin/ld: textbox.c:(.text+0x33d): undefined reference to `wnoutrefresh'
/usr/bin/ld: textbox.c:(.text+0x350): undefined reference to `wattrset'
/usr/bin/ld: textbox.c:(.text+0x364): undefined reference to `wbkgdset'
/usr/bin/ld: textbox.c:(.text+0x39c): undefined reference to `getmaxx'
/usr/bin/ld: textbox.c:(.text+0x3a6): undefined reference to `getmaxy'
/usr/bin/ld: textbox.c:(.text+0x3b4): undefined reference to `wmove'
/usr/bin/ld: textbox.c:(.text+0x3c7): undefined reference to `wprintw'
/usr/bin/ld: textbox.c:(.text+0x3d7): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/textbox.o: in function `dialog_textbox':
textbox.c:(.text+0x48a): undefined reference to `stdscr'
/usr/bin/ld: textbox.c:(.text+0x48f): undefined reference to `getmaxy'
/usr/bin/ld: textbox.c:(.text+0x496): undefined reference to `stdscr'
/usr/bin/ld: textbox.c:(.text+0x49e): undefined reference to `getmaxx'
/usr/bin/ld: textbox.c:(.text+0x4c4): undefined reference to `stdscr'
/usr/bin/ld: textbox.c:(.text+0x4d9): undefined reference to `getmaxx'
/usr/bin/ld: textbox.c:(.text+0x4e0): undefined reference to `stdscr'
/usr/bin/ld: textbox.c:(.text+0x4f5): undefined reference to `getmaxy'
/usr/bin/ld: textbox.c:(.text+0x508): undefined reference to `stdscr'
/usr/bin/ld: textbox.c:(.text+0x530): undefined reference to `newwin'
/usr/bin/ld: textbox.c:(.text+0x540): undefined reference to `keypad'
/usr/bin/ld: textbox.c:(.text+0x55c): undefined reference to `subwin'
/usr/bin/ld: textbox.c:(.text+0x56d): undefined reference to `wattrset'
/usr/bin/ld: textbox.c:(.text+0x581): undefined reference to `wbkgdset'
/usr/bin/ld: textbox.c:(.text+0x58e): undefined reference to `keypad'
/usr/bin/ld: textbox.c:(.text+0x5c0): undefined reference to `wattrset'
/usr/bin/ld: textbox.c:(.text+0x5cf): undefined reference to `wmove'
/usr/bin/ld: textbox.c:(.text+0x5dc): undefined reference to `acs_map'
/usr/bin/ld: textbox.c:(.text+0x5e4): undefined reference to `waddch'
/usr/bin/ld: textbox.c:(.text+0x5f2): undefined reference to `acs_map'
/usr/bin/ld: textbox.c:(.text+0x5fe): undefined reference to `waddch'
/usr/bin/ld: textbox.c:(.text+0x611): undefined reference to `wattrset'
/usr/bin/ld: textbox.c:(.text+0x625): undefined reference to `wbkgdset'
/usr/bin/ld: textbox.c:(.text+0x62b): undefined reference to `acs_map'
/usr/bin/ld: textbox.c:(.text+0x633): undefined reference to `waddch'
/usr/bin/ld: textbox.c:(.text+0x670): undefined reference to `wnoutrefresh'
/usr/bin/ld: textbox.c:(.text+0x678): undefined reference to `getcury'
/usr/bin/ld: textbox.c:(.text+0x683): undefined reference to `getcurx'
/usr/bin/ld: textbox.c:(.text+0x6ca): undefined reference to `wgetch'
/usr/bin/ld: textbox.c:(.text+0x763): undefined reference to `delwin'
/usr/bin/ld: textbox.c:(.text+0x76b): undefined reference to `delwin'
/usr/bin/ld: textbox.c:(.text+0x82c): undefined reference to `wgetch'
/usr/bin/ld: textbox.c:(.text+0x9d4): undefined reference to `delwin'
/usr/bin/ld: textbox.c:(.text+0x9dc): undefined reference to `delwin'
/usr/bin/ld: scripts/kconfig/lxdialog/textbox.o: in function `refresh_text_box':
textbox.c:(.text+0x3ed): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `init_one_color':
util.c:(.text+0x2ef): undefined reference to `init_pair'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `attr_clear':
util.c:(.text+0x324): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x335): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x36c): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x387): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x3a0): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x3b0): undefined reference to `getmaxy'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `dialog_clear':
util.c:(.text+0x3e1): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x3e6): undefined reference to `getmaxy'
/usr/bin/ld: util.c:(.text+0x3ed): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x3f4): undefined reference to `getmaxx'
/usr/bin/ld: util.c:(.text+0x401): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x428): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x42d): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x434): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x440): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x47c): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x48f): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x4a6): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x4c2): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x4c9): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x4d2): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x4de): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x502): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x50c): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x52b): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x542): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x59a): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x5a7): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x5ae): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x5b8): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x5cc): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x5d2): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x5d7): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x5de): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x5e8): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `init_dialog':
util.c:(.text+0x61a): undefined reference to `initscr'
/usr/bin/ld: util.c:(.text+0x621): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x626): undefined reference to `getcury'
/usr/bin/ld: util.c:(.text+0x62d): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x638): undefined reference to `getcurx'
/usr/bin/ld: util.c:(.text+0x63f): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x64a): undefined reference to `getmaxy'
/usr/bin/ld: util.c:(.text+0x651): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x658): undefined reference to `getmaxx'
/usr/bin/ld: util.c:(.text+0x6ea): undefined reference to `has_colors'
/usr/bin/ld: util.c:(.text+0x6f7): undefined reference to `start_color'
/usr/bin/ld: util.c:(.text+0x866): undefined reference to `has_colors'
/usr/bin/ld: util.c:(.text+0x997): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0x9a1): undefined reference to `keypad'
/usr/bin/ld: util.c:(.text+0x9a6): undefined reference to `cbreak'
/usr/bin/ld: util.c:(.text+0x9ab): undefined reference to `noecho'
/usr/bin/ld: util.c:(.text+0xc01): undefined reference to `endwin'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `end_dialog':
util.c:(.text+0xc39): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0xc3e): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xc45): undefined reference to `stdscr'
/usr/bin/ld: util.c:(.text+0xc4a): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `print_title':
util.c:(.text+0xca9): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0xcb6): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xcc8): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0xcd4): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xce7): undefined reference to `waddnstr'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `print_autowrap':
util.c:(.text+0xe18): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xe28): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0xe30): undefined reference to `getcury'
/usr/bin/ld: util.c:(.text+0xe3a): undefined reference to `getcurx'
/usr/bin/ld: util.c:(.text+0xe9d): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xead): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0xeb5): undefined reference to `getcury'
/usr/bin/ld: util.c:(.text+0xebd): undefined reference to `getcurx'
/usr/bin/ld: util.c:(.text+0xf65): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xf75): undefined reference to `waddnstr'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `print_button':
util.c:(.text+0xfa3): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0xfba): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0xfce): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0xff5): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x101d): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x1039): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x1046): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x1054): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x1066): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x1074): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x1088): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x10ba): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x10c7): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x10d5): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x10e7): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x110a): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x111e): undefined reference to `waddnstr'
/usr/bin/ld: util.c:(.text+0x1145): undefined reference to `wattrset'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `draw_box':
util.c:(.text+0x118d): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x11a4): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x11b9): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x11c1): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x11ff): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x122d): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x1248): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x124d): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x126e): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x1273): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x1293): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x129b): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x12aa): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x12b2): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x12c4): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x12c9): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x12e1): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x12e6): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x12f2): undefined reference to `acs_map'
/usr/bin/ld: util.c:(.text+0x12fa): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `draw_shadow':
util.c:(.text+0x133e): undefined reference to `has_colors'
/usr/bin/ld: util.c:(.text+0x136a): undefined reference to `wattrset'
/usr/bin/ld: util.c:(.text+0x137c): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x1398): undefined reference to `winch'
/usr/bin/ld: util.c:(.text+0x13a3): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x13cc): undefined reference to `wmove'
/usr/bin/ld: util.c:(.text+0x13d4): undefined reference to `winch'
/usr/bin/ld: util.c:(.text+0x13df): undefined reference to `waddch'
/usr/bin/ld: util.c:(.text+0x13e7): undefined reference to `winch'
/usr/bin/ld: util.c:(.text+0x13f2): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `on_key_esc':
util.c:(.text+0x1513): undefined reference to `nodelay'
/usr/bin/ld: util.c:(.text+0x151d): undefined reference to `keypad'
/usr/bin/ld: util.c:(.text+0x1525): undefined reference to `wgetch'
/usr/bin/ld: util.c:(.text+0x1530): undefined reference to `wgetch'
/usr/bin/ld: util.c:(.text+0x1544): undefined reference to `wgetch'
/usr/bin/ld: util.c:(.text+0x1555): undefined reference to `nodelay'
/usr/bin/ld: util.c:(.text+0x1562): undefined reference to `keypad'
/usr/bin/ld: util.c:(.text+0x159e): undefined reference to `ungetch'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `attr_clear':
util.c:(.text+0x3c9): undefined reference to `wtouchln'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `dialog_clear':
util.c:(.text+0x4f1): undefined reference to `wnoutrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `end_dialog':
util.c:(.text+0xc53): undefined reference to `endwin'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `print_title':
util.c:(.text+0xcfc): undefined reference to `waddch'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `print_button':
util.c:(.text+0x10a7): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/util.o: in function `draw_shadow':
util.c:(.text+0x140d): undefined reference to `wnoutrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: in function `print_buttons':
yesno.c:(.text+0x6d): undefined reference to `wmove'
/usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: in function `dialog_yesno':
yesno.c:(.text+0xc2): undefined reference to `stdscr'
/usr/bin/ld: yesno.c:(.text+0xc7): undefined reference to `getmaxy'
/usr/bin/ld: yesno.c:(.text+0xda): undefined reference to `stdscr'
/usr/bin/ld: yesno.c:(.text+0xdf): undefined reference to `getmaxx'
/usr/bin/ld: yesno.c:(.text+0xf0): undefined reference to `stdscr'
/usr/bin/ld: yesno.c:(.text+0xf5): undefined reference to `getmaxx'
/usr/bin/ld: yesno.c:(.text+0xfc): undefined reference to `stdscr'
/usr/bin/ld: yesno.c:(.text+0x10b): undefined reference to `getmaxy'
/usr/bin/ld: yesno.c:(.text+0x11d): undefined reference to `stdscr'
/usr/bin/ld: yesno.c:(.text+0x13e): undefined reference to `newwin'
/usr/bin/ld: yesno.c:(.text+0x14e): undefined reference to `keypad'
/usr/bin/ld: yesno.c:(.text+0x180): undefined reference to `wattrset'
/usr/bin/ld: yesno.c:(.text+0x18e): undefined reference to `wmove'
/usr/bin/ld: yesno.c:(.text+0x19b): undefined reference to `acs_map'
/usr/bin/ld: yesno.c:(.text+0x1a3): undefined reference to `waddch'
/usr/bin/ld: yesno.c:(.text+0x1c2): undefined reference to `acs_map'
/usr/bin/ld: yesno.c:(.text+0x1ce): undefined reference to `waddch'
/usr/bin/ld: yesno.c:(.text+0x1e1): undefined reference to `wattrset'
/usr/bin/ld: yesno.c:(.text+0x1e7): undefined reference to `acs_map'
/usr/bin/ld: yesno.c:(.text+0x1ef): undefined reference to `waddch'
/usr/bin/ld: yesno.c:(.text+0x20d): undefined reference to `wattrset'
/usr/bin/ld: yesno.c:(.text+0x23f): undefined reference to `wgetch'
/usr/bin/ld: yesno.c:(.text+0x26b): undefined reference to `delwin'
/usr/bin/ld: yesno.c:(.text+0x29b): undefined reference to `delwin'
/usr/bin/ld: yesno.c:(.text+0x2ba): undefined reference to `delwin'
/usr/bin/ld: yesno.c:(.text+0x2df): undefined reference to `delwin'
/usr/bin/ld: yesno.c:(.text+0x30d): undefined reference to `delwin'
/usr/bin/ld: yesno.c:(.text+0x344): undefined reference to `wrefresh'
/usr/bin/ld: yesno.c:(.text+0x373): undefined reference to `wrefresh'
/usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: in function `print_buttons':
yesno.c:(.text+0x7f): undefined reference to `wrefresh'
/usr/bin/ld: warning: creating DT_TEXTREL in a PIE
collect2: error: ld returned 1 exit status
make[1]: *** [scripts/Makefile.host:123: scripts/kconfig/mconf] Fehler 1
make: *** [Makefile:703: menuconfig] Fehler 2
root@linus:/usr/src/linux-stable-rc#
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-02-04 22:17 ` Peter Schneider
@ 2026-02-05 7:52 ` Ron Economos
2026-02-05 8:24 ` Francesco Dolcini
284 siblings, 0 replies; 295+ messages in thread
From: Ron Economos @ 2026-02-05 7:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 2/4/26 06:36, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.162 release.
> There are 280 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.162-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-02-05 7:52 ` Ron Economos
@ 2026-02-05 8:24 ` Francesco Dolcini
284 siblings, 0 replies; 295+ messages in thread
From: Francesco Dolcini @ 2026-02-05 8:24 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Wed, Feb 04, 2026 at 03:36:14PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.1.162 release.
> There are 280 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Compiled and tested on
- Verdin iMX8MM
- Verdin iMX8MP
- Colibri iMX6
- Colibri iMX6ULL
- Colibri iMX7
- Apalis iMX6
Tested-by: Francesco Dolcini <francesco.dolcini@toradex.com>
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-04 22:17 ` Peter Schneider
@ 2026-02-05 8:31 ` Greg Kroah-Hartman
2026-02-05 8:33 ` Greg Kroah-Hartman
0 siblings, 1 reply; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-05 8:31 UTC (permalink / raw)
To: Peter Schneider
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Wed, Feb 04, 2026 at 11:17:38PM +0100, Peter Schneider wrote:
> Hi Greg,
>
> Am 04.02.2026 um 15:36 schrieb Greg Kroah-Hartman:
> > This is the start of the stable review cycle for the 6.1.162 release.
> > There are 280 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
> > Anything received after that time might be too late.
>
> It seems that this time, I cannot even build this RC. When I run "make
> menuconfig" I get a big serious of warning and error messages; something
> seems to be really messed up here...
>
>
> root@linus:/usr/src/linux-stable-rc# vim .config
> root@linus:/usr/src/linux-stable-rc# make menuconfig
> scripts/kconfig/Makefile:215: Warnung: Das Musterrezept hat das Peer-Ziel „scripts/kconfig/mconf-bin“ nicht aktualisiert.
> HOSTCC scripts/kconfig/mconf.o
> HOSTCC scripts/kconfig/lxdialog/checklist.o
> HOSTCC scripts/kconfig/lxdialog/inputbox.o
> HOSTCC scripts/kconfig/lxdialog/menubox.o
> HOSTCC scripts/kconfig/lxdialog/textbox.o
> HOSTCC scripts/kconfig/lxdialog/util.o
> HOSTCC scripts/kconfig/lxdialog/yesno.o
> HOSTLD scripts/kconfig/mconf
> /usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: warning: relocation against `acs_map' in read-only section `.text'
> /usr/bin/ld: scripts/kconfig/mconf.o: in function `show_help':
> mconf.c:(.text+0xa1b): undefined reference to `stdscr'
> /usr/bin/ld: mconf.c:(.text+0xa20): undefined reference to `getmaxx'
> /usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_arrows':
> checklist.c:(.text+0x2c): undefined reference to `wmove'
<snip>
Ick, yes, I can reproduce this myself here, something is odd. Let me
track it down...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-05 8:31 ` Greg Kroah-Hartman
@ 2026-02-05 8:33 ` Greg Kroah-Hartman
2026-02-05 12:35 ` Peter Schneider
0 siblings, 1 reply; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-05 8:33 UTC (permalink / raw)
To: Peter Schneider
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Thu, Feb 05, 2026 at 09:31:30AM +0100, Greg Kroah-Hartman wrote:
> On Wed, Feb 04, 2026 at 11:17:38PM +0100, Peter Schneider wrote:
> > Hi Greg,
> >
> > Am 04.02.2026 um 15:36 schrieb Greg Kroah-Hartman:
> > > This is the start of the stable review cycle for the 6.1.162 release.
> > > There are 280 patches in this series, all will be posted as a response
> > > to this one. If anyone has any issues with these being applied, please
> > > let me know.
> > >
> > > Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
> > > Anything received after that time might be too late.
> >
> > It seems that this time, I cannot even build this RC. When I run "make
> > menuconfig" I get a big serious of warning and error messages; something
> > seems to be really messed up here...
> >
> >
> > root@linus:/usr/src/linux-stable-rc# vim .config
> > root@linus:/usr/src/linux-stable-rc# make menuconfig
> > scripts/kconfig/Makefile:215: Warnung: Das Musterrezept hat das Peer-Ziel „scripts/kconfig/mconf-bin“ nicht aktualisiert.
> > HOSTCC scripts/kconfig/mconf.o
> > HOSTCC scripts/kconfig/lxdialog/checklist.o
> > HOSTCC scripts/kconfig/lxdialog/inputbox.o
> > HOSTCC scripts/kconfig/lxdialog/menubox.o
> > HOSTCC scripts/kconfig/lxdialog/textbox.o
> > HOSTCC scripts/kconfig/lxdialog/util.o
> > HOSTCC scripts/kconfig/lxdialog/yesno.o
> > HOSTLD scripts/kconfig/mconf
> > /usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: warning: relocation against `acs_map' in read-only section `.text'
> > /usr/bin/ld: scripts/kconfig/mconf.o: in function `show_help':
> > mconf.c:(.text+0xa1b): undefined reference to `stdscr'
> > /usr/bin/ld: mconf.c:(.text+0xa20): undefined reference to `getmaxx'
> > /usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_arrows':
> > checklist.c:(.text+0x2c): undefined reference to `wmove'
>
> <snip>
>
> Ick, yes, I can reproduce this myself here, something is odd. Let me
> track it down...
Ok, found the offending commit, will push out a -rc2 in a bit with this
fixed, thanks for testing!
greg k-h
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-05 8:33 ` Greg Kroah-Hartman
@ 2026-02-05 12:35 ` Peter Schneider
2026-02-05 13:59 ` Greg Kroah-Hartman
0 siblings, 1 reply; 295+ messages in thread
From: Peter Schneider @ 2026-02-05 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Hi Greg,
Am 05.02.2026 um 09:33 schrieb Greg Kroah-Hartman:
> On Thu, Feb 05, 2026 at 09:31:30AM +0100, Greg Kroah-Hartman wrote:
>> On Wed, Feb 04, 2026 at 11:17:38PM +0100, Peter Schneider wrote:
>>> Hi Greg,
>>>
>>> Am 04.02.2026 um 15:36 schrieb Greg Kroah-Hartman:
>>>> This is the start of the stable review cycle for the 6.1.162 release.
>>>> There are 280 patches in this series, all will be posted as a response
>>>> to this one. If anyone has any issues with these being applied, please
>>>> let me know.
>>>>
>>>> Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
>>>> Anything received after that time might be too late.
>>>
>>> It seems that this time, I cannot even build this RC. When I run "make
>>> menuconfig" I get a big serious of warning and error messages; something
>>> seems to be really messed up here...
>>>
>>>
>>> root@linus:/usr/src/linux-stable-rc# vim .config
>>> root@linus:/usr/src/linux-stable-rc# make menuconfig
>>> scripts/kconfig/Makefile:215: Warnung: Das Musterrezept hat das Peer-Ziel „scripts/kconfig/mconf-bin“ nicht aktualisiert.
>>> HOSTCC scripts/kconfig/mconf.o
>>> HOSTCC scripts/kconfig/lxdialog/checklist.o
>>> HOSTCC scripts/kconfig/lxdialog/inputbox.o
>>> HOSTCC scripts/kconfig/lxdialog/menubox.o
>>> HOSTCC scripts/kconfig/lxdialog/textbox.o
>>> HOSTCC scripts/kconfig/lxdialog/util.o
>>> HOSTCC scripts/kconfig/lxdialog/yesno.o
>>> HOSTLD scripts/kconfig/mconf
>>> /usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: warning: relocation against `acs_map' in read-only section `.text'
>>> /usr/bin/ld: scripts/kconfig/mconf.o: in function `show_help':
>>> mconf.c:(.text+0xa1b): undefined reference to `stdscr'
>>> /usr/bin/ld: mconf.c:(.text+0xa20): undefined reference to `getmaxx'
>>> /usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_arrows':
>>> checklist.c:(.text+0x2c): undefined reference to `wmove'
>>
>> <snip>
>>
>> Ick, yes, I can reproduce this myself here, something is odd. Let me
>> track it down...
>
> Ok, found the offending commit, will push out a -rc2 in a bit with this
> fixed, thanks for testing!
>
> greg k-h
I was too tired yesterday evening to investigate my build error and poke around deeper, but today I looked into it
again, and I found that when I revert the two kconfig patches in this RC
7c177eca9e7af1f0a56171b7718a1b05aaa0f237 "kconfig: fix static linking of nconf"
eb5defa1e8284b8b79653beadc92c273c170db7d "kconfig: refactor Makefile to reduce process forks"
then my build error goes away, the build succeeds and the produced kernel seems to work fine.
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 000/280] 6.1.162-rc1 review
2026-02-05 12:35 ` Peter Schneider
@ 2026-02-05 13:59 ` Greg Kroah-Hartman
0 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-05 13:59 UTC (permalink / raw)
To: Peter Schneider
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Thu, Feb 05, 2026 at 01:35:37PM +0100, Peter Schneider wrote:
> Hi Greg,
>
> Am 05.02.2026 um 09:33 schrieb Greg Kroah-Hartman:
> > On Thu, Feb 05, 2026 at 09:31:30AM +0100, Greg Kroah-Hartman wrote:
> > > On Wed, Feb 04, 2026 at 11:17:38PM +0100, Peter Schneider wrote:
> > > > Hi Greg,
> > > >
> > > > Am 04.02.2026 um 15:36 schrieb Greg Kroah-Hartman:
> > > > > This is the start of the stable review cycle for the 6.1.162 release.
> > > > > There are 280 patches in this series, all will be posted as a response
> > > > > to this one. If anyone has any issues with these being applied, please
> > > > > let me know.
> > > > >
> > > > > Responses should be made by Fri, 06 Feb 2026 14:38:23 +0000.
> > > > > Anything received after that time might be too late.
> > > >
> > > > It seems that this time, I cannot even build this RC. When I run "make
> > > > menuconfig" I get a big serious of warning and error messages; something
> > > > seems to be really messed up here...
> > > >
> > > >
> > > > root@linus:/usr/src/linux-stable-rc# vim .config
> > > > root@linus:/usr/src/linux-stable-rc# make menuconfig
> > > > scripts/kconfig/Makefile:215: Warnung: Das Musterrezept hat das Peer-Ziel „scripts/kconfig/mconf-bin“ nicht aktualisiert.
> > > > HOSTCC scripts/kconfig/mconf.o
> > > > HOSTCC scripts/kconfig/lxdialog/checklist.o
> > > > HOSTCC scripts/kconfig/lxdialog/inputbox.o
> > > > HOSTCC scripts/kconfig/lxdialog/menubox.o
> > > > HOSTCC scripts/kconfig/lxdialog/textbox.o
> > > > HOSTCC scripts/kconfig/lxdialog/util.o
> > > > HOSTCC scripts/kconfig/lxdialog/yesno.o
> > > > HOSTLD scripts/kconfig/mconf
> > > > /usr/bin/ld: scripts/kconfig/lxdialog/yesno.o: warning: relocation against `acs_map' in read-only section `.text'
> > > > /usr/bin/ld: scripts/kconfig/mconf.o: in function `show_help':
> > > > mconf.c:(.text+0xa1b): undefined reference to `stdscr'
> > > > /usr/bin/ld: mconf.c:(.text+0xa20): undefined reference to `getmaxx'
> > > > /usr/bin/ld: scripts/kconfig/lxdialog/checklist.o: in function `print_arrows':
> > > > checklist.c:(.text+0x2c): undefined reference to `wmove'
> > >
> > > <snip>
> > >
> > > Ick, yes, I can reproduce this myself here, something is odd. Let me
> > > track it down...
> >
> > Ok, found the offending commit, will push out a -rc2 in a bit with this
> > fixed, thanks for testing!
> >
> > greg k-h
>
> I was too tired yesterday evening to investigate my build error and poke
> around deeper, but today I looked into it again, and I found that when I
> revert the two kconfig patches in this RC
>
> 7c177eca9e7af1f0a56171b7718a1b05aaa0f237 "kconfig: fix static linking of nconf"
> eb5defa1e8284b8b79653beadc92c273c170db7d "kconfig: refactor Makefile to reduce process forks"
>
> then my build error goes away, the build succeeds and the produced kernel seems to work fine.
Yes, those are the commits I dropped, thanks for verifying.
greg k-h
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect
2026-02-04 15:31 ` Mario Limonciello
@ 2026-02-05 14:10 ` Greg Kroah-Hartman
0 siblings, 0 replies; 295+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-05 14:10 UTC (permalink / raw)
To: Mario Limonciello; +Cc: stable, patches, kent.russell, Alex Deucher
On Wed, Feb 04, 2026 at 09:31:48AM -0600, Mario Limonciello wrote:
> On 2/4/26 8:37 AM, Greg Kroah-Hartman wrote:
> > 6.1-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Mario Limonciello (AMD) <superm1@kernel.org>
> >
> > commit 28695ca09d326461f8078332aa01db516983e8a2 upstream.
> >
> > When an eGPU is unplugged the KFD topology should also be destroyed
> > for that GPU. This never happens because the fini_sw callbacks never
> > get to run. Run them manually before calling amdgpu_device_ip_fini_early()
> > when a device has already been disconnected.
> >
> > This location is intentionally chosen to make sure that the kfd locking
> > refcount doesn't get incremented unintentionally.
> >
> > Cc: kent.russell@amd.com
> > Closes: https://community.frame.work/t/amd-egpu-on-linux/8691/33
> > Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
> > Reviewed-by: Kent Russell <kent.russell@amd.com>
> > Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> > (cherry picked from commit 6a23e7b4332c10f8b56c33a9c5431b52ecff9aab)
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
> > @@ -4102,6 +4102,14 @@ void amdgpu_device_fini_hw(struct amdgpu
> > /* disable ras feature must before hw fini */
> > amdgpu_ras_pre_fini(adev);
> > + /*
> > + * device went through surprise hotplug; we need to destroy topology
> > + * before ip_fini_early to prevent kfd locking refcount issues by calling
> > + * amdgpu_amdkfd_suspend()
> > + */
> > + if (drm_dev_is_unplugged(adev_to_drm(adev)))
> > + amdgpu_amdkfd_device_fini_sw(adev);
> > +
> > amdgpu_device_ip_fini_early(adev);
> > amdgpu_irq_fini_hw(adev);
> >
> >
>
> There was a regression [1] reported on this patch yesterday.
>
> I haven't had time to dig into it; but I think we should hold off letting it
> go to any more stable kernels until it's understood.
>
> https://lore.kernel.org/all/b0c22deb-c0fa-3343-33cf-fd9a77d7db99@absolutedigital.net/
Ok, dropping it from all queues now, thanks.
greg k-h
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets
2026-02-04 14:38 ` [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets Greg Kroah-Hartman
@ 2026-02-19 21:34 ` Nathan Gao
2026-03-19 13:55 ` Greg KH
0 siblings, 1 reply; 295+ messages in thread
From: Nathan Gao @ 2026-02-19 21:34 UTC (permalink / raw)
To: gregkh; +Cc: ap420073, kuba, patches, sashal, stable, zcgao
On Wed, Feb 04, 2026 at 03:38:42PM +0100, Greg Kroah-Hartman wrote:
> 6.1-stable review patch. If anyone has any objections, please let me know.
Hi Greg,
Apologies for the reply after review window. This patch depends on lib.sh under
net selftests which doesn't exist in 6.1. The lib.sh file was introduced in
v6.8-rc1 via commit 25ae948b4478 ("selftests/net: add lib.sh").
Without it, the test will fail on:
./amt.sh: line 76: source: lib.sh: file not found
Do you think, in this case, tools/testing/selftests/net/lib.sh is better
backported? Or the patch should be reverted?
Thanks,
Nathan Gao
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets
2026-02-19 21:34 ` Nathan Gao
@ 2026-03-19 13:55 ` Greg KH
2026-03-19 22:33 ` Nathan Gao
0 siblings, 1 reply; 295+ messages in thread
From: Greg KH @ 2026-03-19 13:55 UTC (permalink / raw)
To: Nathan Gao; +Cc: ap420073, kuba, patches, sashal, stable
On Thu, Feb 19, 2026 at 01:34:20PM -0800, Nathan Gao wrote:
> On Wed, Feb 04, 2026 at 03:38:42PM +0100, Greg Kroah-Hartman wrote:
> > 6.1-stable review patch. If anyone has any objections, please let me know.
>
> Hi Greg,
>
> Apologies for the reply after review window. This patch depends on lib.sh under
> net selftests which doesn't exist in 6.1. The lib.sh file was introduced in
> v6.8-rc1 via commit 25ae948b4478 ("selftests/net: add lib.sh").
>
> Without it, the test will fail on:
> ./amt.sh: line 76: source: lib.sh: file not found
>
> Do you think, in this case, tools/testing/selftests/net/lib.sh is better
> backported? Or the patch should be reverted?
Let's revert it, can you send a fix?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 295+ messages in thread
* Re: [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets
2026-03-19 13:55 ` Greg KH
@ 2026-03-19 22:33 ` Nathan Gao
0 siblings, 0 replies; 295+ messages in thread
From: Nathan Gao @ 2026-03-19 22:33 UTC (permalink / raw)
To: gregkh; +Cc: ap420073, kuba, patches, sashal, stable, zcgao
Hi Greg,
Here is the reverting patch:
https://lore.kernel.org/stable/20260303143750.57741-1-zcgao@amazon.com/
Thanks,
Nathan
^ permalink raw reply [flat|nested] 295+ messages in thread
end of thread, other threads:[~2026-03-19 22:34 UTC | newest]
Thread overview: 295+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-04 14:36 [PATCH 6.1 000/280] 6.1.162-rc1 review Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 001/280] firmware: imx: scu-irq: Set mu_resource_id before get handle Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 002/280] efi/cper: Fix cper_bits_to_str buffer handling and return value Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 003/280] Revert "gfs2: Fix use of bio_chain" Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 004/280] xfrm: Fix inner mode lookup in tunnel mode GSO segmentation Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 005/280] pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 006/280] can: etas_es58x: allow partial RX URB allocation to succeed Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 007/280] nvmet-tcp: remove boilerplate code Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 008/280] nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 009/280] btrfs: send: check for inline extents in range_is_hole_in_parent() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 010/280] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 011/280] net: update netdev_lock_{type,name} Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 012/280] macvlan: fix possible UAF in macvlan_forward_source() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 013/280] ipv4: ip_gre: make ipgre_header() robust Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 014/280] vsock/test: add a final full barrier after run all tests Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 015/280] net/mlx5e: Restore destroying state bit after profile cleanup Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 016/280] btrfs: move flush related definitions to space-info.h Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 017/280] btrfs: store fs_info in space_info Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 018/280] btrfs: factor out init_space_info() from create_space_info() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 019/280] btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 020/280] btrfs: introduce btrfs_space_info sub-group Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 021/280] btrfs: fix memory leaks in create_space_info() error paths Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 022/280] hv_netvsc: Allocate rx indirection table size dynamically Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 023/280] net: hv_netvsc: reject RSS hash key programming without RX indirection table Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 024/280] ipv6: Fix use-after-free in inet6_addr_del() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 025/280] selftests: drv-net: fix RPS mask handling for high CPU numbers Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 026/280] net/sched: sch_qfq: do not free existing class in qfq_change_class() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 027/280] ASoC: tlv320adcx140: fix null pointer Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 028/280] ASoC: tlv320adcx140: fix word length Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 029/280] textsearch: describe @list member in ts_ops search Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 030/280] mm, kfence: describe @slab parameter in __kfence_obj_info() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 031/280] dmaengine: tegra-adma: Fix use-after-free Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 032/280] dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 033/280] phy: stm32-usphyc: Fix off by one in probe() Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 034/280] phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 035/280] dmaengine: omap-dma: fix dma_pool resource leak in error paths Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 036/280] HID: usbhid: paper over wrong bNumDescriptor field Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 037/280] scsi: core: Fix error handler encryption support Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 038/280] ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 039/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 040/280] can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 041/280] net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 042/280] x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 043/280] phy: rockchip: inno-usb2: fix communication disruption in gadget mode Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 044/280] phy: freescale: imx8m-pcie: assert phy reset during power on Greg Kroah-Hartman
2026-02-04 14:36 ` [PATCH 6.1 045/280] phy: rockchip: inno-usb2: fix disconnection in gadget mode Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 046/280] phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 047/280] usb: dwc3: Check for USB4 IP_NAME Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 048/280] usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 049/280] USB: OHCI/UHCI: Add soft dependencies on ehci_platform Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 050/280] USB: serial: option: add Telit LE910 MBIM composition Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 051/280] USB: serial: ftdi_sio: add support for PICAXE AXE027 cable Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 052/280] nvme-pci: disable secondary temp for Wodposit WPBSNM8 Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 053/280] ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 054/280] hrtimer: Fix softirq base check in update_needs_ipi() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 055/280] EDAC/x38: Fix a resource leak in x38_probe1() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 056/280] EDAC/i3200: Fix a resource leak in i3200_probe1() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 057/280] x86/resctrl: Add missing resctrl initialization for Hygon Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 058/280] x86/resctrl: Fix memory bandwidth counter width " Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 059/280] mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 060/280] mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 061/280] LoongArch: Fix PMU counter allocation for mixed-type event groups Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 062/280] drm/amd: Clean up kfd node on surprise disconnect Greg Kroah-Hartman
2026-02-04 15:31 ` Mario Limonciello
2026-02-05 14:10 ` Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 063/280] drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 064/280] drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 065/280] drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 066/280] dmaengine: apple-admac: Add "apple,t8103-admac" compatible Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 067/280] dmaengine: at_hdmac: fix device leak on of_dma_xlate() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 068/280] dmaengine: bcm-sba-raid: fix device leak on probe Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 069/280] dmaengine: dw: dmamux: fix OF node leak on route allocation failure Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 070/280] dmaengine: idxd: fix device leaks on compat bind and unbind Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 071/280] dmaengine: lpc18xx-dmamux: fix device leak on route allocation Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 072/280] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 073/280] dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 074/280] dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 075/280] dmaengine: ti: dma-crossbar: fix device leak on am335x " Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 076/280] dmaengine: ti: k3-udma: fix device leak on udma lookup Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 077/280] btrfs: fix deadlock in wait_current_trans() due to ignored transaction type Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 078/280] io_uring: move local task_work in exit cancel loop Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 079/280] posix-clock: introduce posix_clock_context concept Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 080/280] Fix memory leak in posix_clock_open() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 081/280] posix-clock: Store file pointer in struct posix_clock_context Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 082/280] ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 083/280] testptp: Add support for testing ptp_clock_info .adjphase callback Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 084/280] selftests/ptp: Add -x option for testing PTP_SYS_OFFSET_EXTENDED Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 085/280] selftests/ptp: Add -X option for testing PTP_SYS_OFFSET_PRECISE Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 086/280] ptp: add testptp mask test Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 087/280] selftest/ptp: update ptp selftest to exercise the gettimex options Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 088/280] testptp: Add option to open PHC in readonly mode Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 089/280] arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 090/280] btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 091/280] ata: libata: Add cpr_log to ata_dev_print_features() early return Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 092/280] ata: libata: Introduce ata_ncq_supported() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 093/280] ata: libata: cleanup fua support detection Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 094/280] ata: libata-core: Introduce ata_dev_config_lpm() Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 095/280] ata: libata: Call ata_dev_config_lpm() for ATAPI devices Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 096/280] ata: libata: Print features also " Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 097/280] net: usb: dm9601: remove broken SR9700 support Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 098/280] bonding: limit BOND_MODE_8023AD to Ethernet devices Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 099/280] selftests/net: convert fib-onlink-tests.sh to run it in unique namespace Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 100/280] selftests: net: fib-onlink-tests: Convert to use namespaces by default Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 101/280] can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 102/280] sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 103/280] amd-xgbe: avoid misleading per-packet error log Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 104/280] gue: Fix skb memleak with inner IP protocol 0 Greg Kroah-Hartman
2026-02-04 14:37 ` [PATCH 6.1 105/280] netlink: add a proto specification for FOU Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 106/280] net: fou: rename the source for linking Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 107/280] net: fou: use policy and operation tables generated from the spec Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 108/280] fou: Dont allow 0 for FOU_ATTR_IPPROTO Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 109/280] l2tp: avoid one data-race in l2tp_tunnel_del_work() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 110/280] ipvlan: Make the addrs_lock be per port Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 111/280] octeontx2: cn10k: fix RX flowid TCAM mask handling Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 112/280] net/sched: Enforce that teql can only be used as root qdisc Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 113/280] net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 114/280] crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 115/280] serial: 8250_pci: Fix broken RS485 for F81504/508/512 Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 116/280] comedi: dmm32at: serialize use of paged registers Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 117/280] w1: therm: Fix off-by-one buffer overflow in alarms_store Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 118/280] w1: fix redundant counter decrement in w1_attach_slave_device() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 119/280] Revert "nfc/nci: Add the inconsistency check between the input data length and count" Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 120/280] Input: i8042 - add quirks for MECHREVO Wujie 15X Pro Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 121/280] Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 122/280] scsi: storvsc: Process unsupported MODE_SENSE_10 Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 123/280] arm64: dts: rockchip: remove dangerous max-link-speed from helios64 Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 124/280] x86/kfence: avoid writing L1TF-vulnerable PTEs Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 125/280] comedi: Fix getting range information for subdevices 16 to 255 Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 126/280] iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 127/280] iio: adc: ad7280a: handle spi_setup() errors in probe() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 128/280] spi: sprd-adi: Convert to platform remove callback returning void Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 129/280] spi: sprd-adi: Use devm_platform_get_and_ioremap_resource() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 130/280] spi: sprd: adi: Use devm_register_restart_handler() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 131/280] spi: sprd-adi: switch to use spi_alloc_host() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 132/280] spi: spi-sprd-adi: Fix double free in probe error path Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 133/280] regmap: Fix race condition in hwspinlock irqsave routine Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 134/280] kconfig: refactor Makefile to reduce process forks Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 135/280] kconfig: fix static linking of nconf Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 136/280] riscv: clocksource: Fix stimecmp update hazard on RV32 Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 137/280] scsi: core: Wake up the error handler when final completions race against each other Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 138/280] ALSA: usb: Increase volume range that triggers a warning Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 139/280] netdevsim: fix a race issue related to the operation on bpf_bound_progs list Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 140/280] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 141/280] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 142/280] mISDN: annotate data-race around dev->work Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 143/280] ipv6: annotate data-race in ndisc_router_discovery() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 144/280] usbnet: limit max_mtu based on devices hard_mtu Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 145/280] drm/amd/pm: Dont clear SI SMC table when setting power limit Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 146/280] drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 147/280] be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 148/280] selftests: net: amt: wait longer for connection before sending packets Greg Kroah-Hartman
2026-02-19 21:34 ` Nathan Gao
2026-03-19 13:55 ` Greg KH
2026-03-19 22:33 ` Nathan Gao
2026-02-04 14:38 ` [PATCH 6.1 149/280] bonding: provide a net pointer to __skb_flow_dissect() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 150/280] octeontx2-af: Fix error handling Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 151/280] vsock/virtio: fix potential underflow in virtio_transport_get_credit() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 152/280] vsock/virtio: cap TX credit to local buffer size Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 153/280] net/sched: act_ife: avoid possible NULL deref Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 154/280] x86: make page fault handling disable interrupts properly Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 155/280] leds: led-class: Only Add LED to leds_list when it is fully ready Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 156/280] of: fix reference count leak in of_alias_scan() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 157/280] of: platform: Use default match table for /firmware Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 158/280] iio: adc: ad9467: fix ad9434 vref mask Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 159/280] iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 160/280] iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 161/280] ALSA: ctxfi: Fix potential OOB access in audio mixer handling Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 162/280] ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 163/280] mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 164/280] wifi: ath10k: fix dma_free_coherent() pointer Greg Kroah-Hartman
2026-02-04 14:38 ` [PATCH 6.1 165/280] wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 166/280] wifi: rsi: Fix memory corruption due to not set vif driver data size Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 167/280] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 168/280] arm64: Set __nocfi on swsusp_arch_resume() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 169/280] octeontx2: Fix otx2_dma_map_page() error return code Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 170/280] slimbus: core: fix runtime PM imbalance on report present Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 171/280] slimbus: core: fix device reference leak " Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 172/280] intel_th: fix device leak on output open() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 173/280] uacce: fix cdev handling in the cleanup path Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 174/280] uacce: implement mremap in uacce_vm_ops to return -EPERM Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 175/280] uacce: ensure safe queue release with state management Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 176/280] netrom: fix double-free in nr_route_frame() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 177/280] perf/x86/intel: Do not enable BTS for guests Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 178/280] irqchip/gic-v3-its: Avoid truncating memory addresses Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 179/280] can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 180/280] can: kvaser_usb: kvaser_usb_read_bulk_callback(): " Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 181/280] can: mcba_usb: mcba_usb_read_bulk_callback(): " Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 182/280] can: usb_8dev: usb_8dev_read_bulk_callback(): " Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 183/280] migrate: correct lock ordering for hugetlb file folios Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 184/280] bpf: Do not let BPF test infra emit invalid GSO types to stack Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 185/280] bpf: Reject narrower access to pointer ctx fields Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 186/280] mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 187/280] mm/damon/sysfs-scheme: cleanup access_pattern " Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 188/280] Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 189/280] net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 190/280] can: gs_usb: gs_usb_receive_bulk_callback(): fix error message Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 191/280] bonding: annotate data-races around slave->last_rx Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 192/280] net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 193/280] ipv6: use the right ifindex when replying to icmpv6 from localhost Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 194/280] net: wwan: t7xx: fix potential skb->frags overflow in RX path Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 195/280] rocker: fix memory leak in rocker_world_port_post_fini() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 196/280] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 197/280] ice: stop counting UDP csum mismatch as rx_errors Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 198/280] net/mlx5e: Report rx_discards_phy via rx_dropped Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 199/280] net/mlx5e: Account for netdev stats in ndo_get_stats64 Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 200/280] nfc: nci: Fix race between rfkill and nci_unregister_device() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 201/280] net: bridge: fix static key check Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 202/280] scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 203/280] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 204/280] gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 205/280] dma/pool: distinguish between missing and exhausted atomic pools Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 206/280] pinctrl: meson: mark the GPIO controller as sleeping Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 207/280] riscv: compat: fix COMPAT_UTS_MACHINE definition Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 208/280] ASoC: fsl: imx-card: Do not force slot width to sample width Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 209/280] scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 210/280] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 211/280] scsi: qla2xxx: edif: Fix dma_free_coherent() size Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 212/280] efivarfs: fix error propagation in efivar_entry_get() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 213/280] mptcp: only reset subflow errors when propagated Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 214/280] flex_proportions: make fprop_new_period() hardirq safe Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 215/280] scripts: generate_rust_analyzer: Add compiler_builtins -> core dep Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 216/280] drm/amdgpu/soc21: fix xclk for APUs Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 217/280] drm/amdgpu/gfx10: fix wptr reset in KGQ init Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 218/280] drm/amdgpu/gfx11: " Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 219/280] gpio: rockchip: Stop calling pinctrl for set_direction Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 220/280] mm/rmap: fix two comments related to huge_pmd_unshare() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 221/280] arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 222/280] xen: make remove callback of xen driver void returned Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 223/280] scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 224/280] dmaengine: stm32: dmamux: fix OF node leak on route allocation failure Greg Kroah-Hartman
2026-02-04 14:39 ` [PATCH 6.1 225/280] mm/page_alloc: prevent pcp corruption with SMP=n Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 226/280] dmaengine: stm32: dmamux: fix device leak on route allocation Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 227/280] mm: kmsan: fix poisoning of high-order non-compound pages Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 228/280] xfs: set max_agbno to allow sparse alloc of last full inode chunk Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 229/280] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 230/280] ksmbd: smbd: fix dma_unmap_sg() nents Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 231/280] mei: trace: treat reg parameter as string Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 232/280] arm64/fpsimd: signal: Fix restoration of SVE context Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 233/280] mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 234/280] mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 235/280] ALSA: scarlett2: Fix buffer overflow in config retrieval Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 236/280] iio: adc: exynos_adc: fix OF populate on driver rebind Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 237/280] iio: chemical: scd4x: fix reported channel endianness Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 238/280] nvme-fc: rename free_ctrl callback to match name pattern Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 239/280] nvme-pci: do not directly handle subsys reset fallout Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 240/280] nvme: fix PCIe subsystem reset controller state transition Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 241/280] phy: phy-rockchip-inno-usb2: simplify phy clock handling Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 242/280] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 243/280] phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 244/280] ASoC: codecs: wsa881x: Simplify &pdev->dev in probe Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 245/280] ASoC: codecs: wsa881x: Use proper shutdown GPIO polarity Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 246/280] ASoC: codecs: wsa881x: Drop unused version readout Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 247/280] ASoC: codecs: wsa881x: fix unnecessary initialisation Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 248/280] ASoC: codecs: wsa883x: " Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 249/280] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 250/280] team: Move team device type change at the end of team_port_add Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 251/280] wifi: mac80211: use wiphy work for sdata->work Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 252/280] wifi: mac80211: move TDLS work to wiphy work Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 253/280] genirq/irq_sim: Initialize work context pointers properly Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 254/280] drm/amdkfd: fix a memory leak in device_queue_manager_init() Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 255/280] can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 256/280] Revert "mm/mprotect: delete pmd_none_or_clear_bad_unless_trans_huge()" Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 257/280] drm/amd/display: Check dce_hwseq before dereferencing it Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 258/280] crypto: qat - flush misc workqueue during device shutdown Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 259/280] iomap: Fix possible overflow condition in iomap_write_delalloc_scan Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 260/280] fs/ntfs3: Initialize allocated memory before use Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 261/280] blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 262/280] Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 263/280] gfs2: Fix NULL pointer dereference in gfs2_log_flush Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 264/280] NFSD: fix race between nfsd registration and exports_proc Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 265/280] usbnet: Fix using smp_processor_id() in preemptible code warnings Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 266/280] drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 267/280] net: stmmac: make sure that ptp_rate is not 0 before configuring EST Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 268/280] sctp: linearize cloned gso packets in sctp_rcv Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 269/280] ksmbd: fix use-after-free in ksmbd_session_rpc_open Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 270/280] ksmbd: Fix race condition in RPC handle list access Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 271/280] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 272/280] drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 273/280] btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 274/280] net/sched: act_ife: convert comma to semicolon Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 275/280] mptcp: avoid dup SUB_CLOSED events after disconnect Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 276/280] mm/kfence: randomize the freelist on initialization Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 277/280] writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 278/280] drm/imx/tve: fix probe device leak Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 279/280] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver Greg Kroah-Hartman
2026-02-04 14:40 ` [PATCH 6.1 280/280] ksmbd: fix recursive locking in RPC handle list access Greg Kroah-Hartman
2026-02-04 19:52 ` [PATCH 6.1 000/280] 6.1.162-rc1 review Brett A C Sheffield
2026-02-04 19:52 ` Florian Fainelli
2026-02-04 22:17 ` Peter Schneider
2026-02-05 8:31 ` Greg Kroah-Hartman
2026-02-05 8:33 ` Greg Kroah-Hartman
2026-02-05 12:35 ` Peter Schneider
2026-02-05 13:59 ` Greg Kroah-Hartman
2026-02-05 7:52 ` Ron Economos
2026-02-05 8:24 ` Francesco Dolcini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox